CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.08)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Mailercloud WordPress plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 1.0.7.
The tagDiv Composer (td-composer) plugin for WordPress versions up to and including 5.4.3 contains a Basic XSS vulnerability due to improper neutralization of script-related HTML tags, allowing code injection.
The RT-Theme 18 | Extensions plugin for WordPress up to version 2.5 inserts sensitive data into sent information. Attackers can retrieve embedded sensitive data.
CSRF vulnerability in RT-Theme 18 | Extensions (rt18-extensions) up to version 2.5 inclusive. Allows Cross-Site Request Forgery.
The Tribal WordPress plugin inserts sensitive information into sent data, allowing retrieval of embedded sensitive data. This affects versions up to and including 1.3.4.
The UiCore Elements plugin (versions up to and including 1.3.17) is vulnerable to Stored XSS due to improper neutralization of input during web page generation.
The Accept PayPal Payments using Contact Form 7 extension for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 4.0.4.
Missing authorization in the Make My Trivia plugin allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 1.1.0.
The MIPL WC Multisite Sync plugin for WordPress up to version 1.4.4 has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels.
Missing authorization in the Precious Metals Automated Product Pricing – Pro plugin allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 4.0.5.
The WPBITS Addons For Elementor Page Builder plugin for WordPress (versions up to and including 1.8.1) contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. An attacker can inject a malicious script that executes in other users' browsers.
The Animation Addons for Elementor plugin for WordPress (versions up to and including 2.6.1) contains a DOM-Based Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. An attacker can inject a malicious script that executes in the victim's browser.
The WordPress plugin ShopWP (wpshopify) has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This affects versions up to and including 5.2.4.
Missing authorization in the WowOptin plugin allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 1.4.32.
The AI Workflow Automation plugin for WordPress up to version 1.4.2 has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels.
Missing authorization in the The Publisher Desk ads.txt plugin allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 1.5.0.
The MAIO – The new AI GEO / SEO tool plugin for WordPress up to version 6.2.8 has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels.
The Elfsight WhatsApp Chat CC plugin for WordPress (versions up to and including 1.2.0) contains a DOM-Based Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. An attacker can inject a malicious script that executes in the victim's browser.
Server-Side Request Forgery (SSRF) vulnerability in podigee Podigee podigee allows Server Side Request Forgery. This issue affects Podigee: from n/a through <= 1.4.0.
Missing authorization in the Simply Schedule Appointments plugin allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 1.6.10.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS