CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Go Live Update Urls plugin in versions up to and including 7.0.8 contains a PHP Object Injection vulnerability exploitable by a Contributor-level user. This allows injection of a malicious PHP object.
The Kadence WooCommerce Email Designer plugin in versions up to and including 1.5.19.1 contains a PHP Object Injection vulnerability exploitable by a Shop manager-level user. This enables injection of a malicious PHP object.
The FormGent plugin in versions up to and including 1.12.2 contains a Broken Access Control vulnerability exploitable by a Subscriber-level user. Missing access control checks allow unauthorized operations to be performed.
The Import and export users and customers plugin in versions up to and including 2.5.2 contains a Privilege Escalation vulnerability exploitable by a Subscriber-level user. This allows privileges to be elevated.
The GamiPress plugin is vulnerable to Blind SQL Injection due to improper neutralization of special elements used in SQL commands. This affects versions from n/a through 8.0.2.
The NextGEN Gallery plugin in versions up to and including 4.5.0 contains an Arbitrary File Download vulnerability exploitable by an unauthenticated attacker. This allows downloading arbitrary files from the server.
The Responsive Slider Gallery plugin in versions up to and including 1.5.5 contains a PHP Object Injection vulnerability exploitable by an Editor-level user. This enables injection of a malicious PHP object.
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin in versions <= 2.33.6 is vulnerable to PHP Object Injection. The vulnerability can be exploited by a user with Contributor privileges.
The GravityExport Lite for Gravity Forms plugin in versions <= 2.7.2 contains a Broken Access Control vulnerability exploitable without authentication. An unauthenticated attacker can bypass access control mechanisms.
The Easy Pricing Tables plugin in versions <= 4.1.2 is vulnerable to SQL Injection. The vulnerability can be exploited by a user with Contributor privileges.
The Quiz Cat plugin in versions <= 3.1.1 is vulnerable to SQL Injection. The vulnerability can be exploited by a user with Author privileges.
The WordPress Persistent Login plugin in versions <= 3.1.3 is vulnerable to unauthenticated Cross Site Scripting (XSS). An unauthenticated attacker can inject malicious script.
The Site Reviews plugin in versions <= 8.3.1 is vulnerable to unauthenticated Cross Site Scripting (XSS). An unauthenticated attacker can inject malicious script.
The SEO Plugin by Squirrly SEO in versions <= 14.2.5 is vulnerable to PHP Object Injection. The vulnerability can be exploited by a user with Contributor privileges.
The Cost of Goods for WooCommerce plugin in versions <= 3.5.2 is vulnerable to PHP Object Injection. The vulnerability can be exploited by a user with Shop manager privileges.
The WP Statistics plugin in versions <= 14.16.13 is vulnerable to unauthenticated Cross Site Scripting (XSS). An unauthenticated attacker can inject malicious script.
The Minimum and Maximum Quantity for WooCommerce plugin in versions <= 2.1.2 is vulnerable to PHP Object Injection. The vulnerability can be exploited by a user with Author privileges.
The Music Player for WooCommerce plugin versions 1.9.1 and earlier contains a PHP Object Injection vulnerability exploitable by a shop manager. An attacker with shop manager privileges can exploit this to execute arbitrary code.
The WP Data Access plugin versions 5.5.84 and earlier contain an unauthenticated SQL Injection vulnerability. A remote attacker can exploit this to execute unauthorized queries against the database.
The Notification for Telegram plugin versions 3.5.2 and earlier contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS