Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.4The LS Google Map Router plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'map_type' parameter in all versions up to, and including, 1.1.0 due to insufficiCheck if you run itEPSS 0.22%Dec 12, 2025
- Medium6.1The Accept Stripe Payments Using Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'failure_message' parameter in versions up to, and inclCheck if you run itEPSS 0.25%Dec 12, 2025
- Medium6.4The Simple post listing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class_name' parameter in the postlist shortcode in all versions up to, and includCheck if you run itEPSS 0.18%Dec 12, 2025
- Medium4.3The Upcoming for Calendly plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.4.Check if you run itEPSS 0.16%Dec 12, 2025
- High8.1The Blaze Demo Importer plugin for WordPress is vulnerable to unauthorized database resets and file deletion due to a missing capability check on the "blaze_demo_importer_install_dCheck if you run itEPSS 0.27%Dec 12, 2025
- Medium6.4The Better Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider widget in all versions up to, and including, 1.5.5 due to insufficientCheck if you run itEPSS 0.23%Dec 12, 2025
- Medium4.3The Purchase and Expense Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2.Check if you run itEPSS 0.15%Dec 12, 2025
- Medium6.4The FX Currency Converter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fxcc_convert' shortcode in all versions up to, and including, 0.2.0 duCheck if you run itEPSS 0.22%Dec 12, 2025
- Medium6.4The Divelogs Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'latestdive' shortcode in all versions up to, and including, 1.5 due to insufCheck if you run itEPSS 0.22%Dec 12, 2025
- Medium6.4The Zenost Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' and 'target' parameters in the shortcode in all versions up to, and includingCheck if you run itEPSS 0.22%Dec 12, 2025
- Medium5.3The Product Filtering by Categories, Tags, Price Range for WooCommerce – Filter Plus plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to,Check if you run itEPSS 0.28%Dec 12, 2025
- Medium6.1The Category Dropdown List plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the variable in all versions up to, and including, 1.0 due to insufficient inputCheck if you run itEPSS 0.25%Dec 12, 2025
- Medium4.3The Animated Pixel Marquee Creator plugin for WordPress is vulnerable to Cross-Site Request Forgery via the 'marquee' parameter in all versions up to, and including, 1.0.0.Check if you run itEPSS 0.15%Dec 12, 2025
- Critical9.8The LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart plugin for WordPress is vulnerable to privilege escalation via account takeover in all versionsCheck if you run itEPSS 0.36%Dec 12, 2025
- Medium4.4The TWW Protein Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Header' setting in all versions up to, and including, 1.0.24 due to insufficieCheck if you run itEPSS 0.23%Dec 12, 2025
- Medium6.4The WP Flot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'linechart' shortcode in all versions up to, and including, 0.2.2 due to insufficientCheck if you run itEPSS 0.22%Dec 12, 2025
- Medium6.1The 评论小秘书 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the variable in all versions up to, and including, 1.3.2.Check if you run itEPSS 0.25%Dec 12, 2025
- Medium6.4The Paypal Payment Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buttom_image' parameter of the [paypal-shortcode] shortcode in all versionsCheck if you run itEPSS 0.22%Dec 12, 2025
- Medium6.4The Data Visualizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'visualize' shortcode in all versions up to, and including, 1.1 due to insuffCheck if you run itEPSS 0.27%Dec 12, 2025
- Medium4.4The DebateMaster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the color options in the plugin settings in all versions up to, and including, 1.0.0 due to iCheck if you run itEPSS 0.31%Dec 12, 2025
- Medium6.4The Hide Email Address plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'inline_css' parameter in the shortcode in all versions up to, and including, 0.1 dCheck if you run itEPSS 0.27%Dec 12, 2025
- Medium6.4The GPXpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gpxpress' shortcode in all versions up to, and including, 1.3 due to insufficient iCheck if you run itEPSS 0.27%Dec 12, 2025
- Medium6.4The BUKAZU Search widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shortcode' parameter of the 'bukazu_search' shortcode in all versions up to, andCheck if you run itEPSS 0.28%Dec 12, 2025
- Medium6.8The WP User Manager plugin for WordPress is vulnerable to Arbitrary File Deletion in all versions up to, and including, 2.9.12.Check if you run itEPSS 0.82%Dec 12, 2025
- Medium4.3The Simple Theme Changer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the user_theme_admin, display_method_admin, anCheck if you run itEPSS 0.19%Dec 12, 2025
Sort