CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unauthenticated privilege escalation vulnerability in the Abandoned Cart Pro for WooCommerce plugin. Affects versions up to 10.4.0.
Unauthenticated SQL Injection vulnerability in the Locatoraid Store Locator plugin. Affects versions up to 3.9.72.
Broken Authentication vulnerability in Leyka plugin versions up to 3.32.3, exploitable by a user with Subscriber role. A low-privileged user can bypass authentication mechanisms and gain unauthorized access.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Flatastic theme versions up to 2.0. An attacker without authentication can inject a malicious script into the page, which executes in the victim's browser.
Unauthenticated PHP Object Injection vulnerability in Flatastic versions up to 2.0. An attacker can send crafted data to execute arbitrary code.
Unauthenticated SQL Injection vulnerability in Directory Pro versions up to 2.5.8. An attacker can manipulate database queries.
Subscriber Broken Access Control in Homlisti <= 3.1.2 versions.
The Form Maker by 10Web plugin (versions up to 1.15.49) is vulnerable to Stored Cross-site Scripting (XSS) due to improper neutralization of input during web page generation. Malicious JavaScript submitted through a form is stored and executed when a user visits the affected page.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Podlove Podcast Publisher plugin versions up to 4.5.4. An attacker without authentication can inject a malicious script into the page, which executes in the victim's browser.
Unauthenticated Cross Site Scripting (XSS) vulnerability in SEO Plugin by Squirrly SEO plugin versions up to 14.2.2. An attacker without authentication can inject a malicious script into the page, which executes in the victim's browser.
Unauthenticated Cross Site Scripting (XSS) in Aora versions up to 1.3.19. An attacker can inject malicious script without authentication.
Unauthenticated Cross Site Scripting (XSS) in Paymob for WooCommerce versions up to 4.1.10. An attacker can inject malicious script without authentication.
Unauthenticated SQL Injection vulnerability in TheGem (Elementor) versions up to 5.12.3. An attacker can manipulate database queries.
Unauthenticated Cross Site Scripting (XSS) in Advance Product Search versions up to 1.4.8. An attacker can inject malicious script without authentication.
Unauthenticated Cross Site Scripting (XSS) in SmartSMTP versions up to 1.2.0. An attacker can inject malicious script without authentication.
Unauthenticated Cross Site Scripting (XSS) in Swatchly – WooCommerce Variation Swatches for Products versions up to 1.4.13. An attacker can inject malicious script without authentication.
Unauthenticated Cross Site Scripting (XSS) in GeoDirectory versions up to 2.8.173. An attacker can inject malicious script without authentication.
Subscriber Cross Site Scripting (XSS) in Media Library Assistant <= 3.39 versions.
Author Arbitrary File Upload vulnerability in Media Library Assistant versions up to 3.39. A user with author role can upload malicious files.
Unauthenticated Cross Site Scripting (XSS) in B2BKing Premium versions up to 5.6.07. An attacker can inject malicious script without authentication.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS