CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Billey WordPress plugin is vulnerable to Local File Inclusion (LFI) due to improper control of filename in include/require statements. The vulnerability affects versions up to and including 2.1.8.
The Aqua WordPress plugin contains a PHP Local File Inclusion (LFI) vulnerability due to improper filename control in include/require statements. This affects versions up to and including 5.1.2.
The Aalto WordPress plugin is vulnerable to PHP Local File Inclusion (LFI) due to improper filename control in include/require statements. This affects all versions up to and including 1.8.
The CWS SVGicons WordPress plugin is vulnerable to blind SQL injection in versions up to and including 1.5.5. The vulnerability stems from improper neutralization of special elements used in SQL commands.
A CSRF vulnerability in the WorkScout-Core plugin allows authentication bypass. The issue affects all versions up to and including 1.7.08.
The Advanced Shipment Tracking plugin for WooCommerce (versions up to 4.0) is vulnerable to blind SQL injection due to improper neutralization of special elements in SQL commands. An attacker can exploit this flaw to execute unauthorized database queries.
The WP Inventory Manager plugin for WordPress is vulnerable to Blind SQL Injection due to improper neutralization of special elements used in SQL commands. This issue affects versions up to and including 2.4.0.
The GD Rating System WordPress plugin is vulnerable to Blind SQL Injection due to improper neutralization of special elements used in SQL commands. This affects all versions up to and including 3.7.
The Houzez Login Register WordPress plugin contains an incorrect privilege assignment vulnerability that allows privilege escalation. This issue affects versions up to and including 3.3.3.
The RT-Theme 18 | Extensions (rt18-extensions) plugin up to version 2.5 contains a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. An attacker can inject malicious JavaScript code into an HTTP request, which will be executed in the victim's browser.
The RT-Theme 18 | Extensions (rt18-extensions) plugin version 2.5 and earlier contains a PHP Local File Inclusion (LFI) vulnerability due to improper control of filename in include/require statement. This allows an attacker to include arbitrary files from the server.
The AcyMailing SMTP Newsletter plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. This issue affects all versions up to and including 10.11.0.
The AcyMailing SMTP Newsletter plugin for WordPress contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 10.11.1.
The tagDiv Composer WordPress plugin contains a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during page generation. This affects versions up to and including 5.4.3.
The tagDiv Cloud Library (td-cloud-library) plugin for WordPress contains a DOM-based Cross-Site Scripting (XSS) vulnerability. The issue arises from improper neutralization of input during web page generation.
The tagDiv Opt-In Builder WordPress plugin contains a DOM-Based XSS vulnerability due to improper input neutralization during page generation. The issue affects versions up to and including 1.7.4.
The Flatsome plugin for WordPress contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 3.20.5.
The Flatsome plugin for WordPress contains a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. The issue affects versions up to and including 3.20.5.
The Kirki plugin (Themeum) through 6.2.0 has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This may enable unauthorized access to protected functionality.
The Kirki plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. This affects all versions up to and including 6.0.11.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS