CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The PublishPress Capabilities plugin in versions up to and including 2.50.1 contains an unauthenticated Cross Site Request Forgery (CSRF) vulnerability. An attacker can trick a user into performing unwanted actions.
Cross Site Scripting (XSS) vulnerability in the Ditty plugin in versions up to and including 3.1.69. The vulnerability can be exploited by a user with Contributor privileges.
Bypass vulnerability in the Captcha Code plugin in versions up to and including 3.32. The vulnerability can be exploited by an unauthenticated attacker.
Cross Site Scripting (XSS) vulnerability in the Ultimate FAQ plugin in versions up to and including 2.4.14. The vulnerability can be exploited by a user with Contributor privileges.
The Arc browser in affected versions contains an address bar spoofing issue. An attacker can use a <select> element that triggers requestFullscreen without displaying the fullscreen notification to spoof the browser address bar.
The Razorpay Payment Button plugin in versions up to and including 2.4.9 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script into the page.
Unauthenticated Cross Site Scripting (XSS) in Mang Board WP versions up to 2.4.1.
Administrator SQL Injection in Email Log versions up to 2.63.
Cross Site Scripting (XSS) vulnerability in the Premium Addons for Elementor plugin in versions up to and including 4.11.105. The vulnerability can be exploited by a user with Contributor privileges.
Contributor SQL Injection in WP EasyCart versions up to 5.9.4.
Cross Site Scripting (XSS) vulnerability in the Premium Blocks – Gutenberg Blocks for WordPress plugin in versions up to and including 2.3.17. The vulnerability can be exploited by a user with Contributor privileges.
Broken Access Control vulnerability in the MarketKing plugin in versions up to and including 2.1.70. The vulnerability can be exploited by an unauthenticated attacker.
Broken Access Control vulnerability in the WP User Manager plugin in versions up to and including 2.9.19. The vulnerability can be exploited by an unauthenticated attacker.
Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus versions up to 9.3.02.002.
Contributor SQL Injection in Mollie Forms versions up to 2.11.0.
Cross Site Scripting (XSS) vulnerability in the wpForo Forum plugin in versions up to and including 3.1.5. The vulnerability can be exploited by a user with Subscriber privileges.
The AI Engine plugin in versions up to 3.7.8 contains an Insecure Direct Object References (IDOR) vulnerability that allows an unauthenticated attacker to access objects they should not have permission to. The lack of authentication on object references enables manipulation of identifiers to gain unauthorized access.
Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login versions up to 1.5.9.3.
The PayPlus Payment Gateway plugin in versions up to 8.2.5 contains a Broken Access Control vulnerability that allows an unauthenticated attacker to bypass access control mechanisms. The lack of proper permission verification enables performing operations reserved for authorized users.
The JetTricks plugin by Jetimpex Inc. (Crocoblock) in versions up to 2.0.1 contains a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation. This allows an attacker to inject a malicious script that is stored and executed in the victim's browser.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS