CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.08)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The AI BotKit – AI Chatbot & Live Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in the `ai_botkit_widget` shortcode in all versions up to and including 1.1.7 due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access or above to inject arbitrary web scripts that execute whenever a user accesses an injected page.
The aBlocks – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data and disclosure of sensitive information due to missing capability checks on multiple AJAX actions in all versions up to and including 2.4.0. Authenticated attackers with subscriber-level access can read plugin settings including block visibility, maintenance mode configuration, and third-party email marketing API keys.
The Plant - Gardening & Houseplants WordPress theme by EngoTheme contains a vulnerability that allows exposure of sensitive system information to unauthorized parties. The issue affects theme versions up to and including 1.0.0.
On affected platforms running Arista EOS with MACsec configuration, a specially crafted packet can cause the MACsec process to terminate unexpectedly. Continuous receipt of these packets with certain MACsec configurations can cause longer term disruption of dataplane traffic.
The Breeze plugin for WordPress (Cloudways) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects Breeze from n/a through version 2.2.21.
The Responsive Addons for Elementor plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 2.0.8.
The UiChemy plugin for WordPress is vulnerable to Stored XSS due to improper neutralization of input during web page generation. This issue affects versions from n/a through 4.4.2.
The Post Expirator plugin (up to version 4.9.3) contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This enables unauthorized users to access functions that should be protected.
The TheGem Theme Elements plugin (for WPBakery) is vulnerable to DOM-Based XSS due to improper neutralization of input during web page generation. This issue affects versions from n/a through 5.11.0.
The Creator LMS plugin (WPFunnels) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects Creator LMS from n/a through version 1.1.12.
The TheGem Theme Elements plugin (for Elementor) is vulnerable to Stored XSS due to improper neutralization of input during web page generation. This issue affects versions from n/a through 5.11.0.
In the Better Business Reviews plugin (from BBR Plugins), there is a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This affects versions up to and including 0.1.1.
The Events Calendar (the-events-calendar) has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This affects versions through 6.15.12.2.
Stored XSS vulnerability in Accordion plugin (Themepoints) up to version 3.0.3. Improper input neutralization during web page generation allows persistent injection of malicious scripts.
RSS Feed Widget (rss-feed-widget) has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This affects versions through 3.0.2.
In The Events Calendar Countdown Addon (from CoolHappy), there is a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This affects versions up to and including 1.4.15.
The AffiliateX plugin for WordPress (versions up to and including 1.3.9.3) contains a Missing Authorization vulnerability caused by incorrectly configured access control security levels. This allows exploitation of improperly configured authorization mechanisms.
WeDesignTech Ultimate Booking Addon (wedesigntech-ultimate-booking-addon) has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This affects versions through 1.0.3.
The Ultimate Store Kit Elementor Addons plugin (up to version 2.9.4) contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This enables unauthorized users to access functions that should be protected.
The Team Showcase plugin for WordPress is vulnerable to Stored XSS due to improper neutralization of input during web page generation. This issue affects versions from n/a through 2.9.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS