Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.8The Simple Registration for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.8.Check if you run itEPSS 0.20%Oct 25, 2025
- Medium5.3The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check while verifying webhoCheck if you run itEPSS 0.29%Oct 25, 2025
- High8.6GN4 Publishing System versions prior to 2.6 contain an insecure direct object reference (IDOR) vulnerability via the API.Check if you run itEPSS 0.42%Oct 24, 2025
- High7.5The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to Server-Side Request Forgery in all versCheck if you run itEPSS 0.38%Oct 24, 2025
- Medium6.8The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.2.4.Check if you run itEPSS 0.39%Oct 24, 2025
- High8.8The IndieAuth plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4.Check if you run itEPSS 0.21%Oct 24, 2025
- Medium6.3The URL Shortener Plugin For WordPress plugin for WordPress is vulnerable to unauthorized access to functionality provided by the API due to a missing capability check on the verifCheck if you run itEPSS 0.27%Oct 24, 2025
- Medium4.3The Disable Content Editor For Specific Template plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.Check if you run itEPSS 0.13%Oct 24, 2025
- Medium6.1The Multi Item Responsive Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.Check if you run itEPSS 0.21%Oct 24, 2025
- Medium5.5The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.2 does not limit URLs which may be used for the stock photo iCheck if you run itEPSS 0.19%Oct 24, 2025
- Medium6.2An issue was discovered in the NDIS Usermode IO driver (RtkIOAC60.sys, version 6.0.5600.16348) allowing local authenticated attackers to send a crafted IOCTL request to the driverCheck if you run itEPSS 0.13%Oct 24, 2025
- Critical10.0Server-side request forgery (ssrf) in Azure Compute Gallery allows an unauthorized attacker to elevate privileges over a network.Check if you run itEPSS 0.77%Oct 23, 2025
- Medium5.4A flaw was found in Keycloak.Check if you run itEPSS 0.30%Oct 23, 2025
- Medium5.0The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions uCheck if you run itEPSS 0.29%Oct 23, 2025
- Medium5.3The MxChat – AI Chatbot for WordPress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.4.6.Check if you run itEPSS 0.29%Oct 23, 2025
- Medium5.3Cross site request forgery (CSRF) vulnerability in KeeneticOS before 4.3 at "/rci" API endpoint allows attackers to take over the device via adding additional users with full permiCheck if you run itEPSS 0.18%Oct 23, 2025
- Critical9.0Improper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and earlier allows an authenticated basic user to self-approve or approve the temporary acCheck if you run itEPSS 0.33%Oct 22, 2025
- Medium5.1An improper input validation in the Security Dashboard ignored-tasks API of Devolutions Server 2025.2.15.0 and earlier allows an authenticated user to cause a denial of service toCheck if you run itEPSS 0.45%Oct 22, 2025
- High8.8Cross-Site Request Forgery (CSRF) vulnerability in Tusko Trush Advanced Custom Fields : CPT Options Pages acf-cpt-options-pages allows Object Injection.This issue affects AdvancedCheck if you run itEPSS 0.20%Oct 22, 2025
- High7.1Cross-Site Request Forgery (CSRF) vulnerability in integrationshotelrunner HotelRunner Booking Widget hotelrunner allows Stored XSS.This issue affects HotelRunner Booking Widget: fCheck if you run itEPSS 0.13%Oct 22, 2025
- Medium4.3Cross-Site Request Forgery (CSRF) vulnerability in John James Jacoby WP Media Categories wp-media-categories allows Cross Site Request Forgery.This issue affects WP Media CategorieCheck if you run itEPSS 0.14%Oct 22, 2025
- High7.1Cross-Site Request Forgery (CSRF) vulnerability in johnh10 Video Blogster Lite video-blogster-lite allows Stored XSS.This issue affects Video Blogster Lite: from n/a through <= 1.2Check if you run itEPSS 0.13%Oct 22, 2025
- Medium4.4Server-Side Request Forgery (SSRF) vulnerability in Icegram Icegram Express Pro email-subscribers-premium allows Server Side Request Forgery.This issue affects Icegram Express Pro:Check if you run itEPSS 0.21%Oct 22, 2025
- Medium5.4Server-Side Request Forgery (SSRF) vulnerability in captcha.eu Captcha.eu captcha-eu allows Server Side Request Forgery.This issue affects Captcha.eu: from n/a through <= 1.0.61.Check if you run itEPSS 0.21%Oct 22, 2025
- Medium4.3Cross-Site Request Forgery (CSRF) vulnerability in Evergreen Content Poster Evergreen Content Poster evergreen-content-poster allows Cross Site Request Forgery.This issue affects ECheck if you run itEPSS 0.14%Oct 22, 2025
Sort