Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.4The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th…Check if you run itEPSS 0.20%Oct 16, 2026
- High8.0The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function.Check if you run itEPSS 0.29%Oct 16, 2026
- Medium5.4The The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and includin…Check if you run itEPSS 0.23%Oct 16, 2026
- High7.2The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and including, 1.6…Check if you run itEPSS 0.24%Oct 16, 2026
- High7.2The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due…Check if you run itEPSS 0.26%Oct 16, 2026
- High7.5The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions…Check if you run itEPSS 0.46%Oct 16, 2026
- Critical9.8The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the…Check if you run itEPSS 0.58%Oct 16, 2026
- Medium6.4The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all v…Check if you run itEPSS 0.19%Oct 16, 2026
- High7.2The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Fi…Check if you run itEPSS 0.24%Oct 16, 2026
- Medium6.4The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-axis column value ($value->$xarg_s from $wpdb->get_results())' param…Check if you run itEPSS 0.20%Oct 16, 2026
- Low2.7Product Delivery Date for WooCommerce – Lite < 3.3.2 - Contributor+ Order Information Disclosure via Calendar View AJAX ActionsCheck if you run itEPSS 0.23%Oct 16, 2026
- Medium6.8affiliate-toolkit < 3.8.9 - Editor+ SQL Injection via orderby ParameterCheck if you run itEPSS 0.29%Oct 16, 2026
- High7.4OTP Login & Register Woocommerce < 2.7.3 - Unauthenticated Account Takeover via OTP Brute ForceCheck if you run itEPSS 0.27%Oct 16, 2026
- Low2.7Smush < 4.3.4 - Admin+ Network-Wide Plugin Settings Update on MultisiteCheck if you run itEPSS 0.21%Oct 16, 2026
- High8.8Salon Booking System < 10.31.9 - Administrator Account Creation via CSRFCheck if you run itEPSS 0.15%Oct 16, 2026
- Medium5.3Salon Booking System < 10.31.9 - Unauthenticated Booking Creation with Arbitrary Customer ID and StatusCheck if you run itEPSS 0.22%Oct 16, 2026
- Medium4.8Salon Booking System < 10.31.9 - Unauthenticated Salon REST API Access via Predictable Access-TokenCheck if you run itEPSS 0.17%Oct 16, 2026
- Medium4.3Salon Booking System < 10.31.3 - Subscriber+ Booking PII Disclosure via REST bookings/upcomingCheck if you run itEPSS 0.21%Oct 16, 2026
- Medium4.2MB Custom Post Types & Custom Taxonomies < 2.12.2 - Subscriber+ Missing Authorization via CPT UI MigrationCheck if you run itEPSS 0.18%Oct 16, 2026
- Medium4.3Visual Form Builder <= 3.1 - Subscriber+ Sensitive Data Disclosure via Dashboard WidgetCheck if you run itEPSS 0.21%Oct 16, 2026
- Medium4.3Visual Form Builder <= 3.1 - Subscriber+ Arbitrary Form Field Reordering via Missing AuthorizationCheck if you run itEPSS 0.18%Oct 16, 2026
- Medium6.8Mobile Builder <= 1.4.2 - Unauthenticated SQLi via 'delivery_id' ParameterCheck if you run itEPSS 0.27%Oct 16, 2026
- Medium5.3Document Gallery <= 5.1.1 - Unauthenticated Non-Public Attachment Disclosure via dg_generate_gallery and dg_generate_iconsCheck if you run itEPSS 0.21%Oct 16, 2026
- Medium5.3Coinsnap Bitcoin Crowdfunding <= 1.2.0 - Unauthenticated Payment Record Forgery via Webhook Secret DisclosureCheck if you run itEPSS 0.19%Oct 16, 2026
- Medium6.5Subscribe to Comments < 2.3.3 - Unauthenticated Subscription Management Key Disclosure via Forged Comment CookieCheck if you run itEPSS 0.18%Oct 16, 2026