Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.3The Content Writer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.8 through publicly exposed log files.Check if you run itEPSS 0.33%Oct 15, 2025
- Critical9.8The OwnID Passwordless Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.3.4.Check if you run itEPSS 0.79%Oct 15, 2025
- Critical9.8The Orion SMS OTP Verification plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.7.Check if you run itEPSS 0.43%Oct 15, 2025
- Medium5.3The Zip Attachments plugin for WordPress is vulnerable to unauthorized loss of data due to a missing authorization and capability checks on the download.php file in all versions upCheck if you run itEPSS 0.24%Oct 15, 2025
- Medium6.4The Quick Social Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'quick-login' shortcode in all versions up to, and including, 1.4.6 due toCheck if you run itEPSS 0.29%Oct 15, 2025
- Medium6.5The WP Google Map Plugin plugin for WordPress is vulnerable to blind SQL Injection via the 'id' parameter of the 'google_map' shortcode in all versions up to, and including, 1.0 duCheck if you run itEPSS 0.28%Oct 15, 2025
- Medium4.3The Theme Importer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.Check if you run itEPSS 0.13%Oct 15, 2025
- Medium4.3The Library Management System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the owt7_library_management_ajax_handler(Check if you run itEPSS 0.23%Oct 15, 2025
- Medium4.3The TopBar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0.Check if you run itEPSS 0.17%Oct 15, 2025
- Medium6.4The WP ViewSTL plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'viewstl' shortcode in all versions up to, and including, 1.0 due to insufficientCheck if you run itEPSS 0.24%Oct 15, 2025
- Medium6.5The Binary MLM Plan plugin for WordPress is vulnerable to limited Privilege Escalation in all versions up to, and including, 3.0.Check if you run itEPSS 0.34%Oct 15, 2025
- High7.5The Woocommerce Category and Products Accordion Panel plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0 via the 'categoryaccordioCheck if you run itEPSS 0.61%Oct 15, 2025
- High7.5The Outdoor plugin for WordPress is vulnerable to SQL Injection via the 'edit' action in all versions up to, and including, 1.3.2 due to insufficient escaping on the user suppliedCheck if you run itEPSS 0.38%Oct 15, 2025
- Medium6.4The Dhivehi Text plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dhivehi' shortcode in all versions up to, and including, 0.1 due to insufficienCheck if you run itEPSS 0.24%Oct 15, 2025
- High8.8The WPBifröst – Instant Passwordless Temporary Login Links plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ctl_create_link AJAXCheck if you run itEPSS 0.36%Oct 15, 2025
- Medium6.4The URLYar URL Shortner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'urlyar_shortlink' shortcode in all versions up to, and including, 1.1.0Check if you run itEPSS 0.24%Oct 15, 2025
- High7.5The External Login plugin for WordPress is vulnerable to SQL Injection via the 'log' parameter in all versions up to, and including, 1.11.2 due to insufficient escaping on the userCheck if you run itEPSS 0.40%Oct 15, 2025
- High7.2The Demo Import Kit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.1.0 via the import funcCheck if you run itEPSS 0.69%Oct 15, 2025
- Critical9.8The Flex QR Code Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in thesave_qr_code_to_db() function in all versions up tCheck if you run itEPSS 0.92%Oct 15, 2025
- Medium6.5The WP jQuery Pager plugin for WordPress is vulnerable to SQL Injection via the 'ids' shortcode attribute parameter handled by the WPJqueryPaged::get_gallery_page_imgs() function iCheck if you run itEPSS 0.28%Oct 15, 2025
- Medium5.3The WhyDonate – FREE Donate button – Crowdfunding – Fundraising plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the remove_rowCheck if you run itEPSS 0.36%Oct 15, 2025
- Medium6.5The Wp tabber widget plugin for WordPress is vulnerable to SQL Injection via the 'wp-tabber-widget' shortcode in all versions up to, and including, 4.0 due to insufficient escapingCheck if you run itEPSS 0.28%Oct 15, 2025
- Medium4.3The FunKItools plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2.Check if you run itEPSS 0.13%Oct 15, 2025
- Medium4.9The onOffice for WP-Websites plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and including, 6.5.1 due to insufficient escapingCheck if you run itEPSS 0.37%Oct 15, 2025
- Medium4.9The Rich Snippet Site Report plugin for WordPress is vulnerable to SQL Injection via the 'last' parameter in all versions up to, and including, 2.0.0105 due to insufficient escapinCheck if you run itEPSS 0.36%Oct 15, 2025
Sort