Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.1Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Shazdeh Header Image Slider header-image-slider allows DOM-Based XSS.ThCheck if you run itEPSS 0.22%Jan 6, 2026
- High8.8Deserialization of Untrusted Data vulnerability in Digital zoom studio DZS Video Gallery allows Object Injection.This issue affects DZS Video Gallery: from n/a through 12.25.Check if you run itEPSS 0.35%Jan 6, 2026
- High8.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Frappé frappe allows PHP Local File InclusionCheck if you run itEPSS 0.39%Jan 6, 2026
- Medium5.3Missing Authorization vulnerability in Cloudways Breeze breeze allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze: from n/a through <Check if you run itEPSS 0.27%Jan 6, 2026
- Medium6.5Missing Authorization vulnerability in CyberChimps Responsive Addons for Elementor responsive-addons-for-elementor allows Exploiting Incorrectly Configured Access Control SecurityCheck if you run itEPSS 0.24%Jan 6, 2026
- Medium5.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH UiChemy uichemy allows Stored XSS.This issue affects UiChemy: from n/Check if you run itEPSS 0.17%Jan 6, 2026
- Medium4.3Missing Authorization vulnerability in PublishPress Post Expirator post-expirator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post ExCheck if you run itEPSS 0.19%Jan 6, 2026
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for WPBakery) thegem-elements allows DOM-BaCheck if you run itEPSS 0.16%Jan 6, 2026
- Medium5.3Missing Authorization vulnerability in WPFunnels Creator LMS creatorlms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Creator LMS: fromCheck if you run itEPSS 0.27%Jan 6, 2026
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) thegem-elements-elementor alCheck if you run itEPSS 0.16%Jan 6, 2026
- High7.5Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) thegem-elCheck if you run itEPSS 0.39%Jan 6, 2026
- Medium4.3Missing Authorization vulnerability in Tickera Tickera tickera-event-ticketing-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TicCheck if you run itEPSS 0.18%Jan 6, 2026
- Medium4.3Missing Authorization vulnerability in BBR Plugins Better Business Reviews better-business-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issuCheck if you run itEPSS 0.18%Jan 6, 2026
- Medium4.3Missing Authorization vulnerability in Proxy & VPN Blocker Proxy & VPN Blocker proxy-vpn-blocker allows Exploiting Incorrectly Configured Access Control Security Levels.This issueCheck if you run itEPSS 0.18%Jan 6, 2026
- Medium5.4Missing Authorization vulnerability in StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affectsCheck if you run itEPSS 0.20%Jan 6, 2026
- High8.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjahan Jewel Ninja Tables ninja-tables allows Blind SQL Injection.This issuCheck if you run itEPSS 0.24%Jan 6, 2026
- Medium5.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Accordion accordions-wp allows Stored XSS.This issue affects AccorCheck if you run itEPSS 0.17%Jan 6, 2026
- Medium5.4Missing Authorization vulnerability in Fahad Mahmood RSS Feed Widget rss-feed-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RSSCheck if you run itEPSS 0.20%Jan 6, 2026
- Medium4.3Missing Authorization vulnerability in CoolHappy The Events Calendar Countdown Addon countdown-for-the-events-calendar allows Exploiting Incorrectly Configured Access Control SecurCheck if you run itEPSS 0.18%Jan 6, 2026
- Medium4.3Missing Authorization vulnerability in WPCenter AffiliateX affiliatex allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AffiliateX: from n/Check if you run itEPSS 0.18%Jan 6, 2026
- Medium4.3Missing Authorization vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Exploiting Incorrectly Configured Access Control Security Levels.ThisCheck if you run itEPSS 0.18%Jan 6, 2026
- High7.5Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in VanKarWai Calafate calafate allows PHP Local File InclusionCheck if you run itEPSS 0.39%Jan 6, 2026
- Medium5.4Missing Authorization vulnerability in BuddhaThemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Exploiting Incorrectly Configured Access ControlCheck if you run itEPSS 0.20%Jan 6, 2026
- Medium4.3Missing Authorization vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Exploiting Incorrectly Configured Access Control Security Levels.ThisCheck if you run itEPSS 0.19%Jan 6, 2026
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Team Showcase team-showcase allows Stored XSS.This issue affects TCheck if you run itEPSS 0.16%Jan 6, 2026
Sort