Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.5Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in wpweb Follow My Blog Post follow-my-blog-post allows Retrieve Embedded Sensitive Data.ThCheck if you run itEPSS 0.36%Dec 18, 2025
- Critical9.8Deserialization of Untrusted Data vulnerability in BoldThemes Codiqa codiqa allows Object Injection.This issue affects Codiqa: from n/a through < 1.2.8.Check if you run itEPSS 0.38%Dec 18, 2025
- Critical9.9Unrestricted Upload of File with Dangerous Type vulnerability in RedefiningTheWeb WordPress Contact Form 7 PDF, Google Sheet & Database rtwwcfp-wordpress-contact-form-7-pdf allowsCheck if you run itEPSS 0.32%Dec 18, 2025
- High7.7Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP Chill Filr filr-protection allows Path Traversal.This issue affects Filr: from n/Check if you run itEPSS 0.40%Dec 18, 2025
- Critical9.8Deserialization of Untrusted Data vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Object Injection.This issue affects Client Invoicing by SprouCheck if you run itEPSS 0.38%Dec 18, 2025
- Medium6.5Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in colabrio Stockie Extra stockie-extra allows Code Injection.This issue affects StockieCheck if you run itEPSS 0.31%Dec 18, 2025
- High8.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PenciDesign PenNews pennews allows PHP Local File InclusionCheck if you run itEPSS 0.50%Dec 18, 2025
- High7.5Missing Authorization vulnerability in FantasticPlugins WooCommerce Recover Abandoned Cart rac allows Exploiting Incorrectly Configured Access Control Security Levels.This issue afCheck if you run itEPSS 0.29%Dec 18, 2025
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes Reservation Plugin dt-reservation-plugin allows Reflected XSS.ThiCheck if you run itEPSS 0.22%Dec 18, 2025
- High7.5Insertion of Sensitive Information Into Sent Data vulnerability in WP Chill Passster content-protector allows Retrieve Embedded Sensitive Data.This issue affects Passster: from n/aCheck if you run itEPSS 0.35%Dec 18, 2025
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Photography photography allows Reflected XSS.This issue affects PhoCheck if you run itEPSS 0.21%Dec 18, 2025
- High7.5Missing Authorization vulnerability in StylemixThemes MasterStudy LMS Pro masterstudy-lms-learning-management-system-pro allows Accessing Functionality Not Properly Constrained byCheck if you run itEPSS 0.36%Dec 18, 2025
- High7.5Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes MasterStudy LMS Pro masterstudy-lms-learning-management-system-pro allows Retrieve Embedded SensitCheck if you run itEPSS 0.36%Dec 18, 2025
- High7.5Missing Authorization vulnerability in StylemixThemes Masterstudy masterstudy allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Masterstudy: from nCheck if you run itEPSS 0.34%Dec 18, 2025
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TieLabs Jannah jannah allows DOM-Based XSS.This issue affects Jannah: from n/aCheck if you run itEPSS 0.22%Dec 18, 2025
- Critical9.8Deserialization of Untrusted Data vulnerability in TieLabs Jannah jannah allows Object Injection.This issue affects Jannah: from n/a through <= 7.6.0.Check if you run itEPSS 0.47%Dec 18, 2025
- High8.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TieLabs Jannah jannah allows PHP Local File Inclusion.ThisCheck if you run itEPSS 0.40%Dec 18, 2025
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EverPress Mailster mailster allows Reflected XSS.This issue affects Mailster:Check if you run itEPSS 0.22%Dec 18, 2025
- High7.5Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in 8theme XStore xstore allows PHP Local File Inclusion.This iCheck if you run itEPSS 0.46%Dec 18, 2025
- Medium6.3Missing Authorization vulnerability in 8theme XStore xstore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects XStore: from n/a through < 9.Check if you run itEPSS 0.22%Dec 18, 2025
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore xstore allows Reflected XSS.This issue affects XStore: from n/aCheck if you run itEPSS 0.22%Dec 18, 2025
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows Reflected XSS.This issue affects XStoCheck if you run itEPSS 0.22%Dec 18, 2025
- Critical9.8Incorrect Privilege Assignment vulnerability in PenciDesign Soledad soledad allows Privilege Escalation.This issue affects Soledad: from n/a through <= 8.6.9.Check if you run itEPSS 0.43%Dec 18, 2025
- High8.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Inset inset allows PHP Local File Inclusion.ThCheck if you run itEPSS 0.40%Dec 18, 2025
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MatrixAddons Easy Invoice easy-invoice allows DOM-Based XSS.This issue affectsCheck if you run itEPSS 0.18%Dec 18, 2025
Sort