Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.1The illi Link Party! WordPress plugin through 1.0 does not sanitise and escape some parameters, which could allow unauthenticated vistors to perform Cross-Site Scripting attacks.Check if you run itEPSS 0.32%May 15, 2025
- High7.1The Marketing Twitter Bot WordPress plugin through 1.11 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to makCheck if you run itEPSS 0.17%May 15, 2025
- Medium4.3The Ultimate Noindex Nofollow Tool WordPress plugin through 1.1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admiCheck if you run itEPSS 0.21%May 15, 2025
- Medium4.3The WP-Reply Notify WordPress plugin through 1.1 does not have a CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them vCheck if you run itEPSS 0.21%May 15, 2025
- High7.1The aBitGone CommentSafe WordPress plugin through 1.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to makCheck if you run itEPSS 0.19%May 15, 2025
- Medium4.8The Better Follow Button for Jetpack WordPress plugin through 8.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to performCheck if you run itEPSS 0.31%May 15, 2025
- Medium5.4The Add SVG Support for Media Uploader | inventivo WordPress plugin through 1.0.5 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to uploCheck if you run itEPSS 0.30%May 15, 2025
- Medium5.4The SVG Uploads Support WordPress plugin through 2.1.1 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containiCheck if you run itEPSS 0.30%May 15, 2025
- Medium6.1The Payment Gateway for Telcell WordPress plugin through 2.0.1 does not validate the api_url parameter before redirecting the user to its value, leading to an Open Redirect issueCheck if you run itEPSS 0.52%May 15, 2025
- Medium4.8The WolfNet IDX for WordPress plugin through 1.19.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Check if you run itEPSS 0.37%May 15, 2025
- Medium6.1The Allow SVG WordPress plugin before 1.2.0 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS paylCheck if you run itEPSS 0.39%May 15, 2025
- Medium5.4The LogDash Activity Log WordPress plugin before 1.1.4 hooks the wp_login_failed function (from src/Hooks/Users.php) in order to log failed login attempts to the database but it doCheck if you run itEPSS 0.85%May 15, 2025
- High7.3The Travelpayouts: All Travel Brands in One Place WordPress plugin before 1.1.13 does not have CSRF check in place when importing settings from the v1, which could allow attackersCheck if you run itEPSS 0.25%May 15, 2025
- Medium4.8The Travelpayouts: All Travel Brands in One Place WordPress plugin before 1.1.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a ReflecCheck if you run itEPSS 0.39%May 15, 2025
- Medium4.8The Advanced Page Visit Counter WordPress plugin before 8.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform StoCheck if you run itEPSS 0.39%May 15, 2025
- Medium5.4The edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector WordPress plugin before 1.6.6 does not have CSRF check when updating iCheck if you run itEPSS 0.18%May 15, 2025
- Medium5.4The WP-PManager WordPress plugin through 1.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacksCheck if you run itEPSS 0.16%May 15, 2025
- Medium5.4The WP-PManager WordPress plugin through 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CCheck if you run itEPSS 0.17%May 15, 2025
- Medium6.1The FunnelKit WordPress plugin before 3.10.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacksCheck if you run itEPSS 0.27%May 15, 2025
- Medium5.4The Ninja Pages WordPress plugin through 1.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-SiteCheck if you run itEPSS 0.26%May 15, 2025
- Medium6.1The Plugin Oficial WordPress plugin through 1.7.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting whichCheck if you run itEPSS 0.58%May 15, 2025
- Medium4.8The Plugin Oficial WordPress plugin through 1.7.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-SiCheck if you run itEPSS 0.27%May 15, 2025
- Medium6.1The WOOEXIM WordPress plugin through 5.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make an unauthenCheck if you run itEPSS 0.17%May 15, 2025
- Medium6.1The Download HTML TinyMCE Button WordPress plugin through 1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site ScriCheck if you run itEPSS 0.27%May 15, 2025
- Medium4.8The Badgearoo WordPress plugin through 1.0.14 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site SCheck if you run itEPSS 0.29%May 15, 2025
Sort