Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.4The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'additional' parameter in version less than, or equal to, 2025.6 due to insufficient iCheck if you run itEPSS 0.25%Aug 16, 2025
- Medium6.1The Ebook Store WordPress plugin before 5.8015 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Check if you run itEPSS 0.22%Aug 16, 2025
- Medium6.4The Intl DateTime Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘date’ parameter in all versions up to, and including, 1.0.1 due to insufficienCheck if you run itEPSS 0.25%Aug 16, 2025
- Medium6.1The weichuncai(WP伪春菜) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.Check if you run itEPSS 0.14%Aug 16, 2025
- Medium6.4Anber Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the $anber_item['button_link']['url']’ parameter in all versions up to, and including, 1Check if you run itEPSS 0.20%Aug 16, 2025
- High8.8The School Management System for Wordpress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the homework.php file in all versionsCheck if you run itEPSS 0.59%Aug 16, 2025
- Medium6.6The Woocommerce Blocks – Woolook plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7.0 via the via the 'tab' parameter.Check if you run itEPSS 0.85%Aug 16, 2025
- Medium6.1The LatestCheckins plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.Check if you run itEPSS 0.18%Aug 16, 2025
- Medium6.1The Linux Promotional Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.Check if you run itEPSS 0.18%Aug 16, 2025
- High7.5The AL Pack plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the check_activate_permission() permission callback for the /wp-json/presCheck if you run itEPSS 0.51%Aug 16, 2025
- High8.8The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to unauthorized admin account creation in all versions up to, and including, 67.7.0.Check if you run itEPSS 0.32%Aug 16, 2025
- Medium6.4The Surbma | Recent Comments Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'recent-comments' shortcode in all versions up to, and incCheck if you run itEPSS 0.25%Aug 16, 2025
- Medium6.4The Anber Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the $item['button_link']['url'] parameter in all versions up to, and including, 1.0.Check if you run itEPSS 0.25%Aug 16, 2025
- High8.8The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 67.7.0 via the 'page' parameter.Check if you run itEPSS 0.75%Aug 16, 2025
- Medium6.1The Last.fm Recent Album Artwork plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2.Check if you run itEPSS 0.18%Aug 16, 2025
- Medium6.4The Earnware Connect plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ew_hasrole' shortcode in all versions up to, and including, 1.0.74 due to iCheck if you run itEPSS 0.32%Aug 16, 2025
- Medium6.4The Embed Bokun plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ parameter in all versions up to, and including, 0.23 due to insufficient input sanCheck if you run itEPSS 0.26%Aug 16, 2025
- High7.5The School Management System for Wordpress plugin for WordPress is vulnerable to SQL Injection via several parameters across multiple AJAX action in all versions up to, and includiCheck if you run itEPSS 0.43%Aug 16, 2025
- Medium6.5Cross-Site Request Forgery (CSRF) vulnerability in iThemes ServerBuddy by PluginBuddy.Com allows Object Injection.This issue affects ServerBuddy by PluginBuddy.Com: from n/a througCheck if you run itEPSS 0.16%Aug 16, 2025
- Medium5.3The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and including, 5.8.9 via the 'ayCheck if you run itEPSS 0.27%Aug 16, 2025
- High7.1Claude Code is an agentic coding tool.Check if you run itEPSS 0.60%Aug 16, 2025
- High7.3z2d is a pure Zig 2D graphics library.Check if you run itEPSS 0.14%Aug 16, 2025
- Low2.3A vulnerability was found in Buttercup buttercup-browser-extension up to 0.14.2.Check if you run itEPSS 0.48%Aug 15, 2025
- Medium4.3HCL BigFix SaaS Authentication Service is affected by a SQL injection vulnerability.Check if you run itEPSS 0.33%Aug 15, 2025
- Medium5.3HCL BigFix SaaS Authentication Service is affected by a sensitive information disclosure.Check if you run itEPSS 0.27%Aug 15, 2025
Sort