CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.08)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Advanced FAQ Manager plugin for WordPress (up to version 1.5.2) has a DOM-Based XSS vulnerability due to improper input neutralization during page generation. An attacker can inject malicious script that executes in the victim's browser.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WalkerWP Walker Core walker-core allows DOM-Based XSS. This issue affects Walker Core: from n/a through <= 1.3.17.
The Donation Thermometer plugin for WordPress (up to version 2.2.6) has a Stored XSS vulnerability due to improper input neutralization during page generation. An attacker can store a malicious script that executes on every user visit.
oik up to version 4.15.3 contains a DOM-Based XSS vulnerability due to improper input neutralization during web page generation. This allows an attacker to execute malicious scripts in the victim's browser.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FirePlugins FireBox firebox allows Stored XSS. This issue affects FireBox: from n/a through <= 3.1.0-free.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Get Bowtied Shopkeeper Extender shopkeeper-extender allows Stored XSS. This issue affects Shopkeeper Extender: from n/a through < 7.0.
The Essential Widgets plugin by Catch Themes (up to version 2.2.2) has a Stored XSS vulnerability due to improper input neutralization during page generation. An attacker can store a malicious script that executes for other users.
The Multi-Step Checkout for WooCommerce plugin by SilkyPress (up to version 2.33) has a DOM-Based XSS vulnerability due to improper input neutralization during page generation. An attacker can inject malicious script that executes in the victim's browser.
The WP-ShowHide plugin by Lester Chan (up to version 1.05) has a Stored XSS vulnerability due to improper input neutralization during page generation. An attacker can store a malicious script that executes for other users.
The Animation Addons for Elementor plugin (animation-addons-for-elementor) by Wealcoder has a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 2.4.5.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Select-Themes Select Core select-core allows DOM-Based XSS. This issue affects Select Core: from n/a through < 2.6.
The JNews Gallery plugin by jegtheme (versions below 12.0.1) has a Stored XSS vulnerability due to improper input neutralization during page generation. An attacker can store a malicious script that executes for other users.
The ThirstyAffiliates plugin by Blair Williams (up to version 3.11.8) has a Stored XSS vulnerability due to improper input neutralization during page generation. An attacker can store a malicious script that executes for other users.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress LearnPress learnpress allows Stored XSS. This issue affects LearnPress: from n/a through <= 4.2.9.4.
The WP Maps plugin (wp-google-map-plugin) by Flipper Code is vulnerable to Deserialization of Untrusted Data, allowing Object Injection. This issue affects versions up to and including 4.8.6.
The ForumWP plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 2.1.4.
The CWW Companion plugin (versions up to and including 1.3.2) contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this to perform unauthorized operations in the context of a logged-in user.
The Quick Contact Form plugin (versions up to and including 8.2.5) contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this to perform unauthorized operations in the context of a logged-in user.
Vulnerability in the Portfolio and Projects plugin allows exposure of sensitive system information to unauthorized parties. An attacker can retrieve embedded sensitive data.
CSRF vulnerability in the PDF Thumbnail Generator WordPress plugin allows an attacker to perform unauthorized requests on behalf of a logged-in administrator. Affects versions up to and including 1.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS