Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.4The AP Background plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'adv_parallax_back' shortcode in all versions up to, and including, 3.8.2 due tCheck if you run itEPSS 0.24%Oct 3, 2025
- High7.5The WP Dispatcher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wp_dispatcher_process_upload() function in all versions upCheck if you run itEPSS 0.52%Oct 3, 2025
- Medium4.3The Constructor theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clean() function in all versions up to, and includinCheck if you run itEPSS 0.20%Oct 3, 2025
- Medium6.4The X Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Youtube Video ID field in all versions up to, and including, 1.0.16.Check if you run itEPSS 0.25%Oct 3, 2025
- Medium6.4The Flexi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin for WordPress's flexi-form-tag shortcode in all versions up to, and including, 4.28 due tCheck if you run itEPSS 0.25%Oct 3, 2025
- Medium6.3The Schema Plugin For Divi, Gutenberg & Shortcodes plugin for WordPress is vulnerable to Object Instantiation in all versions up to, and including, 4.3.2 via deserialization of untCheck if you run itEPSS 0.27%Oct 3, 2025
- Medium4.3The Notification Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.Check if you run itEPSS 0.13%Oct 3, 2025
- Medium6.4The Auto Bulb Finder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'abf_vehicle' shortcode in all versions up to, and including,Check if you run itEPSS 0.24%Oct 3, 2025
- Medium4.3The ContentMX Content Publisher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6.Check if you run itEPSS 0.17%Oct 3, 2025
- Medium4.3The WP SinoType plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.Check if you run itEPSS 0.16%Oct 3, 2025
- High8.8The WP Dispatcher plugin for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.2.0 due to insufficient escaping on the user suCheck if you run itEPSS 0.35%Oct 3, 2025
- Medium6.4The Fintelligence Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fintelligence-calculator' shortcode in all versions up to, and inclCheck if you run itEPSS 0.21%Oct 3, 2025
- Medium4.3The Customify theme for WordPress is vulnerable to Cross-Site Request Forgery in version 0.4.11.Check if you run itEPSS 0.20%Oct 3, 2025
- Medium5.5The Ultimate Multi Design Video Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.4 due to insufficient input sanitCheck if you run itEPSS 0.22%Oct 3, 2025
- High7.5The Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App plugin for WordPress is vulnerable to SQL Injection via the nh_ynaa_comments() function in all versiCheck if you run itEPSS 0.36%Oct 3, 2025
- Medium6.4The Epic Bootstrap Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘icol’ parameter in all versions up to, and including, 1.0 due to insufficientCheck if you run itEPSS 0.24%Oct 3, 2025
- Medium5.3The Restrict User Registration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1.Check if you run itEPSS 0.15%Oct 3, 2025
- Medium6.5The Woo superb slideshow transition gallery with random effect plugin for WordPress is vulnerable to SQL Injection via the 'woo-superb-slideshow' shortcode in all versions up to, aCheck if you run itEPSS 0.28%Oct 3, 2025
- Medium6.4The Meks Easy Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title field in all version up to, and including, 2.1.4.Check if you run itEPSS 0.25%Oct 3, 2025
- Medium4.3The PayPal Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3.Check if you run itEPSS 0.15%Oct 3, 2025
- Medium4.4The TableGen – Data Table Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.3.1 due to insufficCheck if you run itEPSS 0.24%Oct 3, 2025
- Medium6.4The A Simple Multilanguage Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'asmp-switcher' shortcode in all versions up to, and including,Check if you run itEPSS 0.20%Oct 3, 2025
- Medium6.4The Generic Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widget fields in version 1.2.8 and earlier.Check if you run itEPSS 0.31%Oct 3, 2025
- Medium4.3The Optimize More! – CSS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3.Check if you run itEPSS 0.14%Oct 3, 2025
- Low3.8The Backup Bolt plugin for WordPress is vulnerable to arbitrary file downloads and backup location writes in all versions up to, and including, 1.4.1 via the process_backup_batch()Check if you run itEPSS 0.31%Oct 3, 2025
Sort