Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.4The Any Post Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aps_slider shortcode in all versions up to, and including, 1.0.4 due to insufCheck if you run itEPSS 0.25%Mar 21, 2026
- Medium4.3The Group Chat & Video Chat by AtomChat plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'atomchat_update_auth_ajax'Check if you run itEPSS 0.30%Mar 21, 2026
- Medium6.4The Tour & Activity Operator Plugin for TourCMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' parameter of the tourcms_doc_link shortcode in alCheck if you run itEPSS 0.25%Mar 21, 2026
- Medium4.3The Company Posts for LinkedIn plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.0.Check if you run itEPSS 0.25%Mar 21, 2026
- Medium4.4The Survey plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1 due to insufficient input sanitization andCheck if you run itEPSS 0.26%Mar 21, 2026
- Medium6.4The Simple Football Scoreboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ytmr_fb_scoreboard' shortcode in all versions up to, and including, 1.0 duCheck if you run itEPSS 0.25%Mar 21, 2026
- Medium6.4The Go Night Pro | WordPress Dark Mode Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'go-night-pro-shortcode' shortcode in all versions up to,Check if you run itEPSS 0.26%Mar 21, 2026
- Medium6.1The Alfie – Feed Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'naam' parameter in all versions up to, and including, 1.2.1.Check if you run itEPSS 0.26%Mar 21, 2026
- Medium6.1The WP-WebAuthn plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the AJAX endpoint in all versions up to, and including, 1.3.4 due to insufficiCheck if you run itEPSS 0.28%Mar 21, 2026
- Medium6.4The Ed's Font Awesome plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 2.0.Check if you run itEPSS 0.26%Mar 21, 2026
- Medium4.4The Reward Video Ad for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.6.Check if you run itEPSS 0.26%Mar 21, 2026
- Medium4.3The Speedup Optimization plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.5.9.Check if you run itEPSS 0.22%Mar 21, 2026
- Medium6.4The fyyd podcast shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fyyd-podcast', 'fyyd-episode', and 'fyyd' shortcodes in all versions up to, aCheck if you run itEPSS 0.27%Mar 21, 2026
- Low3.8The Post Affiliate Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.28.0.Check if you run itEPSS 0.28%Mar 21, 2026
- Medium6.4The WPFAQBlock– FAQ & Accordion Plugin For Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' parameter of the 'wpfaqblock' shortcode in alCheck if you run itEPSS 0.26%Mar 21, 2026
- Medium6.4The Ad Short plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ad' shortcode's 'client' attribute in all versions up to and including 2.0.1.Check if you run itEPSS 0.20%Mar 21, 2026
- Medium5.3The WP-Chatbot for Messenger plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.9.Check if you run itEPSS 0.29%Mar 21, 2026
- Medium6.1The rexCrawler plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'url' and 'regex' parameters in the search-pattern tester page in all versions up to, anCheck if you run itEPSS 0.28%Mar 21, 2026
- Medium6.4The Outgrow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the 'outgrow' shortcode in all versions up to, and including, 2.1.Check if you run itEPSS 0.26%Mar 21, 2026
- Medium6.4The Ecover Builder For Dummies plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the 'ecover' shortcode in all versions up to and includinCheck if you run itEPSS 0.21%Mar 21, 2026
- Medium6.4The iVysilani Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' shortcode attribute in all versions up to, and including, 3.0 due to insufCheck if you run itEPSS 0.26%Mar 21, 2026
- Medium4.3The Redirect countdown plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.Check if you run itEPSS 0.15%Mar 21, 2026
- Medium4.3The Add Google Social Profiles to Knowledge Graph Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.Check if you run itEPSS 0.15%Mar 21, 2026
- Medium4.3The WP Posts Re-order plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.Check if you run itEPSS 0.15%Mar 21, 2026
- Medium6.4The Post Flagger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'flag' shortcode in all versions up to, and including, 1.1 due to insufficient iCheck if you run itEPSS 0.26%Mar 21, 2026
Sort