Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.4The Eulerpool Research Systems plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'aaq' shortcode in all versions up to, and including, 4.0.1 due toCheck if you run itEPSS 0.20%Sep 30, 2025
- High8.1The Tiny Bootstrap Elements Light plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.3.34 via the 'language' parameter.Check if you run itEPSS 0.69%Sep 30, 2025
- Medium6.4The BP Direct Menus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bpdm_login' shortcode in all versions up to, and including, 1.0.0 due to insCheck if you run itEPSS 0.20%Sep 30, 2025
- Medium6.4The Any News Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'any-ticker' shortcode in all versions up to, and including, 3.1.1 due to insCheck if you run itEPSS 0.31%Sep 30, 2025
- Medium4.3The Chat by Chatwee plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.3.Check if you run itEPSS 0.16%Sep 30, 2025
- Medium6.4The dbview plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dbview' shortcode in all versions up to, and including, 0.5.5 due to insufficient inpCheck if you run itEPSS 0.24%Sep 30, 2025
- Medium6.4The Nexa Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Google Maps widget in all versions up to, and including, 1.1.0 due to insufficienCheck if you run itEPSS 0.25%Sep 30, 2025
- Medium6.5The All in One Music Player plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.1 via the 'theme' parameter.Check if you run itEPSS 0.42%Sep 30, 2025
- Critical9.8The Post By Email plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the save_attachments function in all versions up to, and incluCheck if you run itEPSS 0.73%Sep 30, 2025
- Medium6.4The WeedMaps Menu for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's weedmaps_menu shortcode in all versions up to, and including, 1.2Check if you run itEPSS 0.24%Sep 30, 2025
- Medium6.4The Big Post Shipping for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wooboigpost_shipping_status' shortcode in all versions upCheck if you run itEPSS 0.25%Sep 30, 2025
- High8.1The Bei Fen – WordPress Backup Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.2 via the 'task'.Check if you run itEPSS 0.70%Sep 30, 2025
- Medium6.4The Yoga Schedule Momoyoga plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'momoyoga-schedule' shortcode in all versions up to, and including, 2.Check if you run itEPSS 0.25%Sep 30, 2025
- Medium6.4The All Social Share Options plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sc' shortcode in all versions up to, and including, 1.0 due to insuCheck if you run itEPSS 0.20%Sep 30, 2025
- Medium6.4The FancyTabs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 1.1.0 due to insufficient input saniCheck if you run itEPSS 0.24%Sep 30, 2025
- Medium6.4The Qyrr – simply and modern QR-Code creation plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the blob_to_file() function in allCheck if you run itEPSS 0.40%Sep 30, 2025
- Medium6.4The Layers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'webcam' shortcode in all versions up to, and including, 0.5 due to insufficient inputCheck if you run itEPSS 0.24%Sep 30, 2025
- Medium6.4The GutenBee – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via parameters in the CountUp and Google Maps Blocks in all versions up to, and inCheck if you run itEPSS 0.25%Sep 30, 2025
- Medium6.4The My AskAI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'myaskai' shortcode in all versions up to, and including, 1.0.0 due to insufficientCheck if you run itEPSS 0.21%Sep 30, 2025
- Medium6.4Quadient DS-700 iQ devices through 2025-09-30 might have a race condition during the quick clicking of (in order) the Question Mark button, the Help Button, the About button, and tCheck if you run itEPSS 0.13%Sep 30, 2025
- Medium6.5An SQL injection vulnerability in user-login.php and index.php of Karthikg1908 Hospital Management System (HMS) 1.0 allows remote attackers to execute arbitrary SQL queries via theCheck if you run itEPSS 0.27%Sep 30, 2025
- Medium5.4TitanSystems Zender v3.9.7 contains an account takeover vulnerability in its password reset functionality.Check if you run itEPSS 0.33%Sep 30, 2025
- Low3.5The EKEN video doorbell T6 BT60PLUS_MAIN_V1.0_GC1084_20230531 periodically sends debug logs to the EKEN cloud servers with sensitive information such as the Wi-Fi SSID and passwordCheck if you run itEPSS 0.20%Sep 30, 2025
- High7.5An issue in finance.js v.4.1.0 allows a remote attacker to cause a denial of service via the seekZero() parameter.Check if you run itEPSS 0.53%Sep 30, 2025
- High7.5Finance.js v4.1.0 contains a Denial of Service (DoS) vulnerability via the IRR function’s depth parameter.Check if you run itEPSS 0.43%Sep 30, 2025
Sort