CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The AffiliateWP plugin version 2.34.0 and earlier contains a Cross Site Scripting (XSS) vulnerability without requiring authentication. An attacker can inject malicious JavaScript code into the page.
The ApusListing plugin version 1.2.63 and earlier contains a Cross Site Request Forgery (CSRF) vulnerability without requiring authentication. An attacker can force a logged-in administrator to perform unwanted actions.
The Grand Photography plugin version 5.7.8 and earlier contains a Cross Site Scripting (XSS) vulnerability without requiring authentication. An attacker can inject malicious JavaScript code into the page.
The WP Google Maps Pro plugin version 10.1.02 and earlier contains a Cross Site Scripting (XSS) vulnerability without requiring authentication. An attacker can inject malicious JavaScript code into the page.
The Breakdance plugin version 2.7.1 and earlier contains a Cross Site Scripting (XSS) vulnerability without requiring authentication. An attacker can inject malicious JavaScript code into the page.
The Smart Manager plugin version 8.90.0 and earlier contains an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
The Real Estate Manager Pro plugin version 12.8.5 and earlier contains an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
The Slider Pro plugin version 4.8.13 and earlier contains a Cross-Site Scripting (XSS) vulnerability exploitable by users with the Subscriber role. An attacker can inject a malicious script that executes in the victim's browser.
The Picture Gallery plugin version 1.6.5 and earlier contains an Arbitrary File Deletion vulnerability exploitable by users with the Contributor role. An attacker can delete arbitrary files on the server.
The MailPoet plugin versions 5.30.0 through 5.33.0 contain a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can force an authenticated user to perform unwanted actions.
The Sprout Clients plugin version 3.2.3 and earlier contains an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
The Download Monitor - WPForms Lock plugin version 1.0.4 and earlier contains an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
The Coaching plugin version 3.9.2 and earlier contains an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
The Funnel Kit Funnel Builder PRO plugin version 3.15.0.7 and earlier contains an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
The Visitor Traffic Real Time Statistics Pro plugin version 11.9.1 and earlier contains an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
The WP Booking System plugin versions below 5.12.8.1 contain a Broken Access Control vulnerability that allows subscribers unauthorized access to functions.
The eRoom plugin version 1.7.1 and earlier contains an SQL Injection vulnerability exploitable by users with Contributor role.
An SQL Injection (Improper Neutralization of Special Elements used in an SQL Command) vulnerability in the John-Michael L'Allier Create mediavine-create plugin allows Blind SQL Injection. This issue affects Create from n/a through 2.5.3.
In the libcupsfilters library, the cfIEEE1284NormalizeMakeModel() function enters an infinite loop when processing an IEEE-1284 device ID with an empty model field. A network-adjacent attacker can broadcast a crafted printer advertisement, causing denial of service.
A flaw in the odh-dashboard web component of Red Hat OpenShift AI (RHOAI) due to incorrect network binding allows a malicious actor within the cluster to bypass authentication and impersonate any user by providing an arbitrary access token.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS