CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Cross Site Scripting (XSS) vulnerability in King Addons for Elementor up to version 51.1.85. A contributor can inject malicious scripts.
Sensitive Data Exposure vulnerability in GiveWP up to version 4.16.9. A subscriber can access sensitive data.
PHP Object Injection vulnerability in Ultimate Addons for Contact Form 7 plugin up to version 3.5.51, exploitable by users with Editor role. May lead to execution of malicious PHP objects.
PHP Object Injection vulnerability in Content Egg plugin up to version 6.3.1, exploitable by users with Shop manager role. May lead to execution of malicious PHP objects.
Themify Builder plugin in versions up to and including 7.8.1 contains a PHP Object Injection vulnerability. A contributor-level user can inject a malicious PHP object, potentially leading to further exploitation.
GiveWP plugin in versions up to and including 4.16.9 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker. The lack of required authentication significantly increases the exploitation risk.
Cross Site Scripting (XSS) vulnerability in The Plus Addons for Elementor Page Builder Lite up to version 6.5.1. A user with Contributor role can inject malicious script.
Category Discount Woocommerce plugin in versions up to and including 5.18 contains an SQL Injection vulnerability. It can be exploited by an administrator-level user.
Admin Notices Manager plugin in versions up to and including 1.6.0 contains an SQL Injection vulnerability. It can be exploited by an administrator-level user.
Bypass vulnerability allowing a Subscriber user to bypass security in All In One WP Security & Firewall up to version 5.4.8.
Arbitrary File Deletion vulnerability allowing an Editor user to delete any file in Template Kit – Import up to version 1.0.16.
Customer Reviews for WooCommerce plugin in versions up to and including 5.120.0 contains an unauthenticated arbitrary content deletion vulnerability. An attacker does not need to be logged in to exploit it.
The Books Gallery plugin in versions up to and including 4.8.3 contains an unauthenticated SQL injection vulnerability. An attacker can execute malicious SQL queries without logging in.
Privilege Escalation vulnerability allowing a Subscriber user to escalate privileges in FluentBoards up to version 2.0.12.
Awesome Support plugin in versions up to and including 6.3.9 contains a Cross Site Scripting (XSS) vulnerability. It can be exploited by a subscriber-level user.
oik plugin in versions up to and including 4.15.4 contains a Cross Site Scripting (XSS) vulnerability. It can be exploited by a subscriber-level user.
WP Express Checkout (Accept PayPal Payments) plugin in versions up to and including 2.4.9 contains a Broken Access Control vulnerability. It can be exploited by an unauthenticated attacker.
MakeCommerce for WooCommerce plugin in versions up to and including 4.1.0 contains a Broken Access Control vulnerability. It can be exploited by a subscriber-level user.
Trusted Shops Easy Integration for WooCommerce plugin in versions up to and including 2.0.6 contains a Cross Site Scripting (XSS) vulnerability. It can be exploited by an unauthenticated attacker.
Vulnerability in Vitepos plugin up to version 3.5.0 allows privilege escalation through a custom user role.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS