Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.3The Purchase and Expense Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2.Check if you run itEPSS 0.15%Dec 12, 2025
- Medium6.4The FX Currency Converter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fxcc_convert' shortcode in all versions up to, and including, 0.2.0 duCheck if you run itEPSS 0.22%Dec 12, 2025
- Medium6.4The Divelogs Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'latestdive' shortcode in all versions up to, and including, 1.5 due to insufCheck if you run itEPSS 0.22%Dec 12, 2025
- Medium6.4The Zenost Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' and 'target' parameters in the shortcode in all versions up to, and includingCheck if you run itEPSS 0.22%Dec 12, 2025
- Medium5.3The Product Filtering by Categories, Tags, Price Range for WooCommerce – Filter Plus plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to,Check if you run itEPSS 0.28%Dec 12, 2025
- Medium6.1The Category Dropdown List plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the variable in all versions up to, and including, 1.0 due to insufficient inputCheck if you run itEPSS 0.25%Dec 12, 2025
- Medium4.3The Animated Pixel Marquee Creator plugin for WordPress is vulnerable to Cross-Site Request Forgery via the 'marquee' parameter in all versions up to, and including, 1.0.0.Check if you run itEPSS 0.15%Dec 12, 2025
- Critical9.8The LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart plugin for WordPress is vulnerable to privilege escalation via account takeover in all versionsCheck if you run itEPSS 0.36%Dec 12, 2025
- Medium4.4The TWW Protein Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Header' setting in all versions up to, and including, 1.0.24 due to insufficieCheck if you run itEPSS 0.23%Dec 12, 2025
- Medium6.4The WP Flot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'linechart' shortcode in all versions up to, and including, 0.2.2 due to insufficientCheck if you run itEPSS 0.22%Dec 12, 2025
- Medium6.1The 评论小秘书 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the variable in all versions up to, and including, 1.3.2.Check if you run itEPSS 0.25%Dec 12, 2025
- Medium6.4The Paypal Payment Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buttom_image' parameter of the [paypal-shortcode] shortcode in all versionsCheck if you run itEPSS 0.22%Dec 12, 2025
- Medium6.4The Data Visualizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'visualize' shortcode in all versions up to, and including, 1.1 due to insuffCheck if you run itEPSS 0.27%Dec 12, 2025
- Medium4.4The DebateMaster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the color options in the plugin settings in all versions up to, and including, 1.0.0 due to iCheck if you run itEPSS 0.31%Dec 12, 2025
- Medium6.4The Hide Email Address plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'inline_css' parameter in the shortcode in all versions up to, and including, 0.1 dCheck if you run itEPSS 0.27%Dec 12, 2025
- Medium6.4The GPXpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gpxpress' shortcode in all versions up to, and including, 1.3 due to insufficient iCheck if you run itEPSS 0.27%Dec 12, 2025
- Medium6.4The BUKAZU Search widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shortcode' parameter of the 'bukazu_search' shortcode in all versions up to, andCheck if you run itEPSS 0.28%Dec 12, 2025
- Medium6.8The WP User Manager plugin for WordPress is vulnerable to Arbitrary File Deletion in all versions up to, and including, 2.9.12.Check if you run itEPSS 0.82%Dec 12, 2025
- Medium4.3The Simple Theme Changer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the user_theme_admin, display_method_admin, anCheck if you run itEPSS 0.19%Dec 12, 2025
- Medium5.3The Premmerce Wishlist for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.1.10.Check if you run itEPSS 0.34%Dec 12, 2025
- Medium4.3The Truefy Embed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0.Check if you run itEPSS 0.15%Dec 12, 2025
- Medium6.4The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in the 'bold_timeline_group' shortcode in all versions up to, andCheck if you run itEPSS 0.28%Dec 12, 2025
- Medium6.4The Reviews Sorted plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'space' parameter of the [reviews-slider] shortcode in all versions up to, and includinCheck if you run itEPSS 0.35%Dec 12, 2025
- Medium4.3The Resource Library for Logged In Users plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.Check if you run itEPSS 0.17%Dec 12, 2025
- Medium4.3The Kirim.Email WooCommerce Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.9.Check if you run itEPSS 0.16%Dec 12, 2025
Sort