Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.5The Latest Registered Users plugin for WordPress is vulnerable to unauthorized user data export in all versions up to, and including, 1.4.Check if you run itEPSS 0.33%Jan 7, 2026
- Low2.7The Rankology SEO and Analytics Tool plugin for WordPress is vulnerable to unauthorized modification of data due to an incorrect capability check on the 'rankology_code_block' pageCheck if you run itEPSS 0.25%Jan 7, 2026
- Medium5.3The Unify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'init' action in all versions up to, and including, 3.4.9Check if you run itEPSS 0.27%Jan 7, 2026
- Medium6.4The Stylish Order Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'product_name' parameter in all versions up to, and including, 1.0 due to iCheck if you run itEPSS 0.29%Jan 7, 2026
- Medium6.1The SVG Map Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0.Check if you run itEPSS 0.14%Jan 7, 2026
- Medium4.4The Page Keys plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘page_key’ parameter in all versions up to, and including, 1.3.3 due to insufficient input sCheck if you run itEPSS 0.22%Jan 7, 2026
- High7.5The User Activity Log plugin is vulnerable to a limited options update in versions up to, and including, 2.2.Check if you run itEPSS 0.36%Jan 7, 2026
- Medium6.4Nokia SR Linux is vulnerable to an authentication vulnerability allowing unauthorized access to the JSON-RPC service.Check if you run itEPSS 0.16%Jan 7, 2026
- Low2.2Improper service binding configuration in internal service components in HCL BigFix IVR version 4.2 allows a privileged attacker to impact service availability via exposure of admiCheck if you run itEPSS 0.35%Jan 7, 2026
- Medium4.4The Key Figures plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the kf_field_figure_default_color_render function in all versions up to, and including, 1.1 duCheck if you run itEPSS 0.21%Jan 7, 2026
- Medium5.4The aBlocks – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data and disclosure of sensitive information due to missing capability cCheck if you run itEPSS 0.25%Jan 7, 2026
- Medium6.1The Premmerce WooCommerce Customers Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'money_spent_from', 'money_spent_to', 'registered_from', anCheck if you run itEPSS 0.31%Jan 7, 2026
- Low2.9Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local attacker to perform unauthorized configuratiCheck if you run itEPSS 0.09%Jan 7, 2026
- Low2.0Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gain prolonged unauthorized access to proteCheck if you run itEPSS 0.18%Jan 7, 2026
- Medium6.5The Flashcard plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 0.9 via the 'source' attribute of the 'flashcard' shortcode.Check if you run itEPSS 0.35%Jan 7, 2026
- Medium6.1CodeDropz drag_and_drop_multiple_file_upload_-_contact_form_7 Unrestricted Upload of File with Dangerous TypePatch nowKEVEPSS 0.37%Jan 7, 2026
- Medium4.3The NS IE Compatibility Fixer plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to, and including, 2.1.5.Check if you run itEPSS 0.16%Jan 7, 2026
- Medium4.4The Simple User Meta Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user meta value field in all versions up to, and including, 1.0.0 due to insufCheck if you run itEPSS 0.18%Jan 7, 2026
- Medium4.4The twinklesmtp – Email Service Provider For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's sender settings in all versions up to, and incCheck if you run itEPSS 0.24%Jan 7, 2026
- Medium4.3The HelpDesk contact form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.5.Check if you run itEPSS 0.16%Jan 7, 2026
- Medium6.1The HBLPAY Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘cusdata’ parameter in all versions up to, and including, 5.Check if you run itEPSS 0.21%Jan 7, 2026
- Medium4.3The Quote Comments plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0.0.Check if you run itEPSS 0.19%Jan 7, 2026
- Medium4.3The Newsletter Email Subscribe plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.Check if you run itEPSS 0.12%Jan 7, 2026
- Medium6.5The Bit Form – Contact Form Plugin plugin for WordPress is vulnerable to unauthorized workflow execution due to missing authorization in the triggerWorkFlow function in all versionCheck if you run itEPSS 0.42%Jan 7, 2026
- High7.7The Frontend File Manager Plugin WordPress plugin before 23.5 did not validate a path parameter and ownership of the file, allowing any authenticated users, such as subscribers toCheck if you run itEPSS 0.27%Jan 7, 2026
Sort