Catalog
Findings
Filter by record type (vulnerability, fix, incident, intelligence, research), severity, source, stack, and weakness.
- High7.2The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site S…Oct 16, 2026
- Medium6.5The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'guid' parameter parameter.Oct 16, 2026
- High8.8The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43.EPSS 0.4%Oct 16, 2026
- Medium6.4The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form' parameter in all versions up to, and…EPSS 0.2%Oct 16, 2026
- High7.2The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is…EPSS 0.2%Oct 16, 2026
- High8.1The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versio…EPSS 0.3%Oct 16, 2026
- High8.0The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function.EPSS 0.3%Oct 16, 2026
- Medium5.4The The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and includin…EPSS 0.2%Oct 16, 2026
- High7.2The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and including, 1.6…EPSS 0.2%Oct 16, 2026
- High7.2The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due…EPSS 0.3%Oct 16, 2026
- High7.5The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions…EPSS 0.5%Oct 16, 2026
- Critical9.8The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the…EPSS 0.6%Oct 16, 2026
- Medium6.4The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all v…EPSS 0.2%Oct 16, 2026
- High7.2The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Fi…EPSS 0.2%Oct 16, 2026
- Low2.7Product Delivery Date for WooCommerce – Lite < 3.3.2 - Contributor+ Order Information Disclosure via Calendar View AJAX ActionsEPSS 0.1%Oct 16, 2026
- Medium6.8affiliate-toolkit < 3.8.9 - Editor+ SQL Injection via orderby ParameterEPSS 0.2%Oct 16, 2026
- High7.4OTP Login & Register Woocommerce < 2.7.3 - Unauthenticated Account Takeover via OTP Brute ForceEPSS 0.2%Oct 16, 2026
- Medium5.3Salon Booking System < 10.31.9 - Unauthenticated Booking Creation with Arbitrary Customer ID and StatusEPSS 0.1%Oct 16, 2026
- Medium4.8Salon Booking System < 10.31.9 - Unauthenticated Salon REST API Access via Predictable Access-TokenEPSS 0.1%Oct 16, 2026
- Medium4.3Visual Form Builder <= 3.1 - Subscriber+ Sensitive Data Disclosure via Dashboard WidgetEPSS 0.1%Oct 16, 2026
- UnknownMalicious code in fromthehotel-poems (PyPI)Oct 16, 2026
- Medium6.8The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints.EPSS 9.0%Oct 16, 2026
- Medium6.5The Mail Mint plugin for WordPress is vulnerable to SQL Injection via the 'filters' parameter of the /wp-json/mrm/v1/segments/contacts REST endpoint in versions up to,…EPSS 0.3%Oct 16, 2026
- Medium5.3The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and including, 3.3.3 The /notif…EPSS 0.2%Oct 16, 2026
- High7.5The Klarna for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.13.3 This is due to the plugin not proper…EPSS 0.3%Oct 16, 2026