Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.3The Accessiy By CodeConfig Accessibility – Easy One-Click Accessibility Toolbar That Truly Matters plugin for WordPress is vulnerable to authorization bypass in versions up to, andCheck if you run itEPSS 0.25%Dec 6, 2025
- Medium6.4The Yet Another WebClap for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' parameter of the webclap_button shortcode in all versions upCheck if you run itEPSS 0.24%Dec 6, 2025
- Medium4.3The Search, Filters & Merchandising for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wcis_save_emaiCheck if you run itEPSS 0.23%Dec 6, 2025
- Medium6.4The Extra Post Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the extra-images shortcode in all versions up to, and including, 1Check if you run itEPSS 0.23%Dec 6, 2025
- Medium6.4The CSS3 Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button' shortcode in all versions up to, and including, 0.1 due to insufficientCheck if you run itEPSS 0.22%Dec 6, 2025
- Medium6.4The RevInsite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitizationCheck if you run itEPSS 0.22%Dec 6, 2025
- Medium6.4The List Attachments Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before_list' parameter in the [list-attachments] shortcode in all versionsCheck if you run itEPSS 0.24%Dec 6, 2025
- Medium4.3The Listar – Directory Listing & Classifieds WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-Check if you run itEPSS 0.19%Dec 6, 2025
- Medium6.4The Canadian Nutrition Facts Label plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'percentage' field in the Nutrition Label custom post type in all versiCheck if you run itEPSS 0.18%Dec 6, 2025
- Medium6.4The Cute News Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'color' shortcode attribute in all versions up to, and including, 1.0 due to insufficCheck if you run itEPSS 0.23%Dec 6, 2025
- Medium6.4The TR Timthumb plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode attributes in all versions up to, and including, 1.0.4 due to insufficient input sanCheck if you run itEPSS 0.22%Dec 6, 2025
- Medium5.3The Helloprint plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.2.Check if you run itEPSS 0.27%Dec 6, 2025
- Medium5.4The Application Passwords plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'reject_url' parameter in all versions up to, and including, 0.1.3.Check if you run itEPSS 0.23%Dec 6, 2025
- Medium4.3The WP Landing Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9.3.Check if you run itEPSS 0.15%Dec 6, 2025
- Medium5.3The g-FFL Cockpit plugin for WordPress is vulnerable to unauthorized modification of data due to IP-based authorization that can be spoofed in the handle_enqueue_only() function inCheck if you run itEPSS 0.28%Dec 6, 2025
- Critical9.8The Flex QR Code Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_qr_code() function in all versions up to,Check if you run itEPSS 0.73%Dec 6, 2025
- Medium4.3The Listar – Directory Listing & Classifieds WordPress Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the '/wp-json/lisCheck if you run itEPSS 0.19%Dec 6, 2025
- Medium6.4The Social Feed Gallery Portfolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the [igp-wp] shortcode in all versions up to, and inclCheck if you run itEPSS 0.23%Dec 6, 2025
- Medium5.3The g-FFL Cockpit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1 via the /server_status REST API endpoint due to aCheck if you run itEPSS 0.28%Dec 6, 2025
- Medium6.4The Ultra Skype Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btn_id' parameter of the [ultra_skype] shortcode in all versions up to, and includCheck if you run itEPSS 0.23%Dec 6, 2025
- Medium6.1The Live Sales Notification for Woocommerce – Woomotiv plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'woomotiv_limit' parameter in all versions up toCheck if you run itEPSS 0.21%Dec 6, 2025
- Medium6.1The myLCO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the parameter in all versions up to, and including, 0.8.1 due to insufficient input sanitizationCheck if you run itEPSS 0.26%Dec 6, 2025
- Medium5.3A vulnerability has been found in fit2cloud Halo 2.21.10.Check if you run itEPSS 0.24%Dec 6, 2025
- High7.6A vulnerability in Apigee-X allowed an attacker to gain unauthorized read and write access to Apigee Analytics (AX) data and access logs belonging to other Apigee customer organizaCheck if you run itEPSS 0.27%Dec 6, 2025
- Medium6.5The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'existing_terms_orderby' parameterCheck if you run itEPSS 0.29%Dec 6, 2025
Sort