CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.09)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Stored XSS vulnerability in the Site Reviews plugin by Gemini Labs. Improper input neutralization during web page generation allows persistent script injection. Affects versions from n/a through 8.2.0.
Unauthenticated Broken Authentication vulnerability in Popup by Supsystic plugin versions up to 1.13.0. An attacker without authentication can bypass authentication mechanisms.
Unauthenticated PHP Object Injection vulnerability in Popup by Supsystic plugin versions up to 1.13.0. An attacker without authentication can inject PHP objects, potentially leading to remote code execution.
The Contact Form by Supsystic plugin version earlier than 1.10.0 has a bypass vulnerability that does not require authentication. This means an unauthenticated attacker can bypass security mechanisms and gain unauthorized access.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Contact Form by Supsystic versions prior to 1.10.0.
Unauthenticated Broken Access Control vulnerability in Ultimate Maps by Supsystic versions prior to 1.5.0.
Unauthenticated PHP Object Injection vulnerability in Ultimate Maps by Supsystic plugin versions before 1.5.0. An attacker without authentication can inject PHP objects, potentially leading to remote code execution.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Ultimate Maps by Supsystic versions prior to 1.5.0.
Unauthenticated Remote File Inclusion vulnerability in Easy Google Maps versions prior to 1.14.2.
Unauthenticated PHP Object Injection vulnerability in Easy Google Maps plugin versions up to 1.13.0. An attacker without authentication can inject PHP objects, potentially leading to remote code execution.
Unauthenticated SQL Injection vulnerability in JetAppointment plugin versions up to 2.5.2. An attacker without authentication can inject SQL queries.
Unauthenticated Cross Site Scripting (XSS) vulnerability in URL Shortify versions up to 2.5.0.
Unauthenticated Cross Site Scripting (XSS) in Recipe Card Blocks for Gutenberg & Elementor versions up to 3.4.18.
Unauthenticated Cross Site Scripting (XSS) in Chaty Pro versions up to 3.5.8.
Cross Site Scripting (XSS) vulnerability in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions up to 4.3.9. The attack requires subscriber-level privileges.
Unauthenticated Cross Site Scripting (XSS) in Affiliates Manager versions up to 2.9.53.
Unauthenticated Arbitrary Content Deletion in Breeze versions up to 2.5.12.
Unauthenticated SQL Injection vulnerability in Affiliates Manager plugin versions up to 2.9.53. An attacker without authentication can inject SQL queries.
Broken Access Control vulnerability in GiveWP versions up to 4.16.5.1. The attack does not require authentication.
Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register versions up to 7.8.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS