Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.2The Lucky Wheel for WooCommerce – Spin a Sale plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 1.1.13.Check if you run itEPSS 0.64%Dec 30, 2025
- Medium5.3Missing Authorization vulnerability in wpdesk ShopMagic shopmagic-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShopMagCheck if you run itEPSS 0.22%Dec 30, 2025
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-liteCheck if you run itEPSS 0.15%Dec 30, 2025
- Medium4.3Missing Authorization vulnerability in Kraft Plugins Demo Importer Plus demo-importer-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affectCheck if you run itEPSS 0.18%Dec 30, 2025
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in autolistings Auto Listings auto-listings allows Stored XSS.This issue affectsCheck if you run itEPSS 0.15%Dec 30, 2025
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vidish Combo Offers WooCommerce woo-combo-offers allows DOM-Based XSS.This issCheck if you run itEPSS 0.16%Dec 30, 2025
- High8.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Lekker lekker allows PHP Local File InclusionCheck if you run itEPSS 0.39%Dec 30, 2025
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A WP Life Blog Filter blog-filter allows DOM-Based XSS.This issue affects BlogCheck if you run itEPSS 0.15%Dec 30, 2025
- Medium5.4Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes FiveStar fivestar allows Exploiting Incorrectly Configured Access Control Security Levels.This issueCheck if you run itEPSS 0.22%Dec 30, 2025
- Medium5.3Missing Authorization vulnerability in Skywarrior Arcane arcane allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Arcane: from n/a throughCheck if you run itEPSS 0.28%Dec 30, 2025
- Medium5.4Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Backpack Traveler backpacktraveler allows Exploiting Incorrectly Configured Access Control SecurityCheck if you run itEPSS 0.22%Dec 30, 2025
- Medium5.4Authorization Bypass Through User-Controlled Key vulnerability in Select-Themes Struktur struktur allows Exploiting Incorrectly Configured Access Control Security Levels.This issueCheck if you run itEPSS 0.22%Dec 30, 2025
- Medium5.3Missing Authorization vulnerability in BoldGrid weForms weforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weForms: from n/a throughCheck if you run itEPSS 0.21%Dec 30, 2025
- Medium5.3Missing Authorization vulnerability in tychesoftwares Product Delivery Date for WooCommerce – Lite product-delivery-date-for-woocommerce-lite allows Exploiting Incorrectly ConfigurCheck if you run itEPSS 0.21%Dec 30, 2025
- Medium4.3Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Roxnor PopupKit popup-builder-block allows Retrieve Embedded Sensitive Data.This issue aCheck if you run itEPSS 0.22%Dec 30, 2025
- Medium4.3Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Aethonic Poptics poptics allows Retrieve Embedded Sensitive Data.This issue affects PoptCheck if you run itEPSS 0.21%Dec 30, 2025
- Medium6.5Missing Authorization vulnerability in bizswoop BizPrint print-google-cloud-print-gcp-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issueCheck if you run itEPSS 0.24%Dec 30, 2025
- Medium4.3Missing Authorization vulnerability in Marketing Fire Discussion Board wp-discussion-board allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affectCheck if you run itEPSS 0.18%Dec 30, 2025
- Medium5.4Missing Authorization vulnerability in Weblizar - WordPress Themes & Plugin HR Management Lite hr-management-lite allows Exploiting Incorrectly Configured Access Control Security LCheck if you run itEPSS 0.21%Dec 30, 2025
- Medium5.4Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Popup box ays-popup-box allows Cross Site Request Forgery.This issue affects Popup box: from n/a through <= 6.0.7.Check if you run itEPSS 0.12%Dec 30, 2025
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Newsletters newsletters-lite allows Stored XSS.This issue aCheck if you run itEPSS 0.16%Dec 30, 2025
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FlippingBook FlippingBook flippingbook allows DOM-Based XSS.This issue affectsCheck if you run itEPSS 0.15%Dec 30, 2025
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamalli Web Directory Free web-directory-free allows DOM-Based XSS.This issueCheck if you run itEPSS 0.16%Dec 30, 2025
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magnigenie RestroPress restropress allows Stored XSS.This issue affects RestroCheck if you run itEPSS 0.16%Dec 30, 2025
- Medium4.3Missing Authorization vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows Exploiting Incorrectly Configured Access Control Security LeveCheck if you run itEPSS 0.22%Dec 30, 2025
Sort