CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Real Testimonials WordPress plugin (versions up to 3.1.15) has a deserialization of untrusted data vulnerability allowing object injection. An attacker can remotely exploit this flaw to execute arbitrary code.
The ICS Calendar WordPress plugin up to version 12.1.1 contains a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during page generation. An attacker can inject malicious JavaScript via a crafted HTTP request.
The Funnel Builder plugin for WordPress contains a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during page generation. An attacker can inject malicious JavaScript code into HTTP request parameters, which will be executed in the victim's browser.
The Forminator plugin for WordPress contains a path traversal vulnerability that allows an attacker to access files outside the restricted directory. The issue affects versions up to and including 1.55.0.2.
The Forminator plugin for WordPress contains a DOM-based XSS vulnerability due to improper input neutralization during web page generation. The issue affects versions up to and including 1.55.0.1.
The APIExperts Square for WooCommerce plugin (woosquare) version up to 4.7.4 is vulnerable to blind SQL injection. Improper neutralization of special elements in SQL commands allows an attacker to execute unauthorized database operations.
The Tonda WordPress plugin contains a PHP Local File Inclusion (LFI) vulnerability due to improper control of filename in include/require statements. The issue affects versions up to and including 2.5.
The TheGem Theme Elements (for Elementor) plugin by CodexThemes contains a PHP Local File Inclusion vulnerability due to improper control of filename for include/require statement. The issue affects versions before 5.12.1.1.
A vulnerability in Struktur Core from Select-Themes allows PHP Local File Inclusion due to improper control of filename in include/require statement. Affects versions before 2.7.
A vulnerability in the Struktur theme by Select-Themes allows PHP Local File Inclusion due to improper control of filename for include/require statement. This affects versions before 2.7.
The SetSail WordPress plugin is vulnerable to PHP Local File Inclusion (LFI) due to improper control of filename in include/require statements. This affects versions up to and including 2.1.
The Overworld WordPress plugin contains a Local File Inclusion (LFI) vulnerability due to improper filename control in include/require statements. This affects versions up to and including 1.5.
The Nuss WordPress plugin (versions up to 1.3.6) contains a PHP Local File Inclusion (LFI) vulnerability due to improper filename control in include/require statements. This allows an attacker to read sensitive files on the server.
The NewsPlus Shortcodes WordPress plugin contains a Local File Inclusion (LFI) vulnerability via improper filename control in include/require statements. Affects versions up to and including 4.2.0.
The Leedo WordPress plugin contains a PHP Local File Inclusion (LFI) vulnerability due to improper filename control in include/require statements. Affects versions up to and including 3.0.0.
The Kitchor WordPress plugin contains a Local File Inclusion (LFI) vulnerability due to improper filename control in include/require statements. Affects versions up to and including 1.4.3.
The Golo Framework WordPress plugin contains a PHP Local File Inclusion (LFI) vulnerability due to improper control of filename in include/require statements. The issue affects versions up to and including 1.7.3.
A vulnerability in the Flow theme by Elated-Themes allows remote file inclusion (RFI) via improper filename control in PHP include/require statements. The issue affects theme versions up to and including 1.8.
The Dør WordPress plugin contains a PHP Local File Inclusion (LFI) vulnerability due to improper control of filename in include/require statements. The issue affects versions up to and including 2.4.1.
The Brook WordPress theme contains a PHP Local File Inclusion (LFI) vulnerability due to improper filename control in include/require statements. This affects versions up to and including 2.9.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS