Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.3The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the qsm_dashboardCheck if you run itEPSS 0.22%Jan 6, 2026
- Medium6.5The Appointment Booking and Scheduling Calendar Plugin – WP Timetics plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capabilityCheck if you run itEPSS 0.24%Jan 6, 2026
- Medium5.3The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the catch_lp_ajax function in allCheck if you run itEPSS 0.27%Jan 6, 2026
- Medium5.4The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to unauthorized modification and deletion of data due to a missing capabiCheck if you run itEPSS 0.17%Jan 6, 2026
- Medium4.3The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing cCheck if you run itEPSS 0.20%Jan 6, 2026
- Medium6.4The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Cell Content in all versions up to, and including, 1.3.30 dueCheck if you run itEPSS 0.18%Jan 6, 2026
- Medium4.3The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on theCheck if you run itEPSS 0.22%Jan 6, 2026
- Medium6.4The Phlox theme for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML attribute in all versions up to, and including, 2.17.7 due to insufficient input sanitizatioCheck if you run itEPSS 0.18%Jan 6, 2026
- High8.7Authentication bypass issue exists in OpenBlocks series versions prior to FW5.0.8, which may allow an attacker to bypass administrator authentication and change the password.Check if you run itEPSS 0.37%Jan 6, 2026
- None0.0Not usedCheck if you run itEPSS 0.00%Jan 6, 2026
- None0.0Not usedCheck if you run itEPSS 0.00%Jan 6, 2026
- None0.0Not usedCheck if you run itEPSS 0.00%Jan 6, 2026
- None0.0Not usedCheck if you run itEPSS 0.00%Jan 6, 2026
- None0.0Not usedCheck if you run itEPSS 0.00%Jan 6, 2026
- None0.0Not usedCheck if you run itEPSS 0.00%Jan 6, 2026
- None0.0Not usedCheck if you run itEPSS 0.00%Jan 6, 2026
- High8.8The BuddyPress Xprofile Custom Field Types plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete_field' function inCheck if you run itEPSS 0.72%Jan 6, 2026
- Critical9.8The FS Registration Password plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.1.Check if you run itEPSS 0.43%Jan 6, 2026
- Medium4.3The Popupkit plugin for WordPress is vulnerable to arbitrary subscriber data deletion due to missing authorization on the DELETE REST API endpoint in all versions up to, and includCheck if you run itEPSS 0.23%Jan 6, 2026
- Critical9.8The AS Password Field In Default Registration Form plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0.Check if you run itEPSS 0.37%Jan 6, 2026
- High7.8iccDEV provides a set of libraries and tools for working with ICC color management profiles.Check if you run itEPSS 0.16%Jan 6, 2026
- Medium6.1iccDEV provides a set of libraries and tools for working with ICC color management profiles.Check if you run itEPSS 0.19%Jan 6, 2026
- Medium6.4The ForumWP – Forum & Discussion Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the User's Display Name in all versions up to, and including, 2.1.6 dueCheck if you run itEPSS 0.22%Jan 6, 2026
- Medium5.3The ilGhera Support System for WooCommerce plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'delete_single_Check if you run itEPSS 0.28%Jan 6, 2026
- Medium5.3The Popup and Slider Builder by Depicter – Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel plugin for WordPress is vulnerCheck if you run itEPSS 0.28%Jan 6, 2026
Sort