Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 19

Export CSV
CVE-2023-5098

Campaign Monitor Forms < 2.5.6 - Subscriber+ Arbitrary Options Update

The Campaign Monitor Forms by Optin Cat WordPress plugin before 2.5.6 does not prevent users with low privileges (like subscribers) from overwriting any options on a site with the string "true", which could lead to a variety of outcomes, including DoS.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Fatcatapps
Products
Campaign Monitor Optin Cat
CVE-2025-59549

WordPress GetResponse Forms Plugin <= 2.6.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fatcatapps GetResponse Forms getresponse allows Stored XSS.This issue affects GetResponse Forms: from n/a through <= 2.6.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fatcatapps Wordpress
Products
Getresponse Forms Wordpress
CVE-2025-26992

WordPress Landing Page Cat plugin <= 1.7.8 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fatcatapps Landing Page Cat landing-page-cat allows Reflected XSS.This issue affects Landing Page Cat: from n/a through <= 1.7.8.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Fatcatapps Wordpress
Products
Landing Page Cat Wordpress
CVE-2025-24615

WordPress Analytics Cat Plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fatcatapps Analytics Cat analytics-cat allows Reflected XSS.This issue affects Analytics Cat: from n/a through <= 1.1.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Fatcatapps Wordpress
Products
Analytics Cat Wordpress
CVE-2024-9226

Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages <= 1.7.6 - Reflected Cross-Site Scripting

The Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.7.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Fatcatapps Wordpress
Products
Landing Page Cat Wordpress
CVE-2024-8870

Forms for Mailchimp by Optin Cat – Grow Your MailChimp List <= 2.5.7 - Reflected Cross-Site Scripting

The Forms for Mailchimp by Optin Cat – Grow Your MailChimp List plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.5.7. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Fatcatapps
Products
Forms For Mailchimp By Optin Cat
CVE-2024-8740

GetResponse Forms by Optin Cat <= 2.5.7 - Reflected Cross-Site Scripting

The GetResponse Forms by Optin Cat plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.5.7. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Fatcatapps
Products
Getresponse Forms
CVE-2024-0708

Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages <= 1.7.2 - Unauthenticated Information Exposure

The Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.2. This makes it possible for unauthenticated attackers to access landing pages that may not be public.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Fatcatapps
Products
Landing Page Cat
CVE-2024-8544

Pixel Cat – Conversion Pixel Manager <= 3.0.5 - Reflected Cross-Site Scripting

The Pixel Cat – Conversion Pixel Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.0.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Fatcatapps
Products
Pixel Cat
CVE-2024-8323

Pricing Tables WordPress Plugin – Easy Pricing Tables <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via fontFamily Attribute

The Pricing Tables WordPress Plugin – Easy Pricing Tables plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘fontFamily’ attribute in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Fatcatapps
Products
Easy Pricing Tables
CVE-2022-4654

Pricing Tables WordPress Plugin – Easy Pricing Tables < 3.2.3 - Contributor+ Stored XSS via Shortcode

The Pricing Tables WordPress Plugin WordPress plugin before 3.2.3 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Fatcatapps
Products
Pricing Tables
CVE-2021-36866

WordPress Easy Pricing Tables plugin <= 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated (author or higher role) Stored Cross-Site Scripting (XSS) vulnerability in Fatcat Apps Easy Pricing Tables plugin <= 3.1.2 at WordPress.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Fatcatapps
Products
Easy Pricing Tables
CVE-2022-40311

WordPress Analytics Cat plugin <= 1.0.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Auth. (admin+) Stored Cross-Site Scripting (XSS) in Fatcat Apps Analytics Cat plugin <= 1.0.9 on WordPress.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Fatcatapps
Products
Analytics Cat
CVE-2022-27855

WordPress Analytics Cat plugin <= 1.0.9 - Plugin Settings change via Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Fatcat Apps Analytics Cat plugin <= 1.0.9 on WordPress allows Plugin Settings Change.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Fatcatapps
Products
Analytics Cat
CVE-2023-47545

WordPress Forms for Mailchimp by Optin Cat Plugin <= 2.5.4 is vulnerable to Cross Site Scripting (XSS)

Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Fatcat Apps Forms for Mailchimp by Optin Cat – Grow Your MailChimp List plugin <= 2.5.4 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Fatcatapps
Products
Forms For Mailchimp By Optin Cat
CVE-2022-1904

Easy Pricing Tables < 3.2.1 - Reflected Cross-Site-Scripting

The Pricing Tables WordPress Plugin WordPress plugin before 3.2.1 does not sanitise and escape parameter before outputting it back in a page available to any user (both authenticated and unauthenticated) when a specific setting is enabled, leading to a Reflected Cross-Site Scripting

CVSS 3.1 · 6.1 Medium EPSS 1.5% KEV · Not listed
Vendors
Fatcatapps
Products
Easy Pricing Tables
CVE-2021-25098

Easy Pricing Tables < 3.1.3 - Arbitrary Post Removal via CSRF

The Pricing Tables WordPress Plugin WordPress plugin before 3.1.3 does not verify the CSRF nonce when removing posts, allowing attackers to make a logged in admin remove arbitrary posts from the blog via a CSRF attack, which will be put in the trash

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fatcatapps
Products
Easy Pricing Tables
CVE-2021-24972

Pixel Cat Lite < 2.6.3 - Admin+ Stored Cross-Site Scripting

The Pixel Cat WordPress plugin before 2.6.3 does not escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Fatcatapps
Products
Pixel Cat
CVE-2021-24922

Pixel Cat Lite < 2.6.2 - CSRF to Stored Cross-Site Scripting

The Pixel Cat WordPress plugin before 2.6.2 does not have CSRF check when saving its settings, and did not sanitise as well as escape some of them, which could allow attacker to make a logged in admin change them and perform Cross-Site Scripting attacks

CVSS 3.1 · 9.0 Critical EPSS < 1% KEV · Not listed
Vendors
Fatcatapps
Products
Pixel Cat