Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.3The Premmerce Wishlist for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.1.10.Check if you run itEPSS 0.34%Dec 12, 2025
- Medium4.3The Truefy Embed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0.Check if you run itEPSS 0.15%Dec 12, 2025
- Medium6.4The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in the 'bold_timeline_group' shortcode in all versions up to, andCheck if you run itEPSS 0.28%Dec 12, 2025
- Medium6.4The Reviews Sorted plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'space' parameter of the [reviews-slider] shortcode in all versions up to, and includinCheck if you run itEPSS 0.35%Dec 12, 2025
- Medium4.3The Resource Library for Logged In Users plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.Check if you run itEPSS 0.17%Dec 12, 2025
- Medium4.3The Kirim.Email WooCommerce Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.9.Check if you run itEPSS 0.16%Dec 12, 2025
- Medium6.4The Easy Map Creator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 3.0.2 due to insufficient inpCheck if you run itEPSS 0.27%Dec 12, 2025
- Medium4.3The IMAQ Core plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1.Check if you run itEPSS 0.17%Dec 12, 2025
- Medium4.3The Premmerce Brands for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveBrandsSettings function inCheck if you run itEPSS 0.28%Dec 12, 2025
- Medium5.3The WPMasterToolKit plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 2.13.0.Check if you run itEPSS 0.46%Dec 12, 2025
- Medium6.4The App Landing Template Blocks for WPBakery (Visual Composer) Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'atvc_video_play' shortcode inCheck if you run itEPSS 0.22%Dec 12, 2025
- High8.1The Visitor Logic Lite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.3 via deserialization of untrusted input from the cookieCheck if you run itEPSS 0.54%Dec 12, 2025
- Medium4.3The Coding Blocks plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0.Check if you run itEPSS 0.16%Dec 12, 2025
- Medium6.4The WPGancio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gancio-event' shortcode in all versions up to, and including, 1.12 due to insufficiCheck if you run itEPSS 0.27%Dec 12, 2025
- Medium4.3The URL Media Uploader plugin for WordPress is vulnerable to unauthorized safe file uploads due to a missing capability check on the url_media_uploader_url_upload_ajax_handler() fuCheck if you run itEPSS 0.28%Dec 12, 2025
- High8.8The Infility Global plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and capability checks in all versions up to, and including, 2.1Check if you run itEPSS 0.59%Dec 12, 2025
- High8.8The Player Leaderboard plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0.2 via the 'player_leaderboard' shortcode.Check if you run itEPSS 0.80%Dec 12, 2025
- Critical9.8The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'plupload_ajax_delete_file' functCheck if you run itEPSS 0.53%Dec 12, 2025
- Medium4.3The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includiCheck if you run itEPSS 0.18%Dec 12, 2025
- Medium6.1The Like DisLike Voting plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the variable in all versions up to, and including, 1.0.1 due to insufficient inputCheck if you run itEPSS 0.26%Dec 12, 2025
- Medium4.4The SimplyConvert plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'simplyconvert_hash' option in all versions up to, and including, 1.0 due to insufficienCheck if you run itEPSS 0.22%Dec 12, 2025
- Medium5.3The Campay Woocommerce Payment Gateway plugin for WordPress is vulnerable to Unauthenticated Payment Bypass in all versions up to, and including, 1.2.2.Check if you run itEPSS 0.37%Dec 12, 2025
- Medium6.1The Complag plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the variable in all versions up to, and including, 1.0.2 due to insufficient input sanitizationCheck if you run itEPSS 0.25%Dec 12, 2025
- Medium6.4The WP Dropzone plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'callback' shortcode attribute in all versions up to, and including, 1.1.1.Check if you run itEPSS 0.28%Dec 12, 2025
- Medium6.4The Wpik WordPress Basic Ajax Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dname' parameter in all versions up to, and including, 1.0 due to insuCheck if you run itEPSS 0.23%Dec 12, 2025
Sort