CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.08)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The ListingPro Lead Form plugin by CridioStudio is vulnerable to Missing Authorization, allowing access to functionality not properly constrained by ACLs. This issue affects ListingPro Lead Form from n/a through <= 1.0.7.
The ListingPro Lead Form plugin (versions up to and including 1.0.7) contains a DOM-Based Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. A malicious script can be executed in the user's browser through DOM manipulation.
Missing Authorization vulnerability in CridioStudio ListingPro theme allows exploiting incorrectly configured access control security levels. This issue affects ListingPro from n/a through <= 2.9.9.
DOM-Based XSS vulnerability in the ListingPro plugin allows injection of malicious script into the page generated by the plugin. An attacker can exploit this to execute script in the victim's browser.
DOM-Based XSS vulnerability in the Master Slider Pro plugin allows injection of malicious script into the page generated by the plugin. An attacker can exploit this to execute script in the victim's browser.
DOM-Based XSS vulnerability in the Xpro Elementor Addons plugin allows injection of malicious script into the page generated by the plugin. An attacker can exploit this to execute script in the victim's browser.
Stored XSS vulnerability in the Tutor LMS Elementor Addons plugin allows persistent injection of malicious script into the page. An attacker can exploit this to execute script in the victim's browser.
DOM-Based XSS vulnerability in Ronneby Theme Core plugin by DFDevelopment. Improper input neutralization during web page generation allows client-side script injection.
DOM-Based XSS vulnerability in WPLMS plugin by VibeThemes. Improper input neutralization during web page generation allows client-side script injection.
The Page View Count WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 2.9.0.
The Make Section & Column Clickable For Elementor plugin (versions up to 2.4) is vulnerable to stored XSS due to improper neutralization of input during web page generation. A malicious script can be stored and executed in users' browsers.
The Traveler theme contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 3.2.6.
The Order Delivery Date for WooCommerce plugin (versions up to and including 4.3.1) contains a Missing Authorization vulnerability. It allows exploitation of incorrectly configured access control security levels.
The Payment Gateway for PayPal on WooCommerce plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 9.0.53.
The WP Hotel Booking plugin (versions up to and including 2.2.7) exposes sensitive system information to an unauthorized control sphere. This may allow reading confidential data embedded in the application.
The WP Hotel Booking plugin (up to version 2.2.8) is vulnerable to Cross-Site Request Forgery (CSRF). An attacker can trick an authenticated user into performing unwanted operations.
The WP Hotel Booking plugin for WordPress contains a DOM-Based XSS vulnerability due to improper input neutralization during web page generation. The issue affects versions up to and including 2.2.8.
Server-Side Request Forgery (SSRF) vulnerability in ThemesInflow Hercules Core (hercules-core) allows Server Side Request Forgery. This issue affects Hercules Core from n/a through <= 7.4.
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in yuvalo WP Google Analytics Events wp-google-analytics-events allows Retrieve Embedded Sensitive Data. This issue affects WP Google Analytics Events: from n/a through <= 2.8.2.
The WP ERP plugin (versions up to and including 1.16.7) contains a Missing Authorization vulnerability due to incorrectly configured access control security levels. This allows exploitation of improperly configured authorization mechanisms.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS