Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.3The WooMulti WordPress plugin through 17 does not validate a file parameter when deleting files, which could allow any authenticated users, such as subscriber to delete arbitrary fCheck if you run itEPSS 0.29%Dec 12, 2025
- Medium5.3The Bookit WordPress plugin before 2.5.1 has a publicly accessible REST endpoint that allows unauthenticated update of the plugins Stripe payment options.Check if you run itEPSS 0.70%Dec 12, 2025
- High8.8A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store.Check if you run itEPSS 1.04%Dec 12, 2025
- High8.1Authorization Bypass Through User-Controlled Key vulnerability in Apache Fineract.Check if you run itEPSS 0.39%Dec 12, 2025
- Medium5.5The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_description' and 'success_message' parameters in versions uCheck if you run itEPSS 0.34%Dec 12, 2025
- Medium5.3The Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 5.9.10.Check if you run itEPSS 0.39%Dec 12, 2025
- Medium4.3The PDF for Contact Form 7 + Drag and Drop Template Builder plugin for WordPress is vulnerable to unauthorized post duplication due to a missing capability check on the 'rednumber_Check if you run itEPSS 0.24%Dec 12, 2025
- Critical9.1Insufficiently Protected Credentials vulnerability in Apache Fineract.Check if you run itEPSS 0.43%Dec 12, 2025
- High8.5Weak Password Requirements vulnerability in Apache Fineract.Check if you run itEPSS 0.52%Dec 12, 2025
- High7.3A vulnerability has been identified in Simcenter Femap (All versions < V2512).Check if you run itEPSS 0.20%Dec 12, 2025
- Medium6.5The Simple CSV Table plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.0.1 via the parameter in the shortcode.Check if you run itEPSS 0.69%Dec 12, 2025
- High8.7Servify Express is a Node.js package to start an Express server and log the port it's running on.Check if you run itEPSS 0.40%Dec 12, 2025
- Medium5.1Frappe Learning Management System (LMS) is a learning system that helps users structure their content.Check if you run itEPSS 0.17%Dec 12, 2025
- High7.5FunnelKit funnel_builder Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 0.38%Dec 12, 2025
- Medium6.5The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.13.3.Check if you run itEPSS 0.42%Dec 12, 2025
- Low3.5The WP Fastest Cache Premium plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.7.4 via the 'get_server_time_ajax_request' AJCheck if you run itEPSS 0.29%Dec 12, 2025
- Medium5.5The BSK PDF Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.7.1 due to insufficient input sanCheck if you run itEPSS 0.30%Dec 12, 2025
- Medium6.1The VikRentItems Flexible Rental Management System plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'delto' parameter in all versions up to, and includiCheck if you run itEPSS 0.26%Dec 12, 2025
- Medium6.4The Mailgun Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mailgun_subscription_form' shortcode in all versions up to, and includCheck if you run itEPSS 0.22%Dec 12, 2025
- Critical9.8Fireshare facilitates self-hosted media and link sharing.Check if you run itEPSS 0.69%Dec 12, 2025
- Low3.7AzuraCast is a self-hosted, all-in-one web radio management suite.Check if you run itEPSS 0.25%Dec 12, 2025
- Medium6.9Parse Server is an open source backend that can be deployed to any infrastructure that runs Node.js.Check if you run itEPSS 0.42%Dec 12, 2025
- High7.5The WPNakama plugin for WordPress is vulnerable to time-based SQL Injection via the 'order_by' parameter in all versions up to, and including, 0.6.3 due to insufficient escaping onCheck if you run itEPSS 0.39%Dec 12, 2025
- Medium5.3The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to arbitrary file write via a missing authorization check in all versions up to, and including, 1.7.1.Check if you run itEPSS 0.28%Dec 12, 2025
- Medium4.3The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'uacf7_get_generated_pdf' function inCheck if you run itEPSS 0.35%Dec 12, 2025
Sort