Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allowsCheck if you run itEPSS 0.24%Sep 26, 2025
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeplugs Authorsy authorsy allows Stored XSS.This issue affects Authorsy: frCheck if you run itEPSS 0.22%Sep 26, 2025
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in undsgn Uncode uncode allows Reflected XSS.This issue affects Uncode: from n/aCheck if you run itEPSS 0.25%Sep 26, 2025
- Medium4.3Cross-Site Request Forgery (CSRF) vulnerability in Di Themes Di Themes Demo Site Importer di-themes-demo-site-importer allows Cross Site Request Forgery.This issue affects Di ThemeCheck if you run itEPSS 0.14%Sep 26, 2025
- Medium6.5Missing Authorization vulnerability in Acclectic Media Acclectic Media Organizer acclectic-media-organizer allows Exploiting Incorrectly Configured Access Control Security Levels.TCheck if you run itEPSS 0.28%Sep 26, 2025
- Medium5.3Missing Authorization vulnerability in guihom Wide Banner wide-banner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wide Banner: from nCheck if you run itEPSS 0.27%Sep 26, 2025
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nick Verwymeren Quantities and Units for WooCommerce quantities-and-units-for-Check if you run itEPSS 0.21%Sep 26, 2025
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shinetheme Traveler traveler allows Reflected XSS.This issue affects Traveler:Check if you run itEPSS 0.24%Sep 26, 2025
- High7.7Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SeaTheme BM Content Builder bm-builder allows Path Traversal.This issue affects BM CCheck if you run itEPSS 0.43%Sep 26, 2025
- High7.5Insertion of Sensitive Information Into Sent Data vulnerability in Maciej Bis Permalink Manager Lite permalink-manager allows Retrieve Embedded Sensitive Data.This issue affects PeCheck if you run itEPSS 0.39%Sep 26, 2025
- High7.5Missing Authorization vulnerability in shinetheme Traveler traveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Traveler: from n/a thCheck if you run itEPSS 0.38%Sep 26, 2025
- High7.3Multiple robotic products by Unitree sharing a common firmware, including the Go2, G1, H1, and B2 devices, contain a command injection vulnerability.Check if you run itEPSS 2.69%Sep 26, 2025
- Medium4.4The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.3.202 due to insufficient inCheck if you run itEPSS 0.20%Sep 26, 2025
- Medium6.4The Markdown Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'markdown' shortcode in all versions up to, and including, 0.2.1 due to inCheck if you run itEPSS 0.32%Sep 26, 2025
- Medium6.4The TweetThis Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tweetthis' shortcode in all versions up to, and including, 1.8.0 due toCheck if you run itEPSS 0.20%Sep 26, 2025
- Medium6.5The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete backup functiCheck if you run itEPSS 0.66%Sep 26, 2025
- Medium5.4The Snow Monkey theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 29.1.5 via the request() function.Check if you run itEPSS 0.28%Sep 26, 2025
- Medium6.4The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 1.20.6 due to insufficient input sCheck if you run itEPSS 0.25%Sep 26, 2025
- High7.2The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the download-add.php file in all versions up to, and inclCheck if you run itEPSS 0.66%Sep 26, 2025
- Medium5.3fifu featured_image_from_url Insertion of Sensitive Information into Log FilePatch nowKEVEPSS 12.31%Sep 26, 2025
- Medium4.9The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to SQL Injection via the get_all_urls() function in all versions up to, and including, 5.2.7 due to insufficieCheck if you run itEPSS 0.33%Sep 26, 2025
- Medium5.3The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the fifu_api_debug_posts() function in allCheck if you run itEPSS 0.29%Sep 26, 2025
- Medium4.9The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to SQL Injection via the get_posts_with_internal_featured_image() function in all versions up to, and includinCheck if you run itEPSS 0.33%Sep 26, 2025
- Medium4.3The System Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.20.Check if you run itEPSS 0.20%Sep 26, 2025
- Medium6.4The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple fields in versions up to, and including, 1.20.0 due to insufficient input sanitizCheck if you run itEPSS 0.26%Sep 26, 2025
Sort