CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.08)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The WP Project Manager plugin for WordPress contains a vulnerability involving the use of hard-coded credentials, allowing an attacker to retrieve sensitive data embedded in the application. The issue affects versions up to and including 2.6.25.
W WPMK PDF Generator występuje podatność typu Cross-Site Request Forgery (CSRF), która umożliwia przeprowadzenie ataku Stored XSS. Problem ten dotyczy wersji od n/a do 1.0.1 włącznie.
W podatności CVE-2025-58267 występuje atak typu Cross-Site Request Forgery (CSRF) w aplikacji Aftabul Islam Stock Message, który umożliwia przeprowadzenie ataku typu Stored XSS. Problem ten dotyczy wersji Stock Message od n/a do 1.1.0 włącznie.
The WordPress plugin Gianism (versions up to 6.0.0) has a Stored XSS vulnerability due to improper input neutralization during web page generation.
Podatność typu Cross-Site Request Forgery (CSRF) w WPDirectoryKit Sweet Energy Efficiency umożliwia przechowywanie ataków XSS. Problem dotyczy wersji Sweet Energy Efficiency od n/a do 1.0.8 włącznie.
Podatność typu Cross-Site Request Forgery (CSRF) w Mavis HTTPS to HTTP Redirection od PressPage Entertainment Inc. umożliwia przeprowadzenie ataku Stored XSS. Problem dotyczy wersji od n/a do 1.4.3 włącznie.
W podatności CVE-2025-58259 występuje luka typu Cross-Site Request Forgery (CSRF) w skryptach Nokri, która pozwala na przeprowadzenie ataku CSRF. Problem ten dotyczy wersji Nokri od n/a do 1.6.4 włącznie.
Stored XSS vulnerability in DOAJ Export plugin (up to 1.0.4) due to improper input neutralization. Allows persistent script injection that executes in the victim's browser.
Podatność typu Cross-Site Request Forgery (CSRF) w wtyczce yonisink Custom Post Type Images umożliwia wstrzykiwanie kodu. Problem ten dotyczy wersji wtyczki od n/a do 0.5 włącznie.
W podatności Cross-Site Request Forgery (CSRF) w ApusTheme Findgo występuje możliwość ominięcia uwierzytelnienia. Problem ten dotyczy wersji Findgo od n/a do 1.3.55 włącznie.
W podatności CVE-2025-58244 występuje problem Cross-Site Request Forgery (CSRF) w Anps Constructo, który umożliwia wstrzykiwanie obiektów. Problem ten dotyczy wersji Constructo od n/a do 4.3.9 włącznie.
The WordPress plugin xili-tidy-tags up to version 1.12.06 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Malicious JavaScript can be persistently stored and executed in a user's browser.
The WP Category Dropdown WordPress plugin is vulnerable to Stored XSS due to improper input neutralization. The issue affects versions up to and including 1.9.
Stored XSS vulnerability in VoucherPress plugin (up to 1.5.7) due to improper input neutralization. Allows persistent script injection that executes in the user's browser.
Missing Authorization vulnerability in Dynamic Web Lab Team Manager wp-team-manager allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Team Manager from n/a through 2.6.8.
The Page-list plugin by webvitaly has a stored XSS vulnerability due to improper neutralization of input during web page generation. Affects versions up to and including 5.8.
The WordPress plugin List Child Pages Shortcode up to version 1.3.1 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Malicious code can be persistently stored and executed in a user's browser.
W podatności CVE-2025-58013 występuje problem Cross-Site Request Forgery (CSRF) w systemie CouponXxL, który pozwala na eskalację uprawnień. Dotyczy to wersji CouponXxL od n/a do 4.5.0 włącznie.
The Content Mask plugin by Alex has a Server-Side Request Forgery (SSRF) vulnerability that allows making server-side requests. Affects versions up to and including 1.8.5.2.
The Participants Database plugin by xnau webdesign has a stored XSS vulnerability due to improper neutralization of input during web page generation. Affects versions up to and including 2.7.6.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS