Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.4mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server.Check if you run itEPSS 0.65%Dec 5, 2025
- Medium5.3The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to missing authorization in versions up to, and including, 3.1.3.Check if you run itEPSS 0.37%Dec 5, 2025
- Medium6.5Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly supersCheck if you run itEPSS 0.81%Dec 5, 2025
- High7.5Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server on Windows with AllowEncodedSlashes On and MergeSlashes Off allows to potentially leak NTLM hashes to a malicCheck if you run itEPSS 0.82%Dec 5, 2025
- High7.5An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the backoff timer becoming 0.Check if you run itEPSS 0.45%Dec 5, 2025
- Medium4.4The Trail Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.0 due to insufficient input sanitizCheck if you run itEPSS 0.24%Dec 5, 2025
- Medium6.4The Thai Lottery Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcode in all versions up to, and including, 2.5.Check if you run itEPSS 0.28%Dec 5, 2025
- High8.1The Cool Tag Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cool_tag_cloud' shortcode in all versions up to, and including, 2.29 due to iCheck if you run itEPSS 0.34%Dec 5, 2025
- Medium6.4The CryptX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 4.0.5 due to insufficient input sanitiCheck if you run itEPSS 0.30%Dec 5, 2025
- High8.8The User Generator and Importer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.2.2.Check if you run itEPSS 0.18%Dec 5, 2025
- Medium5.3The Projectopia – WordPress Project Management plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pto_delete_file AJAXCheck if you run itEPSS 0.34%Dec 5, 2025
- High8.1The My auctions allegro plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.6.32 via the 'controller' parameter.Check if you run itEPSS 0.76%Dec 5, 2025
- Medium4.3The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and incluCheck if you run itEPSS 0.12%Dec 5, 2025
- Medium4.3The ARK Related Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 2.19.Check if you run itEPSS 0.16%Dec 5, 2025
- High7.5The My auctions allegro plugin for WordPress is vulnerable to SQL Injection via the ‘auction_id’ parameter in all versions up to, and including, 3.6.32 due to insufficient escapingCheck if you run itEPSS 0.32%Dec 5, 2025
- Medium6.1The Nouri.sh Newsletter plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the parameter in all versions up to, and including, 1.0.1.3 due to insufficient inpCheck if you run itEPSS 0.25%Dec 5, 2025
- Critical9.8The Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification plugin for WordPress is vulnerable to authentication bypass inCheck if you run itEPSS 0.50%Dec 5, 2025
- Medium5.3The Payaza plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_nopriv_update_order_status' AJAX endpoint in alCheck if you run itEPSS 0.22%Dec 5, 2025
- Medium5.3The Voidek Employee Portal plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX actions in all versions up to, and including,Check if you run itEPSS 0.27%Dec 5, 2025
- Medium4.3The Torod – The smart shipping and delivery portal for e-shops and retailers plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including,Check if you run itEPSS 0.15%Dec 5, 2025
- Medium4.3The Live CSS Preview plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_frontend_save' AJAX endpoint in all vCheck if you run itEPSS 0.22%Dec 5, 2025
- Medium4.4The Weekly Planner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0 due to insufficient input sanitizaCheck if you run itEPSS 0.20%Dec 5, 2025
- Medium6.4The Easy Jump Links Menus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the parameter in all versions up to, and including, 1.0.0 due to insufficient inputCheck if you run itEPSS 0.24%Dec 5, 2025
- Medium5.3The Feedback Modal for Website plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handle_export' function in all versions uCheck if you run itEPSS 0.90%Dec 5, 2025
- High8.8The Auto Thumbnailer plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadThumb() function in all versions up to, and incluCheck if you run itEPSS 0.52%Dec 5, 2025
Sort