Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.8The Expire Users plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.2.Check if you run itEPSS 0.26%Mar 21, 2026
- Medium4.4The Review Map by RevuKangaroo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 1.7 due to insufficieCheck if you run itEPSS 0.27%Mar 21, 2026
- Medium6.5The Hr Press Lite plugin for WordPress is vulnerable to unauthorized access of sensitive employee data due to a missing capability check on the AJAX action in all versions up to, aCheck if you run itEPSS 0.25%Mar 21, 2026
- Medium6.4The Sherk Custom Post Type Displays plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' shortcode attribute in all versions up to, and including, 1.2.Check if you run itEPSS 0.22%Mar 21, 2026
- Medium6.5The ElementCamp plugin for WordPress is vulnerable to time-based SQL Injection via the 'meta_query[compare]' parameter in the 'tcg_select2_search_post' AJAX action in all versionsCheck if you run itEPSS 0.26%Mar 21, 2026
- Medium4.4The Comment SPAM Wiper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'API Key' setting in all versions up to, and including, 1.2.1.Check if you run itEPSS 0.20%Mar 21, 2026
- Medium6.5The Task Manager plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.0.2 via the callback_get_text_from_url() function.Check if you run itEPSS 0.27%Mar 21, 2026
- Medium6.4The Twitter Feeds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tweet_title' parameter in the 'TwitterFeeds' shortcode in all versions up to, and incluCheck if you run itEPSS 0.20%Mar 21, 2026
- High7.2The Performance Monitor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.6.Check if you run itEPSS 0.40%Mar 21, 2026
- Medium6.4The Logo Slider – Logo Carousel, Logo Showcase & Client Logo Slider Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image alt text in all versionsCheck if you run itEPSS 0.20%Mar 21, 2026
- Medium5.3The Punnel – Landing Page Builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.1.Check if you run itEPSS 0.31%Mar 21, 2026
- Medium6.4The Schema Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 1.0 due to insufficient inpuCheck if you run itEPSS 0.17%Mar 21, 2026
- Medium6.4The Integration with Hubspot Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hubspotform' shortcode in all versions up to, and including, 1.2.2 dueCheck if you run itEPSS 0.25%Mar 21, 2026
- Medium6.4The Multi Post Carousel by Category plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slides' shortcode attribute in all versions up to, and including, 1.4Check if you run itEPSS 0.25%Mar 21, 2026
- Medium6.4The Paypal Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'amount' and 'name' shortcode attributes in all versions up to, and including, 0.3.Check if you run itEPSS 0.21%Mar 21, 2026
- Medium6.1The Comment Genius plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the parameter in all versions up to, and including, 1.2.5 due to insufficient input saniCheck if you run itEPSS 0.28%Mar 21, 2026
- Medium5.5The Multi Functional Flexi Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the parameter in all versions up to, and including, 1.2 due to insufficienCheck if you run itEPSS 0.28%Mar 21, 2026
- Medium6.1The itsukaita plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'day_from' and 'day_to' parameters in all versions up to, and including, 0.1.2 due to insCheck if you run itEPSS 0.27%Mar 21, 2026
- Medium6.4The WordPress PayPal Donation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'donate' shortcode in all versions up to, and including, 1.01.Check if you run itEPSS 0.21%Mar 21, 2026
- Medium5.3The e-shot form builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.2.Check if you run itEPSS 0.25%Mar 21, 2026
- Medium6.4The MinhNhut Link Gateway plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'linkgate' shortcode in all versions up to, and including, 3.6.1 due toCheck if you run itEPSS 0.25%Mar 21, 2026
- Medium6.5The Pre* Party Resource Hints plugin for WordPress is vulnerable to SQL Injection via the 'hint_ids' parameter of the pprh_update_hints AJAX action in all versions up to, and incluCheck if you run itEPSS 0.28%Mar 21, 2026
- High8.1The Invelity Product Feeds plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 1.2.6.Check if you run itEPSS 0.18%Mar 21, 2026
- Medium4.3The login_register plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and including, 1.2.0.Check if you run itEPSS 0.15%Mar 21, 2026
- Medium5.6The The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.7.2.Check if you run itEPSS 0.29%Mar 21, 2026
Sort