CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The WP Project Manager plugin for WordPress contains a vulnerability involving the use of hard-coded credentials, allowing an attacker to retrieve sensitive data embedded in the application. The issue affects versions up to and including 2.6.25.
The WordPress plugin Gianism (versions up to 6.0.0) has a Stored XSS vulnerability due to improper input neutralization during web page generation.
Stored XSS vulnerability in DOAJ Export plugin (up to 1.0.4) due to improper input neutralization. Allows persistent script injection that executes in the victim's browser.
The WordPress plugin xili-tidy-tags up to version 1.12.06 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Malicious JavaScript can be persistently stored and executed in a user's browser.
The WP Category Dropdown WordPress plugin is vulnerable to Stored XSS due to improper input neutralization. The issue affects versions up to and including 1.9.
Stored XSS vulnerability in VoucherPress plugin (up to 1.5.7) due to improper input neutralization. Allows persistent script injection that executes in the user's browser.
Missing Authorization vulnerability in Dynamic Web Lab Team Manager wp-team-manager allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Team Manager from n/a through 2.6.8.
The Page-list plugin by webvitaly has a stored XSS vulnerability due to improper neutralization of input during web page generation. Affects versions up to and including 5.8.
The WordPress plugin List Child Pages Shortcode up to version 1.3.1 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Malicious code can be persistently stored and executed in a user's browser.
The Content Mask plugin by Alex has a Server-Side Request Forgery (SSRF) vulnerability that allows making server-side requests. Affects versions up to and including 1.8.5.2.
The Participants Database plugin by xnau webdesign has a stored XSS vulnerability due to improper neutralization of input during web page generation. Affects versions up to and including 2.7.6.3.
Missing Authorization vulnerability in Detheme DethemeKit For Elementor dethemekit-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects DethemeKit For Elementor: from n/a through <= 2.1.10.
The WordPress plugin WP Social Widget up to version 2.3.1 contains a Stored XSS vulnerability due to improper input neutralization during web page generation. An attacker can inject a malicious script that gets stored and executed in the victim's browser.
Stored XSS vulnerability in AuthorSure plugin (up to 2.3) due to improper input neutralization. Allows persistent script injection that executes in the victim's browser.
The Helpdesk Support Ticket System for WooCommerce plugin by WPFactory is vulnerable to missing authorization, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 2.1.1.
The Library Bookshelves plugin (up to version 5.11) has a Stored Cross-site Scripting vulnerability due to improper input neutralization during web page generation.
The Zoho Billing plugin (up to version 4.1) has a DOM-Based XSS vulnerability due to improper input neutralization during web page generation.
The Emergency Password Reset plugin (emergency-password-reset) is vulnerable to Cross-Site Request Forgery. This issue affects versions from n/a through <= 9.3.
The WPeMatico RSS Feed Fetcher plugin by etruel is vulnerable to exposure of sensitive system information to an unauthorized control sphere. This issue affects WPeMatico RSS Feed Fetcher versions from n/a through 2.8.10 and allows retrieval of embedded sensitive data.
The Bot Block – Stop Spam Referrals in Google Analytics plugin has a Stored XSS vulnerability due to improper input neutralization during web page generation. This affects versions up to and including 2.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS