Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.3The Invoct – PDF Invoices & Billing for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions in allCheck if you run itEPSS 0.34%Feb 11, 2026
- Medium4.4The WPlyr Media Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_wplyr_accent_color' parameter in all versions up to, and including, 1.3.0 due to iCheck if you run itEPSS 0.29%Feb 11, 2026
- Medium6.4The BuddyHolis ListSearch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'listsearch' shortcode in all versions up to, and including, 1.1 due toCheck if you run itEPSS 0.28%Feb 11, 2026
- Medium4.3The MMA Call Tracking plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.15.Check if you run itEPSS 0.18%Feb 11, 2026
- Medium6.4The Slideshow Wp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sswpid' attribute of the 'sswp-slide' shortcode in all versions up to, and including, 1.Check if you run itEPSS 0.27%Feb 11, 2026
- Medium6.4The Microtango plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'restkey' parameter of the mt_reservation shortcode in all versions up to, and including, 0Check if you run itEPSS 0.28%Feb 11, 2026
- Medium6.4The WDES Responsive Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wdes-popup-title' shortcode in all versions up to, and including, 1.3.Check if you run itEPSS 0.27%Feb 11, 2026
- High7.2The iONE360 configurator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Contact Form Parameters in all versions up to, and including, 2.0.57 due to insufCheck if you run itEPSS 0.42%Feb 11, 2026
- High8.3Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saastech Cleaning and Internet Services Inc.Check if you run itEPSS 0.31%Feb 11, 2026
- Medium5.4Authorization Bypass Through User-Controlled Key vulnerability in Saastech Cleaning and Internet Services Inc.Check if you run itEPSS 0.23%Feb 11, 2026
- Medium6.4The Orbisius Random Name Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btn_label' parameter in the 'orbisius_random_name_generator' shortcodeCheck if you run itEPSS 0.25%Feb 11, 2026
- Medium4.7Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets (CSS) injection, e.g., because comments are mishandled.Check if you run itEPSS 0.36%Feb 11, 2026
- Medium6.4The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Global Settings parameter in all versionsCheck if you run itEPSS 0.22%Feb 11, 2026
- Medium6.5The SlimStat Analytics plugin for WordPress is vulnerable to time-based SQL Injection via the ‘args’ parameter in all versions up to, and including, 5.3.1 due to insufficient escapCheck if you run itEPSS 0.26%Feb 11, 2026
- Medium4.3The Gallery by FooGallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax_get_gallery_info() function in all versionCheck if you run itEPSS 0.24%Feb 11, 2026
- Medium5.3User-controlled input is reflected into the HTML output without proper encoding on TP-Link Archer C60 v3, allowing arbitrary JavaScript execution via a crafted URL.Check if you run itEPSS 0.33%Feb 11, 2026
- High7.8Apple Multiple Buffer Overflow VulnerabilityPatch nowKEVEPSS 1.65%Feb 11, 2026
- Critical9.8WPvivid migration\,_backup\,_staging Unrestricted Upload of File with Dangerous TypePatch nowKEVEPSS 39.02%Feb 11, 2026
- Medium5.5Safetica Kernel Driver Privileged Termination VulnerabilityPatch nowKEVEPSS 0.26%Feb 11, 2026
- Medium6.1A stored cross-site scripting (XSS) vulnerability in the recipe asset upload and media serving component in Mealie 3.3.1 allows remote authenticated users to inject arbitrary web sCheck if you run itEPSS 0.22%Feb 11, 2026
- Medium5.4A stored HTML injection vulnerability in the Recipe Notes rendering component in Mealie 3.3.1 allows remote authenticated users to inject arbitrary HTML, resulting in user interfacCheck if you run itEPSS 0.27%Feb 11, 2026
- Critical9.8An issue was discovered in OpenSatKit 2.2.1.Check if you run itEPSS 0.63%Feb 11, 2026
- High7.5Directory traversal vulnerability in OpenSatKit 2.2.1 allows attackers to gain access to sensitive information or delete arbitrary files via crafted value to the FileUtil_GetFileInCheck if you run itEPSS 0.84%Feb 11, 2026
- High7.8An issue was discovered in OpenSatKit 2.2.1.Check if you run itEPSS 0.22%Feb 11, 2026
- High7.5An issue in Sunbird-Ed SunbirdEd-portal v1.13.4 allows attackers to obtain sensitive information.Check if you run itEPSS 0.29%Feb 11, 2026
Sort