Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.8The Backup Database WordPress plugin through 4.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-SitCheck if you run itEPSS 0.31%May 15, 2025
- Medium4.8The events-calendar WordPress plugin through 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-SCheck if you run itEPSS 0.33%May 15, 2025
- High7.2The Z-Downloads WordPress plugin before 1.11.5 does not properly validate files uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even wCheck if you run itEPSS 0.70%May 15, 2025
- Medium4.8The Photo Gallery by 10Web WordPress plugin before 1.8.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform StoredCheck if you run itEPSS 0.36%May 15, 2025
- Medium4.8The MapPress Maps for WordPress plugin before 2.93 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-SCheck if you run itEPSS 0.33%May 15, 2025
- Medium4.8The Ajax Search Lite WordPress plugin before 4.12.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Check if you run itEPSS 0.39%May 15, 2025
- Medium4.8The Page Builder: Pagelayer WordPress plugin before 1.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform StoredCheck if you run itEPSS 0.36%May 15, 2025
- Medium4.8The Quiz Maker WordPress plugin before 6.5.9.9 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-SiteCheck if you run itEPSS 0.33%May 15, 2025
- Medium4.8The Everest Forms WordPress plugin before 3.0.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-SiCheck if you run itEPSS 0.36%May 15, 2025
- Medium4.8The Events Calendar WordPress plugin before 6.6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-SiCheck if you run itEPSS 0.36%May 15, 2025
- Medium4.8The Page Builder: Pagelayer WordPress plugin before 1.8.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-SCheck if you run itEPSS 0.33%May 15, 2025
- Medium4.3The Simple Nav Archives WordPress plugin through 2.1.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change thCheck if you run itEPSS 0.18%May 15, 2025
- Medium5.4The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not properly sanitize and escape the IP headers when logging them, allowing visitors to conduct Stored Cross-SiCheck if you run itEPSS 0.33%May 15, 2025
- Medium6.5The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanteCheck if you run itEPSS 0.21%May 15, 2025
- Medium4.3The GamiPress WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSCheck if you run itEPSS 0.19%May 15, 2025
- Medium4.8The Smart Post Show WordPress plugin before 3.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-SiCheck if you run itEPSS 0.31%May 15, 2025
- Medium6.1The BabelZ WordPress plugin through 1.1.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in adCheck if you run itEPSS 0.17%May 15, 2025
- Medium6.5The Ntz Antispam WordPress plugin through 2.0e does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via aCheck if you run itEPSS 0.21%May 15, 2025
- Medium6.1The JavaScript Logic WordPress plugin through 0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make loggCheck if you run itEPSS 0.18%May 15, 2025
- Medium6.1The PeoplePond WordPress plugin through 1.1.9 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged iCheck if you run itEPSS 0.17%May 15, 2025
- Medium4.3The Widgets Reset WordPress plugin through 0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via aCheck if you run itEPSS 0.19%May 15, 2025
- Medium4.3The Custom Author Base WordPress plugin through 1.1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change theCheck if you run itEPSS 0.18%May 15, 2025
- Medium6.1The Smooth Gallery Replacement WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers toCheck if you run itEPSS 0.17%May 15, 2025
- Medium6.5The Secure Downloads WordPress plugin before 1.2.3 is vulnerable does not properly restrict which files can be downloaded.Check if you run itEPSS 0.53%May 15, 2025
- Medium4.3The Joy Of Text Lite WordPress plugin through 2.3.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change themCheck if you run itEPSS 0.19%May 15, 2025
Sort