CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Progressify - Progressive Web App (PWA) plugin in versions up to and including 1.6.0 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker. Insufficient input sanitization enables injection of malicious JavaScript code.
The WP Media folder plugin in versions up to and including 6.2.2 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker. Insufficient input sanitization allows injection of malicious JavaScript code.
The WP2LEADS plugin in versions up to and including 3.5.7 contains a SQL Injection vulnerability exploitable by an attacker with subscriber privileges. Insufficient input validation allows injection of malicious SQL queries.
Broken Access Control vulnerability in WP2LEADS up to version 3.5.7 allows a subscriber to gain unauthorized access to functions they should not have permissions for.
SQL Injection vulnerability in Paid Member Subscriptions up to version 3.1.1 allows a subscriber to inject malicious SQL code into database queries.
Unauthenticated Sensitive Data Exposure vulnerability in SiteVault – Backup, Restore, Migration & Cloning up to version 1.5.17 allows an unauthenticated attacker to access sensitive data.
Unauthenticated Privilege Escalation vulnerability in Salon booking system up to version 10.31.7 allows an unauthenticated attacker to escalate privileges.
Unauthenticated Cross Site Scripting (XSS) vulnerability in WP Mailster up to version 1.9.0.0 allows an unauthenticated attacker to inject malicious scripts into pages viewed by other users.
Subscriber Privilege Escalation vulnerability in WP User Profiles up to version 2.7.3 allows a subscriber to escalate privileges.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Form Block up to version 1.8.1 allows an unauthenticated attacker to inject malicious scripts into pages viewed by other users.
Editor Privilege Escalation vulnerability in Import and export users and customers up to version 2.5.5 allows a user with the editor role to escalate privileges.
Unauthenticated PHP Object Injection vulnerability in Haaken up to version 1.5 allows an unauthenticated attacker to inject malicious PHP objects, potentially leading to remote code execution.
Unauthenticated Cross Site Scripting (XSS) vulnerability in GiveWP up to version 4.17.0 allows an unauthenticated attacker to inject malicious scripts into pages viewed by other users.
LearnPress plugin in versions up to and including 4.4.9 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker.
picu plugin in versions up to and including 3.10.1 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker.
GiveWP plugin in versions up to and including 4.17.0 contains a Privilege Escalation vulnerability exploitable by an unauthenticated attacker.
picu plugin in versions up to and including 3.10.1 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker.
Charitable plugin in versions up to and including 1.8.12.3 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker.
PowerPress Podcasting plugin in versions up to and including 11.17.9 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker.
Groundhogg plugin in versions up to and including 4.8.3 contains a Sensitive Data Exposure vulnerability exploitable by an unauthenticated attacker.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS