Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.1The Gwolle Guestbook plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 5.1.1 due…Check if you run itEPSS 0.21%Oct 16, 2026
- Medium6.5The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and incl…Check if you run itEPSS 0.28%Oct 16, 2026
- High8.0The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field (second-order, via restore) in al…Check if you run itEPSS 0.34%Oct 16, 2026
- Medium6.4The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'icon_light' Shortcode Attri…Check if you run itEPSS 0.16%Oct 16, 2026
- Medium4.3The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Ref…Check if you run itEPSS 0.21%Oct 16, 2026
- Medium6.4The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via [cooked-timer] Shortcode Content in all versions up to, and includ…Check if you run itEPSS 0.24%Oct 16, 2026
- High7.8Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents.Check if you run itEPSS 0.14%Oct 16, 2026
- Medium5.9Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application.Check if you run itEPSS 0.14%Oct 16, 2026
- Medium5.9Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default).Check if you run itEPSS 0.21%Oct 16, 2026
- Low3.7Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems.Check if you run itEPSS 0.21%Oct 16, 2026
- High8.1Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to the parent being saved.Check if you run itEPSS 0.28%Oct 16, 2026
- High8.6Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, as it is by default in development.Check if you run itEPSS 0.26%Oct 16, 2026
- High8.1Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=).Check if you run itEPSS 0.28%Oct 16, 2026
- Critical9.8Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to i…Check if you run itEPSS 0.26%Oct 16, 2026
- Medium6.5Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production, by supplying an X-Wheels-…Check if you run itEPSS 0.16%Oct 16, 2026
- Medium5.3Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potentially dangerous SVG tags.Check if you run itEPSS 0.23%Oct 16, 2026
- High7.2The Flying Scripts: Delay JavaScript to Improve Site Speed & Performance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter…Check if you run itEPSS 0.33%Oct 16, 2026
- High7.2The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…Check if you run itEPSS 0.31%Oct 16, 2026
- High7.2The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.0.390 du…Check if you run itEPSS 0.36%Oct 16, 2026
- Medium5.9The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter.Check if you run itEPSS 0.77%Oct 16, 2026
- High8.1The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the parameter in versions up to, and including, 3.3.0.Check if you run itEPSS 0.52%Oct 16, 2026
- Medium4.9The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products[*].variants[*].Check if you run itEPSS 0.38%Oct 16, 2026
- Medium4.8A weakness has been identified in Ultralytics FastSAM up to b4ed20c2fed75eadc5aa7d8b09fedd137b873b52.Check if you run itEPSS 0.12%Oct 16, 2026
- Low0.9A security flaw has been discovered in ImprintLab Medical-SAM-Adapter 0.1.0-alpha/0.1.0.Check if you run itEPSS 0.11%Oct 16, 2026
- High8.6A hard-coded cryptographic key vulnerability exists in the of some of Moxa's industrial computing products.Check if you run itEPSS 0.15%Oct 16, 2026