Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.8affiliate-toolkit < 3.8.9 - Editor+ SQL Injection via orderby ParameterCheck if you run itEPSS 0.29%Oct 16, 2026
- Low2.7Smush < 4.3.4 - Admin+ Network-Wide Plugin Settings Update on MultisiteCheck if you run itEPSS 0.21%Oct 16, 2026
- High8.8Salon Booking System < 10.31.9 - Administrator Account Creation via CSRFCheck if you run itEPSS 0.15%Oct 16, 2026
- Medium4.8Salon Booking System < 10.31.9 - Unauthenticated Salon REST API Access via Predictable Access-TokenCheck if you run itEPSS 0.17%Oct 16, 2026
- High7.5The Nexter Extension – Security, Performance, Code Snippets & Site Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and includ…Check if you run itEPSS 0.29%Oct 16, 2026
- Medium6.5The Mail Mint plugin for WordPress is vulnerable to SQL Injection via the 'filters' parameter of the /wp-json/mrm/v1/segments/contacts REST endpoint in versions up to,…Check if you run itEPSS 0.28%Oct 16, 2026
- Medium4.3The Bulk Page Generator – LPagery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0 This is due to the plugin not…Check if you run itEPSS 0.22%Oct 16, 2026
- High7.2The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.3 due to insuffi…Check if you run itEPSS 0.27%Oct 16, 2026
- High7.5The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is d…Check if you run itEPSS 0.35%Oct 16, 2026
- Medium4.3The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up t…Check if you run itEPSS 0.28%Oct 16, 2026
- Critical9.8The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7.Check if you run itEPSS 0.89%Oct 16, 2026
- High8.0The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field (second-order, via restore) in al…Check if you run itEPSS 0.34%Oct 16, 2026
- High7.8Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents.Check if you run itEPSS 0.14%Oct 16, 2026
- Medium5.9Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default).Check if you run itEPSS 0.21%Oct 16, 2026
- Medium5.9The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter.Check if you run itEPSS 0.77%Oct 16, 2026
- High8.1The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the parameter in versions up to, and including, 3.3.0.Check if you run itEPSS 0.52%Oct 16, 2026
- Medium4.9The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products[*].variants[*].Check if you run itEPSS 0.38%Oct 16, 2026
- Medium4.8The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2.Check if you run itEPSS 0.26%Oct 16, 2026
- High7.1Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List EndpointCheck if you run itEPSS 0.26%Oct 16, 2026
- Medium6.4Tourfic <= 3.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer RoleCheck if you run itEPSS 0.19%Oct 16, 2026
- Medium4.3Arcane: Environment access token bypasses the admin-required authorization gate onCheck if you run itEPSS 0.20%Oct 16, 2026
- High8.8Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)Check if you run itEPSS 0.29%Oct 16, 2026
- Critical9.8The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.Patch nowKEVEPSS 0.44%Oct 16, 2026
- Medium4.3Fastcache by Host.it <= 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary .htaccess Page-Cache Block Modification via updateSettings() admin_action_update HookCheck if you run itEPSS 0.21%Oct 16, 2026
- Medium5.3zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore department DataScope restrictions by supplyi…Check if you run itEPSS 0.28%Oct 15, 2026