CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The ProfilePress (wp-user-avatar) plugin contains a Missing Authorization vulnerability caused by incorrectly configured access control. The issue affects versions from n/a through 4.17.3.
Authentication bypass by spoofing vulnerability in the Forminator plugin. Affects versions from n/a through 1.57.2.
The ThemeGrill User Registration (user-registration) plugin contains a Missing Authorization vulnerability caused by incorrectly configured access control. The issue affects versions from n/a through 5.2.7.
Authentication bypass by spoofing vulnerability in the GiveWP plugin. Affects versions from n/a through 4.16.8.1.
Reflected XSS vulnerability in the Simple Payment plugin. Affects versions from n/a through 2.5.4.
The Ajax Search Pro plugin (ajax-search-pro) by wpdreams contains an SQL Injection vulnerability (improper neutralization of special elements in SQL commands). It allows an attacker to perform blind SQL injection. This issue affects versions from n/a through 4.29.1.
The tagDiv Opt-In Builder plugin (td-subscription) by tagDiv contains an SQL Injection vulnerability (improper neutralization of special elements in SQL commands). It allows an attacker to perform blind SQL injection. This issue affects versions from n/a through 1.7.6.
Blind SQL Injection vulnerability in the tagDiv Opt-In Builder plugin. Affects versions from n/a through 1.7.6.
The JNews - Pay Writer plugin (up to version 12.0.1) contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This allows an attacker to perform a Blind SQL Injection attack.
The WPLMS plugin (versions before 1.9.9.8.2) contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This allows an attacker to perform a Blind SQL Injection attack.
Blind SQL Injection vulnerability in the UpSolution Core. Affects versions from n/a through 9.3.
Stored XSS vulnerability in the Media Library Assistant plugin. Affects versions from n/a through 3.41.
Reflected XSS vulnerability in the HUSKY plugin. Affects versions from n/a through 1.4.3.2.
Blind SQL Injection vulnerability in the WPLMS plugin. Affects versions from n/a through 4.973.
Blind SQL Injection vulnerability in the Taskbuilder plugin. Affects versions from n/a through 6.0.5.
Reflected XSS vulnerability in the Search in Place plugin. Affects versions from n/a through 1.5.5.
The codemstory 워드프레스 결제 심플페이 (pgall-for-woocommerce) plugin contains a Missing Authorization vulnerability caused by incorrectly configured access control. The issue affects versions from n/a through 5.5.17.
The ShopBuilder – Elementor WooCommerce Builder Addons plugin for WordPress contains a Reflected XSS vulnerability in versions up to and including 3.4.1. An attacker can exploit this to inject malicious scripts into the page.
The VikBooking Hotel Booking Engine & PMS plugin for WordPress contains a Reflected XSS vulnerability in versions up to and including 1.8.14. The vulnerability allows an attacker to inject malicious JavaScript into the page.
The Magepeople inc. Deposits and Partial Payments for WooCommerce (advanced-partial-payment-or-deposit-for-woocommerce) plugin contains a Missing Authorization vulnerability caused by incorrectly configured access control. The issue affects versions from n/a through 4.0.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS