CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.08)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Free Shipping Bar: Amount Left for Free Shipping for WooCommerce plugin up to version 2.4.9 contains a Stored Cross-site Scripting (XSS) vulnerability that allows an attacker to inject a persistent script into the website.
The Academy LMS plugin up to version 3.4.0 contains a Stored Cross-site Scripting (XSS) vulnerability that allows an attacker to inject a persistent script into the website.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixelgrade Category Icon category-icon allows Stored XSS. This issue affects Category Icon: from n/a through <= 1.0.2.
Missing Authorization vulnerability in Spiffy Calendar (up to 5.0.7) allows exploiting incorrectly configured access control security levels.
Missing authorization in the Tablesome plugin (up to version 1.1.35.1) allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized access to functions.
The Tablesome plugin (up to version 1.1.35.1) inserts sensitive information into sent data, allowing unauthorized individuals to retrieve embedded sensitive data.
The Bold Timeline Lite plugin up to version 1.2.7 contains a Stored Cross-site Scripting (XSS) vulnerability that allows an attacker to inject a persistent script into the website.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in creativeinteractivemedia Real 3D FlipBook real3d-flipbook-lite allows Stored XSS. This issue affects Real 3D FlipBook: from n/a through <= 4.11.4.
The Gutenverse Form for WordPress contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 2.3.1.
The WordPress plugin 'User Submitted Posts' up to version 20251121 has an Open Redirect vulnerability that could be used for phishing.
The H5P plugin (versions up to and including 1.16.1) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects H5P from n/a through 1.16.1.
The Prime Slider – Addons For Elementor plugin up to version 4.0.10 contains a Server-Side Request Forgery (SSRF) vulnerability that allows an attacker to send requests from the server to internal resources.
The Astra Widgets plugin (astra-widgets) in versions up to and including 1.2.16 contains a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation.
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor allows Retrieve Embedded Sensitive Data.This issue affects Premium Addons for Elementor: from n/a through <= 4.11.53.
DOM-Based XSS vulnerability in the Greenhouse Job Board plugin (up to version 2.7.3) allows an attacker to manipulate the DOM in the victim's browser, potentially leading to malicious code execution.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The Plugin Factory Google AdSense for Responsive Design – GARD google-adsense-for-responsive-design-gard allows DOM-Based XSS.This issue affects Google AdSense for Responsive Design – GARD: from n/a through <= 2.23.
Stored XSS vulnerability in the Gift Hunt plugin (up to version 2.0.2) allows persistent injection of malicious script, which will be executed on every visit to the infected page.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webheadcoder WH Tweaks wh-tweaks allows Stored XSS. This issue affects WH Tweaks: from n/a through <= 1.0.2.
Stored XSS vulnerability in the Basticom Framework (up to version 1.5.2) allows persistent injection of malicious script, which will be executed in users' browsers.
Stored XSS vulnerability in the Review Disclaimer plugin (up to version 2.0.3) allows persistent injection of malicious script, which will be executed in users' browsers.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS