CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Bookly plugin up to version 27.7 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject a malicious script that executes in the victim's browser.
The WPDM – Premium Packages plugin up to version 6.2.0 contains an unauthenticated Broken Access Control vulnerability. An unauthenticated attacker can bypass authorization mechanisms and gain unauthorized access to functions or data.
The Ziina plugin up to version 1.2.21 contains an unauthenticated Broken Authentication vulnerability. An unauthenticated attacker can bypass authentication mechanisms and gain unauthorized access to accounts or functions.
The Payment Gateway for PayPal on WooCommerce plugin up to version 9.1.4 contains an unauthenticated Broken Access Control vulnerability. An unauthenticated attacker can bypass authorization mechanisms and gain unauthorized access to functions or data.
The miniOrange Discord Integration plugin version 2.2.4 and earlier contains an authentication bypass vulnerability without requiring login. An attacker can bypass authorization mechanisms and gain unauthorized access to plugin features.
The Kali Forms plugin version 2.4.18 and earlier allows a user with the Subscriber role to delete arbitrary files on the server. The vulnerability does not require special privileges beyond a standard subscriber account.
The WP BASE Booking plugin version 6.3.1 and earlier allows a user with the Subscriber role to escalate their privileges. An attacker can gain access to functions reserved for administrators.
The Easy Form Builder plugin version 4.0.12 and earlier contains a Cross Site Scripting (XSS) vulnerability without requiring authentication. An attacker can inject malicious JavaScript code into the page.
The Product Enquiry for WooCommerce plugin version 2.2.34.43 and earlier contains a Cross Site Scripting (XSS) vulnerability without requiring authentication. An attacker can inject malicious JavaScript code into the page.
The AffiliateWP plugin version 2.34.0 and earlier contains a Cross Site Scripting (XSS) vulnerability without requiring authentication. An attacker can inject malicious JavaScript code into the page.
The ApusListing plugin version 1.2.63 and earlier contains a Cross Site Request Forgery (CSRF) vulnerability without requiring authentication. An attacker can force a logged-in administrator to perform unwanted actions.
The Grand Photography plugin version 5.7.8 and earlier contains a Cross Site Scripting (XSS) vulnerability without requiring authentication. An attacker can inject malicious JavaScript code into the page.
The WP Google Maps Pro plugin version 10.1.02 and earlier contains a Cross Site Scripting (XSS) vulnerability without requiring authentication. An attacker can inject malicious JavaScript code into the page.
The Breakdance plugin version 2.7.1 and earlier contains a Cross Site Scripting (XSS) vulnerability without requiring authentication. An attacker can inject malicious JavaScript code into the page.
The Smart Manager plugin version 8.90.0 and earlier contains an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
The Real Estate Manager Pro plugin version 12.8.5 and earlier contains an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
The Slider Pro plugin version 4.8.13 and earlier contains a Cross-Site Scripting (XSS) vulnerability exploitable by users with the Subscriber role. An attacker can inject a malicious script that executes in the victim's browser.
The Picture Gallery plugin version 1.6.5 and earlier contains an Arbitrary File Deletion vulnerability exploitable by users with the Contributor role. An attacker can delete arbitrary files on the server.
The MailPoet plugin versions 5.30.0 through 5.33.0 contain a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can force an authenticated user to perform unwanted actions.
The Sprout Clients plugin version 3.2.3 and earlier contains an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS