Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.5The Ultimate Multi Design Video Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.4 due to insufficient input sanitCheck if you run itEPSS 0.22%Oct 3, 2025
- High7.5The Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App plugin for WordPress is vulnerable to SQL Injection via the nh_ynaa_comments() function in all versiCheck if you run itEPSS 0.36%Oct 3, 2025
- Medium6.4The Epic Bootstrap Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘icol’ parameter in all versions up to, and including, 1.0 due to insufficientCheck if you run itEPSS 0.24%Oct 3, 2025
- Medium5.3The Restrict User Registration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1.Check if you run itEPSS 0.15%Oct 3, 2025
- Medium6.5The Woo superb slideshow transition gallery with random effect plugin for WordPress is vulnerable to SQL Injection via the 'woo-superb-slideshow' shortcode in all versions up to, aCheck if you run itEPSS 0.28%Oct 3, 2025
- Medium6.4The Meks Easy Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title field in all version up to, and including, 2.1.4.Check if you run itEPSS 0.25%Oct 3, 2025
- Medium4.3The PayPal Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3.Check if you run itEPSS 0.15%Oct 3, 2025
- Medium4.4The TableGen – Data Table Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.3.1 due to insufficCheck if you run itEPSS 0.24%Oct 3, 2025
- Medium6.4The A Simple Multilanguage Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'asmp-switcher' shortcode in all versions up to, and including,Check if you run itEPSS 0.20%Oct 3, 2025
- Medium6.4The Generic Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widget fields in version 1.2.8 and earlier.Check if you run itEPSS 0.31%Oct 3, 2025
- Medium4.3The Optimize More! – CSS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3.Check if you run itEPSS 0.14%Oct 3, 2025
- Low3.8The Backup Bolt plugin for WordPress is vulnerable to arbitrary file downloads and backup location writes in all versions up to, and including, 1.4.1 via the process_backup_batch()Check if you run itEPSS 0.31%Oct 3, 2025
- Medium6.4The WP Photo Effects plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wppe_effect' shortcode in all versions up to, and including, 1.2.4 due to iCheck if you run itEPSS 0.30%Oct 3, 2025
- Medium6.1The Mobile Site Redirect plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1.Check if you run itEPSS 0.16%Oct 3, 2025
- Medium6.4The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Animated Text' field of the Typeout Widget in version 1.1.9 and belowCheck if you run itEPSS 0.31%Oct 3, 2025
- Medium6.4The Ird Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'irdslider' shortcode in all versions up to, and including, 1.0.2 due to insufficiCheck if you run itEPSS 0.25%Oct 3, 2025
- Medium5.5The Interactive Human Anatomy with Clickable Body Parts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2Check if you run itEPSS 0.22%Oct 3, 2025
- Critical9.8beardev joomsport Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')Patch nowKEVEPSS 0.66%Oct 3, 2025
- Medium6.4The Event Tickets, RSVPs, Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ticket_spot' shortcode in all versions up to, and including,Check if you run itEPSS 0.25%Oct 3, 2025
- Critical9.8The Appy Pie Connect for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within the reset_user_password() REST handler in all veCheck if you run itEPSS 0.47%Oct 3, 2025
- Medium6.5The Wp cycle text announcement plugin for WordPress is vulnerable to SQL Injection via the 'cycle-text' shortcode in all versions up to, and including, 8.1 due to insufficient escaCheck if you run itEPSS 0.35%Oct 3, 2025
- Medium4.3The MPWizard – Create Mercado Pago Payment Links plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1.Check if you run itEPSS 0.13%Oct 3, 2025
- Medium5.5The Smart Docs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.1 due to insufficient input sanitizatiCheck if you run itEPSS 0.22%Oct 3, 2025
- Medium6.4The Unify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin for WordPress's unify_checkout shortcode in all versions up to, and including, 3.4.7 dueCheck if you run itEPSS 0.31%Oct 3, 2025
- Critical9.1The WPRecovery plugin for WordPress is vulnerable to SQL Injection via the 'data[id]' parameter in all versions up to, and including, 2.0.Check if you run itEPSS 0.42%Oct 3, 2025
Sort