Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Low3.5The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-SitCheck if you run itEPSS 0.27%May 2, 2025
- Medium6.5The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 4.17.4.Check if you run itEPSS 0.34%May 2, 2025
- Medium6.4The Formality plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ parameter in all versions up to, and including, 1.5.8 due to insufficient input saniCheck if you run itEPSS 0.28%May 2, 2025
- Medium4.3The Homey theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the homey_reservation_del() function in all versions up to, anCheck if you run itEPSS 0.24%May 2, 2025
- High8.8Multiple plugins and/or themes for WordPress are vulnerable to Arbitrary File Uploads due to a missing capability check on the ajaxUploadFonts() function in various versions.Check if you run itEPSS 0.76%May 2, 2025
- Medium4.3Multiple plugins and/or themes for WordPress are vulnerable to unauthorized access due to a missing capability check on several AJAX actions like 'gsf_reset_section_options', 'gsf_Check if you run itEPSS 0.24%May 2, 2025
- High7.5The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the 'a_id' parameter in all versions up to, and including,Check if you run itEPSS 1.75%May 2, 2025
- Medium6.5The FULL – Cliente plugin for WordPress is vulnerable to SQL Injection via the 'formId' parameter in all versions 3.1.5 to 3.1.25 due to insufficient escaping on the user suppliedCheck if you run itEPSS 0.39%May 2, 2025
- Medium6.4The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in all versions up to, and including, 5.4 due to insufficient input saCheck if you run itEPSS 0.28%May 2, 2025
- Medium4.3The Homey theme for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.4 via the 'homey_delete_user_account' action due to missinCheck if you run itEPSS 0.24%May 2, 2025
- High7.5The Advance Seat Reservation Management for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'profileId' parameter in all versions up to, and including, 3.3Check if you run itEPSS 0.41%May 2, 2025
- Medium6.4The Taxonomy Chain Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's pn_chain_menu shortcode in all versions up to, and including, 1.0.8 due tCheck if you run itEPSS 0.28%May 2, 2025
- Medium6.4Multiple plugins and/or themes for WordPress using Smart Framework are vulnerable to Stored Cross-Site Scripting due to a missing capability check on the saveOptions() and importThCheck if you run itEPSS 0.20%May 2, 2025
- Critical9.8Agentflow from Flowring Technology has an Account Lockout Bypass vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to perform password brute foCheck if you run itEPSS 0.56%May 2, 2025
- Medium5.3The Flynax Bridge plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the deleteUser() function in all versions up to, and includinCheck if you run itEPSS 0.36%May 2, 2025
- Medium6.4The KiwiChat NextClient plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 6.2 due to insufficient inpuCheck if you run itEPSS 0.30%May 2, 2025
- Medium5.3The Yame | Link In Bio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.9.0 through the publicly accessible phpinfo.phpCheck if you run itEPSS 0.39%May 2, 2025
- High7.3The Flynax Bridge plugin for WordPress is vulnerable to limited Privilege Escalation due to a missing capability check on the registerUser() function in all versions up to, and incCheck if you run itEPSS 0.37%May 2, 2025
- Critical9.8The OTP-less one tap Sign in plugin for WordPress is vulnerable to privilege escalation via account takeover in versions 2.0.14 to 2.0.59.Check if you run itEPSS 0.55%May 2, 2025
- Medium6.5User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.Check if you run itEPSS 0.88%May 2, 2025
- Medium6.9A vulnerability was found in itsourcecode Gym Management System 1.0.Check if you run itEPSS 0.60%May 2, 2025
- Medium6.9A vulnerability was found in itsourcecode Restaurant Management System 1.0 and classified as critical.Check if you run itEPSS 0.60%May 2, 2025
- Medium6.5IBM Concert Software 1.0.0 through 1.0.5 is vulnerable to server-side request forgery (SSRF).Check if you run itEPSS 0.25%May 2, 2025
- Medium5.3IBM Concert Software 1.0.0 through 1.0.5 could allow a remote attacker to traverse directories on the system.Check if you run itEPSS 0.51%May 2, 2025
- Medium5.9IBM Concert Software 1.0.0 through 1.0.5 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.Check if you run itEPSS 0.21%May 2, 2025
Sort