CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin up to version 2.0.12 contains a reflected XSS (Cross-site Scripting) vulnerability due to improper input neutralization during web page generation. An attacker can inject malicious JavaScript code into the server response, which will be executed in the victim's browser.
The Fluent CRM WordPress plugin contains a reflected XSS (Cross-site Scripting) vulnerability due to improper input neutralization during page generation. The issue affects versions up to and including 3.1.7.
The Events Manager WordPress plugin contains a deserialization of untrusted data vulnerability allowing object injection. This issue affects all versions up to and including 7.3.6.
The WPZOOM Portfolio plugin for WordPress is vulnerable to Reflected Cross-site Scripting (XSS) due to improper input neutralization during page generation. This affects versions up to and including 1.4.29.
The Membership For WooCommerce plugin for WordPress contains a path traversal vulnerability that allows an attacker to access files outside the restricted directory. The issue affects versions up to and including 3.1.0.
The Contact Form Entries WordPress plugin up to version 1.5.2 contains a reflected XSS vulnerability. Improper input neutralization during page generation allows injection of malicious scripts.
The Dokan plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper input neutralization during page generation. This affects versions up to and including 5.0.6.
The Event Tickets plugin for WordPress contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 5.28.5.
The ProfileGrid plugin for WordPress contains an authentication bypass vulnerability via an alternate path or channel, allowing password recovery exploitation. This affects versions up to and including 5.9.9.6.
The Document Gallery WordPress plugin contains a reflected XSS (Cross-site Scripting) vulnerability due to improper input neutralization during page generation. The flaw affects all versions up to and including 5.1.0.
The NEX-Forms plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. This affects all versions up to and including 9.2.2.
The Message Filter for Contact Form 7 WordPress plugin is vulnerable to Reflected Cross-site Scripting (XSS) in versions up to and including 1.6.3.8. An attacker can inject malicious scripts due to improper input neutralization during page generation.
The Bopo – WooCommerce Product Bundle Builder plugin for WordPress contains a reflected XSS (Cross-site Scripting) vulnerability due to improper input neutralization during page generation. The issue affects versions up to and including 1.2.0.
The CRM Perks Forms WordPress plugin contains a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during page generation. This affects versions up to and including 1.1.7.
The Cart Lift WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) due to improper input neutralization during page generation. This affects all versions up to and including 3.1.57.
The SiteGround Email Marketing plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. The issue affects versions up to and including 1.7.5.
The Gift Vouchers plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. This affects versions up to and including 4.7.0.
The CF7 Views – Complete Entry Management for Contact Form 7 plugin up to version 3.2.2 contains a DOM-Based Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation.
The MailerPress plugin up to version 2.0.2 contains an incorrect privilege assignment vulnerability that allows privilege escalation. An attacker can exploit this flaw to gain higher privileges within the system.
The Active Products Tables for WooCommerce plugin (versions up to and including 1.1.0) contains a DOM-based XSS vulnerability due to improper input neutralization during page generation. This allows an attacker to inject malicious client-side scripts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS