CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Reflected XSS vulnerability in the Search in Place plugin. Affects versions from n/a through 1.5.5.
The ShopBuilder – Elementor WooCommerce Builder Addons plugin for WordPress contains a Reflected XSS vulnerability in versions up to and including 3.4.1. An attacker can exploit this to inject malicious scripts into the page.
The VikBooking Hotel Booking Engine & PMS plugin for WordPress contains a Reflected XSS vulnerability in versions up to and including 1.8.14. The vulnerability allows an attacker to inject malicious JavaScript into the page.
The Salon booking system plugin for WordPress contains a Reflected XSS vulnerability in versions up to and including 10.31.5. An attacker can exploit this to execute a malicious script in the victim's browser.
The Generate PDF using Contact Form 7 plugin for WordPress contains a Path Traversal vulnerability in versions up to and including 4.2.1. This allows an attacker to access files outside the application directory.
The PDF for Contact Form 7 plugin for WordPress contains a Path Traversal vulnerability in versions up to and including 7.1.0. An attacker can exploit this to read arbitrary files from the server.
The ProfileGrid plugin for WordPress contains a Blind SQL Injection vulnerability in versions up to and including 6.0.0.2. An attacker can exploit this to manipulate database queries.
The JetBlog plugin for WordPress (up to version 2.4.10) contains a Reflected XSS vulnerability due to improper neutralization of input during web page generation. An unauthenticated attacker can inject malicious JavaScript that executes in the victim's browser.
The UsersWP plugin for WordPress (up to version 1.2.73) is vulnerable to Reflected XSS due to improper neutralization of input during web page generation. An attacker can inject a malicious script that is reflected and executed in the user's browser.
The BlockStrap Page Builder - Bootstrap Blocks plugin for WordPress (up to version 0.1.58) contains a Reflected XSS vulnerability due to improper input neutralization. An attacker can inject malicious JavaScript that executes in the victim's browser.
The Pay with Vipps for WooCommerce plugin (up to version 6.2.0) contains a deserialization of untrusted data vulnerability allowing Object Injection. An attacker can supply malicious data that is deserialized by the application.
The Betheme theme for WordPress (up to version 28.5.8) is vulnerable to Reflected XSS due to improper input neutralization during web page generation. An attacker can inject a malicious script that executes in the victim's browser.
The Sassy Social Share plugin for WordPress (up to version 3.3.79) contains a Reflected XSS vulnerability due to improper input neutralization. An attacker can inject malicious JavaScript that executes in the victim's browser.
The Kubio AI Page Builder plugin for WordPress (up to version 2.9.3) is vulnerable to Reflected XSS due to improper input neutralization during web page generation. An attacker can inject a malicious script that is reflected and executed in the user's browser.
The UpSolution Core plugin for WordPress (up to version 8.44) contains a Reflected XSS vulnerability due to improper input neutralization. An attacker can inject malicious JavaScript that executes in the victim's browser.
The Grand Restaurant theme for WordPress (versions before 7.0.11) is vulnerable to Reflected XSS due to improper input neutralization during web page generation. An attacker can inject a malicious script that executes in the victim's browser.
The Total Donations plugin for WordPress (up to version 2.0.5) contains a Stored XSS vulnerability due to improper input neutralization during web page generation. An attacker can store malicious JavaScript that executes in the victim's browser each time the infected page is viewed.
The Gloria Admin Panel plugin in versions up to and including 1.3 contains a Reflected XSS vulnerability caused by improper neutralization of input during web page generation. User-supplied input is not properly sanitized, allowing injection of malicious JavaScript.
Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could exploit this to cause information disclosure, protection mechanism bypass, and unauthorized access.
Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain a Server-Side Request Forgery (SSRF) vulnerability. A high-privileged attacker with remote access could exploit it to cause information disclosure, protection mechanism bypass, SSRF, and unauthorized access.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS