Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.3The Prime Slider – Addons for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.9 via the import_elementor_templCheck if you run itEPSS 0.29%Dec 18, 2025
- Critical9.3A flaw in the binding process of Govee’s cloud platform and devices allows a remote attacker to bind an existing, online Govee device to the attacker’s account, resulting in full cCheck if you run itEPSS 0.39%Dec 18, 2025
- High8.8The Demo Importer Plus plugin for WordPress is vulnerable to unauthorized modification of data, loss of data, and privilege escalation due to a missing capability check on the AjaxCheck if you run itEPSS 0.35%Dec 18, 2025
- Medium6.4The OpenID Connect Generic Client plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'openid_connect_generic_auth_url' shortcode in all versions upCheck if you run itEPSS 0.23%Dec 18, 2025
- High8.8The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.59.12 via the 'Check if you run itEPSS 0.75%Dec 18, 2025
- Medium6.3Insufficient permission validation in Checkmk versions prior to 2.4.0p17 and 2.3.0p42 allow low-privileged users to view agent information via the REST API, which could lead to infCheck if you run itEPSS 0.24%Dec 18, 2025
- High7.5A flaw was found in Nodemailer.Check if you run itEPSS 0.60%Dec 18, 2025
- Medium5.3Improper access checks in M-Files Server before 25.12.15491.7 allows users to download files through M-Files Web using Web Companion despite Print and Download Prevention module beCheck if you run itEPSS 0.31%Dec 18, 2025
- Medium6.5Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in weDevs WP ERP erp allows Retrieve Embedded Sensitive Data.This issue affects WP ERP: froCheck if you run itEPSS 0.25%Dec 18, 2025
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Hostel hostel allows Reflected XSS.This issue affects Hostel: from n/a thrCheck if you run itEPSS 0.17%Dec 18, 2025
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Sprout Clients sprout-clients allows Reflected XSS.This issue affectsCheck if you run itEPSS 0.18%Dec 18, 2025
- High7.5Missing Authorization vulnerability in Ays Pro Easy Form easy-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Form: from n/a thCheck if you run itEPSS 0.27%Dec 18, 2025
- High7.5Insertion of Sensitive Information Into Sent Data vulnerability in UserElements Ultimate Member Widgets for Elementor ultimate-member-widgets-for-elementor allows Retrieve EmbeddedCheck if you run itEPSS 0.28%Dec 18, 2025
- Medium6.5Missing Authorization vulnerability in Anton Vanyukov Offload, AI & Optimize with Cloudflare Images cf-images allows Exploiting Incorrectly Configured Access Control Security LevelCheck if you run itEPSS 0.25%Dec 18, 2025
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Antispam fv-antispam allows Reflected XSS.This issue affects FVCheck if you run itEPSS 0.17%Dec 18, 2025
- Medium6.5Missing Authorization vulnerability in Magnigenie RestroPress restropress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RestroPress: frCheck if you run itEPSS 0.24%Dec 18, 2025
- High7.5Missing Authorization vulnerability in Property Hive PropertyHive propertyhive allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PropertyHiCheck if you run itEPSS 0.27%Dec 18, 2025
- Critical9.1Improper Control of Generation of Code ('Code Injection') vulnerability in jetmonsters Hotel Booking Lite motopress-hotel-booking-lite allows Remote Code Inclusion.This issue affecCheck if you run itEPSS 0.37%Dec 18, 2025
- Critical9.0Unrestricted Upload of File with Dangerous Type vulnerability in Cozmoslabs WP Webhooks wp-webhooks allows Path Traversal.This issue affects WP Webhooks: from n/a through <= 3.3.8.Check if you run itEPSS 0.27%Dec 18, 2025
- High7.5Missing Authorization vulnerability in Tomdever wpForo Forum wpforo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpForo Forum: from n/Check if you run itEPSS 0.28%Dec 18, 2025
- Medium6.5Missing Authorization vulnerability in InstaWP InstaWP Connect instawp-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects InstaWP CoCheck if you run itEPSS 0.23%Dec 18, 2025
- High7.5Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from nCheck if you run itEPSS 0.27%Dec 18, 2025
- High7.1Missing Authorization vulnerability in CridioStudio ListingPro listingpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingPro: froCheck if you run itEPSS 0.20%Dec 18, 2025
- High8.1cridio listingpro Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')Patch nowKEVEPSS 0.40%Dec 18, 2025
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CridioStudio ListingPro listingpro allows Reflected XSS.This issue affects LisCheck if you run itEPSS 0.18%Dec 18, 2025
Sort