Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.3A cross-site request forgery (CSRF) vulnerability in Jenkins Themis Plugin 1.4.1 and earlier allows attackers to connect to an attacker-specified HTTP server.Check if you run itEPSS 0.23%Oct 29, 2025
- Medium5.9Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property to an empty value, disabling a protection mechanism of the Java runtime.Check if you run itEPSS 0.32%Oct 29, 2025
- High7.1Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevent XML external entity (XXE) attacks.Check if you run itEPSS 0.35%Oct 29, 2025
- Medium5.4A cross-site request forgery (CSRF) vulnerability in Jenkins Extensible Choice Parameter Plugin 239.v5f5c278708cf and earlier allows attackers to execute sandboxed Groovy code.Check if you run itEPSS 0.26%Oct 29, 2025
- Medium5.4Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in multiple MCP tools, allowing attackers to trigger builds and obtain information abouCheck if you run itEPSS 0.26%Oct 29, 2025
- High7.5Jenkins SAML Plugin 4.583.vc68232f7018a_ and earlier does not implement a replay cache, allowing attackers able to obtain information about the SAML authentication flow between a uCheck if you run itEPSS 0.47%Oct 29, 2025
- Medium4.3The Call Now Button – The #1 Click to Call Button for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple funcCheck if you run itEPSS 0.27%Oct 29, 2025
- Medium4.3The Call Now Button – The #1 Click to Call Button for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the actCheck if you run itEPSS 0.23%Oct 29, 2025
- Medium4.9The Easy Testimonial Slider and Form plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.2 due to insufficient escaCheck if you run itEPSS 0.30%Oct 29, 2025
- Medium4.9The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.4 due to insufficient escapiCheck if you run itEPSS 0.30%Oct 29, 2025
- Medium5.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Premmerce Premmerce User Roles premmerce-user-roles allows Stored XSS.This issCheck if you run itEPSS 0.18%Oct 29, 2025
- Medium4.3Cross-Site Request Forgery (CSRF) vulnerability in Premmerce Premmerce Product Search for WooCommerce premmerce-search allows Cross Site Request Forgery.This issue affects PremmercCheck if you run itEPSS 0.13%Oct 29, 2025
- Medium5.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Premmerce Premmerce Product Search for WooCommerce premmerce-search allows StoCheck if you run itEPSS 0.18%Oct 29, 2025
- Medium4.3Cross-Site Request Forgery (CSRF) vulnerability in Premmerce Premmerce premmerce allows Cross Site Request Forgery.This issue affects Premmerce: from n/a through <= 1.3.19.Check if you run itEPSS 0.13%Oct 29, 2025
- Medium4.3Cross-Site Request Forgery (CSRF) vulnerability in WpEstate WP Rentals wprentals allows Cross Site Request Forgery.This issue affects WP Rentals: from n/a through <= 3.13.1.Check if you run itEPSS 0.13%Oct 29, 2025
- Medium5.4Missing Authorization vulnerability in Premmerce Premmerce Wholesale Pricing for WooCommerce premmerce-woocommerce-wholesale-pricing allows Exploiting Incorrectly Configured AccessCheck if you run itEPSS 0.22%Oct 29, 2025
- High7.5Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Majestic Support Majestic Support majestic-support allows PCheck if you run itEPSS 0.40%Oct 29, 2025
- Medium6.5Authorization Bypass Through User-Controlled Key vulnerability in Rometheme RTMKit rometheme-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.TCheck if you run itEPSS 0.27%Oct 29, 2025
- Medium4.3Missing Authorization vulnerability in Evergreen Content Poster Evergreen Content Poster evergreen-content-poster allows Exploiting Incorrectly Configured Access Control Security LCheck if you run itEPSS 0.25%Oct 29, 2025
- Medium4.3Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issCheck if you run itEPSS 0.19%Oct 29, 2025
- Medium4.3Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Retrieve Embedded Sensitive Data.This iCheck if you run itEPSS 0.22%Oct 29, 2025
- Medium4.3Cross-Site Request Forgery (CSRF) vulnerability in colabrio Stockie Extra stockie-extra allows Cross Site Request Forgery.This issue affects Stockie Extra: from n/a through <= 1.2.Check if you run itEPSS 0.13%Oct 29, 2025
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ReyCommerce Rey Core rey-core allows Stored XSS.This issue affects Rey Core: fCheck if you run itEPSS 0.17%Oct 29, 2025
- Medium4.3Missing Authorization vulnerability in Strategy11 Team Business Directory business-directory-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issCheck if you run itEPSS 0.19%Oct 29, 2025
- High7.5Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeSphere SmartMag smart-mag allows PHP Local File InclusCheck if you run itEPSS 0.39%Oct 29, 2025
Sort