CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The OAuth Server plugin in versions up to and including 4.5.1 contains a Cross Site Scripting (XSS) vulnerability exploitable by a user with Contributor privileges. This enables injection of a malicious script into the site.
The Event Tickets plugin (Liquid Web / StellarWP) is vulnerable to SQL Injection (Blind SQL Injection) due to improper neutralization of special elements in SQL commands. This issue affects Event Tickets from n/a through 5.29.5.
The Strong Testimonials plugin (up to version 3.3.11) has a Stored XSS vulnerability due to improper input neutralization during web page generation. An attacker can inject malicious scripts that execute in other users' browsers.
The Events Calendar plugin in versions up to and including 6.17.5 contains a Broken Access Control vulnerability exploitable by a user with Contributor privileges. This allows bypassing access control mechanisms.
The Review Schema plugin in versions up to and including 3.1.0 contains an Insecure Direct Object References (IDOR) vulnerability accessible without authentication. An unauthenticated attacker can access objects they should not have access to.
The Polylang plugin in versions up to and including 3.8.9 contains a Cross Site Scripting (XSS) vulnerability exploitable by a user with Contributor privileges. This enables injection of a malicious script into the site.
The OAuth Single Sign On – SSO (OAuth Client) plugin in versions up to and including 7.1.2 contains an unauthenticated bypass vulnerability. An attacker does not need prior authentication to exploit this flaw.
The Premmerce Permalink Manager for WooCommerce plugin in versions up to and including 2.3.13 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker.
The WPFunnels plugin in versions up to and including 3.13.1 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker.
Cross Site Scripting (XSS) vulnerability in CMB2 versions up to 2.13.0, exploitable by a subscriber.
Broken Access Control vulnerability in Prevent files / folders access versions up to 2.6.7, exploitable by a subscriber.
Cross Site Scripting (XSS) vulnerability in Virtue/Ascend/Pinnacle Toolkit versions up to 4.9.12.1, exploitable by a contributor.
Cross Site Scripting (XSS) vulnerability in Visual Composer Website Builder versions up to 45.16.2, exploitable by a contributor.
Unauthenticated Sensitive Data Exposure vulnerability in Notivo versions up to 1.4.2.
The Kreatura LayerSlider plugin in versions from n/a through 8.4.0 contains a Reflected Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation.
The Geo Mashup plugin in versions up to and including 1.13.21 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker.
Unauthenticated Bypass Vulnerability in Paid Member Subscriptions versions up to 3.0.9.
The Booking Activities plugin in versions up to and including 1.18.7.1 is vulnerable to unauthenticated PHP object injection. An attacker can exploit this flaw without logging in.
Unauthenticated Broken Access Control vulnerability in Blocksy Companion versions up to 2.1.55.
The ShortPixel Image Optimizer plugin through 6.5.5 contains a deserialization of untrusted data vulnerability allowing object injection. This may lead to unauthorized actions within the WordPress application context.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS