Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.8The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43.Check if you run itEPSS 0.37%Oct 16, 2026
- Medium5.3The Lightweight Cookie Notice – Cookie Banner for Cookie Consent plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includ…Check if you run itEPSS 0.21%Oct 16, 2026
- High7.2The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' parameter in all versions up to, and including, 1.6.7 due…Check if you run itEPSS 0.24%Oct 16, 2026
- Medium6.4The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form' parameter in all versions up to, and…Check if you run itEPSS 0.20%Oct 16, 2026
- High7.2The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is…Check if you run itEPSS 0.24%Oct 16, 2026
- High8.1The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versio…Check if you run itEPSS 0.34%Oct 16, 2026
- Medium6.5The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'src_by[].val.start / src_by[].val.end (operator 'b…Check if you run itEPSS 0.27%Oct 16, 2026
- High7.2The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sln[ ]' parame…Check if you run itEPSS 0.25%Oct 16, 2026
- High7.2The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url (comment_author_url)' parameter in all versions up to, and…Check if you run itEPSS 0.24%Oct 16, 2026
- Medium6.4The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th…Check if you run itEPSS 0.20%Oct 16, 2026
- High8.0The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function.Check if you run itEPSS 0.29%Oct 16, 2026
- Medium5.4The The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and includin…Check if you run itEPSS 0.23%Oct 16, 2026
- High7.2The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and including, 1.6…Check if you run itEPSS 0.24%Oct 16, 2026
- High7.2The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due…Check if you run itEPSS 0.26%Oct 16, 2026
- High7.5The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions…Check if you run itEPSS 0.46%Oct 16, 2026
- Critical9.8The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the…Check if you run itEPSS 0.58%Oct 16, 2026
- Medium6.4The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all v…Check if you run itEPSS 0.19%Oct 16, 2026
- High7.2The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Fi…Check if you run itEPSS 0.24%Oct 16, 2026
- Medium6.4The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-axis column value ($value->$xarg_s from $wpdb->get_results())' param…Check if you run itEPSS 0.20%Oct 16, 2026
- Low2.7Product Delivery Date for WooCommerce – Lite < 3.3.2 - Contributor+ Order Information Disclosure via Calendar View AJAX ActionsCheck if you run itEPSS 0.23%Oct 16, 2026
- Medium6.8affiliate-toolkit < 3.8.9 - Editor+ SQL Injection via orderby ParameterCheck if you run itEPSS 0.29%Oct 16, 2026
- High7.4OTP Login & Register Woocommerce < 2.7.3 - Unauthenticated Account Takeover via OTP Brute ForceCheck if you run itEPSS 0.27%Oct 16, 2026
- Low2.7Smush < 4.3.4 - Admin+ Network-Wide Plugin Settings Update on MultisiteCheck if you run itEPSS 0.21%Oct 16, 2026
- High8.8Salon Booking System < 10.31.9 - Administrator Account Creation via CSRFCheck if you run itEPSS 0.15%Oct 16, 2026
- Medium5.3Salon Booking System < 10.31.9 - Unauthenticated Booking Creation with Arbitrary Customer ID and StatusCheck if you run itEPSS 0.22%Oct 16, 2026