Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.4The Email Customizer for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email template content in all versions up to, and including, 2.6.7 due toCheck this weekEPSS 33.00%Jan 7, 2026
- High7.5The Yoco Payments plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 3.9.0 via the file parameter.Check if you run itEPSS 1.83%Jan 7, 2026
- High7.5The Reviewify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'send_test_email' AJAX action in all versions up to,Check this weekEPSS 42.00%Jan 7, 2026
- Medium5.3The Awesome Hotel Booking plugin for WordPress is vulnerable to unauthorized modification of data due to incorrect authorization in the room-single.php shortcode handler in all verCheck this weekEPSS 26.00%Jan 7, 2026
- Medium6.4The AI BotKit – AI Chatbot & Live Support for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in the shortcode in all versions upCheck this weekEPSS 22.00%Jan 7, 2026
- Critical9.8The Optional Email plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.3.11.Check this weekEPSS 35.00%Jan 7, 2026
- High7.5The Latest Registered Users plugin for WordPress is vulnerable to unauthorized user data export in all versions up to, and including, 1.4.Check this weekEPSS 33.00%Jan 7, 2026
- High7.5The User Activity Log plugin is vulnerable to a limited options update in versions up to, and including, 2.2.Check this weekEPSS 36.00%Jan 7, 2026
- Medium5.4The aBlocks – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data and disclosure of sensitive information due to missing capability cCheck if you run itEPSS 0.25%Jan 7, 2026
- Medium6.5The Flashcard plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 0.9 via the 'source' attribute of the 'flashcard' shortcode.Check this weekEPSS 35.00%Jan 7, 2026
- Medium6.1CodeDropz drag_and_drop_multiple_file_upload_-_contact_form_7 Unrestricted Upload of File with Dangerous TypePatch nowKEVEPSS 0.37%Jan 7, 2026
- Medium4.4The twinklesmtp – Email Service Provider For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's sender settings in all versions up to, and incCheck this weekEPSS 24.00%Jan 7, 2026
- Medium4.3The Newsletter Email Subscribe plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.Check this weekEPSS 12.00%Jan 7, 2026
- Medium6.5The Bit Form – Contact Form Plugin plugin for WordPress is vulnerable to unauthorized workflow execution due to missing authorization in the triggerWorkFlow function in all versionCheck this weekEPSS 42.00%Jan 7, 2026
- Critical9.3OpenFlagr versions prior to and including 1.1.18 contain an authentication bypass vulnerability in the HTTP middleware.Check if you run itEPSS 1.52%Jan 7, 2026
- High7.2Microsoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections.Check if you run itEPSS 1.22%Jan 7, 2026
- Medium6.5The EmailKit plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in all versions up to, and including, 1.6.1.Check this weekEPSS 29.00%Jan 7, 2026
- Critical9.3Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Patch nowKEVEPSS 12.05%Jan 7, 2026
- High7.5Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in VanKarWai Calafate calafate allows PHP Local File InclusionCheck if you run itEPSS 0.39%Jan 6, 2026
- High7.4A weakness has been identified in Tenda AC23 16.03.07.52.Check if you run itEPSS 3.48%Jan 6, 2026
- High8.7Cayin Signage Media Player 3.0 contains an authenticated remote command injection vulnerability in system.cgi and wizard_system.cgi pages.Check if you run itEPSS 1.43%Jan 6, 2026
- High8.7SnapGear Management Console SG560 3.1.5 contains a file manipulation vulnerability that allows authenticated users to read, write, and delete files using the edit_config_files CGICheck if you run itEPSS 0.74%Jan 6, 2026
- Medium5.1SnapGear Management Console SG560 version 3.1.5 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent.Check if you run itEPSS 0.28%Jan 6, 2026
- Medium6.7Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application, version(s) versions 5.26 to 5.30, contain(s) an Execution with Unnecessary Privileges vulnerability.Check if you run itEPSS 0.12%Jan 6, 2026
- Medium6.5The Appointment Booking and Scheduling Calendar Plugin – WP Timetics plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capabilityCheck this weekEPSS 24.00%Jan 6, 2026
Sort