Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.4The WP Games Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the [game] shortcode in all versions up to and including 0.1beta.Check if you run itEPSS 0.24%Mar 21, 2026
- Medium5.3The Build App Online plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.23.Check if you run itEPSS 0.32%Mar 21, 2026
- Medium5.3The Punnel – Landing Page Builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.1.Check if you run itEPSS 0.30%Mar 21, 2026
- Medium5.3The Appmax plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 1.0.3.Check if you run itEPSS 0.31%Mar 21, 2026
- Medium6.4The Sheets2Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'titles' shortcode attribute in the [sheets2table-render-table] shortcode in…Check if you run itEPSS 0.20%Mar 21, 2026
- Medium6.4The Paypal Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'amount' and 'name' shortcode attributes in all versions up to, and including, 0.3.Check if you run itEPSS 0.21%Mar 21, 2026
- Medium5.3The Smarter Analytics plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.0.Check if you run itEPSS 0.31%Mar 21, 2026
- Medium6.4The Sherk Custom Post Type Displays plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' shortcode attribute in all versions up to, and in…Check if you run itEPSS 0.21%Mar 21, 2026
- Medium5.3The e-shot form builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.2.Check if you run itEPSS 0.24%Mar 21, 2026
- Medium5.3The WP-Chatbot for Messenger plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.9.Check if you run itEPSS 0.28%Mar 21, 2026
- High7.2The Content Syndication Toolkit plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3 via the redux_p AJAX action…Check if you run itEPSS 0.28%Mar 21, 2026
- Medium5.3The REST API TO MiniProgram plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.2.Check if you run itEPSS 0.34%Mar 21, 2026
- Medium4.4The Wikilookup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Popup Width' setting in all versions up to, and including, 1.1.5.Check if you run itEPSS 0.20%Mar 21, 2026
- Medium4.4The Comment SPAM Wiper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'API Key' setting in all versions up to, and including, 1.2.1.Check if you run itEPSS 0.20%Mar 21, 2026
- Medium5.5The Multi Functional Flexi Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the parameter in all versions up to, and including, 1.2 due t…Check if you run itEPSS 0.27%Mar 21, 2026
- Medium5.3The Canto plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.1.1 via the file.Check if you run itEPSS 1.14%Mar 21, 2026
- High8.8The CMS Commander plugin for WordPress is vulnerable to SQL Injection via the 'or_blogname', 'or_blogdescription', and 'or_admin_email' parameters in all versions up t…Check if you run itEPSS 0.36%Mar 21, 2026
- Medium6.4The MinhNhut Link Gateway plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'linkgate' shortcode in all versions up to, and including,…Check if you run itEPSS 0.24%Mar 21, 2026
- Medium4.3The Xhanch - My Advanced Settings plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2.Check if you run itEPSS 0.14%Mar 21, 2026
- Medium4.3The Lobot Slider Administrator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.6.0.Check if you run itEPSS 0.14%Mar 21, 2026
- High7.2The Vagaro Booking Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘vagaro_code’ parameter in all versions up to, and including, 0.3 d…Check if you run itEPSS 0.30%Mar 21, 2026
- High8.8The Linksy Search and Replace plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'linksy_search_and_repla…Check if you run itEPSS 0.31%Mar 21, 2026
- Medium4.4The Ricerca – advanced search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's settings in all versions up to, and including, 1.1.12 due…Check if you run itEPSS 0.16%Mar 21, 2026
- Medium6.1The Post Snippits plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.Check if you run itEPSS 0.13%Mar 21, 2026
- Medium6.5The Hr Press Lite plugin for WordPress is vulnerable to unauthorized access of sensitive employee data due to a missing capability check on the AJAX action in all vers…Check if you run itEPSS 0.24%Mar 21, 2026
Sort