Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.7An ACAP configuration file has improper permissions and lacks input validation, which could potentially lead to privilege escalation.Check if you run itEPSS 0.14%Nov 11, 2025
- Medium6.7An ACAP configuration file has improper permissions, which could allow command injection and potentially lead to privilege escalation.Check if you run itEPSS 1.05%Nov 11, 2025
- Medium6.0A 3rd-party component exposed its password in process arguments, allowing for low-privileged users to access it.Check if you run itEPSS 0.11%Nov 11, 2025
- Medium6.6A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to potential privilege escalation of the malicCheck if you run itEPSS 0.31%Nov 11, 2025
- Medium6.7ACAP applications can gain elevated privileges due to improper input validation, potentially leading to privilege escalation.Check if you run itEPSS 0.15%Nov 11, 2025
- Medium6.8The ACAP Application framework could allow privilege escalation through a symlink attack.Check if you run itEPSS 0.38%Nov 11, 2025
- Medium6.4An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation.Check if you run itEPSS 0.16%Nov 11, 2025
- Medium6.7An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution.Check if you run itEPSS 0.16%Nov 11, 2025
- High7.5The age-restriction WordPress plugin through 3.0.2 does not have authorisation in the age_restrictionRemoteSupportRequest function, allowing any authenticated users, such as subscrCheck if you run itEPSS 0.24%Nov 11, 2025
- High8.8WP Go Maps AJAX Action Unathenticated Cross-Site Scripting (XSS)Patch nowKEVEPSS 1.98%Nov 11, 2025
- Medium5.3The Make Email Customizer for WooCommerce WordPress plugin through 1.0.6 lacks proper authorization checks and option validation in its AJAX actions, allowing any authenticated useCheck if you run itEPSS 0.29%Nov 11, 2025
- Medium6.4The GitHub Gist Shortcode Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the 'gist' shortcode in all versions up to, and including, 0.2Check if you run itEPSS 0.23%Nov 11, 2025
- Medium6.4The Live Photos on WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'video_src', 'img_src', and 'class' parameters in the livephotos_photo shortcCheck if you run itEPSS 0.19%Nov 11, 2025
- Medium4.4The Featured Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image metadata in all versions up to, and including, 2.1 due to insufficient input sanitizaCheck if you run itEPSS 0.51%Nov 11, 2025
- Medium5.3The Add Multiple Marker plugin for WordPress is vulnerable to unauthorized modification of data to due to a missing capability check on the addmultiplemarker_reset_map() and amm_saCheck if you run itEPSS 0.29%Nov 11, 2025
- High8.1The Astra Security Suite – Firewall & Malware Scan plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient validation of remote URLs for zip downloads andCheck if you run itEPSS 0.52%Nov 11, 2025
- Medium6.4The Coon Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'height' parameter in the 'map' shortcode in all versions up to, and including, 1.0.Check if you run itEPSS 0.23%Nov 11, 2025
- Medium5.3The Crypto plugin for WordPress is vulnerable to Information exposure in all versions up to, and including, 2.22.Check if you run itEPSS 0.38%Nov 11, 2025
- Medium6.4The Include Fussball.de Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'api' and 'type' parameters in all versions up to, and including, 4.0.0 duCheck if you run itEPSS 0.23%Nov 11, 2025
- High8.8The Elastic Theme Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a dynamic code generation feature in the process_theme function in all versions up to,Check if you run itEPSS 0.62%Nov 11, 2025
- Medium5.4The The Total Book Project plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0 via several functions due to missing valCheck if you run itEPSS 0.21%Nov 11, 2025
- Medium6.4The Jeba Cute forkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' parameter in the 'jeba_forkit' shortcode in all versions up to, and including,Check if you run itEPSS 0.23%Nov 11, 2025
- Medium6.4The Simple Donate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's simpledonate shortcode in versions less than, or equal to, 1.0 due to insufficiCheck if you run itEPSS 0.19%Nov 11, 2025
- Medium6.4The Twitter Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ottwitter_feed' shortcode in all versions up to, and including, 1.3.1.Check if you run itEPSS 0.19%Nov 11, 2025
- Medium6.4The WP Count Down Timer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters of the 'wp_countdown_timer' shortcode in all versions up to, and iCheck if you run itEPSS 0.23%Nov 11, 2025
Sort