CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unauthenticated Cross Site Scripting (XSS) in Survey Maker versions up to 5.2.3.3.
Unauthenticated Cross Site Scripting (XSS) in Houzez Property Feed versions up to 2.5.48.
Shop manager Privilege Escalation in Order Delivery Date for WooCommerce versions up to 4.6.0.
Subscriber Broken Access Control in AnsPress – Question and answer version 4.4.4.
Author PHP Object Injection in Jeg Kit for Elementor versions up to 3.2.10.
SQL Injection vulnerability in Creative Mail plugin up to version 1.6.9. An attacker with subscriber role can inject SQL queries.
Unauthenticated Cross Site Scripting (XSS) vulnerability in AI Engine plugin up to version 3.6.8. An unauthenticated attacker can inject malicious scripts.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Super Socializer plugin up to version 7.14.5. An unauthenticated attacker can inject malicious scripts.
Sensitive Data Exposure vulnerability in Vimeo plugin up to version 1.2.2. A subscriber user can access sensitive information.
Unauthenticated Broken Authentication vulnerability in Super Socializer plugin up to version 7.14.5. An unauthenticated attacker can bypass authentication mechanisms.
Unauthenticated Broken Access Control vulnerability in Staff Training plugin up to version 1.0.7. An unauthenticated attacker can access functions they should not have permissions for.
Unauthenticated Insecure Direct Object References (IDOR) vulnerability in Formidable Forms Signature Online Contract Automation plugin up to version 2.0.1. An unauthenticated attacker can access objects (e.g., files, data) by manipulating identifiers.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Easy PayPal Buy Now Button plugin up to version 2.0.4. An unauthenticated attacker can inject malicious scripts.
Unauthenticated Cross Site Scripting (XSS) vulnerability in AffiliateWP plugin up to version 2.35.0. An unauthenticated attacker can inject malicious scripts.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Simply Schedule Appointments plugin up to version 1.6.12.10. An unauthenticated attacker can inject malicious scripts.
Unauthenticated Cross Site Scripting (XSS) in wpDataTables versions up to and including 7.5.1.
Unauthenticated Broken Access Control in BOX NOW Delivery Croatia versions up to and including 3.3.0.
Unauthenticated Cross Site Scripting (XSS) in SiteGuard WP Plugin versions up to and including 1.8.6.
Unauthenticated Cross Site Scripting (XSS) in Ninja Tables versions up to and including 5.2.9.
Unauthenticated Cross Site Scripting (XSS) in Media Library Assistant versions up to and including 3.38.