Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.4The Dynamic AJAX Product Filters for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 1.Check if you run itEPSS 0.25%Aug 28, 2025
- Medium5.3The Ajax Search Lite plugin for WordPress is vulnerable to Basic Information Exposure due to missing authorization in its AJAX search handler in all versions up to, and including,Check if you run itEPSS 0.32%Aug 28, 2025
- Critical9.8The RingCentral Communications plugin for WordPress is vulnerable to Authentication Bypass due to improper validation within the ringcentral_admin_login_2fa_verify() function in veCheck if you run itEPSS 0.74%Aug 28, 2025
- High7.5The Xagio SEO plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.1.0.5 via the backup functionality due to weak filename sCheck if you run itEPSS 0.39%Aug 28, 2025
- Medium6.5The Simple Download Monitor plugin for WordPress is vulnerable to time-based SQL Injection via the order parameter in all versions up to, and including, 3.9.33 due to insufficientCheck if you run itEPSS 0.33%Aug 28, 2025
- Medium4.9The File Manager, Code Editor, and Backup by Managefy plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.4.8 via the ajax_downloadfile() fCheck if you run itEPSS 0.50%Aug 28, 2025
- Medium6.4The Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including, 10.14.1 due to insufficient input sanitizaCheck if you run itEPSS 0.20%Aug 28, 2025
- Medium6.4The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 1.5.148 due to insuCheck if you run itEPSS 0.25%Aug 28, 2025
- Medium6.1The WP ULike Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the WP_Ulike_Pro_File_Uploader class in all versions up toCheck if you run itEPSS 0.21%Aug 28, 2025
- Medium4.3Multiple plugins and/or themes for WordPress by LiquidThemes are vulnerable to unauthorized access due to a missing capability check on the liquid_reset_wordpress_before AJAX in vaCheck if you run itEPSS 0.20%Aug 28, 2025
- None0.0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.Open the advisoryAug 28, 2025
- High7.5IBM Security Verify Governance Identity Manager 10.0.2 could allow a remote attacker to obtain sensitive information when detailed technical error messages are returned.Check if you run itEPSS 0.34%Aug 28, 2025
- Medium6.4The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugCheck if you run itEPSS 0.25%Aug 28, 2025
- Medium6.1The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘'fl_builder' parameter in all versions up to, and includinCheck if you run itEPSS 0.22%Aug 28, 2025
- High8.8The Video Share VOD – Turnkey Video Site Builder Script plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.6.Check if you run itEPSS 0.26%Aug 28, 2025
- Medium5.4The Pronamic Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the description field in all versions up to, and including, 2.4.1 due to insufficientCheck if you run itEPSS 0.25%Aug 28, 2025
- Critical10.0Sangoma FreePBX Authentication Bypass VulnerabilityPatch nowKEVEPSS 95.21%Aug 28, 2025
- Medium5.3An input validation flaw in the 'ate' service of Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 to escalate privileges to root via a crafted UDP packet.Check if you run itEPSS 0.80%Aug 28, 2025
- Medium5.3Incorrect access control in the endpoint /goform/ate of Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 allows attackers to escalate privileges or access sensitive components viaCheck if you run itEPSS 0.24%Aug 28, 2025
- Medium5.3Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 was discovered to contain a stack overflow via the security_5g parameter in the function sub_46284C.Check if you run itEPSS 0.59%Aug 28, 2025
- Medium5.3Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 was discovered to contain a stack overflow via the Password parameter in the function R7WebsSecurityHandler.Check if you run itEPSS 0.51%Aug 28, 2025
- High7.5Tenda AC10 v4.0 firmware v16.03.10.20 was discovered to contain a stack overflow via the function get_parentControl_list_Info.Check if you run itEPSS 0.39%Aug 28, 2025
- Medium6.1FormCms v0.5.5 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload feature.Check if you run itEPSS 0.20%Aug 28, 2025
- Critical9.8D-Link dir-868l_firmware Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Patch nowKEVEPSS 6.97%Aug 28, 2025
- Medium5.3An issue was discovered in Tenda AC8 v4.0 AC1200 Dual-band Gigabit Wireless Router AC8v4.0 Firmware 16.03.33.05.Check if you run itEPSS 0.31%Aug 28, 2025
Sort