CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Bopo – WooCommerce Product Bundle Builder plugin for WordPress contains a reflected XSS (Cross-site Scripting) vulnerability due to improper input neutralization during page generation. The issue affects versions up to and including 1.2.0.
The CRM Perks Forms WordPress plugin contains a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during page generation. This affects versions up to and including 1.1.7.
The Cart Lift WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) due to improper input neutralization during page generation. This affects all versions up to and including 3.1.57.
The SiteGround Email Marketing plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. The issue affects versions up to and including 1.7.5.
The Gift Vouchers plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. This affects versions up to and including 4.7.0.
The CF7 Views – Complete Entry Management for Contact Form 7 plugin up to version 3.2.2 contains a DOM-Based Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation.
The MailerPress plugin up to version 2.0.2 contains an incorrect privilege assignment vulnerability that allows privilege escalation. An attacker can exploit this flaw to gain higher privileges within the system.
The Active Products Tables for WooCommerce plugin (versions up to and including 1.1.0) contains a DOM-based XSS vulnerability due to improper input neutralization during page generation. This allows an attacker to inject malicious client-side scripts.
The PDF Generator for WordPress plugin (versions up to 1.6.2) contains a Server-Side Request Forgery (SSRF) vulnerability. It allows an attacker to send requests from the server to internal network resources.
The Open Shop WordPress plugin contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 1.7.1.
The GD Security Headers WordPress plugin contains a reflected Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. This affects versions up to and including 1.8.
The Proxy & VPN Blocker WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. This affects versions up to and including 3.5.8.
The Real Estate Manager Pro WordPress plugin contains a reflected Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. An attacker can inject malicious JavaScript code into an HTTP request, which will be executed in the victim's browser.
The Free Gifts for WooCommerce plugin for WordPress contains a stored Cross-site Scripting (XSS) vulnerability due to improper input neutralization during page generation. All versions up to and including 13.1.0 are affected.
The Newsletters plugin for WordPress (versions up to 4.14) is vulnerable to reflected XSS. Improper input neutralization during web page generation allows injection of malicious scripts.
The Groundhogg WordPress plugin up to version 4.4.1 contains a Path Traversal vulnerability that allows unauthorized access to files outside the restricted directory.
The Hydra Booking WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) due to improper input neutralization during web page generation. This affects all versions up to and including 1.1.44.
The picu WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) due to improper input neutralization during page generation. This affects all versions up to and including 3.5.1.
The aBlocks WordPress plugin contains an incorrect privilege assignment vulnerability that allows privilege escalation. This issue affects plugin versions from n/a through 2.9.1.
The Vitepos WordPress plugin contains a blind SQL injection vulnerability due to improper neutralization of special elements in SQL commands. This affects versions up to and including 3.4.2.