Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.4The aThemes Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Call To Action widget in versions up to, and including, 1.1.5 due to insuCheck if you run itEPSS 0.24%Nov 8, 2025
- Medium6.4The Saphali LiqPay for donate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saphali_liqpay' shortcode in all versions up to, and including, 1.0.2.Check if you run itEPSS 0.23%Nov 8, 2025
- Medium6.5The CYAN Backup plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete' functionality in all versions up to, and inclCheck if you run itEPSS 0.78%Nov 8, 2025
- Medium4.9The Quick Featured Images plugin for WordPress is vulnerable to SQL Injection via the 'delete_orphaned' function in all versions up to, and including, 13.7.3 due to insufficient esCheck if you run itEPSS 0.33%Nov 8, 2025
- Medium5.3The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.Check if you run itEPSS 0.27%Nov 8, 2025
- High7.2The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.8 via deCheck if you run itEPSS 0.56%Nov 8, 2025
- Medium5.3The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on the 'create_Check if you run itEPSS 0.27%Nov 8, 2025
- Medium4.3The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized booking note creation due to a missing capability check on the 'booking_adCheck if you run itEPSS 0.24%Nov 8, 2025
- High8.8The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 1.7.7.Check if you run itEPSS 0.54%Nov 8, 2025
- Medium4.4The HTML Forms – Simple WordPress Forms Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.5.5 dueCheck if you run itEPSS 0.21%Nov 8, 2025
- Medium6.4The Insert Headers and Footers Code – HT Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via adding scripts in all versions up to, and including, 1.1.6 dueCheck if you run itEPSS 0.19%Nov 8, 2025
- Medium6.5The WPFunnels plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wpfnl_delete_log() function in all versions up to, and iCheck if you run itEPSS 0.78%Nov 8, 2025
- Medium4.3The Groups plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.0 via the 'group_id' parameter of the group_join functioCheck if you run itEPSS 0.23%Nov 8, 2025
- Medium6.1The Mang Board WP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mp' parameter in all versions up to, and including, 2.3.1 due to insufficient inputCheck if you run itEPSS 0.22%Nov 8, 2025
- High8.8The Smart Auto Upload Images plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the auto-image creation functionality in all versioCheck if you run itEPSS 0.56%Nov 8, 2025
- Medium4.9The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to SQL Injection via the 'post_types' parameter in all versions up to, and inCheck if you run itEPSS 0.33%Nov 8, 2025
- Medium6.5The Ovatheme Events Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the /class-ovaem-ajax.php file in alCheck if you run itEPSS 0.22%Nov 8, 2025
- Medium5.3The WPFunnels – The Easiest Funnel Builder For WordPress And WooCommerce To Collect Leads And Increase Sales plugin for WordPress is vulnerable to unauthorized user registration inCheck if you run itEPSS 0.24%Nov 8, 2025
- Medium6.1The WP2Social Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and including, 2.4.7 due to insufficient inpuCheck if you run itEPSS 0.22%Nov 8, 2025
- Medium5.3The Course Booking System plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check in the csv-export.php file in all versions up to, andCheck if you run itEPSS 0.26%Nov 8, 2025
- Medium5.3The Download Manager plugin for WordPress is vulnerable to unauthorized access due to a hardcoded Cron key used in the deleteExpired() and clearTempDataCPCron() functions in all veCheck if you run itEPSS 0.24%Nov 8, 2025
- Medium4.3The Contact Form 7 AWeber Extension plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_aweber_logreset' AJAXCheck if you run itEPSS 0.21%Nov 8, 2025
- Medium6.4The Simple Downloads List plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_neofix_sdl_edit' AJAX endpoint aCheck if you run itEPSS 0.23%Nov 8, 2025
- High7.5The Asgaros Forum plugin for WordPress is vulnerable to SQL Injection via the '$_COOKIE['asgarosforum_unread_exclude']' cookie in all versions up to, and including, 3.1.0 due to inPatch nowKEVEPSS 1.60%Nov 8, 2025
- High7.3Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.Check if you run itEPSS 7.23%Nov 8, 2025
Sort