Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.4The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ssa_admin_upcomingCheck if you run itEPSS 0.29%Jun 14, 2025
- Medium6.4The Click to Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-no_number’ parameter in all versions up to, and including, 4.22 to insufficient inCheck if you run itEPSS 0.28%Jun 14, 2025
- Medium6.5The Restrict File Access plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.2 via the output() function.Check if you run itEPSS 0.64%Jun 14, 2025
- Medium4.3The Yougler Blogger Profile Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, v1.01.Check if you run itEPSS 0.14%Jun 14, 2025
- Medium4.3The AI Image Lab – Free AI Image Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6.Check if you run itEPSS 0.14%Jun 14, 2025
- Medium6.1The Zen Sticky Social plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.3.Check if you run itEPSS 0.13%Jun 14, 2025
- Medium6.4The StreamWeasels Kick Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘status-classic-offline-text’ parameter in all versions up to, and inclCheck if you run itEPSS 0.28%Jun 14, 2025
- Medium6.1The Easy Flashcards plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1.Check if you run itEPSS 0.22%Jun 14, 2025
- High8.1The Zagg - Electronics & Accessories WooCommerce WordPress Theme theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.1 via the load_Check if you run itEPSS 0.84%Jun 14, 2025
- Medium5.9The UserPro - Community and User Profile WordPress Plugin plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 5.1.10 via the userpro_fbcCheck if you run itEPSS 0.63%Jun 14, 2025
- Medium6.1The WP URL Shortener plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.Check if you run itEPSS 0.13%Jun 14, 2025
- Medium6.4The DIOT SCADA with MQTT plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'diot' shortcode in all versions up to, and including, 1.0.5.1 due to inCheck if you run itEPSS 0.22%Jun 14, 2025
- Critical9.1The Image Resizer On The Fly plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete' task in all versions up to, andCheck if you run itEPSS 0.96%Jun 14, 2025
- High7.2The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the fieldCheck if you run itEPSS 0.40%Jun 14, 2025
- High7.2The File Manager Pro – Filester plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.8.8.Check if you run itEPSS 0.62%Jun 14, 2025
- Medium4.3The Seraphinite Accelerator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.27.21.Check if you run itEPSS 0.17%Jun 14, 2025
- High8.5IBM Backup, Recovery and Media Services for i 7.4 and 7.5 could allow a user with the capability to compile or restore a program to gain elevated privileges due to a library unqualCheck if you run itEPSS 0.60%Jun 14, 2025
- High8.8An arbitrary free vulnerability exists in the cv_close functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior to 6.2.26.36.Check if you run itEPSS 2.71%Jun 13, 2025
- High8.4An out-of-bounds read vulnerability exists in the cv_send_blockdata functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior to 6.2.26.36.Check if you run itEPSS 2.00%Jun 13, 2025
- Low3.7A flaw was found in how GLib’s GString manages memory when adding data to strings.Check if you run itEPSS 0.52%Jun 13, 2025
- Medium6.1A flaw was found in GIMP.Check if you run itEPSS 0.59%Jun 13, 2025
- Critical9.8b-link bl-wr9000_firmware Improper Neutralization of Special Elements used in a Command ('Command Injection')Patch nowKEVEPSS 10.80%Jun 13, 2025
- Critical9.8b-link bl-wr9000_firmware Improper Neutralization of Special Elements used in a Command ('Command Injection')Patch nowKEVEPSS 6.86%Jun 13, 2025
- Medium6.4The Game Review Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 4.8.1 due to insufficienCheck if you run itEPSS 0.28%Jun 13, 2025
- High7.5The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_Check if you run itEPSS 0.30%Jun 13, 2025
Sort