Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.1Improper Access Control (IDOR) in the Graylog API, version 2.2.3, which occurs when modifying the user ID in the URL.Check if you run itEPSS 0.25%Feb 18, 2026
- Critical9.3Not properly invalidated session vulnerability in Graylog Web Interface, version 2.2.3, due to incorrect management of session invalidation after new logins.Check if you run itEPSS 0.42%Feb 18, 2026
- Low3.7The WP All Export plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.14 via the export download endpoint.Check if you run itEPSS 0.33%Feb 18, 2026
- Medium6.5The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 7.37.Check if you run itEPSS 0.28%Feb 18, 2026
- Medium4.3The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Incorrect Authorization in all versiCheck if you run itEPSS 0.19%Feb 18, 2026
- Medium4.9The Bookster – WordPress Appointment Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the ‘raw’ parameter in all versions up to, and including, 2.1.1 due to iCheck if you run itEPSS 0.38%Feb 18, 2026
- Medium6.5The Brevo - Email, SMS, Web Push, Chat, and more.Check if you run itEPSS 0.52%Feb 18, 2026
- Medium4.8A security flaw has been discovered in admesh up to 0.98.5.Check if you run itEPSS 0.27%Feb 18, 2026
- Medium6.5The WP-DownloadManager plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.69 via the 'file' parameter in the file deletion functionality.Check if you run itEPSS 1.41%Feb 18, 2026
- Medium6.5The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the b2s_curation_drCheck if you run itEPSS 0.38%Feb 18, 2026
- Medium5.3The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to payment bypass due to insufficient verificationCheck if you run itEPSS 0.24%Feb 18, 2026
- Medium6.4The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cmplz-accept-link shortcode in all versions up to, and iCheck if you run itEPSS 0.28%Feb 18, 2026
- Medium5.3The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 20260Check if you run itEPSS 0.39%Feb 18, 2026
- Medium4.4The Video Share VOD – Turnkey Video Site Builder Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin settings in all versions up to, and including,Check if you run itEPSS 0.31%Feb 18, 2026
- Medium5.3The Business Directory Plugin for WordPress is vulnerable to authorization bypass due to a missing authorization check in all versions up to, and including, 6.4.20.Check if you run itEPSS 0.36%Feb 18, 2026
- Medium5.4The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to unauthorized arbitrary shortcode execution in all versions up to, and including, 1.70.4.Check if you run itEPSS 0.32%Feb 18, 2026
- Medium4.4The Community Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ce_venue_name' parameter in all versions up to, and including, 1.5.7 due to insufficCheck if you run itEPSS 0.27%Feb 18, 2026
- High7.5The WPNakama – Team and multi-Client Collaboration, Editorial and Project Management plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the '/wp-json/Check if you run itEPSS 0.48%Feb 18, 2026
- Medium6.4The WP Event Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_events' shortcode in all versions up to, and including, 1.8.7 due toCheck if you run itEPSS 0.28%Feb 18, 2026
- Medium4.3The Dam Spam plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.8.Check if you run itEPSS 0.19%Feb 18, 2026
- Medium4.3The Kali Forms plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.8.Check if you run itEPSS 0.33%Feb 18, 2026
- Low2.7The YayMail - WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized plugin installation and activation due to missing capability checks on the 'yaymail_inCheck if you run itEPSS 0.33%Feb 18, 2026
- Medium4.4The YayMail – WooCommerce Email Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including, 4.3.2 due to insuffiCheck if you run itEPSS 0.30%Feb 18, 2026
- Medium5.3The YayMail – WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized license key deletion due to a missing authorization check on the REST endpoint in versCheck if you run itEPSS 0.35%Feb 18, 2026
- Medium4.3The EventPrime plugin for WordPress is vulnerable to unauthorized post modification due to missing authorization checks in all versions up to, and including, 4.2.8.4.Check if you run itEPSS 0.32%Feb 18, 2026
Sort