Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.4The Easy Map Creator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 3.0.2 due to insufficient inpCheck if you run itEPSS 0.27%Dec 12, 2025
- Medium4.3The IMAQ Core plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1.Check if you run itEPSS 0.17%Dec 12, 2025
- Medium4.3The Premmerce Brands for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveBrandsSettings function inCheck if you run itEPSS 0.28%Dec 12, 2025
- Medium5.3The WPMasterToolKit plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 2.13.0.Check if you run itEPSS 0.46%Dec 12, 2025
- Medium6.4The App Landing Template Blocks for WPBakery (Visual Composer) Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'atvc_video_play' shortcode inCheck if you run itEPSS 0.22%Dec 12, 2025
- High8.1The Visitor Logic Lite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.3 via deserialization of untrusted input from the cookieCheck if you run itEPSS 0.54%Dec 12, 2025
- Medium4.3The Coding Blocks plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0.Check if you run itEPSS 0.16%Dec 12, 2025
- Medium6.4The WPGancio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gancio-event' shortcode in all versions up to, and including, 1.12 due to insufficiCheck if you run itEPSS 0.27%Dec 12, 2025
- Medium4.3The URL Media Uploader plugin for WordPress is vulnerable to unauthorized safe file uploads due to a missing capability check on the url_media_uploader_url_upload_ajax_handler() fuCheck if you run itEPSS 0.28%Dec 12, 2025
- High8.8The Infility Global plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and capability checks in all versions up to, and including, 2.1Check if you run itEPSS 0.59%Dec 12, 2025
- High8.8The Player Leaderboard plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0.2 via the 'player_leaderboard' shortcode.Check if you run itEPSS 0.80%Dec 12, 2025
- Critical9.8The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'plupload_ajax_delete_file' functCheck if you run itEPSS 0.53%Dec 12, 2025
- Medium4.3The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includiCheck if you run itEPSS 0.18%Dec 12, 2025
- Medium6.1The Like DisLike Voting plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the variable in all versions up to, and including, 1.0.1 due to insufficient inputCheck if you run itEPSS 0.26%Dec 12, 2025
- Medium4.4The SimplyConvert plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'simplyconvert_hash' option in all versions up to, and including, 1.0 due to insufficienCheck if you run itEPSS 0.22%Dec 12, 2025
- Medium5.3The Campay Woocommerce Payment Gateway plugin for WordPress is vulnerable to Unauthenticated Payment Bypass in all versions up to, and including, 1.2.2.Check if you run itEPSS 0.37%Dec 12, 2025
- Medium6.1The Complag plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the variable in all versions up to, and including, 1.0.2 due to insufficient input sanitizationCheck if you run itEPSS 0.25%Dec 12, 2025
- Medium6.4The WP Dropzone plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'callback' shortcode attribute in all versions up to, and including, 1.1.1.Check if you run itEPSS 0.28%Dec 12, 2025
- Medium6.4The Wpik WordPress Basic Ajax Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dname' parameter in all versions up to, and including, 1.0 due to insuCheck if you run itEPSS 0.23%Dec 12, 2025
- Medium6.4The Ayo Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'color' parameter of the ayo_action shortcode in all versions up to, and including, 0.2Check if you run itEPSS 0.22%Dec 12, 2025
- Medium4.9The WatchTowerHQ plugin for WordPress is vulnerable to arbitrary file read via the 'wht_download_big_object_origin' parameter in all versions up to, and including, 3.16.0.Check if you run itEPSS 0.51%Dec 12, 2025
- Medium4.4The WP Job Portal plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.4.Check if you run itEPSS 0.24%Dec 12, 2025
- Medium5.4The BuddyTask plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on multiple AJAX endpoints in all versions up to,Check if you run itEPSS 0.26%Dec 12, 2025
- Medium4.3The Vimeo SimpleGallery plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 0.2.Check if you run itEPSS 0.22%Dec 12, 2025
- Medium6.4The Simple Nivo Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode parameter in all versions up to, and including, 0.5.6 due to insuffiCheck if you run itEPSS 0.27%Dec 12, 2025
Sort