Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Low3.8The Post Affiliate Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.28.0.Check if you run itEPSS 0.28%Mar 21, 2026
- Medium6.4The WPFAQBlock– FAQ & Accordion Plugin For Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' parameter of the 'wpfaqblock' shortcode in alCheck if you run itEPSS 0.26%Mar 21, 2026
- Medium6.4The Ad Short plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ad' shortcode's 'client' attribute in all versions up to and including 2.0.1.Check if you run itEPSS 0.20%Mar 21, 2026
- Medium5.3The WP-Chatbot for Messenger plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.9.Check if you run itEPSS 0.29%Mar 21, 2026
- Medium6.1The rexCrawler plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'url' and 'regex' parameters in the search-pattern tester page in all versions up to, anCheck if you run itEPSS 0.28%Mar 21, 2026
- Medium6.4The Outgrow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the 'outgrow' shortcode in all versions up to, and including, 2.1.Check if you run itEPSS 0.26%Mar 21, 2026
- Medium6.4The Ecover Builder For Dummies plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the 'ecover' shortcode in all versions up to and includinCheck if you run itEPSS 0.21%Mar 21, 2026
- Medium6.4The iVysilani Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' shortcode attribute in all versions up to, and including, 3.0 due to insufCheck if you run itEPSS 0.26%Mar 21, 2026
- Medium4.3The Redirect countdown plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.Check if you run itEPSS 0.15%Mar 21, 2026
- Medium4.3The Add Google Social Profiles to Knowledge Graph Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.Check if you run itEPSS 0.15%Mar 21, 2026
- Medium4.3The WP Posts Re-order plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.Check if you run itEPSS 0.15%Mar 21, 2026
- Medium6.4The Post Flagger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'flag' shortcode in all versions up to, and including, 1.1 due to insufficient iCheck if you run itEPSS 0.26%Mar 21, 2026
- High8.8The Linksy Search and Replace plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'linksy_search_and_replace_item_detaiCheck if you run itEPSS 0.31%Mar 21, 2026
- Medium6.4The WP NG Weather plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ng-weather' shortcode in all versions up to, and including, 1.0.9 due to insufCheck if you run itEPSS 0.25%Mar 21, 2026
- Medium6.4The WP Random Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cat', 'nocat', and 'text' shortcode attributes of the 'wp_random_button' shortcode iCheck if you run itEPSS 0.21%Mar 21, 2026
- Medium6.5The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.5.10.Check if you run itEPSS 0.30%Mar 21, 2026
- High7.2The SurveyJS plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.5.3 via survey result submissions.Check if you run itEPSS 0.30%Mar 21, 2026
- High7.5The Fonts Manager | Custom Fonts plugin for WordPress is vulnerable to time-based SQL Injection via the ‘fmcfIdSelectedFnt’ parameter in all versions up to, and including, 1.2 dueCheck if you run itEPSS 0.41%Mar 21, 2026
- Medium5.3The Smarter Analytics plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.0.Check if you run itEPSS 0.32%Mar 21, 2026
- Medium5.3The Canto plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.1.1 via the file.Check if you run itEPSS 1.17%Mar 21, 2026
- High7.2The WowOptin: Next-Gen Popup Maker plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.29.Check if you run itEPSS 0.31%Mar 21, 2026
- Medium5.3OpenClaw versions prior to 2026.2.25 fail to consistently apply sender-policy checks to reaction_* and pin_* non-message events before adding them to system-event context.Check if you run itEPSS 0.21%Mar 21, 2026
- Medium5.3OpenClaw versions prior to 2026.2.23 contain an authorization bypass vulnerability in the ACP client that auto-approves tool calls based on untrusted toolCall.kind metadata and perCheck if you run itEPSS 0.27%Mar 21, 2026
- Medium6.3OpenClaw versions prior to 2026.2.22 reuse gateway.auth.token as a fallback hash secret for owner-ID prompt obfuscation when commands.ownerDisplay is set to hash and commands.ownerCheck if you run itEPSS 0.27%Mar 21, 2026
- Medium6.3The BlueBubbles webhook handler in OpenClaw versions prior to 2026.2.21 contains a passwordless fallback authentication path that allows unauthenticated webhook events in certain rCheck if you run itEPSS 0.26%Mar 21, 2026
Sort