CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unauthenticated Cross Site Scripting (XSS) vulnerability in the Photo Gallery by 10Web plugin in versions up to 1.8.47.
SQL Injection vulnerability in the Qode Tours plugin in versions up to 3.1.3.2, affecting users with the subscriber role.
Unauthenticated Cross Site Scripting (XSS) vulnerability in the Slider by 10Web plugin in versions up to 1.2.63.
Unauthenticated Cross Site Scripting (XSS) vulnerability in the Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin in versions up to 6.0.5.
Unauthenticated Broken Access Control vulnerability in the DK plugin in versions up to 3.2.1.
Unauthenticated Broken Access Control vulnerability in Grand News plugin up to version 3.4. Allows unauthorized users to access functions they should not have permissions for.
Unauthenticated Local File Inclusion vulnerability in Kids Care plugin up to version 3.2.4. Allows unauthorized users to read local files on the server.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tutor LMS: from n/a through 4.1.0.
Unauthenticated Cross Site Scripting (XSS) vulnerability in FV Player 8 plugin up to version 8.1.8. Allows unauthorized users to inject malicious scripts into pages viewed by other users.
The WordPress plugin "Social Share Icons & Social Share Buttons" (ultimate-social-media-plus) up to version 3.7.5 is vulnerable to Reflected Cross-site Scripting due to improper neutralization of input during web page generation.
The WordPress plugin SiteVault – Backup, Restore, Migration & Cloning (up to version 1.5.19) contains a Code Injection vulnerability that allows Remote Code Inclusion. Improper control of code generation lets an attacker execute arbitrary code within the application context.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Jannah theme up to version 7.6.5. Allows unauthorized users to inject malicious scripts into pages viewed by other users.
SQL Injection vulnerability in Events Manager plugin up to version 7.4.6, requiring subscriber privileges. Allows a user with subscriber role to inject malicious SQL queries into the database.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Qode Real Estate plugin up to version 1.1.7.3. Allows unauthorized users to inject malicious scripts into pages viewed by other users.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Qode Music plugin up to version 2.1.8.2. Allows unauthorized users to inject malicious scripts into pages viewed by other users.
Unauthenticated Sensitive Data Exposure vulnerability in Web Plura Backup & Restore Manager plugin up to version 0.2.25. Allows unauthorized users to access sensitive data.
The Swish Migrate and Backup plugin in versions up to 1.4.0 exposes sensitive data without authentication. An unauthenticated attacker can access confidential information.
The Jetpack VideoPress plugin in versions up to 3.6 has a subscriber broken access control vulnerability. A subscriber-level user can perform actions beyond their permissions.
The PeepSo plugin versions up to 9.0.5.4 allow a subscriber to delete arbitrary files on the server.
The Jotform – AI Chatbot plugin versions up to 3.8.2 contain an unauthenticated Cross-Site Scripting (XSS) vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS