Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- UnknownRank Math SEO PRO 3.0.123 - Unauthenticated Embedded Malicious CodeOct 16, 2026
- UnknownFastcache by Host.it <= 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary .htaccess Page-Cache Block Modification via updateSettings() admin_action_update HookOct 16, 2026
- UnknownWP Sessions Time Monitoring Full Automatic <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting via 'action' GET ParameterOct 15, 2026
- UnknownEvents Made Easy <= 3.2.22 - Unauthenticated Stored Cross-Site Scripting via 'event[location_name]' ParameterOct 15, 2026
- UnknownGeoDirectory <= 2.8.191 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via data-embed-url AttributeOct 15, 2026
- UnknownGoSMTP Pro <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Email Log BodyOct 15, 2026
- High8.8DoubleScale | All-in-One CRM <= 1.5.1 - Authenticated (Subscriber+) Arbitrary File Upload via Portal 'ticketless' Attachment EndpointEPSS 0.5%Oct 15, 2026
- High7.2SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via sc-cart-loader 'template' Attribute in CommentEPSS 0.3%Oct 15, 2026
- Medium6.4Name Directory <= 1.34.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dir' Shortcode AttributeEPSS 0.2%Oct 15, 2026
- Medium5.4The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.17.5.EPSS 0.2%Oct 15, 2026
- High7.5Vitepos <= 3.5.1 - Unauthenticated SQL Injection via 'src_by' ParameterOct 15, 2026
- Medium6.4Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name ParameterOct 15, 2026
- Medium6.4Social Share Buttons <= 1.30 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'share_url' Network SettingEPSS 0.2%Oct 15, 2026
- High7.2User Registration PRO <= 6.2.9 - Unauthenticated Stored Cross-Site Scripting via HTTP Referer HeaderOct 15, 2026
- High8.1Vulnity Security <= 1.4.3 - Unauthenticated Authentication Bypass to Administrator via Exposed Pairing CredentialsOct 15, 2026
40 records · page 2 of 2
PreviousNext