Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High7.5The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions…EPSS 0.5%Oct 16, 2026
- Critical9.8The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the…EPSS 0.6%Oct 16, 2026
- Medium6.4The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all v…EPSS 0.2%Oct 16, 2026
- High7.2The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Fi…EPSS 0.2%Oct 16, 2026
- UnknownMalicious code in fromthehotel-poems (PyPI)Oct 16, 2026
- Medium6.8The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints.EPSS 0.0%Oct 16, 2026
- Medium6.5The The Broken Link Checker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.14.1.Oct 16, 2026
- Medium6.5The Mail Mint plugin for WordPress is vulnerable to SQL Injection via the 'filters' parameter of the /wp-json/mrm/v1/segments/contacts REST endpoint in versions up to,…EPSS 0.3%Oct 16, 2026
- Medium5.3The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and including, 3.3.3 The /notif…EPSS 0.2%Oct 16, 2026
- High7.5The Klarna for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.13.3 This is due to the plugin not proper…EPSS 0.3%Oct 16, 2026
- Critical9.8The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.EPSS 0.4%Oct 16, 2026
- High7.5The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is d…EPSS 0.4%Oct 16, 2026
- Medium4.3The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up t…EPSS 0.3%Oct 16, 2026
- High7.5The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.16.0.6 This…EPSS 0.3%Oct 16, 2026
- High7.5The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.11…EPSS 0.3%Oct 16, 2026
- Critical9.8The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7.EPSS 0.9%Oct 16, 2026
- High7.5The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and…EPSS 0.4%Oct 16, 2026
- Medium6.5The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and incl…EPSS 0.3%Oct 16, 2026
- Medium4.4ZDI-26-780: X.Org Server GestureBuildSprite Use-After-Free Information Disclosure VulnerabilityOct 16, 2026
- High7.2The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter i…Oct 16, 2026
- Medium6.4The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'icon_light' Shortcode Attri…Oct 16, 2026
- Medium4.3The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Ref…Oct 16, 2026
- High7.8Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents.EPSS 0.1%Oct 16, 2026
- Medium5.9Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application.EPSS 0.1%Oct 16, 2026
- Medium5.9Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default).EPSS 0.2%Oct 16, 2026