CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Nuss WordPress plugin (versions up to 1.3.6) contains a PHP Local File Inclusion (LFI) vulnerability due to improper filename control in include/require statements. This allows an attacker to read sensitive files on the server.
The NewsPlus Shortcodes WordPress plugin contains a Local File Inclusion (LFI) vulnerability via improper filename control in include/require statements. Affects versions up to and including 4.2.0.
The Leedo WordPress plugin contains a PHP Local File Inclusion (LFI) vulnerability due to improper filename control in include/require statements. Affects versions up to and including 3.0.0.
The Kitchor WordPress plugin contains a Local File Inclusion (LFI) vulnerability due to improper filename control in include/require statements. Affects versions up to and including 1.4.3.
The Golo Framework WordPress plugin contains a PHP Local File Inclusion (LFI) vulnerability due to improper control of filename in include/require statements. The issue affects versions up to and including 1.7.3.
A vulnerability in the Flow theme by Elated-Themes allows remote file inclusion (RFI) via improper filename control in PHP include/require statements. The issue affects theme versions up to and including 1.8.
The Dør WordPress plugin contains a PHP Local File Inclusion (LFI) vulnerability due to improper control of filename in include/require statements. The issue affects versions up to and including 2.4.1.
The Brook WordPress theme contains a PHP Local File Inclusion (LFI) vulnerability due to improper filename control in include/require statements. This affects versions up to and including 2.9.0.
The Billey WordPress plugin is vulnerable to Local File Inclusion (LFI) due to improper control of filename in include/require statements. The vulnerability affects versions up to and including 2.1.8.
The Aqua WordPress plugin contains a PHP Local File Inclusion (LFI) vulnerability due to improper filename control in include/require statements. This affects versions up to and including 5.1.2.
The Aalto WordPress plugin is vulnerable to PHP Local File Inclusion (LFI) due to improper filename control in include/require statements. This affects all versions up to and including 1.8.
The CWS SVGicons WordPress plugin is vulnerable to blind SQL injection in versions up to and including 1.5.5. The vulnerability stems from improper neutralization of special elements used in SQL commands.
A CSRF vulnerability in the WorkScout-Core plugin allows authentication bypass. The issue affects all versions up to and including 1.7.08.
The Advanced Shipment Tracking plugin for WooCommerce (versions up to 4.0) is vulnerable to blind SQL injection due to improper neutralization of special elements in SQL commands. An attacker can exploit this flaw to execute unauthorized database queries.
The WP Inventory Manager plugin for WordPress is vulnerable to Blind SQL Injection due to improper neutralization of special elements used in SQL commands. This issue affects versions up to and including 2.4.0.
The GD Rating System WordPress plugin is vulnerable to Blind SQL Injection due to improper neutralization of special elements used in SQL commands. This affects all versions up to and including 3.7.
The Houzez Login Register WordPress plugin contains an incorrect privilege assignment vulnerability that allows privilege escalation. This issue affects versions up to and including 3.3.3.
The RT-Theme 18 | Extensions (rt18-extensions) plugin up to version 2.5 contains a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. An attacker can inject malicious JavaScript code into an HTTP request, which will be executed in the victim's browser.
The RT-Theme 18 | Extensions (rt18-extensions) plugin version 2.5 and earlier contains a PHP Local File Inclusion (LFI) vulnerability due to improper control of filename in include/require statement. This allows an attacker to include arbitrary files from the server.
The AcyMailing SMTP Newsletter plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. This issue affects all versions up to and including 10.11.0.