CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Dokan versions up to 5.0.2 contain a vulnerability that allows customer privilege escalation.
Shared Files versions up to 1.7.64 are vulnerable to an unauthenticated Path Traversal attack, allowing an attacker to access system files.
In WooCommerce versions up to 3.1.4, there is a vulnerability of unauthenticated broken authentication in the Upsell Order Bump Offer feature.
LatePoint versions up to 5.5.1 contain a vulnerability that allows privilege escalation for contributors.
Versions of Chatway Live Chat, AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service, and Chat Buttons up to 1.4.8 have a vulnerability that allows for the exposure of subscriber sensitive data.
There is an unauthenticated vulnerability type in WP Travel Engine versions up to 6.7.10 that could be exploited by attackers.
In Knit Pay versions <= 9.4.0.0, there is an unauthenticated broken access control vulnerability that may allow unauthorized users to access resources.
Coupon Affiliates versions up to 7.8.1 have a vulnerability that allows the exposure of subscriber sensitive data.
The Conekta Payment Gateway versions up to 6.0.0 have a vulnerability that allows unauthenticated access to sensitive data.
The Hippoo mobile app for WooCommerce versions up to 1.9.5 has an issue with unauthenticated access that may lead to broken access control.
Listdom versions up to 5.5.0 contain a vulnerability that allows unauthenticated privilege escalation.
In WPC Product Options for WooCommerce versions <= 3.2.1, there is a vulnerability allowing unauthenticated arbitrary file download.
The WooCommerce PDF Invoices, Packing Slips, Delivery Notes, and Shipping Labels plugin versions up to 4.9.4 has a vulnerability that allows unauthorized access to sensitive data.
Versions of Drag and Drop Multiple File Upload – Contact Form 7 up to 1.3.9.7 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
Versions of Really Simple SSL up to 9.5.10 have a vulnerability in authentication that allows for unauthorized access.
Versions of Funnel Builder by FunnelKit up to 3.15.0.2 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
There is a SQL Injection vulnerability in ELEX WordPress HelpDesk and Customer Ticketing System versions up to 3.3.6. An attacker can exploit this flaw to execute unauthorized queries against the database.
Amelia versions up to 2.3 contain a vulnerability that allows subscriber privilege escalation.
Versions of HollerBox up to 2.3.10.1 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
There is an unauthenticated broken access control vulnerability in WPC Product Bundles for WooCommerce versions <= 8.5.3.