Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.3A vulnerability was found in youlaitech youlai-mall 1.0.0/2.0.0.Check if you run itEPSS 0.32%Dec 5, 2025
- Medium5.3A vulnerability has been found in youlaitech youlai-mall 1.0.0/2.0.0.Check if you run itEPSS 0.40%Dec 5, 2025
- Medium5.4mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server.Check if you run itEPSS 0.65%Dec 5, 2025
- Medium5.3The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to missing authorization in versions up to, and including, 3.1.3.Check if you run itEPSS 0.37%Dec 5, 2025
- High7.5An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the backoff timer becoming 0.Check if you run itEPSS 0.45%Dec 5, 2025
- Medium4.3The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and incluCheck if you run itEPSS 0.12%Dec 5, 2025
- High7.5The My auctions allegro plugin for WordPress is vulnerable to SQL Injection via the ‘auction_id’ parameter in all versions up to, and including, 3.6.32 due to insufficient escapingCheck if you run itEPSS 0.32%Dec 5, 2025
- Medium6.1The Nouri.sh Newsletter plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the parameter in all versions up to, and including, 1.0.1.3 due to insufficient inpCheck if you run itEPSS 0.25%Dec 5, 2025
- Critical9.8The Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification plugin for WordPress is vulnerable to authentication bypass inCheck if you run itEPSS 0.50%Dec 5, 2025
- Medium5.3The Payaza plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_nopriv_update_order_status' AJAX endpoint in alCheck if you run itEPSS 0.22%Dec 5, 2025
- Medium5.3The Voidek Employee Portal plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX actions in all versions up to, and including,Check if you run itEPSS 0.27%Dec 5, 2025
- Medium4.3The Torod – The smart shipping and delivery portal for e-shops and retailers plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including,Check if you run itEPSS 0.15%Dec 5, 2025
- Medium4.3The Live CSS Preview plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_frontend_save' AJAX endpoint in all vCheck if you run itEPSS 0.22%Dec 5, 2025
- Medium4.4The Weekly Planner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0 due to insufficient input sanitizaCheck if you run itEPSS 0.20%Dec 5, 2025
- Medium6.4The Easy Jump Links Menus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the parameter in all versions up to, and including, 1.0.0 due to insufficient inputCheck if you run itEPSS 0.24%Dec 5, 2025
- Medium5.3The Feedback Modal for Website plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handle_export' function in all versions uCheck if you run itEPSS 0.90%Dec 5, 2025
- Medium5.4The PDF Catalog for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pdfcatalog' AJAX action in all versions up to, and including, 1.1.18 dueCheck if you run itEPSS 0.17%Dec 5, 2025
- Medium4.3The Image Optimizer by wps.sk plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.0.Check if you run itEPSS 0.15%Dec 5, 2025
- High8.8The Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versionCheck if you run itEPSS 0.33%Dec 5, 2025
- Medium6.1The Twitscription plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the admin.php PATH_INFO in all versions up to, and including, 0.1.1 due to insufficient iCheck if you run itEPSS 0.26%Dec 5, 2025
- Medium4.3The Takeads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.0.13.Check if you run itEPSS 0.21%Dec 5, 2025
- Medium6.1The Jabbernotification plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the admin.php PATH_INFO in all versions up to, and including, 0.99-RC2 due to insuffCheck if you run itEPSS 0.26%Dec 5, 2025
- Medium6.1The WP-SOS-Donate Donation Sidebar Plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the parameter in all versions up to, and including, 0.9.2 due to insuffiCheck if you run itEPSS 0.26%Dec 5, 2025
- High8.8The ContentStudio plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the cstu_update_post() function in all versions up to, and incCheck if you run itEPSS 0.61%Dec 5, 2025
- Medium4.3The Quantic Social Image Hover plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.8.Check if you run itEPSS 0.15%Dec 5, 2025
Sort