Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.4The Social Share Buttons & Analytics Plugin – GetSocial.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'response' parameter in all versio…Check if you run itEPSS 0.25%Oct 14, 2026
- Medium6.5The Hyyan WooCommerce Polylang Integration plugin for WordPress is vulnerable to SQL Injection via the 'variation_ids' parameter of the 'woocommerce_remove_variations'…Check if you run itEPSS 0.32%Oct 14, 2026
- High7.2The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.5 via the 'Last referrers' meta box on the plu…Check if you run itEPSS 0.31%Oct 14, 2026
- Medium5.3The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.1 via the 'args[link_target]' parameter.Check if you run itEPSS 0.28%Oct 14, 2026
- High7.2The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and includin…Check if you run itEPSS 0.31%Oct 14, 2026
- Medium6.4The PO/MO Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'podata' parameter in all versions up to, and including, 1.4.2 due to insuff…Check if you run itEPSS 0.26%Oct 14, 2026
- High7.5The Gmedia Photo Gallery plugin for WordPress is vulnerable to time-based SQL Injection via the 'gmedia__in' parameter in all versions up to, and including, 1.25.1 due…Check if you run itEPSS 0.45%Oct 14, 2026
- High7.2The Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formString' parameter in all v…Check if you run itEPSS 0.36%Oct 14, 2026
- High7.5The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs' parameter in all…Check if you run itEPSS 0.43%Oct 14, 2026
- Medium6.4The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and including, 8.1.7 due to…Check if you run itEPSS 0.25%Oct 14, 2026
- High7.2The Verified Reviews (Avis Vérifiés) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moderation' parameter in all versions up to, and includ…Check if you run itEPSS 0.39%Oct 14, 2026
- High7.2The Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via data_object Parameter in all version…Check if you run itEPSS 0.39%Oct 14, 2026
- Critical9.8The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the saveImage() function.Check if you run itEPSS 0.79%Oct 14, 2026
- High7.2The Contact Form DB for Enfold plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form Field Values in all versions up to, and including, 2.…Check if you run itEPSS 0.31%Oct 14, 2026
- High7.5The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via 'product.push' Identity Endpoint in all versions up to, and includ…Check if you run itEPSS 0.42%Oct 14, 2026
- High7.2The Document Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dg_thumber_webhook' Action Request Body in all versions up to, and includin…Check if you run itEPSS 0.31%Oct 14, 2026
- Medium6.4The Countdown Timer – Widget Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'redirect_url' Shortcode Attribute in all versions up to,…Check if you run itEPSS 0.21%Oct 14, 2026
- High7.5Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled.Check if you run itEPSS 0.25%Oct 14, 2026
- Critical9.8The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the 'width (and height)' parameter parameter.Check if you run itEPSS 1.03%Oct 14, 2026
- Medium4.7The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to…Check if you run itEPSS 0.24%Oct 14, 2026
- Medium6.4The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'phone' Listing Field i…Check if you run itEPSS 0.25%Oct 14, 2026
- High7.2The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'QUERY_STRING / REQUEST_URI' parameter in all versions up to, and including,…Check if you run itEPSS 0.31%Oct 14, 2026
- UnknownCVE-2026-63676 is listed by USN-8925-1: YAML-LibYAML vulnerabilities.Open the advisoryOct 14, 2026
- UnknownCVE-2019-25777 is listed by USN-8925-1: YAML-LibYAML vulnerabilities.Check if you run itEPSS 0.34%Oct 14, 2026
- UnknownCVE-2017-20285 is listed by USN-8925-1: YAML-LibYAML vulnerabilities.Check if you run itEPSS 0.32%Oct 14, 2026