Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.5Missing Authorization vulnerability in renatoatshown Shown Connector shown-connector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShowCheck if you run itEPSS 0.38%Jan 22, 2026
- Critical10.0Unrestricted Upload of File with Dangerous Type vulnerability in garidium g-FFL Checkout g-ffl-checkout allows Upload a Web Shell to a Web Server.This issue affects g-FFL Checkout:Check if you run itEPSS 0.65%Jan 22, 2026
- Critical9.9Unrestricted Upload of File with Dangerous Type vulnerability in InspiryThemes Real Homes CRM realhomes-crm allows Using Malicious Files.This issue affects Real Homes CRM: from n/aCheck if you run itEPSS 0.57%Jan 22, 2026
- High7.6Missing Authorization vulnerability in e-plugins Lawyer Directory lawyer-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LawyerCheck if you run itEPSS 0.36%Jan 22, 2026
- High8.8Incorrect Privilege Assignment vulnerability in e-plugins Lawyer Directory lawyer-directory allows Privilege Escalation.This issue affects Lawyer Directory: from n/a through <= 1.3Check if you run itEPSS 0.47%Jan 22, 2026
- High8.6Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ovatheme Movie Booking movie-booking allows Path Traversal.This issue affects MovieCheck if you run itEPSS 0.61%Jan 22, 2026
- Medium6.4Server-Side Request Forgery (SSRF) vulnerability in Marco van Wieren WPO365 wpo365-login allows Server Side Request Forgery.This issue affects WPO365: from n/a through <= 40.0.Check if you run itEPSS 0.26%Jan 22, 2026
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in purethemes WorkScout-Core workscout-core allows Reflected XSS.This issue affecCheck if you run itEPSS 0.28%Jan 22, 2026
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in purethemes WorkScout workscout allows Reflected XSS.This issue affects WorkScoCheck if you run itEPSS 0.28%Jan 22, 2026
- Medium6.5Missing Authorization vulnerability in Taxcloud TaxCloud for WooCommerce simple-sales-tax allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affectsCheck if you run itEPSS 0.30%Jan 22, 2026
- High8.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TangibleWP Listivo Core listivo-core allows PHP Local FileCheck if you run itEPSS 0.60%Jan 22, 2026
- High7.5Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TangibleWP MyHome Core myhome-core allows PHP Local File InCheck if you run itEPSS 0.56%Jan 22, 2026
- Medium6.5Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Retrieve Embedded SensitCheck if you run itEPSS 0.42%Jan 22, 2026
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Tour grandtour allows Reflected XSS.This issue affects GrandCheck if you run itEPSS 0.28%Jan 22, 2026
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designingmedia Hostiko hostiko allows Reflected XSS.This issue affects HostikoCheck if you run itEPSS 0.28%Jan 22, 2026
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in scriptsbundle AdForest Elementor adforest-elementor allows Reflected XSS.ThisCheck if you run itEPSS 0.28%Jan 22, 2026
- High8.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in scriptsbundle AdForest adforest allows PHP Local File IncluCheck if you run itEPSS 0.60%Jan 22, 2026
- Critical9.3mailerlite mailerlite Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 0.44%Jan 22, 2026
- Critical9.1Improper Control of Generation of Code ('Code Injection') vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Code Injection.This issue affects Nelio AB TestinCheck if you run itEPSS 0.58%Jan 22, 2026
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows ReflectedCheck if you run itEPSS 0.28%Jan 22, 2026
- Medium6.5Missing Authorization vulnerability in peachpayments Peach Payments Gateway wc-peach-payments-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This iCheck if you run itEPSS 0.41%Jan 22, 2026
- High8.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes The Aisle theaisle allows PHP Local File InclCheck if you run itEPSS 0.60%Jan 22, 2026
- High8.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Powerlift powerlift allows PHP Local File IncCheck if you run itEPSS 0.60%Jan 22, 2026
- Medium6.5Missing Authorization vulnerability in Tickera Tickera tickera-event-ticketing-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TicCheck if you run itEPSS 0.39%Jan 22, 2026
- High8.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Biagiotti biagiotti allows PHP Local File IncCheck if you run itEPSS 0.63%Jan 22, 2026
Sort