Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in icc0rz H5P h5p allows Stored XSS.This issue affects H5P: from n/a through <= 1Check if you run itEPSS 0.20%Oct 27, 2025
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev Activity Plus Reloaded for BuddyPress bp-activity-plus-reloaded allowCheck if you run itEPSS 0.20%Oct 27, 2025
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Konstantin Pankratov Date counter date-counter allows Stored XSS.This issue afCheck if you run itEPSS 0.20%Oct 27, 2025
- Medium6.5Missing Authorization vulnerability in Nelio Software Nelio Content nelio-content allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Nelio CCheck if you run itEPSS 0.33%Oct 27, 2025
- Medium5.4Missing Authorization vulnerability in Conversios Conversios.io enhanced-e-commerce-for-woocommerce-store allows Exploiting Incorrectly Configured Access Control Security Levels.ThCheck if you run itEPSS 0.27%Oct 27, 2025
- Medium6.5Missing Authorization vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affecCheck if you run itEPSS 0.33%Oct 27, 2025
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Debuggers Studio Marquee Addons for Elementor marquee-addons-for-elementor allCheck if you run itEPSS 0.20%Oct 27, 2025
- Medium5.3Missing Authorization vulnerability in Shambhu Patnaik Export Categories export-categories allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects ExportCheck if you run itEPSS 0.29%Oct 27, 2025
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pagup Bulk Auto Image Title Attribute bulk-image-title-attribute allows DOM-BaCheck if you run itEPSS 0.20%Oct 27, 2025
- Medium5.4Missing Authorization vulnerability in themeshopy TS Demo Importer ts-demo-importer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TS DeCheck if you run itEPSS 0.28%Oct 27, 2025
- Medium5.4Missing Authorization vulnerability in ignitionwp IgnitionDeck ignitiondeck allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IgnitionDeck:Check if you run itEPSS 0.28%Oct 27, 2025
- UnknownThis CVE ID has been rejected or withdrawn by its CVE Numbering Authority.Open the advisoryOct 27, 2025
- UnknownThis CVE ID has been rejected or withdrawn by its CVE Numbering Authority.Open the advisoryOct 27, 2025
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RexTheme WP VR wpvr allows DOM-Based XSS.This issue affects WP VR: from n/a thCheck if you run itEPSS 0.21%Oct 27, 2025
- Medium4.3Missing Authorization vulnerability in Premmerce Premmerce User Roles premmerce-user-roles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affectCheck if you run itEPSS 0.25%Oct 27, 2025
- Unknown** REJECT ** DO NOT USE THIS CANDIDATE NUMBER.Check if you run itEPSS 1.00%Oct 27, 2025
- Unknown** REJECT ** DO NOT USE THIS CANDIDATE NUMBER.Check if you run itEPSS 1.00%Oct 27, 2025
- Unknown** REJECT ** DO NOT USE THIS CANDIDATE NUMBER.Check if you run itEPSS 1.00%Oct 27, 2025
- Low2.7GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.3, and 18.5 before 18.5.1 that under certain conditions could have allowed authenticated usCheck if you run itEPSS 0.32%Oct 27, 2025
- Critical10.0An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by default, allowing an on-path attacker to execute injected JavaCheck if you run itEPSS 0.29%Oct 27, 2025
- High8.0StarCharge Artemis AC Charger 7-22 kW v1.0.4 was discovered to contain a stack overflow via the cgiMain function at download.cgi.Check if you run itEPSS 0.29%Oct 27, 2025
- High8.8AhnLab EPP 1.0.15 is vulnerable to SQL Injection via the "preview parameter."Check if you run itEPSS 0.32%Oct 27, 2025
- Medium6.4The The7 — Website and eCommerce Builder for WordPress theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ the7_fancy_title_css’ parameter in all versions upCheck if you run itEPSS 0.19%Oct 25, 2025
- Medium4.3The FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) plugin for WordPress is vulnerable to Cross-Site Request FoCheck if you run itEPSS 0.14%Oct 25, 2025
- Medium6.4The SpendeOnline.org plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spendeonline' shortcode in all versions up to, and including, 3.0.1 due toCheck if you run itEPSS 0.23%Oct 25, 2025
Sort