Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.4The Task Scheduler plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.3 via the “Check Website” task.Check this weekEPSS 24.00%Oct 15, 2025
- High7.2The Find And Replace content for WordPress plugin for WordPress is vulnerable to unauthorized Stored Cross-Site Scripting and Arbitrary Content Replacement due to a missing capabilCheck this weekEPSS 29.00%Oct 15, 2025
- Critical9.8The OwnID Passwordless Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.3.4.Check this weekEPSS 79.00%Oct 15, 2025
- Medium4.3The Theme Importer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.Check this weekEPSS 13.00%Oct 15, 2025
- Medium4.3The TopBar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0.Check this weekEPSS 17.00%Oct 15, 2025
- High8.8The WPBifröst – Instant Passwordless Temporary Login Links plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ctl_create_link AJAXCheck this weekEPSS 36.00%Oct 15, 2025
- High7.2The Demo Import Kit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.1.0 via the import funcCheck this weekEPSS 70.00%Oct 15, 2025
- Medium4.3The FunKItools plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2.Check this weekEPSS 13.00%Oct 15, 2025
- High8.8The Keyy Two Factor Authentication (like Clef) plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.2.3.Check this weekEPSS 35.00%Oct 15, 2025
- High7.3The Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme plugin for WordPress is vulnerable to privilege escalation in all versions up to, and includingCheck this weekEPSS 23.00%Oct 15, 2025
- Medium6.5Fortinet FortiOS Insufficient Session ExpirationPatch nowKEVEPSS 0.34%Oct 14, 2025
- Medium4.3The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 1.12.1.Check this weekEPSS 25.00%Oct 14, 2025
- UnknownFour-Faith f3x36_firmware Active Debug CodePatch nowKEVEPSS 3.04%Oct 13, 2025
- Medium4.3The Course Redirects for Learndash plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.4.Check this weekEPSS 13.00%Oct 11, 2025
- Medium4.3The Web Accessibility By accessiBe plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10.Check this weekEPSS 16.00%Oct 11, 2025
- Medium4.9The Custom 404 Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ‘path’ parameter in all versions up to, and including, 3.12.0 due to insufficient escapingCheck this weekEPSS 30.00%Oct 11, 2025
- Low2.4The GSheetConnector For Gravity Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions less than, or equal to, 1.3.23.Check this weekEPSS 16.00%Oct 11, 2025
- Medium4.9The Error Log Viewer by BestWebSoft plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.6 via the rrrlgvwr_get_file function.Check this weekEPSS 71.00%Oct 11, 2025
- Medium4.3The Newsup theme for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the newsup_admin_info_install_plugin() function in all versionCheck this weekEPSS 25.00%Oct 11, 2025
- Medium4.3The Page Blocks plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0.Check this weekEPSS 17.00%Oct 11, 2025
- Medium6.8The WP Scraper plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.8.1 via the wp_scraper_extract_content function.Check this weekEPSS 34.00%Oct 11, 2025
- Medium4.3The WidgetPack Comment System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.1.Check this weekEPSS 16.00%Oct 11, 2025
- Medium4.9The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in the action nf_load_form_entries in all versioCheck this weekEPSS 32.00%Oct 11, 2025
- Medium5.3The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and incCheck if you run itEPSS 1.01%Oct 11, 2025
- Medium4.9The My auctions allegro plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and including, 3.6.31 due to insufficient escaping on tCheck this weekEPSS 30.00%Oct 11, 2025