CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A missing authorization vulnerability in Marcin Wise Chat (wise-chat) allows exploiting incorrectly configured access control security levels. This affects versions through 3.4.3.
A vulnerability in the Edwiser Bridge plugin up to version 4.3.4 allows an unauthenticated attacker to expose sensitive data.
A vulnerability in the Instapage Plugin up to version 3.7.2 allows an unauthenticated attacker to perform a Server Side Request Forgery (SSRF) attack.
Unauthenticated Cross Site Scripting (XSS) in Lumise Product Designer versions up to 2.1.1.
Unauthenticated Cross Site Scripting (XSS) in HTTP Requests Manager versions up to 1.3.11.
Unauthenticated Cross Site Scripting (XSS) in WPLMS versions up to 4.972.
Unauthenticated Cross Site Scripting (XSS) in Mapster WP Maps versions up to 2.0.4.
Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor versions up to 1.0.4.
Subscriber SQL Injection in Mooberry Book Manager version 4.16.2.
Unauthenticated SQL Injection in WooCommerce Lottery versions up to 2.2.9.
Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce versions up to 1.1.2606090.
Unauthenticated Cross Site Scripting (XSS) in Frontend File Manager versions up to 23.6.
The SUMO Affiliates Pro plugin in versions up to and including 11.7.0 contains a Cross Site Scripting (XSS) vulnerability that can be exploited by an unauthenticated attacker. Insufficient input sanitization allows injection of malicious JavaScript code.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EDGARROJAS Smart Forms smart-forms allows DOM-Based XSS.This issue affects Smart Forms: from n/a through 2.6.104.
The WP User Frontend Pro plugin in versions up to and including 4.2.13 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker. Insufficient input sanitization allows injection of malicious JavaScript code.
The Progressify - Progressive Web App (PWA) plugin in versions up to and including 1.6.0 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker. Insufficient input sanitization enables injection of malicious JavaScript code.
The WP Media folder plugin in versions up to and including 6.2.2 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker. Insufficient input sanitization allows injection of malicious JavaScript code.
The WP2LEADS plugin in versions up to and including 3.5.7 contains a SQL Injection vulnerability exploitable by an attacker with subscriber privileges. Insufficient input validation allows injection of malicious SQL queries.
Broken Access Control vulnerability in WP2LEADS up to version 3.5.7 allows a subscriber to gain unauthorized access to functions they should not have permissions for.
SQL Injection vulnerability in Paid Member Subscriptions up to version 3.1.1 allows a subscriber to inject malicious SQL code into database queries.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS