CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.20)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Contact Form by Supsystic plugin version earlier than 1.10.0 has a bypass vulnerability that does not require authentication. This means an unauthenticated attacker can bypass security mechanisms and gain unauthorized access.
Cross Site Scripting (XSS) vulnerability in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions up to 4.3.9. The attack requires subscriber-level privileges.
Broken Access Control vulnerability in GiveWP versions up to 4.16.5.1. The attack does not require authentication.
Broken Access Control vulnerability in GiveWP versions earlier than 4.16.6. The attack does not require authentication.
Insecure Direct Object References (IDOR) vulnerability in WP Crowdfunding versions earlier than 2.2.1. The attack requires subscriber-level privileges.
Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the containing folder. This vulnerability was only reachable if both types of keys (filekeys and dirkeys) were manually enabled in the volume flags simultaneously. This issue is fixed in version 1.20.17.
Privilege Escalation vulnerability in MasterStudy LMS versions up to 3.7.41. The attack requires subscriber-level privileges.
Cross Site Scripting (XSS) vulnerability in GeoDirectory versions up to 2.8.172. The attack requires contributor-level privileges.
Broken Access Control vulnerability in Appointment Hour Booking versions up to 1.5.91. The attack does not require authentication.
Broken Access Control vulnerability in MultiVendorX versions up to 5.0.14. The attack does not require authentication.
Cross Site Scripting (XSS) vulnerability in WP Tab Widget versions up to 1.2.11. The attack requires contributor-level privileges.
Cross Site Scripting (XSS) vulnerability in the Table of Contents Block in versions up to 1.5.0. A user with Contributor role can inject malicious script.
Cross Site Scripting (XSS) vulnerability in Typing Effect in versions up to 1.3.7. A user with Contributor role can inject malicious script.
Cross Site Scripting (XSS) vulnerability in Wufoo Shortcode in versions up to 1.55. A user with Contributor role can inject malicious script.
Cross Site Scripting (XSS) vulnerability in Video Conferencing with Zoom in versions up to 4.6.8. A user with Contributor role can inject malicious script.
Cross Site Scripting (XSS) vulnerability in Login With Ajax in versions up to 4.5.1. A user with Contributor role can inject malicious script.
Cross Site Scripting (XSS) vulnerability in WPZOOM Forms – Contact Form Plugin for Gutenberg in versions up to 2.0.4. A user with Contributor role can inject malicious script.
Cross Site Scripting (XSS) vulnerability in Frontend Admin by DynamiApps in versions up to 3.29.10. A user with Contributor role can inject malicious script.
Cross Site Scripting (XSS) vulnerability in Featured Video Plus in versions up to 2.3.3. A user with Contributor role can inject malicious script.
Cross Site Scripting (XSS) vulnerability in Wise Chat in versions up to 3.4. A user with Contributor role can inject malicious script.