Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.5The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions…Check if you run itEPSS 0.46%Oct 16, 2026
- Critical9.8The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the…Check if you run itEPSS 0.58%Oct 16, 2026
- Medium6.4The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all v…Check if you run itEPSS 0.19%Oct 16, 2026
- High7.2The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Fi…Check if you run itEPSS 0.24%Oct 16, 2026
- Medium6.4The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-axis column value ($value->$xarg_s from $wpdb->get_results())' param…Check if you run itEPSS 0.20%Oct 16, 2026
- Low2.7Product Delivery Date for WooCommerce – Lite < 3.3.2 - Contributor+ Order Information Disclosure via Calendar View AJAX ActionsCheck if you run itEPSS 0.23%Oct 16, 2026
- Medium6.8affiliate-toolkit < 3.8.9 - Editor+ SQL Injection via orderby ParameterCheck if you run itEPSS 0.29%Oct 16, 2026
- High7.4OTP Login & Register Woocommerce < 2.7.3 - Unauthenticated Account Takeover via OTP Brute ForceCheck if you run itEPSS 0.27%Oct 16, 2026
- Low2.7Smush < 4.3.4 - Admin+ Network-Wide Plugin Settings Update on MultisiteCheck if you run itEPSS 0.21%Oct 16, 2026
- High8.8Salon Booking System < 10.31.9 - Administrator Account Creation via CSRFCheck if you run itEPSS 0.15%Oct 16, 2026
- Medium5.3Salon Booking System < 10.31.9 - Unauthenticated Booking Creation with Arbitrary Customer ID and StatusCheck if you run itEPSS 0.22%Oct 16, 2026
- Medium4.8Salon Booking System < 10.31.9 - Unauthenticated Salon REST API Access via Predictable Access-TokenCheck if you run itEPSS 0.17%Oct 16, 2026
- Medium4.3Salon Booking System < 10.31.3 - Subscriber+ Booking PII Disclosure via REST bookings/upcomingCheck if you run itEPSS 0.21%Oct 16, 2026
- Medium4.2MB Custom Post Types & Custom Taxonomies < 2.12.2 - Subscriber+ Missing Authorization via CPT UI MigrationCheck if you run itEPSS 0.18%Oct 16, 2026
- Medium4.3Visual Form Builder <= 3.1 - Subscriber+ Sensitive Data Disclosure via Dashboard WidgetCheck if you run itEPSS 0.21%Oct 16, 2026
- Medium4.3Visual Form Builder <= 3.1 - Subscriber+ Arbitrary Form Field Reordering via Missing AuthorizationCheck if you run itEPSS 0.18%Oct 16, 2026
- Medium6.8Mobile Builder <= 1.4.2 - Unauthenticated SQLi via 'delivery_id' ParameterCheck if you run itEPSS 0.27%Oct 16, 2026
- Medium5.3Document Gallery <= 5.1.1 - Unauthenticated Non-Public Attachment Disclosure via dg_generate_gallery and dg_generate_iconsCheck if you run itEPSS 0.21%Oct 16, 2026
- Medium5.3Coinsnap Bitcoin Crowdfunding <= 1.2.0 - Unauthenticated Payment Record Forgery via Webhook Secret DisclosureCheck if you run itEPSS 0.19%Oct 16, 2026
- Medium6.5Subscribe to Comments < 2.3.3 - Unauthenticated Subscription Management Key Disclosure via Forged Comment CookieCheck if you run itEPSS 0.18%Oct 16, 2026
- Medium6.8WX Subscribe <= 1.2.1 - Unauthenticated SQLi via 'attach' ParameterCheck if you run itEPSS 0.22%Oct 16, 2026
- Medium6.8The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints.Check if you run itEPSS 9.00%Oct 16, 2026
- High7.5The Nexter Extension – Security, Performance, Code Snippets & Site Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and includ…Check if you run itEPSS 0.29%Oct 16, 2026
- Medium6.5The Mail Mint plugin for WordPress is vulnerable to SQL Injection via the 'filters' parameter of the /wp-json/mrm/v1/segments/contacts REST endpoint in versions up to,…Check if you run itEPSS 0.28%Oct 16, 2026
- Medium5.3The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and including, 3.3.3 The /notif…Check if you run itEPSS 0.24%Oct 16, 2026