CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Stored Cross-Site Scripting (XSS) vulnerability in Nota Fiscal Eletrônica WooCommerce (versions up to 3.4.0.9) due to improper input neutralization during web page generation.
The WP Ticket Customer Service Software & Support Ticket System up to version 6.0.2 contains a Stored XSS vulnerability. The issue arises from improper neutralization of input during web page generation.
The WP Virtual Assistant plugin for WordPress has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 3.0.
The MWW Disclaimer Buttons plugin has a stored XSS vulnerability due to improper neutralization of input during web page generation. Affects versions up to and including 3.41.
The Subscribe To Unlock plugin for WordPress (versions up to and including 1.1.5) contains a Missing Authorization vulnerability. This allows exploitation of incorrectly configured access control security levels.
The Notely plugin has a stored XSS vulnerability due to improper neutralization of input during web page generation. Affects versions up to and including 1.8.0.
The Subscribe to Download plugin for WordPress (versions up to and including 2.0.9) contains a Missing Authorization vulnerability. This enables exploitation of incorrectly configured access control security levels.
The HT Feed plugin contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through 1.3.0.
The Map Categories to Pages plugin has a stored XSS vulnerability due to improper neutralization of input during web page generation. Affects versions up to and including 1.3.2.
The Lenix scss compiler plugin (up to version 1.2) contains a Cross-Site Request Forgery (CSRF) vulnerability, allowing an attacker to perform unauthorized actions in the context of a logged-in user.
The Lenix scss compiler plugin has a stored XSS vulnerability due to improper neutralization of input during web page generation. Affects versions up to and including 1.2.
Missing Authorization vulnerability in the Netgsm WordPress plugin (versions up to and including 2.9.69) allows exploiting incorrectly configured access control security levels.
The Simple Meta Tags WordPress plugin contains a DOM-Based Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The issue affects versions up to and including 1.5.
The Tribal plugin has a stored XSS vulnerability due to improper neutralization of input during web page generation. Affects versions up to and including 1.3.3.
Insertion of Sensitive Information Into Sent Data vulnerability in thetechtribe The Tribal allows retrieving embedded sensitive data. This issue affects The Tribal from n/a through <= 1.3.3.
CSRF vulnerability in the Sendle Shipping plugin for WordPress. An attacker can exploit this flaw to perform unauthorized actions on behalf of an administrator.
The SKT Blocks WordPress plugin contains a Stored Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The issue affects versions up to and including 2.6.
CSRF vulnerability in the Post Featured Video plugin. Allows an attacker to perform unauthorized operations in the context of a logged-in user.
The User Notes plugin has a stored XSS vulnerability due to improper neutralization of input during web page generation. Affects versions up to and including 1.0.2.
The PE Easy Slider plugin has a stored XSS vulnerability due to improper neutralization of input during web page generation. Affects versions up to and including 1.1.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS