CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Insecure Direct Object References (IDOR) vulnerability in Newsletters, Email Marketing, SMS and Popups by Omnisend up to version 1.9.0. A subscriber can access objects without authorization.
Cross Site Scripting (XSS) vulnerability in EWWW Image Optimizer up to version 8.7.7. A contributor can inject malicious scripts.
Insecure Direct Object References (IDOR) vulnerability in GiveWP up to version 4.16.9. An unauthenticated user can access objects without logging in.
Unauthenticated XSS attack in Happyforms plugin up to version 1.26.15. An attacker can inject malicious script without authentication.
Unauthenticated CSRF attack in Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification plugin up to version 2.3.1. An attacker can perform unauthorized actions on behalf of a logged-in user.
Remote Code Execution (RCE) vulnerability exploitable by users with Contributor role in CartFlows plugin up to version 3.2.0. A low-privileged user can execute code on the server.
Unauthenticated XSS attack in Parsi Date plugin up to version 6.3. An attacker can inject malicious script without authentication.
Cross Site Scripting (XSS) vulnerability in King Addons for Elementor up to version 51.1.85. A contributor can inject malicious scripts.
Sensitive Data Exposure vulnerability in GiveWP up to version 4.16.9. A subscriber can access sensitive data.
PHP Object Injection vulnerability in Ultimate Addons for Contact Form 7 plugin up to version 3.5.51, exploitable by users with Editor role. May lead to execution of malicious PHP objects.
PHP Object Injection vulnerability in Content Egg plugin up to version 6.3.1, exploitable by users with Shop manager role. May lead to execution of malicious PHP objects.
Themify Builder plugin in versions up to and including 7.8.1 contains a PHP Object Injection vulnerability. A contributor-level user can inject a malicious PHP object, potentially leading to further exploitation.
GiveWP plugin in versions up to and including 4.16.9 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker. The lack of required authentication significantly increases the exploitation risk.
Cross Site Scripting (XSS) vulnerability in The Plus Addons for Elementor Page Builder Lite up to version 6.5.1. A user with Contributor role can inject malicious script.
Category Discount Woocommerce plugin in versions up to and including 5.18 contains an SQL Injection vulnerability. It can be exploited by an administrator-level user.
Admin Notices Manager plugin in versions up to and including 1.6.0 contains an SQL Injection vulnerability. It can be exploited by an administrator-level user.
Bypass vulnerability allowing a Subscriber user to bypass security in All In One WP Security & Firewall up to version 5.4.8.
Arbitrary File Deletion vulnerability allowing an Editor user to delete any file in Template Kit – Import up to version 1.0.16.
Customer Reviews for WooCommerce plugin in versions up to and including 5.120.0 contains an unauthenticated arbitrary content deletion vulnerability. An attacker does not need to be logged in to exploit it.
The Books Gallery plugin in versions up to and including 4.8.3 contains an unauthenticated SQL injection vulnerability. An attacker can execute malicious SQL queries without logging in.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS