CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.08)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Missing Authorization vulnerability in Detheme DethemeKit For Elementor dethemekit-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects DethemeKit For Elementor: from n/a through <= 2.1.10.
The WordPress plugin WP Social Widget up to version 2.3.1 contains a Stored XSS vulnerability due to improper input neutralization during web page generation. An attacker can inject a malicious script that gets stored and executed in the victim's browser.
Stored XSS vulnerability in AuthorSure plugin (up to 2.3) due to improper input neutralization. Allows persistent script injection that executes in the victim's browser.
Wtyczka Flexible PDF Invoices dla WooCommerce i WordPress zawiera podatność na atak Cross-Site Request Forgery (CSRF), co pozwala na nieautoryzowane działania w imieniu użytkownika. Problem dotyczy wersji od n/a do 6.0.13.
The Helpdesk Support Ticket System for WooCommerce plugin by WPFactory is vulnerable to missing authorization, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 2.1.1.
Podatność CVE-2025-57968 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w VikRestaurants, co prowadzi do ataków typu Reflected XSS. Problem ten występuje w wersjach od n/a do 1.5 włącznie.
The Library Bookshelves plugin (up to version 5.11) has a Stored Cross-site Scripting vulnerability due to improper input neutralization during web page generation.
The Zoho Billing plugin (up to version 4.1) has a DOM-Based XSS vulnerability due to improper input neutralization during web page generation.
The Emergency Password Reset plugin (emergency-password-reset) is vulnerable to Cross-Site Request Forgery. This issue affects versions from n/a through <= 9.3.
The WPeMatico RSS Feed Fetcher plugin by etruel is vulnerable to exposure of sensitive system information to an unauthorized control sphere. This issue affects WPeMatico RSS Feed Fetcher versions from n/a through 2.8.10 and allows retrieval of embedded sensitive data.
The Bot Block – Stop Spam Referrals in Google Analytics plugin has a Stored XSS vulnerability due to improper input neutralization during web page generation. This affects versions up to and including 2.6.
The Piotnet Forms WordPress plugin has a Cross-Site Request Forgery (CSRF) vulnerability that allows CSRF attacks. This affects all versions up to and including 1.0.30.
The Double the Donation plugin has a Stored XSS vulnerability due to improper input neutralization during web page generation. This affects versions up to and including 2.0.0.
W podatności CVE-2025-57925 występuje niewłaściwa kontrola nazw plików w instrukcjach include/require w programie PHP, co prowadzi do lokalnego włączenia plików. Problem dotyczy wersji immonex Kickstart Team od n/a do 1.6.9.
Podatność CVE-2025-57919 dotyczy deserializacji niezaufanych danych w ConveyThis, co pozwala na wstrzyknięcie obiektów. Problem ten dotyczy wersji ConveyThis od n/a do 269.1 włącznie.
Podatność typu Cross-Site Request Forgery (CSRF) w ERA404 LinkedInclude umożliwia przeprowadzenie ataku typu Stored XSS. Problem ten dotyczy wersji LinkedInclude od n/a do 3.0.4 włącznie.
The AnyClip Luminous Studio plugin (anyclip-media) contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through <= 1.3.3.
The Epeken All Kurir WordPress plugin is vulnerable to Stored XSS (Cross-Site Scripting) due to improper input neutralization during web page generation. The issue affects versions up to and including 2.0.6.
The WP Compress plugin (wp-compress-image-optimizer) for WordPress has a missing authorization vulnerability, allowing access to functionality not properly constrained by ACLs. This affects versions up to 6.50.54.
LB-Link routers, including models BL-AC2100_AZ3 V1.0.4, BL-WR4000 v2.5.0, BL-WR9000_AE4 v2.4.9, BL-AC1900_AZ2 v1.0.2, BL-X26_AC8 v1.2.8, and BL-LTE300_DA4 V1.2.3, are vulnerable to unauthorized command injection. Attackers can exploit the /goform/set_serial_cfg interface to gain the highest device privileges without authorization and remotely execute malicious commands.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS