CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.13)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Make Section & Column Clickable For Elementor plugin (versions up to 2.4) is vulnerable to stored XSS due to improper neutralization of input during web page generation. A malicious script can be stored and executed in users' browsers.
Podatność typu Cross-Site Request Forgery (CSRF) w wtyczce New User Approve autorstwa Saada Iqbala umożliwia przeprowadzenie ataku CSRF. Problem ten dotyczy wersji wtyczki od n/a do 3.2.3 włącznie.
The Traveler theme contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 3.2.6.
The Order Delivery Date for WooCommerce plugin (versions up to and including 4.3.1) contains a Missing Authorization vulnerability. It allows exploitation of incorrectly configured access control security levels.
The Payment Gateway for PayPal on WooCommerce plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 9.0.53.
The WP Hotel Booking plugin (versions up to and including 2.2.7) exposes sensitive system information to an unauthorized control sphere. This may allow reading confidential data embedded in the application.
The WP Hotel Booking plugin (up to version 2.2.8) is vulnerable to Cross-Site Request Forgery (CSRF). An attacker can trick an authenticated user into performing unwanted operations.
The WP Hotel Booking plugin for WordPress contains a DOM-Based XSS vulnerability due to improper input neutralization during web page generation. The issue affects versions up to and including 2.2.8.
Server-Side Request Forgery (SSRF) vulnerability in ThemesInflow Hercules Core (hercules-core) allows Server Side Request Forgery. This issue affects Hercules Core from n/a through <= 7.4.
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in yuvalo WP Google Analytics Events wp-google-analytics-events allows Retrieve Embedded Sensitive Data. This issue affects WP Google Analytics Events: from n/a through <= 2.8.2.
The WP ERP plugin (versions up to and including 1.16.7) contains a Missing Authorization vulnerability due to incorrectly configured access control security levels. This allows exploitation of improperly configured authorization mechanisms.
Vulnerability in the EventPrime plugin allows insertion of sensitive information into sent data, enabling an attacker to retrieve embedded sensitive data.
The EventPrime plugin for WordPress has an authorization vulnerability that allows exploiting incorrectly configured access control security levels. Affects versions up to and including 4.2.4.1.
Podatność CVE-2025-63003 dotyczy niewłaściwej kontroli nazw plików w instrukcjach include/require w wtyczce North - Required Plugin dla PHP, co umożliwia lokalne włączenie plików PHP. Problem ten dotyczy wersji wtyczki od n/a do 1.4.2.
The Litho Addons plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 3.5.
The WP EasyCart plugin from levelfourdevelopment is vulnerable to insertion of sensitive information into sent data, allowing retrieval of embedded sensitive data. This affects versions up to and including 5.8.11.
The Custom Layouts – Post + Product grids made easy plugin by Code Amp contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 1.4.12.
The MultiParcels Shipping For WooCommerce plugin up to version 1.30.12 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
Vulnerability in the WP AI CoPilot plugin allows insertion of sensitive information into sent data, enabling an attacker to retrieve embedded sensitive data.
The Notification for Telegram plugin up to version 3.5.1 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS