CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Missing Authorization vulnerability in Ashan Perera LifePress lifepress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects LifePress from n/a through <= 2.1.3.
The Chartbeat plugin through version 2.0.7 contains a Server-Side Request Forgery (SSRF) vulnerability. This allows an attacker to force the server to make requests to arbitrary resources.
The Houzez theme for WordPress is vulnerable to PHP Local File Inclusion due to improper control of filenames in include/require statements. This affects versions before 4.1.4.
The Custom Comment plugin by imaprogrammer contains a stored cross-site scripting vulnerability due to improper neutralization of input during web page generation. This issue affects Custom Comment through version 2.1.6.
Server-Side Request Forgery (SSRF) vulnerability in vEnCa-X rajce rajce allows Server Side Request Forgery. This issue affects rajce: from n/a through <= 0.4.2.
The Popup for CF7 with Sweet Alert plugin (cf7-sweet-alert-popup) in versions up to and including 1.6.5 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows unauthorized actions on behalf of a logged-in user.
The Hesabfa Accounting plugin (hesabfa-accounting) in versions up to and including 2.2.5 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows unauthorized actions on behalf of a logged-in user.
The Hesabfa Accounting plugin for WordPress (versions up to and including 2.2.5) contains an Insertion of Sensitive Information Into Sent Data vulnerability, allowing retrieval of embedded sensitive data.
The Varnish/Nginx Proxy Caching plugin by Razvan Stanga contains a stored cross-site scripting vulnerability due to improper neutralization of input during web page generation. This issue affects Varnish/Nginx Proxy Caching through version 1.8.3.
The Risk Free Cash On Delivery (COD) – WooCommerce plugin by everythingwp contains a stored cross-site scripting vulnerability due to improper neutralization of input during web page generation. This issue affects Risk Free Cash On Delivery (COD) – WooCommerce through version 1.0.4.
Cross-Site Request Forgery (CSRF) vulnerability in Theme Century Century ToolKit (century-toolkit) allows Cross Site Request Forgery. This issue affects Century ToolKit from n/a through <= 1.2.1.
The Kanpress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects Kanpress versions from n/a through 1.1.
The Better Post & Filter Widgets for Elementor plugin contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects Better Post & Filter Widgets for Elementor versions from n/a through 1.6.1.
The Yandex Site search pinger plugin by sitesearch-yandex contains a stored cross-site scripting vulnerability due to improper neutralization of input during web page generation. This issue affects Yandex Site search pinger through version 1.5.
The AutoWP plugin (autowp-ai-content-writer-rewriter) by Basar Ventures has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 2.2.7.
The Video Gallery – Vimeo and YouTube Gallery plugin contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects Video Gallery – Vimeo and YouTube Gallery versions from n/a through 1.1.7.
The Site Offline plugin by chandrashekharsahu has an incorrect privilege assignment vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 1.5.7.
The bxSlider integration plugin for WordPress (versions up to 1.7.2) is vulnerable to stored XSS due to improper neutralization of input during web page generation. An attacker can store a malicious script that executes in a user's browser.
A missing authorization vulnerability in the inkthemes WP Mailgun SMTP plugin (wp-mailgun-smtp) allows accessing functionality not properly constrained by ACLs. This issue affects WP Mailgun SMTP versions up to and including 1.0.7.
The tli.tl auto Twitter poster plugin for WordPress is vulnerable to stored XSS due to improper neutralization of input during web page generation. This issue affects versions up to and including 3.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS