Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.2Deserialization of Untrusted Data vulnerability in Icegram Email Subscribers & Newsletters email-subscribers allows Object Injection.This issue affects Email Subscribers & NewslettCheck if you run itEPSS 0.47%Nov 21, 2025
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold enfold allows Stored XSS.This issue affects Enfold: from n/a thrCheck if you run itEPSS 0.20%Nov 21, 2025
- Medium4.3The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.9 via the 'Check if you run itEPSS 0.31%Nov 21, 2025
- Medium6.4The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting viCheck if you run itEPSS 0.31%Nov 21, 2025
- Medium4.3The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'eh_crm_remCheck if you run itEPSS 0.30%Nov 21, 2025
- None0.0In the Linux kernel, the following vulnerability has been resolved: ACPI: video: Fix use-after-free in acpi_video_switch_brightness() The switch_brightness_work delayed work accessCheck if you run itEPSS 0.21%Nov 21, 2025
- High7.5In the Linux kernel, the following vulnerability has been resolved: Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND" I've found that pynfs COMP6 now leavesCheck if you run itEPSS 0.36%Nov 21, 2025
- None0.0In the Linux kernel, the following vulnerability has been resolved: btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation When btrfs_add_qgroup_relation() is called wiCheck if you run itEPSS 0.20%Nov 21, 2025
- Medium4.9The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to SQL Injection via the 'term' parameter in all versions up to, and including, 4.2.6Check if you run itEPSS 0.33%Nov 21, 2025
- High7.2The Simple User Registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpr_admin_msg' parameter in all versions up to, and including, 6.6 due to inCheck if you run itEPSS 0.24%Nov 21, 2025
- Medium6.4The Magical Products Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mpdpr_title_tag' and 'mpdpr_subtitle_tag' parameters in the MPD Pricing TablCheck if you run itEPSS 0.25%Nov 21, 2025
- Medium4.4The WP Delete Post Copies plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 6.0.2 due to insufficient inputCheck if you run itEPSS 0.20%Nov 21, 2025
- High7.5The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'columns_search' parameter of the select_2_ajax() function in all versions up to, and including, 1.Check if you run itEPSS 1.63%Nov 21, 2025
- High8.8The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the insert_media_attachment()Check if you run itEPSS 0.73%Nov 21, 2025
- Medium6.4The Shortcode for Google Street View plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'streetview' shortcode in all versions up to, and including, 0.5.7.Check if you run itEPSS 0.20%Nov 21, 2025
- Medium4.3The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress is vulnerable to unauthorized modification of daCheck if you run itEPSS 0.20%Nov 21, 2025
- Medium6.4The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Gutenberg blocks in all versions up to, and includingCheck if you run itEPSS 0.23%Nov 21, 2025
- Medium4.9The 简数采集器 plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.6.3 via the __kds_flag functionality that imports featured images.Check if you run itEPSS 0.34%Nov 21, 2025
- Medium6.4The WP Company Info plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' attribute of the 'social-networks' shortcode in all versions up to, and includCheck if you run itEPSS 0.20%Nov 21, 2025
- Medium5.3The BigBuy Dropshipping Connector for WooCommerce plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 2.0.5 due to insufficient IP addreCheck if you run itEPSS 0.30%Nov 21, 2025
- Medium6.4The WPSite Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'format' shortcode attribute in the wpsite_y shortcode and the 'before' attribute inCheck if you run itEPSS 0.25%Nov 21, 2025
- High8.8The Realty Portal plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'rp_save_prCheck if you run itEPSS 0.41%Nov 21, 2025
- Medium6.4The Bulma Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' shortcode attribute in the bulma-notification shortcode in all versions up to,Check if you run itEPSS 0.20%Nov 21, 2025
- Medium6.4The Surbma | MiniCRM Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute of the 'minicrm' shortcode in all versions up to,Check if you run itEPSS 0.20%Nov 21, 2025
- Medium4.3The Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabilityCheck if you run itEPSS 0.24%Nov 21, 2025
Sort