CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in the Jobs plugin for WordPress up to version 2.8.2 allows a user with the Contributor role to delete arbitrary files.
A vulnerability in the PayPlug for WooCommerce (Official) plugin up to version 3.1.0 allows an unauthenticated attacker to exploit broken access control.
A vulnerability in the StoreGrowth: Smart Sales Booster for WooCommerce plugin up to version 2.0.6 allows an unauthenticated attacker to perform cross-site scripting (XSS).
The App for Cloudflare® plugin in versions up to and including 1.10.1 contains a Broken Access Control vulnerability that allows a user with the Subscriber role to perform actions beyond their permissions.
A vulnerability in the EduMall theme up to version 4.5.3 allows an unauthenticated attacker to perform cross-site scripting (XSS).
A vulnerability in the Woffice theme up to version 5.4.35 allows a user with the Subscriber role to perform SQL injection.
The Booknetic plugin is vulnerable to SQL Injection (improper neutralization of special elements in SQL commands), allowing an attacker to perform Blind SQL Injection. This issue affects versions before 5.10.3.
A vulnerability in the Contact Form to DB by BestWebSoft plugin up to version 1.7.6 allows an unauthenticated attacker to perform cross-site scripting (XSS).
A vulnerability in the Database for CF7 plugin up to version 1.2.6 allows an unauthenticated attacker to perform cross-site scripting (XSS).
A missing authorization vulnerability in Marcin Wise Chat (wise-chat) allows exploiting incorrectly configured access control security levels. This affects versions through 3.4.3.
A vulnerability in the Edwiser Bridge plugin up to version 4.3.4 allows an unauthenticated attacker to expose sensitive data.
A vulnerability in the Instapage Plugin up to version 3.7.2 allows an unauthenticated attacker to perform a Server Side Request Forgery (SSRF) attack.
The WC Fields Factory plugin in versions up to and including 4.1.12 contains a Cross Site Scripting (XSS) vulnerability that allows a user with the Subscriber role to inject malicious script.
Unauthenticated Cross Site Scripting (XSS) in Lumise Product Designer versions up to 2.1.1.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. It is a duplicate of CVE-2026-1829.
Unauthenticated Cross Site Scripting (XSS) in HTTP Requests Manager versions up to 1.3.11.
Unauthenticated Cross Site Scripting (XSS) in WPLMS versions up to 4.972.
Unauthenticated Cross Site Scripting (XSS) in Mapster WP Maps versions up to 2.0.4.
Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor versions up to 1.0.4.
Subscriber SQL Injection in Mooberry Book Manager version 4.16.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS