Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.4The Preload Current Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'complete' parameter in the 'preload_progress_bar' shortcode in all versions upCheck if you run itEPSS 0.23%Nov 11, 2025
- Medium6.4The Woocommerce – Products By Custom Tax plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'woo_products_custom_tax' shortcode in all versions up to, and inCheck if you run itEPSS 0.23%Nov 11, 2025
- Medium4.4The Squirrels Auto Inventory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.3 due to insufficient inCheck if you run itEPSS 0.21%Nov 11, 2025
- Medium6.4The Paypal Donation Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'paypal' shortcode in all versions up to, and including, 0.1.Check if you run itEPSS 0.19%Nov 11, 2025
- Medium5.3The Wisly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0.0 due to missing validation on the 'wishlist_id' user conCheck if you run itEPSS 0.23%Nov 11, 2025
- Medium6.4The WP-Iconics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters of the 'wp_iconics' shortcode in all versions up to, and including, 0.0.4 dCheck if you run itEPSS 0.23%Nov 11, 2025
- Medium4.3The Ninja Countdown | Fastest Countdown Builder plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ninja_countdown_admin_ajaxCheck if you run itEPSS 0.19%Nov 11, 2025
- Medium4.3The Private Google Calendars plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pgc_remove' action in all versions upCheck if you run itEPSS 0.23%Nov 11, 2025
- Medium6.4The Precise Columns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcode attribute in all versions up to, and including, 1.0.Check if you run itEPSS 0.19%Nov 11, 2025
- Medium6.4The Chart Expert plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pmzez_chart' shortcode in all versions up to, and including, 1.0.Check if you run itEPSS 0.23%Nov 11, 2025
- Medium6.4The Magazine Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'headerHtmlTag' attribute in the bnm-blocks/featured-posts-1 block in all versionsCheck if you run itEPSS 0.24%Nov 11, 2025
- Critical9.8The WP移行専用プラグイン for CPI plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the Cpiwm_Import_Controller::import function in all versCheck if you run itEPSS 0.84%Nov 11, 2025
- Critical9.8The Holiday class post calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.1 via the 'contents' parameter.Check if you run itEPSS 0.91%Nov 11, 2025
- Medium6.4The Share to Google Classroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the share_to_google shortcode in all versions up to, and including, 1.0 due to iCheck if you run itEPSS 0.19%Nov 11, 2025
- Critical9.8The EasyCommerce – AI-Powered, Fast & Beautiful WordPress Ecommerce Plugin plugin for WordPress is vulnerable to Privilege Escalation in versions 0.9.0-beta2 to 1.8.2.Check if you run itEPSS 0.43%Nov 11, 2025
- Medium6.1The YSlider plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and including, 1.1.Check if you run itEPSS 0.15%Nov 11, 2025
- Medium6.4The Eventbee Ticketing Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eventbeeticketwidget' shortcode in all versions up to, and including, 1.0.Check if you run itEPSS 0.24%Nov 11, 2025
- Medium4.3The USB Qr Code Scanner For Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0.Check if you run itEPSS 0.16%Nov 11, 2025
- Medium6.1The WP-OAuth plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'error_description' parameter in all versions up to, and including, 0.4.1 due to insufficiCheck if you run itEPSS 0.35%Nov 11, 2025
- Medium4.9The Double the Donation – A workplace giving tool to help your fundraising efforts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versiCheck if you run itEPSS 0.22%Nov 11, 2025
- Medium6.4The Flickr Show plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'div_height' parameter of the 'flickrshow' shortcode in all versions up to, and including,Check if you run itEPSS 0.23%Nov 11, 2025
- Medium6.1The WP-Walla plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and including, 0.5.3.5.Check if you run itEPSS 0.16%Nov 11, 2025
- Medium4.3The WP Custom Admin Login Page Logo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.8.4.Check if you run itEPSS 0.13%Nov 11, 2025
- Medium5.3The Document Pro Elementor – Documentation & Knowledge Base plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.9.Check if you run itEPSS 0.40%Nov 11, 2025
- High7.5The Auto Amazon Links – Amazon Associates Affiliate Plugin plugin for WordPress is vulnerable to arbitrary files reads in all versions up to, and including, 5.4.3 via the '/wp-jsonCheck if you run itEPSS 0.49%Nov 11, 2025
Sort