Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.3Amon2::Plugin::Web::CSRFDefender versions from 7.00 through 7.03 for Perl generate an insecure session id.Check if you run itEPSS 0.42%Apr 8, 2026
- Medium6.4The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scrip…Check if you run itEPSS 0.21%Apr 8, 2026
- Medium5.1Unrestricted upload of file with dangerous type issue exists in MATCHA INVOICE 2.6.6 and earlier.Check if you run itEPSS 0.23%Apr 8, 2026
- Medium5.1Cross-site scripting vulnerability exists in MATCHA SNS 1.3.9 and earlier.Check if you run itEPSS 0.15%Apr 8, 2026
- High8.7SQL Injection vulnerability exists in MATCHA INVOICE 2.6.6 and earlier.Check if you run itEPSS 0.29%Apr 8, 2026
- Medium6.4The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_caption' paramete…Check if you run itEPSS 0.37%Apr 8, 2026
- Medium6.4The Prime Slider – Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'follow_us_text' setting of the Mount widget in all v…Check if you run itEPSS 0.37%Apr 8, 2026
- Medium6.4The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'skin' attribute of the learn_press_courses shortcode i…Check if you run itEPSS 0.32%Apr 8, 2026
- Medium5.3The MainWP Child Reports plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.2.6.Check if you run itEPSS 0.56%Apr 8, 2026
- Critical9.8The Users manager – PN plugin for WordPress is vulnerable to Privilege Escalation via Arbitrary User Meta Update in all versions up to and including 1.1.15.Patch nowKEVEPSS 0.91%Apr 8, 2026
- Medium5.3The LTL Freight Quotes – R+L Carriers Edition plugin for WordPress is vulnerable to Missing Authorization via the plugin's webhook handler in all versions up to, and i…Check if you run itEPSS 0.39%Apr 8, 2026
- Medium6.4The Investi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'investi-announcements-accordion' shortcode's 'maximum-num-years' attribute in al…Check if you run itEPSS 0.27%Apr 8, 2026
- Medium6.4The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tableon_button' shortcode in all versions up…Check if you run itEPSS 0.27%Apr 8, 2026
- Medium6.4The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's testimonial_view shortcode in all versions up to, and includ…Check if you run itEPSS 0.21%Apr 8, 2026
- Medium6.4The LightPress Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the attribute in the shortcode in all versions up to, and including, 2.3.4.Check if you run itEPSS 0.27%Apr 8, 2026
- Medium6.4The Blubrry PowerPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'powerpress' and 'podcast' shortcodes in versions up to, and including…Check if you run itEPSS 0.21%Apr 8, 2026
- High8.4ASDA-Soft Stack-based Buffer Overflow VulnerabilityCheck if you run itEPSS 0.34%Apr 8, 2026
- Medium4.1An insufficient session expiration vulnerability exists in the latest version of parisneo/lollms.Check if you run itEPSS 0.22%Apr 8, 2026
- High8.8The Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 13.4.6 th…Check if you run itEPSS 0.17%Apr 8, 2026
- Critical9.8WPEverest everest_forms Deserialization of Untrusted DataPatch nowKEVEPSS 3.59%Apr 8, 2026
- High8.2When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case tha…Check if you run itEPSS 0.35%Apr 8, 2026
- Medium6.1Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used.Check if you run itEPSS 0.29%Apr 8, 2026
- Medium5.5tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sp…Check if you run itEPSS 0.29%Apr 8, 2026
- High7.5If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources.Check if you run itEPSS 0.63%Apr 8, 2026
- Medium6.4On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when th…Check if you run itEPSS 0.30%Apr 8, 2026
Sort