CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Salon booking system plugin for WordPress contains a Reflected XSS vulnerability in versions up to and including 10.31.5. An attacker can exploit this to execute a malicious script in the victim's browser.
The Crocoblock JetReviews (jet-reviews) plugin contains a Stored Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The issue affects versions from n/a through 3.1.2.
The Generate PDF using Contact Form 7 plugin for WordPress contains a Path Traversal vulnerability in versions up to and including 4.2.1. This allows an attacker to access files outside the application directory.
The Mamunur Rashid Classified Listing (classified-listing) plugin contains a Stored Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The issue affects versions from n/a through 6.1.2.
The PDF for Contact Form 7 plugin for WordPress contains a Path Traversal vulnerability in versions up to and including 7.1.0. An attacker can exploit this to read arbitrary files from the server.
The ProfileGrid plugin for WordPress contains a Blind SQL Injection vulnerability in versions up to and including 6.0.0.2. An attacker can exploit this to manipulate database queries.
The JetBlog plugin for WordPress (up to version 2.4.10) contains a Reflected XSS vulnerability due to improper neutralization of input during web page generation. An unauthenticated attacker can inject malicious JavaScript that executes in the victim's browser.
The UsersWP plugin for WordPress (up to version 1.2.73) is vulnerable to Reflected XSS due to improper neutralization of input during web page generation. An attacker can inject a malicious script that is reflected and executed in the user's browser.
The BlockStrap Page Builder - Bootstrap Blocks plugin for WordPress (up to version 0.1.58) contains a Reflected XSS vulnerability due to improper input neutralization. An attacker can inject malicious JavaScript that executes in the victim's browser.
The Pay with Vipps for WooCommerce plugin (up to version 6.2.0) contains a deserialization of untrusted data vulnerability allowing Object Injection. An attacker can supply malicious data that is deserialized by the application.
The Zombify plugin (up to version 1.7.7) contains an Unrestricted Upload of File with Dangerous Type vulnerability, allowing an attacker to upload a web shell to the web server.
The Betheme theme for WordPress (up to version 28.5.8) is vulnerable to Reflected XSS due to improper input neutralization during web page generation. An attacker can inject a malicious script that executes in the victim's browser.
The Sassy Social Share plugin for WordPress (up to version 3.3.79) contains a Reflected XSS vulnerability due to improper input neutralization. An attacker can inject malicious JavaScript that executes in the victim's browser.
The Kubio AI Page Builder plugin for WordPress (up to version 2.9.3) is vulnerable to Reflected XSS due to improper input neutralization during web page generation. An attacker can inject a malicious script that is reflected and executed in the user's browser.
The UpSolution Core plugin for WordPress (up to version 8.44) contains a Reflected XSS vulnerability due to improper input neutralization. An attacker can inject malicious JavaScript that executes in the victim's browser.
The Grand Restaurant theme for WordPress (versions before 7.0.11) is vulnerable to Reflected XSS due to improper input neutralization during web page generation. An attacker can inject a malicious script that executes in the victim's browser.
The Total Donations plugin for WordPress (up to version 2.0.5) contains a Stored XSS vulnerability due to improper input neutralization during web page generation. An attacker can store malicious JavaScript that executes in the victim's browser each time the infected page is viewed.
The Gloria Admin Panel plugin in versions up to and including 1.3 contains a Reflected XSS vulnerability caused by improper neutralization of input during web page generation. User-supplied input is not properly sanitized, allowing injection of malicious JavaScript.
The Traveler plugin (up to version 3.2.9) contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This allows an attacker to perform a Blind SQL Injection attack.
Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain an Incorrect Authorization vulnerability. A high-privileged attacker with remote access could exploit it, leading to privilege escalation and unauthorized access.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS