Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.8PDW File Browser version 1.3 contains stored and reflected cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts through file rename aCheck if you run itEPSS 0.24%Jan 28, 2026
- High8.5Program Access Controller 1.2.0.0 contains an unquoted service path vulnerability in PACService.exe that allows local attackers to execute code with elevated privileges.Check if you run itEPSS 0.17%Jan 28, 2026
- High8.5IP Watcher 3.0.0.30 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to execute arbitrary code.Check if you run itEPSS 0.17%Jan 28, 2026
- Medium6.4The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'content_protector' shortcode in all versions uCheck if you run itEPSS 0.28%Jan 28, 2026
- Critical9.8The Snow Monkey Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'generate_user_dirpath' function in all versionsCheck this weekEPSS 13.28%Jan 28, 2026
- Medium4.4The WP Google Ad Manager Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.0 due to insufficientCheck if you run itEPSS 0.23%Jan 28, 2026
- Medium4.3The Change WP URL plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.Check if you run itEPSS 0.16%Jan 28, 2026
- High7.5The Frontend File Manager Plugin for WordPress is vulnerable to unauthorized file sharing due to a missing capability check on the 'wpfm_send_file_in_email' AJAX action in all versCheck if you run itEPSS 0.35%Jan 28, 2026
- Medium6.4The BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting vCheck if you run itEPSS 0.22%Jan 28, 2026
- Medium6.1The SEO Links Interlinking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'google_error' parameter in all versions up to, and including, 1.7.9.9.1 dueCheck if you run itEPSS 0.26%Jan 28, 2026
- Medium4.3The Bitcoin Donate Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.Check if you run itEPSS 0.15%Jan 28, 2026
- High8.8The Simple User Registration plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 6.7 due to insufficient restriction on the 'profile_save_fCheck if you run itEPSS 0.34%Jan 28, 2026
- Medium5.3The Vzaar Media Management plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.2 due to insufficient input sanitization andCheck if you run itEPSS 0.30%Jan 28, 2026
- Medium5.3The Rupantorpay plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_webhook() function in all versions up to, anCheck if you run itEPSS 0.24%Jan 28, 2026
- Medium4.3The imwptip plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.Check if you run itEPSS 0.15%Jan 28, 2026
- High7.2The AI Engine – The Chatbot and AI Framework for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the function in all vCheck if you run itEPSS 0.73%Jan 28, 2026
- Medium4.4The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.5.13 due toCheck if you run itEPSS 0.28%Jan 28, 2026
- Medium4.4The Order Minimum/Maximum Amount Limits for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including, 4.6.8 dCheck if you run itEPSS 0.27%Jan 28, 2026
- Medium4.3When a user explicitly requested Thunderbird to decrypt an inline OpenPGP message that was embedded in a text section of an email that was formatted and styled with HTML and CSS, tCheck if you run itEPSS 0.18%Jan 28, 2026
- Critical9.8SolarWinds web_help_desk Weak AuthenticationPatch nowKEVEPSS 60.64%Jan 28, 2026
- Critical9.8SolarWinds web_help_desk Deserialization of Untrusted DataPatch nowKEVEPSS 67.97%Jan 28, 2026
- Critical9.8SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that if exploited, would allow a malicious actor to execute actions and methods thatCheck this weekEPSS 52.00%Jan 28, 2026
- High7.5SolarWinds Web Help Desk was found to be susceptible to a hardcoded credentials vulnerability that, under certain situations, could allow access to administrative functions.Check if you run itEPSS 0.59%Jan 28, 2026
- Medium5.3The RegistrationMagic plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.0.7.4.Check if you run itEPSS 0.27%Jan 28, 2026
- Medium4.3The Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.4.Check if you run itEPSS 0.23%Jan 28, 2026
Sort