Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.3The Mamurjor Employee Info plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0.Check if you run itEPSS 0.18%Jan 7, 2026
- Medium6.1The Post Like Dislike plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the variable in all versions up to, and including, 1.0 due to insufficient input saniCheck if you run itEPSS 0.31%Jan 7, 2026
- Medium6.4The Cool YT Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'videoid' parameter in all versions up to, and including, 1.0 due to insufficient inputCheck if you run itEPSS 0.27%Jan 7, 2026
- Medium5.3The Awesome Hotel Booking plugin for WordPress is vulnerable to unauthorized modification of data due to incorrect authorization in the room-single.php shortcode handler in all verCheck if you run itEPSS 0.26%Jan 7, 2026
- Medium6.4The Niche Hero | Beautifully-designed blocks in seconds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'spacing' parameter of the nh_row shortcode in allCheck if you run itEPSS 0.28%Jan 7, 2026
- Medium6.4The AI BotKit – AI Chatbot & Live Support for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in the shortcode in all versions upCheck if you run itEPSS 0.22%Jan 7, 2026
- Medium6.1The Starred Review plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the PHP_SELF variable in all versions up to, and including, 1.4.2 due to insufficient inCheck if you run itEPSS 0.36%Jan 7, 2026
- Medium6.4The WP Js List Pages Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' shortcode attribute in all versions up to, and including, 1.21 dueCheck if you run itEPSS 0.27%Jan 7, 2026
- Medium6.4The STM Gallery 1.9 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'composicion' parameter in all versions up to, and including, 0.9 due to insufficientCheck if you run itEPSS 0.32%Jan 7, 2026
- Medium6.4The My Album Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image titles in all versions up to, and including, 1.0.4.Check if you run itEPSS 0.26%Jan 7, 2026
- Medium4.4The Contact Us Simple Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0 due to insufficient inputCheck if you run itEPSS 0.33%Jan 7, 2026
- Medium6.1The Stumble! for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the variable in all versions up to, and including, 1.1.1 due to insufficient inpCheck if you run itEPSS 0.30%Jan 7, 2026
- Medium6.1The Testimonial Master plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the variable in all versions up to, and including, 0.2.1 due to insufficient input sCheck if you run itEPSS 0.37%Jan 7, 2026
- Medium6.4The WP Recipe Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Skill Level' input field in all versions up to, and including, 1.0.0 due to insuffiCheck if you run itEPSS 0.26%Jan 7, 2026
- Medium6.4The AH Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'column' shortcode attribute in all versions up to, and including, 1.0.2 due to insufficCheck if you run itEPSS 0.31%Jan 7, 2026
- Medium6.4The Wish To Go plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode attributes in all versions up to, and including, 0.5.2 due to insufficient input saniCheck if you run itEPSS 0.26%Jan 7, 2026
- Medium5.3The AA Block Country plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.0.1.Check if you run itEPSS 0.23%Jan 7, 2026
- Medium6.4The PhotoFade plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'time' parameter in all versions up to, and including, 0.2.1 due to insufficient input sanitCheck if you run itEPSS 0.32%Jan 7, 2026
- Critical9.8The Optional Email plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.3.11.Check if you run itEPSS 0.35%Jan 7, 2026
- Medium4.3The WP Status Notifier plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.Check if you run itEPSS 0.15%Jan 7, 2026
- High8.8The WP Enable WebP plugin for WordPress is vulnerable to arbitrary file uploads due to improper file type validation in the 'wpse_file_and_ext_webp' function in all versions up to,Check if you run itEPSS 0.50%Jan 7, 2026
- Medium6.4The Recras WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'recrasname' shortcode attribute in all versions up to, and including, 6.4.1.Check if you run itEPSS 0.29%Jan 7, 2026
- Medium4.3The MTCaptcha WordPress Plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.2.Check if you run itEPSS 0.17%Jan 7, 2026
- Medium5.3The Moosend Landing Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the moosend_landings_auth_get function in allCheck if you run itEPSS 0.33%Jan 7, 2026
- Medium4.3The xShare plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1.Check if you run itEPSS 0.17%Jan 7, 2026
Sort