CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Designil PDPA Thailand WordPress plugin contains a Stored XSS vulnerability due to improper input neutralization during web page generation. This allows persistent injection of malicious scripts.
The NGG Smart Image Search plugin contains a Stored XSS vulnerability in versions up to and including 3.4.3. An attacker can inject a malicious script that executes in the user's browser.
The Termageddon: Cookie Consent & Privacy Compliance plugin contains a Stored XSS vulnerability in versions up to and including 1.8.1. An attacker can inject a malicious script that executes in the user's browser.
The Master Slider plugin contains a Stored XSS vulnerability in versions up to and including 3.11.0. An attacker can inject a malicious script that executes in the user's browser.
The Genealogical Tree plugin contains a Stored XSS vulnerability in versions up to and including 2.2.7. An attacker can inject a malicious script that executes in the user's browser.
The ShortCode plugin for WordPress (versions up to and including 0.8.1) contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. A malicious script can be persistently stored and executed in the user's browser.
The WordPress plugin List Child Pages Shortcode up to version 1.3.1 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Malicious code can be persistently stored and executed in a user's browser.
The Theater for WordPress plugin (versions up to 0.18.8) is vulnerable to stored XSS due to improper input neutralization during web page generation. Attackers can inject malicious scripts.
The Search Atlas SEO plugin for WordPress (versions up to and including 2.5.4) contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. A malicious script can be persistently stored and executed in the user's browser.
The Mail Subscribe List plugin for WordPress (versions up to and including 2.1.10) contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. A malicious script can be persistently stored and executed in the user's browser.
The Ultimate Store Kit Elementor Addons plugin contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through 2.8.6.
Missing Authorization vulnerability in CF7 Submissions (versions up to 0.26) allows exploiting incorrectly configured access control security levels.
The Content Mask plugin by Alex has a Server-Side Request Forgery (SSRF) vulnerability that allows making server-side requests. Affects versions up to and including 1.8.5.2.
The Participants Database plugin by xnau webdesign has a stored XSS vulnerability due to improper neutralization of input during web page generation. Affects versions up to and including 2.7.6.3.
The Memberful WordPress plugin (versions up to 1.75.0) has a missing authorization vulnerability, allowing access to functionality not properly constrained by ACLs.
Missing Authorization vulnerability in Detheme DethemeKit For Elementor dethemekit-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects DethemeKit For Elementor: from n/a through <= 2.1.10.
The Clariti plugin in versions up to 1.2.1 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.
The WordPress plugin WP Social Widget up to version 2.3.1 contains a Stored XSS vulnerability due to improper input neutralization during web page generation. An attacker can inject a malicious script that gets stored and executed in the victim's browser.
Stored XSS vulnerability in AuthorSure plugin (up to 2.3) due to improper input neutralization. Allows persistent script injection that executes in the victim's browser.
The Helpdesk Support Ticket System for WooCommerce plugin by WPFactory is vulnerable to missing authorization, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 2.1.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS