CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Video Background Block plugin in versions up to and including 2.0.3 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. The flaw allows injection of malicious scripts into site pages.
Reflected Cross-Site Scripting vulnerability in Social Rocket WordPress plugin due to improper input neutralization during web page generation. Affects versions through 1.3.5.
The UDesign Core plugin in versions up to and including 4.15.0 contains a Subscriber-level SQL Injection vulnerability. The flaw allows injection of malicious SQL queries into the database.
The ListingPro plugin in versions up to and including 2.9.12 contains a Subscriber-level SQL Injection vulnerability. The flaw allows injection of malicious SQL queries into the database.
The Snapshotify – All-in-One Backup & Restore & Migrate plugin in versions up to and including 1.3.2 contains an unauthenticated Sensitive Data Exposure vulnerability. The flaw may lead to unauthorized access to confidential information.
The Norvis Backup plugin in versions up to and including 1.1.0 contains an unauthenticated Sensitive Data Exposure vulnerability. The flaw may lead to unauthorized access to confidential information.
The Museder RestoreOne plugin in versions up to and including 2.7.276 contains an unauthenticated Sensitive Data Exposure vulnerability. The flaw may lead to unauthorized access to confidential information.
The WXD Backup Lite plugin in versions up to and including 1.0.2 contains an unauthenticated Broken Access Control vulnerability. The flaw allows bypassing access control mechanisms.
The SafeSnap – Verified WordPress Backup & Restore plugin in versions up to and including 2.1.2 contains an unauthenticated Sensitive Data Exposure vulnerability. The flaw may lead to unauthorized access to confidential information.
The CF7 Views – Complete Entry Management for Contact Form 7 plugin in versions up to 3.2.6 contains a Cross Site Scripting (XSS) vulnerability. The vulnerability can be exploited by an unauthenticated attacker.
The Blog, Posts and Category Filter for Elementor plugin in versions up to 2.1.0 contains a Cross Site Scripting (XSS) vulnerability. The vulnerability can be exploited by an unauthenticated attacker.
The Advanced Posts Listing – Show Post List Easily plugin in versions up to 1.0.8 contains a Broken Access Control vulnerability. The vulnerability can be exploited by an unauthenticated attacker.
The WooCommerce Multivendor Marketplace – REST API plugin in versions up to 1.6.3 contains a Broken Access Control vulnerability. The vulnerability can be exploited by an unauthenticated attacker.
The Simple JWT Login plugin in version 4.0.0 contains a Broken Authentication vulnerability. The vulnerability can be exploited by a Subscriber-level user.
The Simple File List plugin in versions up to 6.3.11 contains an Arbitrary File Deletion vulnerability. The vulnerability can be exploited by an unauthenticated attacker.
Reflected XSS vulnerability in the VikRentCar WordPress plugin, versions up to 1.4.7. Improper input neutralization during page generation allows reflected XSS attacks.
The Hotel Booking plugin in versions up to 3.8 contains a Cross Site Scripting (XSS) vulnerability. The vulnerability can be exploited by an unauthenticated attacker.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Rossiter Document Gallery (document-gallery) allows Reflected XSS. This issue affects Document Gallery through version 5.1.1.
The Youzify plugin in versions up to 1.3.7 contains a Cross Site Scripting (XSS) vulnerability. The vulnerability can be exploited by an unauthenticated attacker.
The Ansar Import – One Click Starter Sites – for Elementor & Themes plugin in versions <= 2.1.2 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS