CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Missing Authorization vulnerability in Payrexx Payment Gateway for WooCommerce (versions up to 3.1.5) allows exploiting incorrectly configured access control security levels.
The Custom iFrame for Elementor plugin up to version 1.0.13 is vulnerable to DOM-Based XSS due to improper input neutralization during web page generation. This allows execution of malicious scripts in the user's browser.
The Save as PDF WordPress plugin contains a Stored Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The issue affects versions up to and including 4.5.2.
The Revive.so plugin for WordPress in versions up to and including 2.0.6 contains a Missing Authorization vulnerability. It enables exploitation of incorrectly configured access control security levels.
The GetResponse Forms plugin up to version 2.6.0 is vulnerable to Stored XSS due to improper input neutralization during web page generation. This allows injection of malicious scripts that execute in the user's browser.
The Product Catalog Simple plugin by impleCode has a stored XSS vulnerability due to improper neutralization of input during web page generation. Affects versions up to and including 1.8.2.
The WPComplete WordPress plugin contains a Stored Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The issue affects versions up to and including 2.9.5.2.
The Custom Login URL plugin for WordPress up to version 1.0.2 has missing authorization, allowing exploitation of incorrectly configured access control security levels.
The MaxiBlocks plugin (versions up to and including 2.1.3) contains a Missing Authorization vulnerability due to incorrectly configured access control security levels. This may allow unauthorized access to functions or data.
The Fusion Page Builder : Extension – Gallery plugin up to version 1.7.6 is vulnerable to Stored XSS due to improper input neutralization during web page generation. This allows injection of malicious scripts that execute in the user's browser.
The Publitio plugin (versions up to 2.2.1) is vulnerable to Server-Side Request Forgery (SSRF). This allows an attacker to force server-side requests to arbitrary resources.
Stored XSS vulnerability in IP Based Login plugin (up to 2.4.3) due to improper input neutralization during web page generation. Allows an attacker to inject a persistent script that executes in the victim's browser.
Missing Authorization vulnerability in VPSUForm (versions up to 3.2.20) allows exploiting incorrectly configured access control security levels.
The WordPress plugin WP Delete User Accounts up to version 1.2.4 contains a stored XSS vulnerability due to improper input neutralization during web page generation. An attacker can inject a malicious script that gets stored and executed in the browser of an administrator or other user.
The WordPress plugin Skyword API Plugin up to version 2.5.3 contains a stored XSS vulnerability due to improper input neutralization during page generation. This allows injection of a malicious script that gets stored and executed in the victim's browser.
The WordPress plugin MarketKing (marketking-multivendor-marketplace-for-woocommerce) up to version 2.0.92 is vulnerable to stored XSS due to improper input neutralization during page generation. An attacker can inject malicious code that gets stored and executed in the user's browser.
The Genesis Club Lite plugin up to version 1.17 is vulnerable to Stored XSS due to improper input neutralization during web page generation. This allows injection of malicious scripts that execute in the user's browser.
The Tapfiliate plugin (versions up to 3.2.2) contains a stored Cross-site Scripting (XSS) vulnerability. It results from improper neutralization of input during web page generation.
The Cecabank WooCommerce Plugin (versions up to and including 0.3.4) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthenticated or low-privileged user may perform actions they should not have access to.
The WordPress plugin Logo Showcase (logo-showcase) up to version 4.0.1 contains a stored XSS vulnerability due to improper input neutralization during page generation. This allows injection of a malicious script that gets stored and executed in the browser of an administrator or other user.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS