Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.3Out-of-bounds Read in Shelly Pro 3EM (before v1.4.4) allows Overread Buffers.Check if you run itEPSS 0.19%Nov 19, 2025
- Medium4.3The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Improper Authorization leading to Sensitive Post Meta Disclosure in versions up to and including 1.3.2.Check if you run itEPSS 0.25%Nov 19, 2025
- Medium5.3The SureForms plugin for WordPress is vulnerable to Cross-Site Request Forgery Bypass in all versions up to, and including, 1.13.1.Check if you run itEPSS 0.21%Nov 19, 2025
- Critical9.8WavePlayer Unauthenticated Arbitrary File UploadPatch nowKEVEPSS 0.61%Nov 19, 2025
- Medium4.3The WP Login and Register using JWT plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'mo_jwt_generate_new_api_key' functioCheck if you run itEPSS 0.21%Nov 19, 2025
- Medium5.3The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to unauthorized modification of data due to n incorrect capability check on the siteseo_reset_settings function in aCheck if you run itEPSS 0.28%Nov 19, 2025
- Medium5.4The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.3 via the 'get_image_size_by_url' funcCheck if you run itEPSS 0.26%Nov 19, 2025
- Medium6.5The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on thCheck if you run itEPSS 0.21%Nov 19, 2025
- High7.2The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.33.1.Check if you run itEPSS 0.55%Nov 19, 2025
- Medium6.4The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcode in all versions up to, and including, 3.Check if you run itEPSS 0.26%Nov 19, 2025
- Medium6.4The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpCheck if you run itEPSS 0.20%Nov 19, 2025
- High7.5The Community Events plugin for WordPress is vulnerable to SQL Injection via the 'dayofyear' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on tCheck if you run itEPSS 0.35%Nov 19, 2025
- Medium4.3The WSChat – WordPress Live Chat plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'reset_settings' AJAX endpoint inCheck if you run itEPSS 0.20%Nov 19, 2025
- Medium6.4The Pet-Manager – Petfinder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the kwm-petfinder shortcode in all versions up to, and including, 3.6.1 due to insCheck if you run itEPSS 0.25%Nov 19, 2025
- Medium5.3The Booking Plugin for WordPress Appointments – Time Slot plugin for WordPress is vulnerable to unauthorized email sending in versions up to, and including, 1.4.7 due to missing vaCheck if you run itEPSS 0.31%Nov 19, 2025
- Medium5.3The Quiz Maker plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.7.0.80.Check if you run itEPSS 0.35%Nov 19, 2025
- Medium5.3The Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin for WordPress is vulnerable to Authorization in versions up to, and including, 5.9.10.Check if you run itEPSS 0.33%Nov 19, 2025
- Medium6.4The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via $item['field_id'] in all versions up to, and including, 1.7.1036 dueCheck if you run itEPSS 0.20%Nov 19, 2025
- Medium5.3The New User Approve plugin for WordPress is vulnerable to unauthorized data disclosure in all versions up to, and including, 3.0.9 due to insufficient API key validation using looCheck if you run itEPSS 0.32%Nov 19, 2025
- Medium5.3The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.10.0 via the REST API endpoint and AJAXCheck if you run itEPSS 0.30%Nov 19, 2025
- Medium5.3The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.10.0.Check if you run itEPSS 0.33%Nov 19, 2025
- Critical9.3When the service of ABP and AES is installed in a directory writable by non-administrative users, an attacker can replace or plant a DLL with the same name as one loaded by the serCheck if you run itEPSS 0.19%Nov 19, 2025
- Medium5.6Tanium addressed an arbitrary file deletion vulnerability in TanOS.Check if you run itEPSS 0.17%Nov 19, 2025
- High8.4DLL Loading vulnerability in NEC Corporation RakurakuMusen Start EX All Verisons allows a attacker to manipulate the PC environment to cause unintended operations on the user's devCheck if you run itEPSS 0.15%Nov 19, 2025
- High7.3D-Link Router DIR-868L A1 FW106KRb01.bin has an unauthenticated remote code execution vulnerability in the cgibin binary.Check if you run itEPSS 8.08%Nov 19, 2025
Sort