Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jgwhite33 WP Review Slider wp-facebook-reviews allows Stored XSS.…Check if you run itEPSS 0.17%Mar 25, 2026
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jgwhite33 WP TripAdvisor Review Slider wp-tripadvisor-review-slid…Check if you run itEPSS 0.17%Mar 25, 2026
- Medium6.5Missing Authorization vulnerability in bPlugins B Blocks b-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects B Blocks:…Check if you run itEPSS 0.25%Mar 25, 2026
- High8.1Incorrect Privilege Assignment vulnerability in wpeverest User Registration user-registration allows Privilege Escalation.This issue affects User Registration: from n/…Check if you run itEPSS 0.37%Mar 25, 2026
- High7.5Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe…Check if you run itEPSS 0.28%Mar 25, 2026
- High8.8Deserialization of Untrusted Data vulnerability in BoldGrid weForms weforms allows Object Injection.This issue affects weForms: from n/a through <= 1.6.26.Check if you run itEPSS 0.30%Mar 25, 2026
- Medium6.5Missing Authorization vulnerability in codepeople Contact Form Email contact-form-to-email allows Exploiting Incorrectly Configured Access Control Security Levels.This…Check if you run itEPSS 0.31%Mar 25, 2026
- Critical9.9Unrestricted Upload of File with Dangerous Type vulnerability in deothemes Ona ona allows Upload a Web Shell to a Web Server.This issue affects Ona: from n/a through < 1.24.Check if you run itEPSS 0.34%Mar 25, 2026
- High7.7Missing Authorization vulnerability in WebToffee Comments Import & Export comments-import-export-woocommerce allows Exploiting Incorrectly Configured Access Control Se…Check if you run itEPSS 0.29%Mar 25, 2026
- High8.2Missing Authorization vulnerability in Devteam HaywoodTech Product Rearrange for WooCommerce products-rearrange-woocommerce allows Exploiting Incorrectly Configured Ac…Check if you run itEPSS 0.28%Mar 25, 2026
- Critical9.3Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Devteam HaywoodTech Product Rearrange for WooCommerce products-re…Check if you run itEPSS 0.30%Mar 25, 2026
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hookandhook WP Courses LMS wp-courses allows DOM-Based XSS.This i…Check if you run itEPSS 0.17%Mar 25, 2026
- High8.6Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Whitebox-Studio Scape scape allows Path Traversal.This issue affects Sc…Check if you run itEPSS 0.39%Mar 25, 2026
- Medium5.6Authorization bypass through User-Controlled key vulnerability in HYPR Server allows Privilege Escalation.This issue affects Server: from 9.5.2 before 10.7.2.Check if you run itEPSS 0.31%Mar 25, 2026
- High7.5Kiteworks is a private data network (PDN).Check if you run itEPSS 0.25%Mar 25, 2026
- Medium4.6Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to properly validate CSRF tokens in the /api/v4/access_control_polic…Check if you run itEPSS 0.13%Mar 25, 2026
- Medium6.1Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to properly validate user identity in the OpenID {{IsSameUser()}} co…Check if you run itEPSS 0.19%Mar 25, 2026
- Critical9.8Deserialization of Untrusted Data vulnerability in magepeopleteam Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Object Injec…Check if you run itEPSS 0.40%Mar 25, 2026
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in G5Theme Darna Framework darna-framework allows Reflected XSS.This…Check if you run itEPSS 0.19%Mar 25, 2026
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in G5Theme Wolverine Framework wolverine-framework allows Reflected…Check if you run itEPSS 0.19%Mar 25, 2026
- Critical9.8Deserialization of Untrusted Data vulnerability in ThemeREX Buisson buisson allows Object Injection.This issue affects Buisson: from n/a through <= 1.1.11.Check if you run itEPSS 0.51%Mar 25, 2026
- Critical9.8Deserialization of Untrusted Data vulnerability in ThemeREX Work & Travel Company work-travel-company allows Object Injection.This issue affects Work & Travel Company:…Check if you run itEPSS 0.40%Mar 25, 2026
- Critical9.8Deserialization of Untrusted Data vulnerability in ThemeREX Love Story lovestory allows Object Injection.This issue affects Love Story: from n/a through <= 1.3.12.Check if you run itEPSS 0.40%Mar 25, 2026
- High8.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Rosebud rosebud allows PHP Local…Check if you run itEPSS 0.43%Mar 25, 2026
- High8.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Deston deston allows PHP Local F…Check if you run itEPSS 0.54%Mar 25, 2026
Sort