CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unauthenticated Cross Site Scripting (XSS) vulnerability in WooCommerce Product Table Lite up to version 5.6.7.
Cross Site Scripting (XSS) vulnerability in pixfort Core before version 4.3.3. A user with Contributor role can inject malicious script.
Unauthenticated Cross Site Scripting (XSS) vulnerability in YITH WooCommerce Ajax Search up to version 2.28.0.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Classified Listing up to version 6.1.3.
The Estatik plugin in versions up to and including 4.3.5 allows a subscriber to escalate privileges. A low-privileged user can gain higher privileges.
The SiteSkite plugin in versions up to and including 2.1.8 contains an unauthenticated remote code execution (RCE) vulnerability. An attacker can execute arbitrary code on the server without logging in.
Unauthenticated Broken Access Control vulnerability in Bookly up to version 28.2.
Insecure Direct Object References (IDOR) vulnerability in Bookly up to version 28.2. A Subscriber user can access unauthorized resources.
Author SQL Injection vulnerability in WP ERP up to version 1.17.9.
Administrator SQL Injection vulnerability in Estatik up to version 4.3.5.
Custom role PHP Object Injection vulnerability in eCommerce Product Catalog up to version 3.6.0.
Custom role PHP Object Injection vulnerability in WP ERP up to version 1.17.9.
Cross Site Scripting (XSS) vulnerability in Profile Builder up to version 4.0.2. A Subscriber user can inject malicious script.
An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes this while resolving the signature's key reference, before the message is authenticated, so an eleven-byte extension triggers a 2 GB allocation. Repeated requests exhaust server memory.
The Hostinger Migrator plugin in versions up to and including 1.0 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker. Missing access control checks allow unauthorized operations to be performed.
The Conversational Forms for ChatBot plugin in versions up to and including 1.5.0 contains a PHP Object Injection vulnerability exploitable by a Subscriber-level user. This allows injection of a malicious PHP object.
The DesignSetGo plugin in versions up to and including 2.8.0 contains a PHP Object Injection vulnerability exploitable by a Contributor-level user. This enables injection of a malicious PHP object.
Unauthenticated Denial of Service (DoS) vulnerability in WP Store Locator before version 3.0.0.
The Go Live Update Urls plugin in versions up to and including 7.0.8 contains a PHP Object Injection vulnerability exploitable by a Contributor-level user. This allows injection of a malicious PHP object.
The Kadence WooCommerce Email Designer plugin in versions up to and including 1.5.19.1 contains a PHP Object Injection vulnerability exploitable by a Shop manager-level user. This enables injection of a malicious PHP object.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS