Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.0Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the invited recipient's email address when redeeming team…Check if you run itEPSS 0.16%Oct 16, 2026
- High7.1Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST parameter which a…Check if you run itEPSS 0.19%Oct 16, 2026
- Medium6.5Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to limit the size of remote image responses buffered in memory during…Check if you run itEPSS 0.28%Oct 16, 2026
- Medium6.4The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'purchased_plan' parameter in all versions up to…Check if you run itEPSS 0.24%Oct 16, 2026
- High7.5Observable response discrepancy vulnerability in IKAS Technology Inc.Check if you run itEPSS 0.24%Oct 16, 2026
- Critical9.3Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in halfdata Green Popups halfdata-green-popups allows Blind SQL Inje…Check if you run itEPSS 0.24%Oct 16, 2026
- High8.8The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.7.7…Check if you run itEPSS 0.57%Oct 16, 2026
- High8.8The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the parameter of the…Check if you run itEPSS 1.47%Oct 16, 2026
- Medium4.3Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to cap the number and size of mention keys stored in a user's notifi…Check if you run itEPSS 0.21%Oct 16, 2026
- Medium4.3The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_status() and bulk() functions in…Check if you run itEPSS 0.20%Oct 16, 2026
- Medium4.3Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize the active channel field returned by the user status API…Check if you run itEPSS 0.18%Oct 16, 2026
- Medium4.9Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to invalidate the stored AD/LDAP bind password when other connection…Check if you run itEPSS 0.23%Oct 16, 2026
- Medium6.5Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validating an o…Check if you run itEPSS 0.22%Oct 16, 2026
- Medium6.4Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to enforce DM/GM check on server side which allows an authenticated u…Check if you run itEPSS 0.15%Oct 16, 2026
- Medium6.5Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the combination of guest and admin scheme roles which all…Check if you run itEPSS 0.22%Oct 16, 2026
- Medium5.4The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for…Check if you run itEPSS 0.18%Oct 16, 2026
- Medium4.9The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to generic SQL Injection via the 'data[orderby]' parameter in all versions up to, and inclu…Check if you run itEPSS 0.29%Oct 16, 2026
- Medium6.4The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'twitteruse…Check if you run itEPSS 0.22%Oct 16, 2026
- High7.2The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'CalendarTitle' parameter in all versions up to, and includ…Check if you run itEPSS 0.25%Oct 16, 2026
- Medium6.4The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note' parameter in all versions up to,…Check if you run itEPSS 0.22%Oct 16, 2026
- Medium5.3Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects…Check if you run itEPSS 0.18%Oct 16, 2026
- Medium6.4The WebberZone Top 10 — Popular Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'other_attributes (parsed to inject instance_id) + unde…Check if you run itEPSS 0.21%Oct 16, 2026
- Medium5.4The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.9 This is due to the plugin removi…Check if you run itEPSS 0.29%Oct 16, 2026
- Low2.7The WP Mail Logging plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.17.0 via the 'email_address' parameter.Check if you run itEPSS 0.32%Oct 16, 2026
- Medium6.4The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'message' parameter in a…Check if you run itEPSS 0.26%Oct 16, 2026