Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.2The Buddypress Force Password Change plugin for WordPress is vulnerable to authenticated account takeover due to the plugin not properly validating a user's identity prior to updatCheck if you run itEPSS 0.22%Apr 24, 2025
- High8.3The Verification SMS with TargetSMS plugin for WordPress is vulnerable to limited Remote Code Execution in all versions up to, and including, 1.5 via the 'targetvr_ajax_handler' fuCheck if you run itEPSS 0.94%Apr 24, 2025
- Medium6.5The ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin for WordPress is vulnerable to SQL Injection via the 'attribute_value_filter' parameter in all versionsCheck if you run itEPSS 0.39%Apr 24, 2025
- Medium5.3The Reales WP - Real Estate WordPress Theme theme for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'reales_delete_Check if you run itEPSS 0.29%Apr 24, 2025
- Medium6.4The FuseDesk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘successredirect’ parameter in all versions up to, and including, 6.7 due to insufficient inpCheck if you run itEPSS 0.32%Apr 24, 2025
- High7.2The WPMasterToolKit (WPMTK) – All in one plugin plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.5.2.Check if you run itEPSS 0.89%Apr 24, 2025
- Medium6.4The Lottie Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File uploads in all versions up to, and including, 1.1.8 due to insufficient input sanitizatCheck if you run itEPSS 0.32%Apr 24, 2025
- High8.8The Frontend Login and Registration Blocks plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.8.Check if you run itEPSS 0.45%Apr 24, 2025
- Critical9.8The Flynax Bridge plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.2.0.Check if you run itEPSS 0.73%Apr 24, 2025
- High8.8The Configurator Theme Core plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.4.7.Check if you run itEPSS 0.38%Apr 24, 2025
- Medium6.4The Advanced Accordion Gutenberg Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 5.0.2 due to insCheck if you run itEPSS 0.33%Apr 24, 2025
- Medium4.3The Woocommerce Automatic Order Printing | ( Formerly WooCommerce Google Cloud Print) plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to,Check if you run itEPSS 0.28%Apr 24, 2025
- Critical9.1The Database Toolset plugin is vulnerable to arbitrary file deletion due to insufficient file path validation in a function in all versions up to, and including, 1.8.4.Check if you run itEPSS 1.13%Apr 24, 2025
- High8.8The Xelion Webchat plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the xwc_save_sCheck if you run itEPSS 0.48%Apr 24, 2025
- Medium4.3An issue has been discovered in access controls could allow users to view certain restricted project information even when related features are disabled in GitLab EE, affecting allCheck if you run itEPSS 0.31%Apr 24, 2025
- Medium6.5An issue has been discovered affecting service availability via issue preview in GitLab CE/EE affecting all versions from 16.7 before 17.9.7, 17.10 before 17.10.5, and 17.11 beforeCheck if you run itEPSS 0.46%Apr 24, 2025
- High7.7An issue has been discovered in GitLab EE/CE that could allow an attacker to track users' browsing activities, potentially leading to full account take-over, affecting all versionsCheck if you run itEPSS 0.39%Apr 24, 2025
- High8.8The My Tickets – Accessible Event Ticketing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.16.Check if you run itEPSS 0.38%Apr 24, 2025
- Low3.1Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate permissions for the API endpoint /plugins/playbooks/api/v0/signal/keywords/ignorCheck if you run itEPSS 0.28%Apr 24, 2025
- Medium6.5Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to validate the uniqueness and quantity of task actions within the UpdateRunTaskActions GraphQL operaCheck if you run itEPSS 0.40%Apr 24, 2025
- Medium6.5Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate the props used by the RetrospectivePost custom post type in the Playbooks pluginCheck if you run itEPSS 0.50%Apr 24, 2025
- Medium6.8Use of hard-coded cryptographic key vulnerability in i-PRO Configuration Tool affects the network system for i-PRO Co., Ltd.Check if you run itEPSS 0.17%Apr 24, 2025
- High8.6The-wound WordPress theme through 0.0.1 does not validate some parameters before using them to generate paths passed to include function/s, allowing unauthenticated users to perforCheck if you run itEPSS 2.41%Apr 24, 2025
- Medium4.8The Category Posts Widget WordPress plugin before 4.9.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored CCheck if you run itEPSS 0.27%Apr 24, 2025
- Medium4.4The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the board_header and board_footer parameters in all versions up to, and including, 1.8.6 dueCheck if you run itEPSS 0.24%Apr 24, 2025
Sort