Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.3Missing Authorization vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WelcartCheck if you run itEPSS 0.24%Oct 27, 2025
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in icc0rz H5P h5p allows Stored XSS.This issue affects H5P: from n/a through <= 1Check if you run itEPSS 0.20%Oct 27, 2025
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev Activity Plus Reloaded for BuddyPress bp-activity-plus-reloaded allowCheck if you run itEPSS 0.20%Oct 27, 2025
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Konstantin Pankratov Date counter date-counter allows Stored XSS.This issue afCheck if you run itEPSS 0.20%Oct 27, 2025
- Medium6.5Missing Authorization vulnerability in Nelio Software Nelio Content nelio-content allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Nelio CCheck if you run itEPSS 0.33%Oct 27, 2025
- Medium5.4Missing Authorization vulnerability in Conversios Conversios.io enhanced-e-commerce-for-woocommerce-store allows Exploiting Incorrectly Configured Access Control Security Levels.ThCheck if you run itEPSS 0.27%Oct 27, 2025
- Medium6.5Missing Authorization vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affecCheck if you run itEPSS 0.33%Oct 27, 2025
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Debuggers Studio Marquee Addons for Elementor marquee-addons-for-elementor allCheck if you run itEPSS 0.20%Oct 27, 2025
- Medium5.3Missing Authorization vulnerability in Shambhu Patnaik Export Categories export-categories allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects ExportCheck if you run itEPSS 0.29%Oct 27, 2025
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pagup Bulk Auto Image Title Attribute bulk-image-title-attribute allows DOM-BaCheck if you run itEPSS 0.20%Oct 27, 2025
- Medium5.4Missing Authorization vulnerability in themeshopy TS Demo Importer ts-demo-importer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TS DeCheck if you run itEPSS 0.28%Oct 27, 2025
- Medium5.4Missing Authorization vulnerability in ignitionwp IgnitionDeck ignitiondeck allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IgnitionDeck:Check if you run itEPSS 0.28%Oct 27, 2025
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RexTheme WP VR wpvr allows DOM-Based XSS.This issue affects WP VR: from n/a thCheck if you run itEPSS 0.21%Oct 27, 2025
- Medium4.3Missing Authorization vulnerability in Premmerce Premmerce User Roles premmerce-user-roles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affectCheck if you run itEPSS 0.25%Oct 27, 2025
- Critical10.0An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by default, allowing an on-path attacker to execute injected JavaCheck if you run itEPSS 0.29%Oct 27, 2025
- High8.0StarCharge Artemis AC Charger 7-22 kW v1.0.4 was discovered to contain a stack overflow via the cgiMain function at download.cgi.Check if you run itEPSS 0.29%Oct 27, 2025
- High8.8AhnLab EPP 1.0.15 is vulnerable to SQL Injection via the "preview parameter."Check if you run itEPSS 0.32%Oct 27, 2025
- Medium6.4The The7 — Website and eCommerce Builder for WordPress theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ the7_fancy_title_css’ parameter in all versions upCheck if you run itEPSS 0.19%Oct 25, 2025
- Medium4.3The FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) plugin for WordPress is vulnerable to Cross-Site Request FoCheck if you run itEPSS 0.14%Oct 25, 2025
- Medium6.4The SpendeOnline.org plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spendeonline' shortcode in all versions up to, and including, 3.0.1 due toCheck if you run itEPSS 0.23%Oct 25, 2025
- High7.5The Product Filter by WBW plugin for WordPress is vulnerable to SQL Injection via the 'filtersDataBackend' parameter in all versions up to, and including, 2.9.7.Check if you run itEPSS 0.39%Oct 25, 2025
- High7.5The wpForo Forum plugin for WordPress is vulnerable to error‐based or time-based SQL Injection via the get_members() function in all versions up to, and including, 2.4.8 due to misCheck if you run itEPSS 0.37%Oct 25, 2025
- Medium5.3The Social Feed Gallery plugin for WordPress is vulnerable to Information Exposure in versions less than, or equal to, 4.9.2.Check if you run itEPSS 0.30%Oct 25, 2025
- High7.5The Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions plugin for WordPress is vulnerable to SQL Injection via the 'wpfs-form-name' parameCheck if you run itEPSS 0.35%Oct 25, 2025
- Medium6.3The The Discussion Board – WordPress Forum Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.5.5.Check if you run itEPSS 0.26%Oct 25, 2025
Sort