CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.08)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
DOM-Based XSS vulnerability in The7 theme by Dream-Theme. Improper input neutralization during web page generation allows client-side script injection.
Stored XSS vulnerability in Cornerstone plugin by THEMECO. Improper input neutralization during web page generation allows persistent script injection.
The Shortcodes and extra features for Phlox theme plugin from averta is vulnerable to insertion of sensitive information into sent data, allowing retrieval of embedded sensitive data. This affects versions up to and including 2.17.15.
Vulnerability in the Download Manager plugin allows exposure of sensitive system information to unauthorized parties. An attacker can retrieve embedded sensitive data.
The Ivory Search plugin (add-search-to-menu) by Vinod Dalvi has a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 5.5.12.
The Contact Form 7 – Dynamic Text Extension by sevenspark is vulnerable to Basic XSS in versions up to and including 5.0.5. The issue involves improper neutralization of script-related HTML tags, allowing code injection.
The Porto Theme - Functionality plugin versions below 3.7.3 have a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
The Porto Theme - Functionality plugin (versions below 3.7.3) contains a Stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. A malicious script can be persistently stored and executed in the user's browser.
An Authorization Bypass Through User-Controlled Key vulnerability in David Lingren's Media Library Assistant plugin allows exploiting incorrectly configured access control security levels. This issue affects versions from n/a through 3.29.
The EventON plugin (versions up to and including 4.9.12) contains a Stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. A malicious script can be persistently stored and executed in the user's browser.
The Yandex.Metrica plugin (wp-yandex-metrika) is vulnerable to Missing Authorization, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 1.2.2.
The KALLYAS theme (versions below 4.25.0) contains a DOM-Based Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. A malicious script can be executed in the user's browser through DOM manipulation.
The KALLYAS plugin (by hogash) is vulnerable to Cross-Site Request Forgery (CSRF). This issue affects KALLYAS versions from n/a through < 4.25.0.
The Ninja Popups plugin (versions up to and including 4.7.8) contains a Stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. A malicious script can be persistently stored and executed in the user's browser.
An Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Hiroaki Miyashita's Custom Field Template plugin allows retrieving embedded sensitive data. This issue affects versions from n/a through 2.7.6.
The WordPress plugin Wp Ultimate Review (wp-ultimate-review) by Roxnor is vulnerable to DOM-Based Cross-site Scripting (XSS) due to improper neutralization of input during web page generation. The issue affects versions up to and including 2.3.7.
Stored XSS vulnerability in Master Addons for Elementor plugin by Liton Arefin. Improper input neutralization during web page generation allows persistent script injection.
The Quiz And Survey Master plugin by ExpressTech Systems is vulnerable to Missing Authorization, allowing exploitation of incorrectly configured access control security levels. This issue affects Quiz And Survey Master from n/a through <= 10.3.2.
Stored XSS vulnerability in SimpLy Gallery plugin by GalleryCreator. Improper input neutralization during web page generation allows persistent script injection.
The REHub Framework plugin (versions below 19.9.9.7) contains a Stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. A malicious script can be persistently stored and executed in the user's browser.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS