CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Privilege Escalation vulnerability allowing a Subscriber user to escalate privileges in FluentBoards up to version 2.0.12.
Awesome Support plugin in versions up to and including 6.3.9 contains a Cross Site Scripting (XSS) vulnerability. It can be exploited by a subscriber-level user.
oik plugin in versions up to and including 4.15.4 contains a Cross Site Scripting (XSS) vulnerability. It can be exploited by a subscriber-level user.
WP Express Checkout (Accept PayPal Payments) plugin in versions up to and including 2.4.9 contains a Broken Access Control vulnerability. It can be exploited by an unauthenticated attacker.
MakeCommerce for WooCommerce plugin in versions up to and including 4.1.0 contains a Broken Access Control vulnerability. It can be exploited by a subscriber-level user.
Trusted Shops Easy Integration for WooCommerce plugin in versions up to and including 2.0.6 contains a Cross Site Scripting (XSS) vulnerability. It can be exploited by an unauthenticated attacker.
Vulnerability in Vitepos plugin up to version 3.5.0 allows privilege escalation through a custom user role.
Unauthenticated Cross Site Scripting (XSS) vulnerability in WooCommerce Product Table Lite up to version 5.6.7.
Cross Site Scripting (XSS) vulnerability in pixfort Core before version 4.3.3. A user with Contributor role can inject malicious script.
Unauthenticated Cross Site Scripting (XSS) vulnerability in YITH WooCommerce Ajax Search up to version 2.28.0.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Classified Listing up to version 6.1.3.
The Estatik plugin in versions up to and including 4.3.5 allows a subscriber to escalate privileges. A low-privileged user can gain higher privileges.
The SiteSkite plugin in versions up to and including 2.1.8 contains an unauthenticated remote code execution (RCE) vulnerability. An attacker can execute arbitrary code on the server without logging in.
Unauthenticated Broken Access Control vulnerability in Bookly up to version 28.2.
Insecure Direct Object References (IDOR) vulnerability in Bookly up to version 28.2. A Subscriber user can access unauthorized resources.
Author SQL Injection vulnerability in WP ERP up to version 1.17.9.
Administrator SQL Injection vulnerability in Estatik up to version 4.3.5.
Custom role PHP Object Injection vulnerability in eCommerce Product Catalog up to version 3.6.0.
Custom role PHP Object Injection vulnerability in WP ERP up to version 1.17.9.
Cross Site Scripting (XSS) vulnerability in Profile Builder up to version 4.0.2. A Subscriber user can inject malicious script.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS