CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.09)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Broken Access Control vulnerability in Appointment Hour Booking versions up to 1.5.91. The attack does not require authentication.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Templately versions up to 3.7.1. An attacker can inject a malicious script that executes in the victim's browser.
Missing Authorization vulnerability in MultiVendorX dc-woocommerce-multi-vendor allows exploiting incorrectly configured access control security levels. This issue affects MultiVendorX from n/a through 5.0.20.
Cross Site Scripting (XSS) vulnerability in WP Tab Widget versions up to 1.2.11. The attack requires contributor-level privileges.
Cross Site Scripting (XSS) vulnerability in the Table of Contents Block in versions up to 1.5.0. A user with Contributor role can inject malicious script.
Cross Site Scripting (XSS) vulnerability in Typing Effect in versions up to 1.3.7. A user with Contributor role can inject malicious script.
Cross Site Scripting (XSS) vulnerability in Wufoo Shortcode in versions up to 1.55. A user with Contributor role can inject malicious script.
Cross Site Scripting (XSS) vulnerability in Video Conferencing with Zoom in versions up to 4.6.8. A user with Contributor role can inject malicious script.
Cross Site Scripting (XSS) vulnerability in Login With Ajax in versions up to 4.5.1. A user with Contributor role can inject malicious script.
Cross Site Scripting (XSS) vulnerability in WPZOOM Forms – Contact Form Plugin for Gutenberg in versions up to 2.0.4. A user with Contributor role can inject malicious script.
Cross Site Scripting (XSS) vulnerability in Frontend Admin by DynamiApps in versions up to 3.29.10. A user with Contributor role can inject malicious script.
Cross Site Scripting (XSS) vulnerability in Featured Video Plus in versions up to 2.3.3. A user with Contributor role can inject malicious script.
Stored XSS vulnerability in the Wise Chat plugin by Marcin. Improper input neutralization during page generation allows persistent execution of malicious scripts.
The Slider by 10Web plugin (versions up to 1.2.63) is vulnerable to Cross-Site Request Forgery (CSRF). An attacker can trick a logged-in user into performing unwanted actions within the application, such as changing slider settings.
Insecure Direct Object References (IDOR) vulnerability in Modal Survey in versions up to 2.0.2.2.3. A user with Subscriber role can access unauthorized resources.
Unauthenticated XSS vulnerability in Fluent Forms Pro Add On Pack versions prior to 6.2.12. An attacker can inject malicious scripts that execute in the victim's browser.
Unauthenticated XSS vulnerability in Kirki versions up to 6.2.3. An attacker can inject malicious scripts that execute in the victim's browser.
The GP Premium plugin by EDGE22 Studios Ltd. contains an unrestricted upload of dangerous file type vulnerability, allowing remote code inclusion. The issue affects versions from n/a through 2.5.5.
Unauthenticated SQL Injection vulnerability in Depicter Slider versions up to 4.8.0. An attacker can inject malicious SQL queries into the database.
The Ultimate Dashboard Pro plugin for WordPress (versions up to 3.11.2) contains a DOM-Based XSS (Cross-site Scripting) vulnerability. This means that an attacker can inject a malicious script into the page, which will execute in the user's browser, potentially leading to data theft or session hijacking.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS