CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Yandex Metrica Counter plugin versions up to 1.4.3 contains a stored Cross-Site Scripting (XSS) vulnerability with authentication (admin+). An attacker can exploit this vulnerability to inject malicious scripts that will be executed in the context of users' browsers.
The Miled WordPress Social Login plugin versions up to 3.0.4 contains a stored Cross-Site Scripting (XSS) vulnerability with admin privileges. An attacker can exploit this flaw to inject malicious scripts that will be executed in the victim's browser context.
The WooCommerce Box Office plugin versions up to 1.1.50 contains a Stored Cross-Site Scripting (XSS) vulnerability for users with contributor permissions and above.
phpjabbers PHP Forum Script version 3.0 is vulnerable to Cross Site Scripting (XSS) via the 'keyword' parameter.
phpjabbers Business Directory Script version 3.2 is vulnerable to Cross Site Scripting (XSS) via the 'keyword' parameter.
The Alan Tien Call Now Icon Animate plugin versions <= 0.1.0 has a stored Cross-Site Scripting (XSS) vulnerability with authentication (admin+).
The Valiano Unite Gallery Lite plugin versions <= 1.7.61 has a stored Cross-Site Scripting (XSS) vulnerability with authentication (admin+).
The Joaquín Ruiz Easy Admin Menu plugin versions <= 1.3 has a stored Cross-Site Scripting (XSS) vulnerability with admin authorization.
The nuajik plugin versions <= 0.1.0 has a stored Cross-Site Scripting (XSS) vulnerability with authentication (admin+).
The gsmith Cookie Monster plugin versions <= 1.51 has a stored Cross-Site Scripting (XSS) vulnerability with authentication (admin+).
AffiliateWP for WordPress is vulnerable to unauthorized data modification due to a missing capability check in the 'affwp_activate_addons_page_plugin' function called via an AJAX action in versions up to and including 2.14.0. This allows authenticated attackers with subscriber-level access and above to activate arbitrary plugins.
An issue has been discovered in GitLab affecting all versions before 16.2.0. Committing directories containing LF character results in 500 errors when viewing the commit.
The Email Encoder plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'eeb_mailto' shortcode in versions up to and including 2.1.8 due to insufficient input sanitization and output escaping on user supplied attributes.
The Slimstat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'slimstat' shortcode in versions up to and including 5.0.9 due to insufficient input sanitization and output escaping on user supplied attributes.
AudimexEE version 15.0 was found to contain a full path disclosure vulnerability.
AudimexEE v15.0 was found to contain multiple reflected cross-site scripting (XSS) vulnerabilities via the Show Kai Data component.
A Stored Cross-Site Scripting (XSS) vulnerability in Usermin 2.001's SSH configuration tab allows remote attackers to inject arbitrary web scripts or HTML via options for the host value while editing host options.
Badaso versions 0.0.1 through 2.9.7 have a Cross Site Scripting vulnerability that allows a remote attacker to execute arbitrary code via a crafted payload to the rack number parameter in the add new rack function.
An improper authorization vulnerability exists where an authenticated, low privileged remote attacker could view a list of all the users available in the application.
A cross-site scripting (XSS) vulnerability in the device web interface of BDCOM OLT P3310D-2AC 10.1.0F Build 69083 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter.