Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.2The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 6.4.8 due to insufficient inCheck if you run itEPSS 0.25%Dec 12, 2025
- Medium5.3The Guest Support plugin for WordPress is vulnerable to User Email Disclosure in versions up to, and including, 1.2.3.Check if you run itEPSS 0.33%Dec 12, 2025
- High7.5Tornado is a Python web framework and asynchronous networking library.Check if you run itEPSS 0.53%Dec 12, 2025
- Medium4.3The Construction Light WordPress theme before 1.6.8 does not have authorisation and CSRF when activating via an AJAX action, allowing any authenticated users, such as subscriber toCheck if you run itEPSS 0.12%Dec 12, 2025
- High7.5Tornado is a Python web framework and asynchronous networking library.Check if you run itEPSS 0.56%Dec 12, 2025
- Medium5.4Tornado is a Python web framework and asynchronous networking library.Check if you run itEPSS 0.24%Dec 12, 2025
- High8.0gardenctl is a command-line client for the Gardener which configures access to clusters and cloud provider CLI tools.Check if you run itEPSS 0.24%Dec 12, 2025
- Medium5.1In GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZION prior to ver5.7.1, "External page display restriction" is set to "Do nCheck if you run itEPSS 0.21%Dec 12, 2025
- Medium5.3SQL Injection vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION prior to ver5.3.2.Check if you run itEPSS 0.19%Dec 12, 2025
- Medium5.1Cross-site request forgery vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION prior to ver5.3.2.Check if you run itEPSS 0.13%Dec 12, 2025
- Medium6.9GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION prior to ver5.3.2.Check if you run itEPSS 0.15%Dec 12, 2025
- Medium5.3In GroupSession, a Circular notice can be created with its memo field non-editable, but the authorization check is improperly implemented.Check if you run itEPSS 0.19%Dec 12, 2025
- Medium5.1Reflected cross-site scripting vulnerability exists in GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZION prior to ver5.7.1.Check if you run itEPSS 0.19%Dec 12, 2025
- Medium5.1Reflected cross-site scripting vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION prior to ver5.3.2.Check if you run itEPSS 0.19%Dec 12, 2025
- Medium4.8Stored cross-site scripting vulnerabilities exist in GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZION prior to ver5.7.1.Check if you run itEPSS 0.17%Dec 12, 2025
- Medium4.8Stored cross-site scripting vulnerabilities exist in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION prior to ver5.3.2.Check if you run itEPSS 0.17%Dec 12, 2025
- Medium5.1Stored cross-site scripting vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION prior to ver5.3.2.Check if you run itEPSS 0.19%Dec 12, 2025
- High8.2Masa CMS is an open source Enterprise Content Management platform.Check if you run itEPSS 0.25%Dec 12, 2025
- Medium6.1The WPLG Default Mail From plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the variable in all versions up to, and including, 1.0.0 due to insufficient inpCheck if you run itEPSS 0.25%Dec 12, 2025
- Medium4.3The Simple Theme Changer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.Check if you run itEPSS 0.12%Dec 12, 2025
- Medium4.4The Contact Form 7 with ChatWork plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'api_token' and 'roomid' settings in all versions up to, and including, 1Check if you run itEPSS 0.23%Dec 12, 2025
- Medium6.4The VigLink SpotLight By ShortCode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'float' parameter of the 'spotlight' shortcode in all versions up to, aCheck if you run itEPSS 0.22%Dec 12, 2025
- Medium6.4The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a regex bypass in nsp_shortcode function in all versions up to, and including, 1.4.3 due to iCheck if you run itEPSS 0.23%Dec 12, 2025
- Medium4.3The Rabbit Hole plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.Check if you run itEPSS 0.15%Dec 12, 2025
- Medium6.1The Simple AL Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the variable in all versions up to, and including, 1.2.10 due to insufficient input saCheck if you run itEPSS 0.26%Dec 12, 2025
Sort