Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.4The Canto Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fx' shortcode attribute in all versions up to, and including, 1.0 due to insufficiCheck if you run itEPSS 0.27%Jan 24, 2026
- Medium4.9The WP-ClanWars plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the userCheck if you run itEPSS 0.41%Jan 24, 2026
- Medium5.4The Same Category Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget title placeholder functionality in all versions up to, and including, 1.1.1Check if you run itEPSS 0.24%Jan 24, 2026
- Medium4.3The Star Review Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.2.Check if you run itEPSS 0.18%Jan 24, 2026
- Medium4.3The WP Youtube Video Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.Check if you run itEPSS 0.15%Jan 24, 2026
- Critical9.8The Kalrav AI Agent plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the kalrav_upload_file AJAX action in all versions up to, anCheck if you run itEPSS 1.15%Jan 24, 2026
- High7.2The Frontis Blocks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.1.6.Check if you run itEPSS 0.36%Jan 24, 2026
- Medium6.4The VK Google Job Posting Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Job Description field in versions up to, and including, 1.2.23 due to inCheck if you run itEPSS 0.28%Jan 24, 2026
- Medium4.3The Alex User Counter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.0.Check if you run itEPSS 0.18%Jan 24, 2026
- Medium4.3The Simple Crypto Shortcodes plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.2.Check if you run itEPSS 0.18%Jan 24, 2026
- High7.5The Administrative Shortcodes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.3.4 via the 'slug' attribute of the 'get_template'Check if you run itEPSS 0.74%Jan 24, 2026
- Medium6.5Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite.Check if you run itEPSS 0.37%Jan 24, 2026
- Medium5.1BloofoxCMS 0.5.2.1 contains a stored cross-site scripting vulnerability in the articles text parameter that allows authenticated attackers to inject malicious scripts.Check if you run itEPSS 0.23%Jan 23, 2026
- High8.7PhreeBooks 5.2.3 contains an authenticated file upload vulnerability in the Image Manager that allows remote code execution.Check if you run itEPSS 0.71%Jan 23, 2026
- High8.6LiteSpeed Web Server Enterprise 5.4.11 contains an authenticated command injection vulnerability in the external app configuration interface.Check if you run itEPSS 1.63%Jan 23, 2026
- Medium6.9YetiShare File Hosting Script 5.1.0 contains a server-side request forgery vulnerability that allows attackers to read local system files through the remote file upload feature.Check if you run itEPSS 0.30%Jan 23, 2026
- High8.5Epson USB Display 1.6.0.0 contains an unquoted service path vulnerability in the EMP_UDSA service running with LocalSystem privileges.Check if you run itEPSS 0.14%Jan 23, 2026
- Medium5.1PEEL Shopping 9.3.0 contains a stored cross-site scripting vulnerability in the address parameter of the change_params.php script.Check if you run itEPSS 0.26%Jan 23, 2026
- Medium6.7Nsauditor 3.2.2.0 contains a denial of service vulnerability that allows attackers to crash the application by overwriting the Event Description field with a large buffer.Check if you run itEPSS 0.36%Jan 23, 2026
- Medium6.7Managed Switch Port Mapping Tool 2.85.2 contains a denial of service vulnerability that allows attackers to crash the application by creating an oversized buffer.Check if you run itEPSS 0.29%Jan 23, 2026
- Medium5.1PEEL Shopping 9.3.0 contains a stored cross-site scripting vulnerability in the 'Comments / Special Instructions' parameter of the purchase page.Check if you run itEPSS 0.26%Jan 23, 2026
- Critical9.3Unified Remote 3.9.0.2463 contains a remote code execution vulnerability that allows attackers to send crafted network packets to execute arbitrary commands.Check if you run itEPSS 0.95%Jan 23, 2026
- High8.5Softros LAN Messenger 9.6.4 contains an unquoted service path vulnerability in the SoftrosSpellChecker service that allows local attackers to potentially execute arbitrary code.Check if you run itEPSS 0.14%Jan 23, 2026
- High8.7Textpattern versions prior to 4.8.3 contain an authenticated remote code execution vulnerability that allows logged-in users to upload malicious PHP files.Check if you run itEPSS 0.71%Jan 23, 2026
- Medium5.1LavaLite CMS versions up to and including 10.1.0 contain a stored cross-site scripting vulnerability in the package creation and search functionality.Check if you run itEPSS 0.22%Jan 23, 2026
Sort