CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.13)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Cookie Notice & Compliance for GDPR / CCPA plugin (versions up to 2.5.8) is vulnerable to stored XSS due to improper neutralization of input during web page generation. An attacker can inject a malicious script that is stored and executed in other users' browsers.
The Advanced FAQ Manager plugin for WordPress (up to version 1.5.2) has a DOM-Based XSS vulnerability due to improper input neutralization during page generation. An attacker can inject malicious script that executes in the victim's browser.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WalkerWP Walker Core walker-core allows DOM-Based XSS. This issue affects Walker Core: from n/a through <= 1.3.17.
The Donation Thermometer plugin for WordPress (up to version 2.2.6) has a Stored XSS vulnerability due to improper input neutralization during page generation. An attacker can store a malicious script that executes on every user visit.
oik up to version 4.15.3 contains a DOM-Based XSS vulnerability due to improper input neutralization during web page generation. This allows an attacker to execute malicious scripts in the victim's browser.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FirePlugins FireBox firebox allows Stored XSS. This issue affects FireBox: from n/a through <= 3.1.0-free.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Get Bowtied Shopkeeper Extender shopkeeper-extender allows Stored XSS. This issue affects Shopkeeper Extender: from n/a through < 7.0.
The Essential Widgets plugin by Catch Themes (up to version 2.2.2) has a Stored XSS vulnerability due to improper input neutralization during page generation. An attacker can store a malicious script that executes for other users.
The Multi-Step Checkout for WooCommerce plugin by SilkyPress (up to version 2.33) has a DOM-Based XSS vulnerability due to improper input neutralization during page generation. An attacker can inject malicious script that executes in the victim's browser.
The WP-ShowHide plugin by Lester Chan (up to version 1.05) has a Stored XSS vulnerability due to improper input neutralization during page generation. An attacker can store a malicious script that executes for other users.
The Animation Addons for Elementor plugin (animation-addons-for-elementor) by Wealcoder has a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 2.4.5.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Select-Themes Select Core select-core allows DOM-Based XSS. This issue affects Select Core: from n/a through < 2.6.
The JNews Gallery plugin by jegtheme (versions below 12.0.1) has a Stored XSS vulnerability due to improper input neutralization during page generation. An attacker can store a malicious script that executes for other users.
The ThirstyAffiliates plugin by Blair Williams (up to version 3.11.8) has a Stored XSS vulnerability due to improper input neutralization during page generation. An attacker can store a malicious script that executes for other users.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress LearnPress learnpress allows Stored XSS. This issue affects LearnPress: from n/a through <= 4.2.9.4.
The WP Maps plugin (wp-google-map-plugin) by Flipper Code is vulnerable to Deserialization of Untrusted Data, allowing Object Injection. This issue affects versions up to and including 4.8.6.
W podatności CVE-2025-67534 występuje problem Cross-Site Request Forgery (CSRF) w aplikacji Jacques Malgrange Rencontre, który umożliwia przeprowadzenie ataku Stored XSS. Problem ten dotyczy wersji Rencontre od n/a do 3.13.7 włącznie.
Podatność CVE-2025-67533 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych, co prowadzi do ataków typu Cross-site Scripting (XSS) w wtyczce Themify Portfolio Post w wersjach od n/a do 1.3.0. Umożliwia to atakującym przechowywanie złośliwego kodu, który może być wykonany w przeglądarkach użytkowników.
W podatności CVE-2025-67532 występuje niewłaściwa kontrola nazwy pliku w instrukcji Include/Require w programie PHP, co umożliwia lokalne włączenie pliku PHP. Problem ten dotyczy wersji Hara od n/a do 1.2.17 włącznie.
W podatności CVE-2025-67531 występuje niewłaściwa kontrola nazw plików w instrukcji Include/Require w programie PHP, co pozwala na lokalne włączenie pliku. Problem dotyczy wersji Turitor od n/a do poniżej 1.5.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS