Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.4The Tour & Activity Operator Plugin for TourCMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' parameter of the tourcms_doc_link sh…Check if you run itEPSS 0.24%Mar 21, 2026
- High7.5The Fonts Manager | Custom Fonts plugin for WordPress is vulnerable to time-based SQL Injection via the ‘fmcfIdSelectedFnt’ parameter in all versions up to, and includ…Check if you run itEPSS 0.40%Mar 21, 2026
- High7.2The Performance Monitor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.6.Check if you run itEPSS 0.39%Mar 21, 2026
- Medium6.1The Comment Genius plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the parameter in all versions up to, and including, 1.2.5 due to insufficie…Check if you run itEPSS 0.27%Mar 21, 2026
- Medium6.4The Schema Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 1.0 due to insu…Check if you run itEPSS 0.16%Mar 21, 2026
- Medium4.3The login_register plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and including, 1.2.0.Check if you run itEPSS 0.15%Mar 21, 2026
- Medium6.4The PQ Addons – Creative Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widget attributes in all versions up to, and including…Check if you run itEPSS 0.20%Mar 21, 2026
- Medium4.3The Add Google Social Profiles to Knowledge Graph Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.Check if you run itEPSS 0.14%Mar 21, 2026
- Medium4.3The SR WP Minify HTML plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.Check if you run itEPSS 0.14%Mar 21, 2026
- Medium4.3The Redirect countdown plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.Check if you run itEPSS 0.14%Mar 21, 2026
- Medium4.3The WP Posts Re-order plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.Check if you run itEPSS 0.14%Mar 21, 2026
- High8.3The MimeTypes Link Icons plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.2.20.Check if you run itEPSS 0.32%Mar 21, 2026
- Medium4.4The Mandatory Field plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.6.8 due to insufficien…Check if you run itEPSS 0.20%Mar 21, 2026
- Medium6.4The Multi Post Carousel by Category plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slides' shortcode attribute in all versions up to, and i…Check if you run itEPSS 0.24%Mar 21, 2026
- Medium4.3The Group Chat & Video Chat by AtomChat plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'atomchat_upda…Check if you run itEPSS 0.30%Mar 21, 2026
- Medium4.4The Survey plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1 due to insufficient input san…Check if you run itEPSS 0.26%Mar 21, 2026
- Medium6.4The WPFAQBlock– FAQ & Accordion Plugin For Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' parameter of the 'wpfaqblock' sh…Check if you run itEPSS 0.25%Mar 21, 2026
- Medium6.4The Logo Slider – Logo Carousel, Logo Showcase & Client Logo Slider Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image alt text in…Check if you run itEPSS 0.19%Mar 21, 2026
- High8.1The Invelity Product Feeds plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 1.2.6.Check if you run itEPSS 0.18%Mar 21, 2026
- Medium6.1The WP-WebAuthn plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the AJAX endpoint in all versions up to, and including, 1.3.4 due…Check if you run itEPSS 0.27%Mar 21, 2026
- Medium5.6The The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.7.2.Check if you run itEPSS 0.28%Mar 21, 2026
- High7.2The WowOptin: Next-Gen Popup Maker plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.29.Check if you run itEPSS 0.30%Mar 21, 2026
- Medium5.3OpenClaw versions prior to 2026.2.25 fail to consistently apply sender-policy checks to reaction_* and pin_* non-message events before adding them to system-event context.Check if you run itEPSS 0.21%Mar 21, 2026
- Medium5.3OpenClaw versions prior to 2026.2.23 contain an authorization bypass vulnerability in the ACP client that auto-approves tool calls based on untrusted toolCall.kind met…Check if you run itEPSS 0.26%Mar 21, 2026
- Medium6.3OpenClaw versions prior to 2026.2.22 reuse gateway.auth.token as a fallback hash secret for owner-ID prompt obfuscation when commands.ownerDisplay is set to hash and c…Check if you run itEPSS 0.27%Mar 21, 2026
Sort