CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.09)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unauthenticated Broken Access Control in Arvow AI SEO Writer plugin versions up to 1.5.3. An attacker without authentication can access functions that should be protected.
Unauthenticated Cross-Site Scripting (XSS) in Local Delivery Drivers for WooCommerce plugin versions up to 3.0.0. An attacker can inject malicious script without authentication.
Cross Site Scripting (XSS) vulnerability in FluentCommunity versions up to 2.7.5, exploitable by a user with Subscriber role.
Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce plugin versions up to 2.1.1. An attacker without authentication can access unauthorized functions.
The Cartify plugin versions up to 1.3.0.1 contain an unauthenticated Broken Authentication vulnerability. An attacker without logging in can bypass authentication mechanisms and gain access to user or administrator accounts.
Broken Access Control vulnerability in Internal Link Optimiser versions up to 5.2.7, exploitable without authentication.
Unauthenticated Sensitive Data Exposure in iCARRY plugin versions up to 2.9. An attacker without authentication can access confidential information.
Unauthenticated Sensitive Data Exposure in WooCommerce Appointments plugin versions up to 5.3.8. An attacker without authentication can access confidential information.
Unauthenticated Broken Access Control vulnerability in SMEPay: UPI Gateway for WooCommerce versions up to 1.0.5.
Cross Site Scripting (XSS) vulnerability in AfterShip Tracking versions up to 1.18.1, exploitable by a user with Subscriber role.
Broken Access Control vulnerability in AI for SEO versions up to 2.4.2, exploitable without authentication.
The RealPress plugin versions up to 1.1.2 contain an unauthenticated SQL Injection vulnerability. An attacker without logging in can send specially crafted queries that can manipulate the database.
Cross Site Scripting (XSS) vulnerability in Profile Extra Fields by BestWebSoft versions up to 1.3.4, exploitable by a user with Subscriber role.
Broken Access Control vulnerability in ReactPress versions up to 3.4.0, exploitable by a user with Subscriber role.
Broken Access Control vulnerability in WP Social Avatar versions up to 1.5, exploitable without authentication.
The Salon booking system plugin versions up to 10.30.26 contain an unauthenticated Broken Authentication vulnerability. An attacker without logging in can bypass authentication mechanisms and gain access to user or administrator accounts.
Unauthenticated Local File Inclusion vulnerability in Geo Mashup versions up to 1.13.18.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Geo Mashup versions up to 1.13.18.
The If-So Dynamic Content Personalization plugin versions up to 1.10 contain a Subscriber SQL Injection vulnerability. An attacker with a subscriber account can send specially crafted queries that can manipulate the database.
Sensitive Data Exposure vulnerability in Payment Forms for Paystack versions up to 4.0.5, exploitable by a user with Subscriber role.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS