CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In Bookly versions up to 27.4, there is a vulnerability allowing unauthorized access to sensitive data.
The salon booking system versions up to 10.30.25 have an unauthenticated broken access control vulnerability that may allow unauthorized users to access resources.
Versions of Motive Commerce Search up to 1.38.2 contain a vulnerability in access control that allows unauthorized access to AI product search features in WooCommerce.
The WP Customer Area plugin versions up to 8.3.4 contain a Path Traversal vulnerability, which may allow unauthorized access to system files.
Versions of Classified Listing up to 5.3.8 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
Versions of AutomatorWP up to 5.6.7 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
Versions of Favicon Rotator up to 1.2.11 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
CloudSecure WP Security versions up to 1.4.7 contain a vulnerability that allows unauthorized session takeover.
The Simply Schedule Appointments application versions below 1.6.11.2 have a vulnerability that allows unauthorized access to sensitive data.
Versions of WP Time Slots Booking Form up to 1.2.46 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
Amelia versions up to 2.2 have a vulnerability that allows unauthorized access to sensitive data.
ChatBot versions up to 7.9.7 have a vulnerability in access control that may allow unauthorized subscribers to access resources.
Versions of Quiz And Survey Master <= 11.0.0 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
AutomatorWP versions up to 5.6.7 have a vulnerability in subscriber authentication, which may lead to unauthorized access.
Versions of ReviewX <= 2.3.6 have an issue with unauthenticated broken authentication, potentially allowing attackers to access the system without proper credentials.
In Link Library versions <= 7.8.8, there is a vulnerability allowing arbitrary file deletion by users with appropriate permissions.
In WP Event Solution versions up to 4.1.8, there is an issue with unauthenticated access that may lead to broken access control.
There is an unauthenticated access control issue in Royal MCP versions <= 1.4.2.
The Booking package versions <= 1.7.06 have an issue with unauthenticated access that allows for broken access control.
Versions of Coupon Affiliates <= 7.5.3 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.