CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The AcyMailing SMTP Newsletter plugin for WordPress contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 10.11.1.
The tagDiv Composer WordPress plugin contains a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during page generation. This affects versions up to and including 5.4.3.
The tagDiv Cloud Library (td-cloud-library) plugin for WordPress contains a DOM-based Cross-Site Scripting (XSS) vulnerability. The issue arises from improper neutralization of input during web page generation.
The tagDiv Opt-In Builder WordPress plugin contains a DOM-Based XSS vulnerability due to improper input neutralization during page generation. The issue affects versions up to and including 1.7.4.
The Flatsome plugin for WordPress contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 3.20.5.
The Flatsome plugin for WordPress contains a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. The issue affects versions up to and including 3.20.5.
The Kirki WordPress plugin contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 6.0.13.
The Kirki plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. This affects all versions up to and including 6.0.11.
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin up to version 2.0.12 contains a reflected XSS (Cross-site Scripting) vulnerability due to improper input neutralization during web page generation. An attacker can inject malicious JavaScript code into the server response, which will be executed in the victim's browser.
The Fluent CRM WordPress plugin contains a reflected XSS (Cross-site Scripting) vulnerability due to improper input neutralization during page generation. The issue affects versions up to and including 3.1.7.
The Events Manager WordPress plugin contains a deserialization of untrusted data vulnerability allowing object injection. This issue affects all versions up to and including 7.3.6.
The WPZOOM Portfolio plugin for WordPress is vulnerable to Reflected Cross-site Scripting (XSS) due to improper input neutralization during page generation. This affects versions up to and including 1.4.29.
The Membership For WooCommerce plugin for WordPress contains a path traversal vulnerability that allows an attacker to access files outside the restricted directory. The issue affects versions up to and including 3.1.0.
The Contact Form Entries WordPress plugin up to version 1.5.2 contains a reflected XSS vulnerability. Improper input neutralization during page generation allows injection of malicious scripts.
The Dokan plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper input neutralization during page generation. This affects versions up to and including 5.0.6.
The Event Tickets plugin for WordPress contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 5.28.5.
The ProfileGrid plugin for WordPress contains an authentication bypass vulnerability via an alternate path or channel, allowing password recovery exploitation. This affects versions up to and including 5.9.9.6.
The Document Gallery WordPress plugin contains a reflected XSS (Cross-site Scripting) vulnerability due to improper input neutralization during page generation. The flaw affects all versions up to and including 5.1.0.
The NEX-Forms plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. This affects all versions up to and including 9.2.2.
The Message Filter for Contact Form 7 WordPress plugin is vulnerable to Reflected Cross-site Scripting (XSS) in versions up to and including 1.6.3.8. An attacker can inject malicious scripts due to improper input neutralization during page generation.