Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- UnknownThe OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password verification attempts, because the attempt limit is trac…EPSS 0.2%Oct 16, 2026
- UnknownThe Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creating a booking and trusts a caller-supplied user identifier a…EPSS 0.1%Oct 16, 2026
- UnknownThe Salon Booking System WordPress plugin before 10.31.9 does not generate its booking-API access tokens from a secure random source, instead deriving them from a valu…EPSS 0.1%Oct 16, 2026
- Low2.7The WP Mail Logging plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.17.0 via the 'email_address' parameter.EPSS 0.3%Oct 16, 2026
- Medium6.5The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.9.5.EPSS 0.3%Oct 16, 2026
- Medium6.8The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to th…EPSS 0.5%Oct 16, 2026
- High7.2The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in…EPSS 0.3%Oct 16, 2026
- Medium5.3The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4…EPSS 0.3%Oct 16, 2026
- UnknownThe Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data in a dashboard widget, allow…EPSS 0.1%Oct 16, 2026
- Medium4.8The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The…EPSS 0.3%Oct 16, 2026
- Critical9.8The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and…EPSS 0.5%Oct 16, 2026
- UnknownMalicious code in @flexmr/survey-conversation (npm)Oct 16, 2026
- UnknownMalicious code in @flexmr/survey-client (npm)Oct 16, 2026
- High7.2The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp_review_text' parameter in all versions up to…Oct 16, 2026
- High7.2The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site S…Oct 16, 2026
- Medium6.5The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'guid' parameter parameter.Oct 16, 2026
- Critical9.8The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1.Oct 16, 2026
- High8.8The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43.Oct 16, 2026
- Medium6.4The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form' parameter in all versions up to, and…EPSS 0.2%Oct 16, 2026
- High7.2The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is…EPSS 0.2%Oct 16, 2026
- High8.1The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versio…EPSS 0.3%Oct 16, 2026
- High8.0The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function.EPSS 0.3%Oct 16, 2026
- Medium5.4The The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and includin…EPSS 0.2%Oct 16, 2026
- High7.2The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and including, 1.6…EPSS 0.2%Oct 16, 2026
- High7.2The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due…EPSS 0.3%Oct 16, 2026