52085+ vulnerabilities with CVSS scores, EPSS exploit predictions, and CISA KEV status. Updated daily.
Unauthenticated Broken Access Control in Welcart e-Commerce <= 2.11.28 versions.
Subscriber Cross Site Scripting (XSS) in FV Flowplayer Video Player < 7.5.51.7212 versions.
Unauthenticated Cross Site Request Forgery (CSRF) in WP Migrate Lite <= 2.7.8 versions.
Subscriber Sensitive Data Exposure in XCloner <= 4.8.6 versions.
Unauthenticated Broken Access Control in JS Help Desk <= 3.0.9 versions.
Subscriber Cross Site Scripting (XSS) in WP Job Portal <= 2.5.2 versions.
Subscriber Sensitive Data Exposure in Visual Link Preview <= 2.4.1 versions.
Subscriber Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.62 versions.
MultiJuicer is used to run separate Juice Shop instances on a central kubernetes cluster without the need for local instances. In versions 8.0.0 through 10.0.0, …
Unauthenticated Bypass Vulnerability in Stripe Payments <= 2.0.98 versions.
Unauthenticated Broken Authentication in Masteriyo - LMS <= 2.1.8 versions.
Subscriber Cross Site Scripting (XSS) in Modula Image Gallery <= 2.14.23 versions.
Unauthenticated Cross Site Scripting (XSS) in Simple Membership <= 4.7.2 versions.
Unauthenticated Bypass Vulnerability in Event Tickets <= 5.27.5 versions.
Subscriber Sensitive Data Exposure in Contest Gallery <= 28.1.7 versions.
Subscriber Broken Access Control in Advanced Form Integration <= 1.126.12 versions.
Unauthenticated Other Vulnerability Type in Contest Gallery <= 28.1.7 versions.
Subscriber Cross Site Scripting (XSS) in Contest Gallery <= 28.1.6 versions.
Unauthenticated Bypass Vulnerability in Best Payments Plugin for WP <= 4.6.19 versions.
Subscriber Broken Access Control in Classified Listing <= 5.3.9 versions.
Unauthenticated Broken Access Control in Classified Listing <= 5.3.8 versions.
Subscriber Broken Authentication in WP Full Stripe Free <= 8.4.1 versions.
Subscriber Cross Site Scripting (XSS) in ProfilePress <= 4.16.13 versions.
Unauthenticated Broken Authentication in Simple Cloudflare Turnstile <= 1.38.0 versions.
Subscriber Sensitive Data Exposure in WPPizza <= 3.19.9 versions.
Subscriber Broken Access Control in Amelia <= 2.2 versions.
Subscriber Broken Access Control in myCred <= 3.0.3 versions.
Subscriber Broken Access Control in Groundhogg < 4.4.1 versions.
Subscriber Insecure Direct Object References (IDOR) in KiviCare <= 4.2.1 versions.
Subscriber Sensitive Data Exposure in WP SMS <= 7.2.1 versions.
Unauthenticated Broken Access Control in WPAdverts <= 2.3.0 versions.
Subscriber Broken Access Control in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.9 versions.
Unauthenticated Broken Access Control in Tutor LMS <= 3.9.7 versions.
Subscriber Broken Access Control in Ultra Addons for WPForms <= 1.0.11 versions.
Subscriber Broken Access Control in RepairBuddy <= 4.1132 versions.
Subscriber Cross Site Scripting (XSS) in Shipment Tracker for Woocommerce <= 1.5.3.2 versions.
Subscriber Arbitrary File Upload in WpStream < 4.11.2 versions.
Unauthenticated Broken Access Control in Booking Activities <= 1.16.48.1 versions.
Subscriber Broken Access Control in Motors < 1.4.107 versions.
Subscriber Cross Site Scripting (XSS) in JupiterX Core <= 4.14.1 versions.
Author Arbitrary File Download in Download Monitor <= 5.1.9 versions.
Contributor Arbitrary File Deletion in Meta Box – WordPress Custom Fields Framework <= 5.11.1 versions.
Unauthenticated Cross Site Scripting (XSS) in WP Google Review Slider <= 18.0 versions.
Subscriber Broken Access Control in Rank Math SEO <= 1.0.271 versions.
Unauthenticated Broken Access Control in Essential Addons for Elementor < 6.6.0 versions.
Subscriber Broken Access Control in Bookify <= 1.1.1 versions.
Subscriber Broken Access Control in bunny.net <= 2.3.6 versions.
Administrator Server Side Request Forgery (SSRF) in PopAd <= 1.0.4 versions.
Multiple out-of-bounds read vulnerabilities were found in GStreamer's pcapparse element. Malformed PCAP records can trigger reads beyond buffer boundaries during IPv4/TCP header parsing. This element …
A denial of service vulnerability was found in GStreamer's AV1 codec parser in gst-plugins-bad. The gst_av1_parser_parse_tile_list_obu() function passes a byte count to a bit-reader API …
Free website and port scanning — find vulnerabilities before attackers do.