CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Admin Notices Manager plugin in versions up to and including 1.6.0 contains an SQL Injection vulnerability. It can be exploited by an administrator-level user.
Customer Reviews for WooCommerce plugin in versions up to and including 5.120.0 contains an unauthenticated arbitrary content deletion vulnerability. An attacker does not need to be logged in to exploit it.
Awesome Support plugin in versions up to and including 6.3.9 contains a Cross Site Scripting (XSS) vulnerability. It can be exploited by a subscriber-level user.
oik plugin in versions up to and including 4.15.4 contains a Cross Site Scripting (XSS) vulnerability. It can be exploited by a subscriber-level user.
WP Express Checkout (Accept PayPal Payments) plugin in versions up to and including 2.4.9 contains a Broken Access Control vulnerability. It can be exploited by an unauthenticated attacker.
MakeCommerce for WooCommerce plugin in versions up to and including 4.1.0 contains a Broken Access Control vulnerability. It can be exploited by a subscriber-level user.
Trusted Shops Easy Integration for WooCommerce plugin in versions up to and including 2.0.6 contains a Cross Site Scripting (XSS) vulnerability. It can be exploited by an unauthenticated attacker.
Vulnerability in Vitepos plugin up to version 3.5.0 allows privilege escalation through a custom user role.
Unauthenticated Cross Site Scripting (XSS) vulnerability in WooCommerce Product Table Lite up to version 5.6.7.
Unauthenticated Cross Site Scripting (XSS) vulnerability in YITH WooCommerce Ajax Search up to version 2.28.0.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Classified Listing up to version 6.1.3.
Unauthenticated Broken Access Control vulnerability in Bookly up to version 28.2.
Author SQL Injection vulnerability in WP ERP up to version 1.17.9.
Administrator SQL Injection vulnerability in Estatik up to version 4.3.5.
Custom role PHP Object Injection vulnerability in eCommerce Product Catalog up to version 3.6.0.
Custom role PHP Object Injection vulnerability in WP ERP up to version 1.17.9.
An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes this while resolving the signature's key reference, before the message is authenticated, so an eleven-byte extension triggers a 2 GB allocation. Repeated requests exhaust server memory.
The Hostinger Migrator plugin in versions up to and including 1.0 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker. Missing access control checks allow unauthorized operations to be performed.
The Conversational Forms for ChatBot plugin in versions up to and including 1.5.0 contains a PHP Object Injection vulnerability exploitable by a Subscriber-level user. This allows injection of a malicious PHP object.
The DesignSetGo plugin in versions up to and including 2.8.0 contains a PHP Object Injection vulnerability exploitable by a Contributor-level user. This enables injection of a malicious PHP object.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS