CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The ARForms plugin in versions <= 7.1.2 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker.
The Challan plugin in versions <= 3.7.88 contains a privilege escalation vulnerability exploitable by a shop manager-level user.
Unauthenticated SQL Injection vulnerability in Radius Booking — Booking Calendar for Appointments & Services versions up to 1.0.19. An attacker can inject SQL queries.
The Missing Authorization vulnerability in the Autoship Cloud for WooCommerce Subscription Products (autoship-cloud) plugin allows exploiting incorrectly configured access control security levels. This issue affects versions from n/a through 2.17.1.
Unauthenticated Privilege Escalation vulnerability in Meta Box AIO versions up to 3.7.1. An attacker without authentication can gain higher privileges.
The vulnerability allows an employer or sales representative to perform arbitrary file upload in Workreap Core up to version 3.4.5.
The Midtrans-WooCommerce plugin in versions <= 2.32.3 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker.
The vulnerability allows a subscriber to perform arbitrary file upload in Taskbot up to version 6.6.
The Wappointment plugin in versions up to and including 2.7.7 contains an Insecure Direct Object References (IDOR) vulnerability that allows an unauthenticated attacker to access resources they should not have permission to.
The vulnerability allows a subscriber to perform arbitrary file upload in WP Duplicate up to version 1.1.11.
The Piotnet Addons For Elementor plugin in versions up to and including 7.1.71 allows a user with the Contributor role to download arbitrary files from the server.
The vulnerability allows an unauthenticated attacker to escalate privileges in Taskbot up to version 6.6.
A vulnerability in the Jobs plugin for WordPress up to version 2.8.2 allows a user with the Contributor role to delete arbitrary files.
A vulnerability in the PayPlug for WooCommerce (Official) plugin up to version 3.1.0 allows an unauthenticated attacker to exploit broken access control.
A vulnerability in the StoreGrowth: Smart Sales Booster for WooCommerce plugin up to version 2.0.6 allows an unauthenticated attacker to perform cross-site scripting (XSS).
The App for Cloudflare® plugin in versions up to and including 1.10.1 contains a Broken Access Control vulnerability that allows a user with the Subscriber role to perform actions beyond their permissions.
A vulnerability in the EduMall theme up to version 4.5.3 allows an unauthenticated attacker to perform cross-site scripting (XSS).
A vulnerability in the Woffice theme up to version 5.4.35 allows a user with the Subscriber role to perform SQL injection.
The Booknetic plugin is vulnerable to SQL Injection (improper neutralization of special elements in SQL commands), allowing an attacker to perform Blind SQL Injection. This issue affects versions before 5.10.3.
A vulnerability in the Contact Form to DB by BestWebSoft plugin up to version 1.7.6 allows an unauthenticated attacker to perform cross-site scripting (XSS).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS