CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Form Maker by 10Web plugin versions up to 1.15.46. An attacker without authentication can inject a malicious script into the page, which executes in the victim's browser.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Podlove Podcast Publisher plugin versions up to 4.5.4. An attacker without authentication can inject a malicious script into the page, which executes in the victim's browser.
Unauthenticated Cross Site Scripting (XSS) vulnerability in SEO Plugin by Squirrly SEO plugin versions up to 14.2.2. An attacker without authentication can inject a malicious script into the page, which executes in the victim's browser.
Unauthenticated Cross Site Scripting (XSS) in Aora versions up to 1.3.19. An attacker can inject malicious script without authentication.
Unauthenticated Cross Site Scripting (XSS) in Paymob for WooCommerce versions up to 4.1.10. An attacker can inject malicious script without authentication.
Unauthenticated SQL Injection vulnerability in TheGem (Elementor) versions up to 5.12.3. An attacker can manipulate database queries.
Unauthenticated Cross Site Scripting (XSS) in Advance Product Search versions up to 1.4.8. An attacker can inject malicious script without authentication.
Unauthenticated Cross Site Scripting (XSS) in SmartSMTP versions up to 1.2.0. An attacker can inject malicious script without authentication.
Unauthenticated Cross Site Scripting (XSS) in Swatchly – WooCommerce Variation Swatches for Products versions up to 1.4.13. An attacker can inject malicious script without authentication.
Unauthenticated Cross Site Scripting (XSS) in GeoDirectory versions up to 2.8.173. An attacker can inject malicious script without authentication.
Subscriber Cross Site Scripting (XSS) in Media Library Assistant <= 3.39 versions.
Author Arbitrary File Upload vulnerability in Media Library Assistant versions up to 3.39. A user with author role can upload malicious files.
Unauthenticated Cross Site Scripting (XSS) in B2BKing Premium versions up to 5.6.07. An attacker can inject malicious script without authentication.
Unauthenticated Cross Site Scripting (XSS) in wpDataTables versions up to 6.5.1.4. An attacker can inject malicious script without authentication.
Unauthenticated Broken Access Control in WP Data Access <= 5.5.80 versions.
Subscriber SQL Injection in WordPress Persistent Login versions up to 3.1.0. A user with subscriber role can execute unauthorized database queries.
Unauthenticated SQL Injection vulnerability in Security & Malware scan by CleanTalk versions up to 2.184. An attacker can manipulate database queries.
Unauthenticated SQL Injection vulnerability in rtMedia for WordPress, BuddyPress and bbPress versions up to 4.7.11. An attacker can manipulate database queries.
Unauthenticated Cross Site Scripting (XSS) in Tagembed versions up to 7.4. An attacker can inject malicious script without authentication.
Author Local File Inclusion in WP Cafe Pro < 3.0.15 versions.