CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The PDF Generator for WordPress plugin (versions up to 1.6.2) contains a Server-Side Request Forgery (SSRF) vulnerability. It allows an attacker to send requests from the server to internal network resources.
The Open Shop WordPress plugin contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 1.7.1.
The GD Security Headers WordPress plugin contains a reflected Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. This affects versions up to and including 1.8.
The Proxy & VPN Blocker WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. This affects versions up to and including 3.5.8.
The Real Estate Manager Pro WordPress plugin contains a reflected Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. An attacker can inject malicious JavaScript code into an HTTP request, which will be executed in the victim's browser.
The Free Gifts for WooCommerce plugin for WordPress contains a stored Cross-site Scripting (XSS) vulnerability due to improper input neutralization during page generation. All versions up to and including 13.1.0 are affected.
The Newsletters plugin for WordPress (versions up to 4.14) is vulnerable to reflected XSS. Improper input neutralization during web page generation allows injection of malicious scripts.
The Groundhogg WordPress plugin up to version 4.4.1 contains a Path Traversal vulnerability that allows unauthorized access to files outside the restricted directory.
The Hydra Booking WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) due to improper input neutralization during web page generation. This affects all versions up to and including 1.1.44.
The picu WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) due to improper input neutralization during page generation. This affects all versions up to and including 3.5.1.
The aBlocks plugin by Kodezen LLC contains an Incorrect Privilege Assignment vulnerability that allows Privilege Escalation. The issue affects versions before 2.9.1.
The Vitepos WordPress plugin contains a blind SQL injection vulnerability due to improper neutralization of special elements in SQL commands. This affects versions up to and including 3.4.2.
The JobSearch WordPress plugin (versions up to 3.2.9) contains a stored XSS vulnerability. Improper input neutralization during web page generation allows an attacker to inject a malicious script.
The Simple File List WordPress plugin contains a reflected Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. This affects all versions up to and including 6.3.8.
The PropertyHive WordPress plugin contains a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during page generation. This affects all versions up to and including 2.2.3.
The Extensions for Leaflet Map WordPress plugin is vulnerable to DOM-based XSS. The flaw affects versions up to and including 5.1, allowing an attacker to inject malicious scripts.
The FormyChat WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. This affects all versions up to and including 2.15.3.
The Advanced Forms WordPress plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 1.9.3.7.
The ElementInvader Addons for Elementor WordPress plugin contains a DOM-Based Cross-Site Scripting (XSS) vulnerability. The flaw arises from improper input neutralization during web page generation, allowing an attacker to inject malicious JavaScript code.
SSRF vulnerability in the WPJAM Basic plugin allows an attacker to send requests from the server to internal network resources. The issue affects versions up to and including 7.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS