Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- UnknownweForms <= 1.6.28 - Unauthenticated Limited Media File Deletion via 'wpuf_files' ParameterOct 16, 2026
- UnknownEuropean VAT Compliance Assistant for WooCommerce <= 1.36.10 - Unauthenticated Stored Cross-Site Scripting via CF-IPCountry HeaderOct 16, 2026
- UnknownPayment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.61 - Unauthenticated Stored Cross-Site Scripting via 'mmdwqzpoxadd' ParameterOct 16, 2026
- UnknownYMC Filter <= 3.12.19 - Authenticated (Author+) Stored DOM-Based Cross-Site Scripting via 'post_title' ParameterOct 16, 2026
- UnknownTutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' ParameterOct 16, 2026
- UnknownxSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_content' ParameterOct 16, 2026
- UnknownPost Export Import with Media <= 1.17.2 - Authenticated (Administrator+) Path Traversal via 'theme_slug' ParameterOct 16, 2026
- UnknownUser Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart TagOct 16, 2026
- UnknownUser Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action()Oct 16, 2026
- UnknownUser Registration & Membership <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field ValueOct 16, 2026
- UnknownWP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'user_permission' Parameter via Cross-Form Nonce ReuseOct 16, 2026
- UnknownWP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wpbs_refresh_calendar_editor AJAX actionOct 16, 2026
- UnknownWP Booking System <= 2.1.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'wpbs_action=email_logs' ActionOct 16, 2026
- UnknownEU VAT Assistant for WooCommerce <= 2.1.30.260413 - Unauthenticated Stored Cross-Site Scripting via 'vat_number' ParameterOct 16, 2026
- UnknownThemify Popup <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via 'popup_width_unit' ParameterOct 16, 2026
- UnknownThemify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode AttributeOct 16, 2026
- UnknownWelcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' CookieOct 16, 2026
- UnknownLearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' ParameterOct 16, 2026
- UnknownLearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX ActionOct 16, 2026
- UnknownAppointment Booking Plugin <= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' ParameterOct 16, 2026
- UnknownLearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' ParametersOct 16, 2026
- UnknownKirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' ParameterOct 16, 2026
- UnknownAppointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts CounterOct 16, 2026
- UnknownHippoo Mobile App for WooCommerce <= 1.12.0 - Reflected Cross-Site Scripting via 'token_id' ParameterOct 16, 2026
- UnknownKirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template ImportOct 16, 2026
40 records · page 1 of 2
PreviousNext