150016+ vulnerabilities with CVSS scores, EPSS exploit predictions, and CISA KEV status. Updated daily.
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions.
Contributor Cross Site Scripting (XSS) in The Plus Addons for Elementor Page Builder Lite <= 6.5.1 versions.
Administrator SQL Injection in Category Discount Woocommerce <= 5.18 versions.
Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions.
Subscriber Bypass Vulnerability in All In One WP Security & Firewall <= 5.4.8 versions.
Editor Arbitrary File Deletion in Template Kit – Import <= 1.0.16 versions.
Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce <= 5.120.0 versions.
Unauthenticated SQL Injection in Books Gallery <= 4.8.3 versions.
Subscriber Privilege Escalation in FluentBoards <= 2.0.12 versions.
Subscriber Cross Site Scripting (XSS) in Awesome Support <= 6.3.9 versions.
Subscriber Cross Site Scripting (XSS) in oik <= 4.15.4 versions.
Unauthenticated Broken Access Control in WP Express Checkout (Accept PayPal Payments) <= 2.4.9 versions.
Subscriber Broken Access Control in MakeCommerce for WooCommerce <= 4.1.0 versions.
Unauthenticated Cross Site Scripting (XSS) in Trusted Shops Easy Integration for WooCommerce <= 2.0.6 versions.
Custom role Privilege Escalation in Vitepos <= 3.5.0 versions.
Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 5.6.7 versions.
Contributor Cross Site Scripting (XSS) in pixfort Core < 4.3.3 versions.
Unauthenticated Cross Site Scripting (XSS) in YITH WooCommerce Ajax Search <= 2.28.0 versions.
Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 6.1.3 versions.
Subscriber Privilege Escalation in Estatik <= 4.3.5 versions.
Unauthenticated Remote Code Execution (RCE) in SiteSkite <= 2.1.8 versions.
Unauthenticated Broken Access Control in Bookly <= 28.2 versions.
Subscriber Insecure Direct Object References (IDOR) in Bookly <= 28.2 versions.
Author SQL Injection in WP ERP <= 1.17.9 versions.
Administrator SQL Injection in Estatik <= 4.3.5 versions.
Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.
Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.
Subscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.2 versions.
An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 …
Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions.
Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions.
Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions.
Unauthenticated Denial of Service Attack in WP Store Locator < 3.0.0 versions.
Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions.
Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.
Contributor Cross Site Scripting (XSS) in Pixel Manager for WooCommerce <= 1.69.0 versions.
Unauthenticated Insecure Direct Object References (IDOR) in Simply Schedule Appointments <= 1.6.12.31 versions.
Contributor Insecure Direct Object References (IDOR) in Safe SVG <= 2.5.0 versions.
Subscriber Broken Access Control in FormGent <= 1.12.2 versions.
Unauthenticated Remote Code Execution (RCE) in AcyMailing SMTP Newsletter <= 11.0.5 versions.
Subscriber Privilege Escalation in Import and export users and customers <= 2.5.2 versions.
Unauthenticated SQL Injection in GamiPress <= 8.0.2 versions.
Contributor Insecure Direct Object References (IDOR) in Business Directory <= 6.4.27 versions.
Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.
Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions.
Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions.
Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <= 2.7.2 versions.
Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions.
Author SQL Injection in Quiz Cat <= 3.1.1 versions.
Unauthenticated Cross Site Scripting (XSS) in WordPress Persistent Login <= 3.1.3 versions.
Free website and port scanning — find vulnerabilities before attackers do.