Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.3The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the processBackgroundAction()Check if you run itEPSS 0.28%Jan 24, 2026
- Medium6.1The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘options’ parameter in all versions up to, and including, 4.5.5 dueCheck if you run itEPSS 0.25%Jan 24, 2026
- High7.5The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the action_imporCheck if you run itEPSS 0.59%Jan 24, 2026
- Medium5.3wpdirectorykit wp_directory_kit Exposure of Sensitive Information to an Unauthorized ActorPatch nowKEVEPSS 0.71%Jan 24, 2026
- Medium4.3The SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity plugin for WordPress is vulnerable to Cross-Site Request Forgery in allCheck if you run itEPSS 0.14%Jan 24, 2026
- Medium4.3The Friendly Functions for Welcart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.5.Check if you run itEPSS 0.21%Jan 24, 2026
- Medium4.4The Responsive Header plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple plugin settings parameters in all versions up to, and including, 1.0 due to insCheck if you run itEPSS 0.23%Jan 24, 2026
- Medium6.4The LeadBI Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_id' parameter of the 'leadbi_form' shortcode in all versions up to,Check if you run itEPSS 0.22%Jan 24, 2026
- Medium4.3The SurveyJS: Drag & Drop WordPress Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.2.Check if you run itEPSS 0.15%Jan 24, 2026
- Medium6.4The CM CSS Columns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' shortcode attribute in all versions up to, and including, 1.2.1 due to insufficieCheck if you run itEPSS 0.22%Jan 24, 2026
- Low3.7The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including,Check if you run itEPSS 0.22%Jan 24, 2026
- Medium4.4The Postalicious plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.0.1 due to insufficient input sanitizaCheck if you run itEPSS 0.29%Jan 24, 2026
- Medium4.3The Meta-box GalleryMeta plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mb_gallery' custom post type in all versiCheck if you run itEPSS 0.22%Jan 24, 2026
- Medium4.3The Moderate Selected Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.Check if you run itEPSS 0.13%Jan 24, 2026
- High7.2The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom fields in all versions uCheck if you run itEPSS 0.25%Jan 24, 2026
- Medium6.4The Administrative Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'login' and 'logout' shortcode attributes in all versions up to, and includiCheck if you run itEPSS 0.25%Jan 24, 2026
- Medium4.3The Login Page Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.Check if you run itEPSS 0.17%Jan 24, 2026
- Medium6.1The JustClick registration plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 0.1.Check if you run itEPSS 0.29%Jan 24, 2026
- Medium6.4The ThemeRuby Multi Authors – Assign Multiple Writers to Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before' and 'after' shortcode attributes iCheck if you run itEPSS 0.26%Jan 24, 2026
- Medium5.3The Wise Analytics plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.1.9.Check if you run itEPSS 0.35%Jan 24, 2026
- Medium6.4The GZSEO plugin for WordPress is vulnerable to authorization bypass leading to Stored Cross-Site Scripting in all versions up to, and including, 2.0.11.Check if you run itEPSS 0.29%Jan 24, 2026
- Medium5.3The Wizit Gateway for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary Order Cancellation in all versions up to, and including, 1.3.1.Check if you run itEPSS 0.40%Jan 24, 2026
- Medium5.3The Alchemist Ajax Upload plugin for WordPress is vulnerable to unauthorized media file deletion due to a missing capability check on the 'delete_file' function in all versions upCheck if you run itEPSS 0.33%Jan 24, 2026
- Medium5.4The AIKTP plugin for WordPress is vulnerable to unauthorized modification of data due to missing authorization checks on the /aiktp/getToken REST API endpoint in all versions up toCheck if you run itEPSS 0.26%Jan 24, 2026
- Medium6.4The Alpha Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘alpha_block_css’ parameter in all versions up to, and including, 1.5.0 due to insufficieCheck if you run itEPSS 0.21%Jan 24, 2026
Sort