Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.9The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.14.16.Check if you run itEPSS 0.47%Nov 1, 2025
- High8.8The RESTful Content Syndication plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ingest_image() function in versions 1.1.0 toCheck if you run itEPSS 0.54%Nov 1, 2025
- High8.8The WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to arbitrary file uploads when importing recipes via CSV in all vCheck if you run itEPSS 0.54%Nov 1, 2025
- Critical9.8The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation iCheck if you run itEPSS 1.07%Nov 1, 2025
- High7.3The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.12 via the select_one() function.Check if you run itEPSS 0.47%Nov 1, 2025
- High8.8The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and excluding, 6.1.Check if you run itEPSS 0.30%Nov 1, 2025
- Medium6.5The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the Subscriptions Manager in all versions up to, and including, 2.4.9 due to insufficient escaping on the uCheck if you run itEPSS 0.28%Nov 1, 2025
- Medium6.4The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'saswp_tiny_multiple_faq' shortcode in all versions upCheck if you run itEPSS 0.23%Nov 1, 2025
- Medium4.3The Folderly plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability check on the /wp-json/folderly/v1/config/clear-all-data RESTCheck if you run itEPSS 0.19%Nov 1, 2025
- Medium4.3The WP Discourse plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.5.9.Check if you run itEPSS 0.27%Nov 1, 2025
- Medium6.4The Employee Spotlight – Team Member Showcase & Meet the Team Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Social URLs in all versions up to, and inCheck if you run itEPSS 0.19%Nov 1, 2025
- Medium4.3The Qi Blocks plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.4.3.Check if you run itEPSS 0.23%Nov 1, 2025
- High8.8The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0.Check if you run itEPSS 0.38%Nov 1, 2025
- Medium4.4The Flying Images: Optimize and Lazy Load Images for Faster Page Speed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, aCheck if you run itEPSS 0.24%Nov 1, 2025
- Medium6.4The Schema Scalpel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title in all versions up to, and including, 1.6.1 due to insufficient input sanitiCheck if you run itEPSS 0.24%Nov 1, 2025
- High7.2The Community Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event details parameter in all versions up to, and including, 1.5.2 due to insufficient iCheck if you run itEPSS 0.29%Nov 1, 2025
- Medium4.3The List category posts plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 0.92.0 via the 'catlist' shortcode due to insufficient restCheck if you run itEPSS 0.23%Nov 1, 2025
- Medium4.3The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.3.1.Check if you run itEPSS 0.23%Nov 1, 2025
- Medium4.4The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 12.0.5 due to insufficient iCheck if you run itEPSS 0.19%Nov 1, 2025
- Medium6.9Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 9Check if you run itEPSS 0.29%Nov 1, 2025
- Medium6.4The Inactive Logout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ina_redirect_page_individual_user' parameter in all versions up to, and including, 3.Check if you run itEPSS 0.24%Nov 1, 2025
- High8.8The WPCOM Member plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7.14 via the action parameter in one of its shortcodes.Check if you run itEPSS 0.56%Nov 1, 2025
- Medium5.3The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missinCheck if you run itEPSS 0.30%Nov 1, 2025
- Medium5.3The Document Library Lite plugin for WordPress is vulnerable to Improper Authorization in all versions up to, and including, 1.1.6.Check if you run itEPSS 0.37%Nov 1, 2025
- Critical9.8WPExperts post_smtp Missing AuthorizationPatch nowKEVEPSS 61.48%Nov 1, 2025
Sort