Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.3The WP-Redirection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.0.3.Check if you run itEPSS 0.13%May 12, 2026
- Medium6.1The Tm – WordPress Redirection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.Check if you run itEPSS 0.12%May 12, 2026
- Medium6.1The WP Google Maps Integration plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the parameter in all versions up to, and including, 1.2.Check if you run itEPSS 0.21%May 12, 2026
- Medium6.1The AzonPost plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the parameter in all versions up to, and including, 1.3.Check if you run itEPSS 0.20%May 12, 2026
- Medium4.3The Forms Rb plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.9.Check if you run itEPSS 0.28%May 12, 2026
- Medium4.3The Woo Commerce Minimum Weight plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 3.0.1.Check if you run itEPSS 0.13%May 12, 2026
- Medium6.4The Shortcodely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'widget_area' parameter in all versions up to, and including, 1.0.1 due to in…Check if you run itEPSS 0.20%May 12, 2026
- Medium6.1The Pricing Tables for WP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.1.0.Check if you run itEPSS 0.26%May 12, 2026
- Medium4.3The Skysa Text Ticker App plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.Check if you run itEPSS 0.13%May 12, 2026
- Medium4.3The Coinbase Commerce for Contact Form 7 plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.1.2.Check if you run itEPSS 0.21%May 12, 2026
- Medium5.3The HEL Online Classroom: AI-powered Online Classrooms plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.3.Check if you run itEPSS 0.31%May 12, 2026
- High7.2The LifePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'n' parameter of the lp_update_mds AJAX action in all versions up to, and including, 2.2.2.Check if you run itEPSS 0.24%May 12, 2026
- Medium4.8The GWD Connect plugin for WordPress is vulnerable to missing authorization to limited code execution in all versions up to, and including, 2.9.Check if you run itEPSS 0.27%May 12, 2026
- Medium6.5webpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin source code exposure when serving over a non-potentially trustworthy origin such as plain HTTP.Check if you run itEPSS 0.29%May 12, 2026
- Medium6.4The Credits Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the 'credits' shortcode in all versions up to, and…Check if you run itEPSS 0.19%May 12, 2026
- Medium6.4The scratchblocks for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'element' attribute of the 'scratchblocks' shortcode in all versions…Check if you run itEPSS 0.19%May 12, 2026
- Medium6.4The Quick Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style' attribute of the 'qtbl' shortcode in all versions up to, and includin…Check if you run itEPSS 0.19%May 12, 2026
- Medium6.4The Voyage Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' attribute of the 'post-content' shortcode in all versions up to, and…Check if you run itEPSS 0.19%May 12, 2026
- Medium5.3The Smart Appointment & Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and a nonce validation logic…Check if you run itEPSS 0.23%May 12, 2026
- Medium6.4The Fancy Image Show plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 9.1 due to insu…Check if you run itEPSS 0.24%May 12, 2026
- Medium6.5The Eight Day Week Print Workflow plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'title' parameter in the AJAX action in all versions up…Check if you run itEPSS 0.24%May 12, 2026
- Medium6.4The Next Date plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'default' shortcode attribute in all versions up to, and including, 1.0 due to…Check if you run itEPSS 0.19%May 12, 2026
- Medium6.4The SP Blog Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'design' attribute of the shortcode in all versions up to, and including…Check if you run itEPSS 0.19%May 12, 2026
- Medium4.3The Rate Star Review Vote - AJAX Reviews, Votes, Star Ratings plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.6.4.Check if you run itEPSS 0.27%May 12, 2026
- Medium4.9The WP SEO Structured Data Schema plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the parameter in all versions up to, and including, 2.8.1 due t…Check if you run itEPSS 0.23%May 12, 2026
Sort