Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.8The ClickSold IDX WordPress plugin through 1.90 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-SiteCheck if you run itEPSS 0.36%May 15, 2025
- Medium4.8The PWA for WP WordPress plugin before 1.7.72 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site SCheck if you run itEPSS 0.33%May 15, 2025
- Medium4.8The Simple Share WordPress plugin through 0.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-SiteCheck if you run itEPSS 0.33%May 15, 2025
- Medium4.8The DL Verification WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-SitCheck if you run itEPSS 0.31%May 15, 2025
- Medium4.8The DL Robots.txt WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-SiteCheck if you run itEPSS 0.31%May 15, 2025
- Medium4.8The PVN Auth Popup WordPress plugin through 1.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-SiCheck if you run itEPSS 0.33%May 15, 2025
- Medium6.1The MapFig Studio WordPress plugin through 0.2.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make loggeCheck if you run itEPSS 0.18%May 15, 2025
- Medium4.8The User Profile Builder WordPress plugin before 3.12.2 does not sanitise and escape some parameters before outputting its content on the admin area, which allows Admin+ users to pCheck if you run itEPSS 0.36%May 15, 2025
- Medium4.8The wccp-pro WordPress plugin before 15.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site ScripCheck if you run itEPSS 0.31%May 15, 2025
- Medium6.1The KBucket: Your Curated Content in WordPress plugin before 4.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-SiteCheck if you run itEPSS 0.33%May 15, 2025
- Medium4.8The KBucket: Your Curated Content in WordPress plugin before 4.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perforCheck if you run itEPSS 0.33%May 15, 2025
- Critical9.1The 'wp_ajax_boost_proxy_ig' action allows administrators to make GET requests to arbitrary URLs.Check if you run itEPSS 0.57%May 15, 2025
- High7.2The ImageMagick Engine ImageMagick Engine WordPress plugin before 1.7.11 for WordPress is vulnerable to OS Command Injection via the "cli_path" parameter.Check if you run itEPSS 2.35%May 15, 2025
- Medium4.8The CTT Expresso para WooCommerce WordPress plugin before 3.2.13 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to performCheck if you run itEPSS 0.33%May 15, 2025
- Medium4.8The DL Yandex Metrika WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-SCheck if you run itEPSS 0.31%May 15, 2025
- Medium4.8The Tracking Code Manager WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored CrCheck if you run itEPSS 0.36%May 15, 2025
- Medium4.8The CM Tooltip Glossary WordPress plugin before 4.3.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored CrosCheck if you run itEPSS 0.33%May 15, 2025
- Medium6.1The Badgearoo WordPress plugin through 1.0.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which coulCheck if you run itEPSS 0.34%May 15, 2025
- Medium4.8The Podlove Podcast Publisher WordPress plugin before 4.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform StoreCheck if you run itEPSS 0.33%May 15, 2025
- Medium4.8The Podlove Podcast Publisher WordPress plugin before 4.1.24 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform StorCheck if you run itEPSS 0.33%May 15, 2025
- Medium4.8The GDPR Framework By Data443 WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform StoreCheck if you run itEPSS 0.33%May 15, 2025
- Medium6.1The LifterLMS WordPress plugin before 8.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which couldCheck if you run itEPSS 0.58%May 15, 2025
- Medium4.8The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to pCheck if you run itEPSS 0.33%May 15, 2025
- Medium4.8The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-SiCheck if you run itEPSS 0.33%May 15, 2025
- Medium4.8The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-SiCheck if you run itEPSS 0.31%May 15, 2025
Sort