CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.31)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unauthenticated Cross Site Scripting (XSS) in Urna versions up to 2.6.2. Allows injecting malicious script into the page.
Unauthenticated Cross Site Scripting (XSS) in WPComplete versions up to 2.9.5.6. Allows injecting malicious script into the page.
Unauthenticated Local File Inclusion in WP Cafe Pro versions before 3.0.15. An attacker can read arbitrary files from the server.
Unauthenticated Sensitive Data Exposure in WP Cafe Pro versions before 3.0.15. Allows access to confidential information without authentication.
Unauthenticated Cross Site Scripting (XSS) in 12 Step Meeting List versions up to 3.19.16. Allows injecting malicious script into the page.
Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress versions up to 8.9.1. An attacker can gain elevated privileges without authentication.
Unauthenticated SQL Injection in Woo Essential versions up to 4.3.0. An attacker can manipulate database queries.
SQL Injection vulnerability in WP Project Manager Pro versions up to 4.0.1, exploitable by a user with Subscriber role.
Unauthenticated arbitrary file deletion vulnerability in ShopBuilder Pro – Elementor WooCommerce Builder Addons versions up to 2.2.0.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Brave Conversion Engine (PRO) versions up to 0.8.6.
SQL Injection vulnerability in ProLancer Element versions up to 1.4.8, exploitable by a user with Subscriber role.
Broken Access Control vulnerability in ProLancer Element versions up to 1.4.8, exploitable by a user with Subscriber role.
Unauthenticated arbitrary file deletion vulnerability in WooCommerce File Approval versions up to 10.7.
Unauthenticated arbitrary file download vulnerability in Super Forms versions up to 6.3.315.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Tourmaster versions up to 5.4.9.
Unauthenticated Privilege Escalation in Digits versions up to 9.2. An attacker can gain elevated privileges without authentication.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Events Made Easy versions up to 3.2.5.
Unauthenticated Broken Access Control vulnerability in Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More versions up to 1.7.1.
Unauthenticated Local File Inclusion in Tonda Core versions prior to 2.6.
Unauthenticated Local File Inclusion in Tonda versions prior to 2.6.