CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unauthenticated Cross Site Scripting (XSS) vulnerability in WP Mailster up to version 1.9.0.0 allows an unauthenticated attacker to inject malicious scripts into pages viewed by other users.
The Delete All Comments of wordpress plugin in versions up to 7.1 contains a missing authorization vulnerability due to incorrectly configured access control security levels. This allows attackers to exploit the misconfigured access control.
Subscriber Privilege Escalation vulnerability in WP User Profiles up to version 2.7.3 allows a subscriber to escalate privileges.
The Zero Spam plugin in versions up to and including 5.7.11 contains a Bypass vulnerability that allows an unauthenticated attacker to circumvent protection mechanisms.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Form Block up to version 1.8.1 allows an unauthenticated attacker to inject malicious scripts into pages viewed by other users.
Editor Privilege Escalation vulnerability in Import and export users and customers up to version 2.5.5 allows a user with the editor role to escalate privileges.
Unauthenticated PHP Object Injection vulnerability in Haaken up to version 1.5 allows an unauthenticated attacker to inject malicious PHP objects, potentially leading to remote code execution.
Unauthenticated Cross Site Scripting (XSS) vulnerability in GiveWP up to version 4.17.0 allows an unauthenticated attacker to inject malicious scripts into pages viewed by other users.
LearnPress plugin in versions up to and including 4.4.9 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker.
picu plugin in versions up to and including 3.10.1 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker.
GiveWP plugin in versions up to and including 4.17.0 contains a Privilege Escalation vulnerability exploitable by an unauthenticated attacker.
The Motors plugin by StylemixThemes in versions up to and including 1.4.124 contains an Insertion of Sensitive Information Into Sent Data vulnerability that allows retrieval of embedded sensitive data.
picu plugin in versions up to and including 3.10.1 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker.
Charitable plugin in versions up to and including 1.8.12.3 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker.
PowerPress Podcasting plugin in versions up to and including 11.17.9 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker.
Groundhogg plugin in versions up to and including 4.8.3 contains a Sensitive Data Exposure vulnerability exploitable by an unauthenticated attacker.
Payflex Payment Gateway plugin in versions up to and including 2.7.1 contains a Reflected Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation.
WPO365 plugin in versions up to and including 44.1 contains a Broken Access Control vulnerability exploitable by a subscriber-level attacker.
Xserver Migrator plugin in versions up to and including 1.6.6 contains a Sensitive Data Exposure vulnerability exploitable by an unauthenticated attacker.
The Advanced Google reCAPTCHA plugin version 5.40 and earlier contains a vulnerability of unauthenticated broken authentication. This means an attacker can bypass the login process without providing valid credentials.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS