CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Reflected XSS vulnerability in the VikRentCar WordPress plugin, versions up to 1.4.7. Improper input neutralization during page generation allows reflected XSS attacks.
The Hotel Booking plugin in versions up to 3.8 contains a Cross Site Scripting (XSS) vulnerability. The vulnerability can be exploited by an unauthenticated attacker.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Rossiter Document Gallery (document-gallery) allows Reflected XSS. This issue affects Document Gallery through version 5.1.1.
The Youzify plugin in versions up to 1.3.7 contains a Cross Site Scripting (XSS) vulnerability. The vulnerability can be exploited by an unauthenticated attacker.
The Ansar Import – One Click Starter Sites – for Elementor & Themes plugin in versions <= 2.1.2 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker.
The Tabs plugin in versions <= 2.5 contains a Remote Code Execution (RCE) vulnerability exploitable by an editor-level user.
The JobZilla - Job Board WordPress theme in versions <= 2.2 contains a privilege escalation vulnerability exploitable by a subscriber-level user.
The Tourfic Pro plugin in versions <= 1.17.3 contains a privilege escalation vulnerability exploitable by an unauthenticated attacker.
The Buddyboss Platform plugin in versions <= 3.1.0 contains an SQL Injection vulnerability exploitable by a subscriber-level user.
The Graphina – Charts and Graphs For Elementor plugin by Iqonic Designs contains an authentication bypass using an alternate path or channel, enabling password recovery exploitation. The issue affects versions up to and including 3.1.12.
The ARForms plugin in versions <= 7.1.2 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker.
The Challan plugin in versions <= 3.7.88 contains a privilege escalation vulnerability exploitable by a shop manager-level user.
The Midtrans-WooCommerce plugin in versions <= 2.32.3 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker.
A vulnerability in the Jobs plugin for WordPress up to version 2.8.2 allows a user with the Contributor role to delete arbitrary files.
A vulnerability in the PayPlug for WooCommerce (Official) plugin up to version 3.1.0 allows an unauthenticated attacker to exploit broken access control.
A vulnerability in the StoreGrowth: Smart Sales Booster for WooCommerce plugin up to version 2.0.6 allows an unauthenticated attacker to perform cross-site scripting (XSS).
A vulnerability in the EduMall theme up to version 4.5.3 allows an unauthenticated attacker to perform cross-site scripting (XSS).
A vulnerability in the Woffice theme up to version 5.4.35 allows a user with the Subscriber role to perform SQL injection.
A vulnerability in the Contact Form to DB by BestWebSoft plugin up to version 1.7.6 allows an unauthenticated attacker to perform cross-site scripting (XSS).
A vulnerability in the Database for CF7 plugin up to version 1.2.6 allows an unauthenticated attacker to perform cross-site scripting (XSS).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS