CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.08)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Dynamic User Directory (dynamic-user-directory) plugin is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), allowing Stored XSS. This issue affects Dynamic User Directory from n/a through <= 2.3.
The WP Gravity Forms Zoho CRM and Bigin plugin by CRM Perks contains an open redirect vulnerability, allowing phishing. This issue affects versions up to and including 1.2.8.
The Persian Admnin Fonts plugin by MDZ has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 4.1.03.
A vulnerability in the ACF to REST API plugin (acf-to-rest-api) up to version 3.3.4. Sensitive information is inserted into sent data, allowing unauthorized retrieval of embedded sensitive data.
The KiotViet Sync plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions from n/a through <= 1.8.5.
The 百度站长SEO合集 (baiduseo) plugin contains a missing authorization vulnerability that allows accessing functionality not properly constrained by ACLs. This issue affects 百度站长SEO合集 from n/a through <= 2.1.4.
The Sendle Shipping plugin for WordPress (official-sendle-shipping-method) has a Missing Authorization vulnerability that allows accessing functionality not properly constrained by ACLs. This issue affects Sendle Shipping from n/a through <= 6.02.
Stored Cross-site Scripting (XSS) vulnerability in Headline Analyzer (headline-analyzer) by CoSchedule. The issue is due to improper neutralization of input during web page generation. This affects versions from n/a through 1.3.7 inclusive.
BuddyForms (Themekraft plugin) up to version 2.10.2 contains a missing authorization vulnerability, allowing access to functionality not properly constrained by ACLs. Attackers can exploit this for unauthorized operations.
The WebinarPress plugin (wp-webinarsystem) contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through <= 1.33.28.
Stored Cross-site Scripting (XSS) vulnerability in Attesa Extra (attesa-extra) by CrestaProject. The issue is due to improper neutralization of input during web page generation. This affects versions from n/a through 1.4.7 inclusive.
The Link Whisper Free plugin by Spencer Haws has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 0.9.2.
Stored Cross-site Scripting (XSS) vulnerability in NextMove Lite (woo-thank-you-page-nextmove-lite) by XLPlugins. The issue is due to improper neutralization of input during web page generation. This affects versions from n/a through 2.23.0 inclusive.
Stored Cross-site Scripting (XSS) vulnerability in WP Last Modified Info (wp-last-modified-info) by Sayan Datta. The issue is due to improper neutralization of input during web page generation. This affects versions from n/a through 1.9.2 inclusive.
The DirectoryPress plugin (directorypress) is vulnerable to DOM-Based XSS due to improper neutralization of input during web page generation. This issue affects versions from n/a through <= 3.6.25.
The GoCache plugin for WordPress (versions up to and including 1.3.6) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthenticated or low-privileged user may perform actions they should not be allowed to.
Missing authorization in the Admin Management Xtended WordPress plugin. Incorrectly configured access control security levels allow exploitation.
The MDTF (wp-meta-data-filter-and-taxonomy-filter) plugin for WordPress in versions up to and including 1.3.6 contains a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This enables performing operations without the required privileges.
Podatność typu Cross-Site Request Forgery (CSRF) w CloudSearch autorstwa Andrea Landonio umożliwia wykonanie ataku typu Stored XSS. Problem ten dotyczy wersji CloudSearch od n/a do 3.0.0 włącznie.
W podatności CVE-2025-62959 występuje niewłaściwa kontrola generowania kodu, co prowadzi do możliwości zdalnego wstrzyknięcia kodu w aplikacji videowhisper Paid Videochat Turnkey Site w wersjach od n/a do 7.3.23. Problem ten może umożliwić atakującym wykonanie nieautoryzowanego kodu na serwerze.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS