CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unauthenticated Sensitive Data Exposure in TrustedLogin Connector <= 2.0.3 versions.
Unauthenticated Insecure Direct Object References (IDOR) in Team <= 6.0.0 versions.
Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <= 3.5.50 versions.
Subscriber Cross Site Scripting (XSS) in PixelYourSite – Your smart PIXEL (TAG) Manager <= 11.4.1 versions.
The Conekta Payment Gateway plugin in versions up to and including 6.2.4 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker. The flaw involves improper access control on plugin functionality.
The WP User Frontend plugin in versions up to and including 4.3.11 contains an Arbitrary File Deletion vulnerability exploitable by a Subscriber-level user. The flaw stems from insufficient permission validation during file operations.
The WP User Frontend plugin in versions up to and including 4.3.11 contains a Bypass vulnerability exploitable by an unauthenticated attacker. The flaw allows bypassing the plugin's control mechanisms.
The WP User Frontend plugin in versions up to and including 4.3.11 contains a Bypass vulnerability exploitable by a Subscriber-level user. The flaw allows bypassing the plugin's control mechanisms.
The Netgsm plugin in versions up to and including 2.10.0 contains a Bypass vulnerability exploitable by an unauthenticated attacker. The flaw allows bypassing the plugin's control mechanisms.
The Podcast Importer SecondLine plugin in versions up to and including 1.5.6 contains a Cross Site Scripting (XSS) vulnerability exploitable by a Contributor-level user. The flaw allows injection of a malicious script.
The Post Grid plugin in versions up to and including 7.9.5 contains a Cross Site Scripting (XSS) vulnerability exploitable by a Contributor-level user. The flaw allows injection of a malicious script.
The Fluent Support plugin in versions up to and including 2.3.2 contains a Broken Access Control vulnerability exploitable by a Subscriber-level user. The flaw involves improper access control on plugin functionality.
The Post Grid plugin in versions up to and including 7.9.5 contains a Cross Site Scripting (XSS) vulnerability exploitable by a Contributor-level user. The flaw allows injection of a malicious script.
Cross Site Scripting (XSS) vulnerability in the ElementsKit Elementor addons Lite plugin in versions up to and including 4.0.5. The vulnerability can be exploited by a user with Contributor privileges.
Broken Access Control vulnerability in the AppMySite plugin in versions up to and including 3.15.4. The vulnerability can be exploited by an unauthenticated attacker.
Cross Site Scripting (XSS) vulnerability in the Ditty plugin in versions up to and including 3.1.69. The vulnerability can be exploited by a user with Contributor privileges.
Bypass vulnerability in the Captcha Code plugin in versions up to and including 3.32. The vulnerability can be exploited by an unauthenticated attacker.
Cross Site Scripting (XSS) vulnerability in the Ultimate FAQ plugin in versions up to and including 2.4.14. The vulnerability can be exploited by a user with Contributor privileges.
Cross Site Scripting (XSS) vulnerability in the Premium Addons for Elementor plugin in versions up to and including 4.11.105. The vulnerability can be exploited by a user with Contributor privileges.
Cross Site Scripting (XSS) vulnerability in the Premium Blocks – Gutenberg Blocks for WordPress plugin in versions up to and including 2.3.17. The vulnerability can be exploited by a user with Contributor privileges.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS