Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.5The Product Filter by WBW plugin for WordPress is vulnerable to SQL Injection via the 'filtersDataBackend' parameter in all versions up to, and including, 2.9.7.Check if you run itEPSS 0.39%Oct 25, 2025
- High7.5The wpForo Forum plugin for WordPress is vulnerable to error‐based or time-based SQL Injection via the get_members() function in all versions up to, and including, 2.4.8 due to misCheck if you run itEPSS 0.37%Oct 25, 2025
- Medium5.3The Social Feed Gallery plugin for WordPress is vulnerable to Information Exposure in versions less than, or equal to, 4.9.2.Check if you run itEPSS 0.30%Oct 25, 2025
- High7.5The Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions plugin for WordPress is vulnerable to SQL Injection via the 'wpfs-form-name' parameCheck if you run itEPSS 0.35%Oct 25, 2025
- Medium6.3The The Discussion Board – WordPress Forum Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.5.5.Check if you run itEPSS 0.26%Oct 25, 2025
- Medium4.3The Advanced Database Cleaner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.6.Check if you run itEPSS 0.23%Oct 25, 2025
- Medium4.3The Password Policy Manager | Password Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'moppm_ajax' AJAX enCheck if you run itEPSS 0.20%Oct 25, 2025
- Medium6.4The Widget Options – The #1 WordPress Widget & Block Control Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple functions in all versions up to,Check if you run itEPSS 0.19%Oct 25, 2025
- Medium6.5The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to SQL Injection via the donation_ids parameter in aCheck if you run itEPSS 0.38%Oct 25, 2025
- High8.1The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to arbitrary file move due to insufficient file path validatioCheck if you run itEPSS 0.91%Oct 25, 2025
- Medium4.4The Fast Velocity Minify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.5.1 due to insufficient inputCheck if you run itEPSS 0.24%Oct 25, 2025
- High8.8The Simple Registration for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.8.Check if you run itEPSS 0.20%Oct 25, 2025
- Medium4.3The WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress plugin for WordPress is vulnerable to unauthorized access of data in all versions up to, and including, 8.5.41.Check if you run itEPSS 0.24%Oct 25, 2025
- Medium5.4The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.8.3 due to mCheck if you run itEPSS 0.18%Oct 25, 2025
- Medium5.3The User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin for WordPress is vulnerable to unauthorized access of data due to a missing capabiliCheck if you run itEPSS 0.26%Oct 25, 2025
- Low2.7The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficientCheck if you run itEPSS 0.22%Oct 25, 2025
- Medium6.5The GenerateBlocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_option_rest' function in all versions up to, andCheck if you run itEPSS 0.29%Oct 25, 2025
- Medium6.4The Open Source Genesis Framework theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's shortcodes in all versions up to, and including, 3.6.0 due to insCheck if you run itEPSS 0.19%Oct 25, 2025
- Medium6.4The Gutenberg Blocks – PublishPress Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Marker Title' and 'Marker Description' parameters for the MapsCheck if you run itEPSS 0.23%Oct 25, 2025
- Low3.7The Password Protected plugin for WordPress is vulnerable to authorization bypass via IP address spoofing in all versions up to, and including, 2.7.11.Check if you run itEPSS 0.31%Oct 25, 2025
- Medium6.4The Testimonial Carousel For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions less than, or equal to, 11.6.2 due to iCheck if you run itEPSS 0.25%Oct 25, 2025
- Medium5.3The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check while verifying webhoCheck if you run itEPSS 0.29%Oct 25, 2025
- Medium6.4The Listeo theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in version less than, or equal to, 2.0.8 due to insufficient input sanitizatiCheck if you run itEPSS 0.19%Oct 25, 2025
- Medium4.3The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.8.3.Check if you run itEPSS 0.22%Oct 25, 2025
- High7.2The Watu Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTTP Referer header in versions less than, or equal to, 3.4.4 due to insufficient input saniCheck if you run itEPSS 0.26%Oct 25, 2025
Sort