CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.25)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Foton Core plugin version 1.1.1 and earlier contains an unauthenticated Local File Inclusion (LFI) vulnerability. An attacker without authentication can read arbitrary files from the server, such as configuration files or user data.
The MultiParcels Shipping For WooCommerce plugin version 1.30.36 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser without requiring authentication.
Unauthenticated Local File Inclusion in Barista plugin versions up to 2.5.1. An attacker without authentication can include local files from the server.
Unauthenticated Broken Access Control in Arvow AI SEO Writer plugin versions up to 1.5.3. An attacker without authentication can access functions that should be protected.
Unauthenticated Cross-Site Scripting (XSS) in Local Delivery Drivers for WooCommerce plugin versions up to 3.0.0. An attacker can inject malicious script without authentication.
Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce plugin versions up to 2.1.1. An attacker without authentication can access unauthorized functions.
Unauthenticated Sensitive Data Exposure in iCARRY plugin versions up to 2.9. An attacker without authentication can access confidential information.
Unauthenticated Sensitive Data Exposure in WooCommerce Appointments plugin versions up to 5.3.8. An attacker without authentication can access confidential information.
Unauthenticated Broken Access Control vulnerability in SMEPay: UPI Gateway for WooCommerce versions up to 1.0.5.
Unauthenticated Local File Inclusion vulnerability in Geo Mashup versions up to 1.13.18.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Geo Mashup versions up to 1.13.18.
Unauthenticated Sensitive Data Exposure vulnerability in REST API Log versions up to 1.7.1.
Unauthenticated Broken Access Control vulnerability in MultiVendorX versions up to 5.0.10.
Subscriber Sensitive Data Exposure vulnerability in WPJAM Basic versions up to 7.0.2.1.
Unauthenticated Broken Access Control vulnerability in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) versions up to 1.0.7.
Subscriber SQL Injection vulnerability in Visitor Traffic Real Time Statistics Pro versions up to 11.10.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Visitor Traffic Real Time Statistics Pro versions up to 11.10.
Unauthenticated Cross Site Scripting (XSS) vulnerability in WP-Stats versions up to 2.56.
The AI Hub plugin versions up to 1.3.10 allow a subscriber-level user to download arbitrary files from the server.
The Agrion plugin versions up to 1.0.0 contain a Cross-Site Scripting (XSS) vulnerability that can be exploited without authentication.