CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.14)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Ad Inserter WordPress plugin version 2.8.11 and earlier contains a Cross-site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. The flaw allows an attacker to exploit incorrectly configured access control security levels.
The Anti-Malware Security and Brute-Force Firewall (gotmls) plugin contains a reflected XSS vulnerability due to improper input neutralization during page generation. The issue affects versions up to and including 4.23.89.
The Razorpay Payment Links for WooCommerce plugin (rzp-woocommerce) contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 2.1.4.
The Author Box WP Lens plugin for Divi contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. This affects all versions up to and including 2.1.5.
The Stock Locations for WooCommerce plugin for WordPress contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 3.1.8.
The Client Invoicing by Sprout Invoices WordPress plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 20.8.13.
The ChatBot for eCommerce – WoowBot plugin for WooCommerce contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. This affects versions up to and including 4.6.1.
SSRF vulnerability in the Instant Image Generator (ai-image) WordPress plugin allows an attacker to send requests from the server to internal network resources. The issue affects versions up to and including 2.1.4.
The Gift Vouchers plugin for WordPress contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 4.6.9.
The Peach Payments Gateway plugin for WooCommerce has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 4.0.2.
The FundEngine WordPress plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 1.7.6.
The Booking and Rental Manager plugin for WooCommerce has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 2.6.9.
The Flexible Refund and Return Order for WooCommerce plugin up to version 1.0.51 contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. An attacker can inject malicious scripts that execute in other users' browsers.
The Event Tickets Manager for WooCommerce plugin (versions up to 1.5.5) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This flaw enables an attacker to gain unauthorized access to ticket management functions.
The Tourfic WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 2.22.5.
The WooCommerce PDF Invoice Builder plugin for WordPress (versions up to 2.0.8) exposes sensitive system information to unauthorized entities, allowing retrieval of embedded sensitive data.
The Tourfic WordPress plugin contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 2.22.5.
The Loops & Logic WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. All versions up to and including 4.2.3 are affected.
The Extra Product Options Builder for WooCommerce plugin contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 1.2.167.
The WowAddons plugin for WordPress has a missing authorization vulnerability in the product-addons feature, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 1.6.8.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS