Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.5The Simple CSV Table plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.0.1 via the parameter in the shortcode.Check if you run itEPSS 0.69%Dec 12, 2025
- Medium6.5The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.13.3.Check if you run itEPSS 0.42%Dec 12, 2025
- Medium6.4The Mailgun Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mailgun_subscription_form' shortcode in all versions up to, and includCheck if you run itEPSS 0.22%Dec 12, 2025
- Medium5.3The Guest Support plugin for WordPress is vulnerable to User Email Disclosure in versions up to, and including, 1.2.3.Check if you run itEPSS 0.33%Dec 12, 2025
- Medium5.4Tornado is a Python web framework and asynchronous networking library.Check if you run itEPSS 0.24%Dec 12, 2025
- Medium5.3SQL Injection vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION prior to ver5.3.2.Check if you run itEPSS 0.19%Dec 12, 2025
- High8.2Masa CMS is an open source Enterprise Content Management platform.Check if you run itEPSS 0.25%Dec 12, 2025
- Medium6.1The WPLG Default Mail From plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the variable in all versions up to, and including, 1.0.0 due to insufficient inpCheck if you run itEPSS 0.25%Dec 12, 2025
- Medium6.4The LS Google Map Router plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'map_type' parameter in all versions up to, and including, 1.1.0 due to insufficiCheck if you run itEPSS 0.22%Dec 12, 2025
- Medium6.1The Accept Stripe Payments Using Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'failure_message' parameter in versions up to, and inclCheck if you run itEPSS 0.25%Dec 12, 2025
- Critical9.8The LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart plugin for WordPress is vulnerable to privilege escalation via account takeover in all versionsCheck if you run itEPSS 0.36%Dec 12, 2025
- Medium6.4The Hide Email Address plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'inline_css' parameter in the shortcode in all versions up to, and including, 0.1 dCheck if you run itEPSS 0.27%Dec 12, 2025
- Medium4.3The Kirim.Email WooCommerce Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.9.Check if you run itEPSS 0.16%Dec 12, 2025
- High8.1The Visitor Logic Lite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.3 via deserialization of untrusted input from the cookieCheck if you run itEPSS 0.54%Dec 12, 2025
- High8.8The Player Leaderboard plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0.2 via the 'player_leaderboard' shortcode.Check if you run itEPSS 0.80%Dec 12, 2025
- Medium4.9The WatchTowerHQ plugin for WordPress is vulnerable to arbitrary file read via the 'wht_download_big_object_origin' parameter in all versions up to, and including, 3.16.0.Check if you run itEPSS 0.51%Dec 12, 2025
- Medium4.4The WP Job Portal plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.4.Check if you run itEPSS 0.24%Dec 12, 2025
- High7.0When a user configures the NAS to retrieve UPS status or control the UPS, a non-enforced TLS certificate verification can allow an attacker able to intercept network traffic betweeCheck if you run itEPSS 0.10%Dec 12, 2025
- High7.0When the user set the Notification's sender to send emails to the SMTP server via msmtp, an improper validated TLS/SSL certificates allows an attacker who can intercept network traCheck if you run itEPSS 0.18%Dec 12, 2025
- High7.5The LT Unleashed plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.1 via the 'template' parameter in the shortcode due to insuffiCheck if you run itEPSS 0.58%Dec 12, 2025
- Medium4.6jshERP versions 3.5 and earlier are affected by a stored XSS vulnerability.Check if you run itEPSS 0.17%Dec 12, 2025
- High8.8An eval injection in the malware de-obfuscation routines of CloudLinux ai-bolit before v32.7.4 allows attackers to overwrite arbitrary files as root via scanning a crafted file.Check if you run itEPSS 0.30%Dec 12, 2025
- High8.8Apple Multiple Products Use-After-Free WebKit VulnerabilityPatch nowKEVEPSS 25.65%Dec 12, 2025
- High7.1Gladinet CentreStack and Triofox Hard Coded Cryptographic VulnerabilityPatch nowKEVEPSS 53.30%Dec 12, 2025
- High8.8Google Chromium Out of Bounds Memory Access VulnerabilityPatch nowKEVEPSS 55.33%Dec 12, 2025
Sort