CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The WP BASE Booking plugin version 6.3.1 and earlier allows a user with the Subscriber role to escalate their privileges. An attacker can gain access to functions reserved for administrators.
The Easy Form Builder plugin version 4.0.12 and earlier contains a Cross Site Scripting (XSS) vulnerability without requiring authentication. An attacker can inject malicious JavaScript code into the page.
The Product Enquiry for WooCommerce plugin version 2.2.34.43 and earlier contains a Cross Site Scripting (XSS) vulnerability without requiring authentication. An attacker can inject malicious JavaScript code into the page.
The AffiliateWP plugin version 2.34.0 and earlier contains a Cross Site Scripting (XSS) vulnerability without requiring authentication. An attacker can inject malicious JavaScript code into the page.
The ApusListing plugin version 1.2.63 and earlier contains a Cross Site Request Forgery (CSRF) vulnerability without requiring authentication. An attacker can force a logged-in administrator to perform unwanted actions.
The Grand Photography plugin version 5.7.8 and earlier contains a Cross Site Scripting (XSS) vulnerability without requiring authentication. An attacker can inject malicious JavaScript code into the page.
The WP Google Maps Pro plugin version 10.1.02 and earlier contains a Cross Site Scripting (XSS) vulnerability without requiring authentication. An attacker can inject malicious JavaScript code into the page.
The Breakdance plugin version 2.7.1 and earlier contains a Cross Site Scripting (XSS) vulnerability without requiring authentication. An attacker can inject malicious JavaScript code into the page.
The Smart Manager plugin version 8.90.0 and earlier contains an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
The Real Estate Manager Pro plugin version 12.8.5 and earlier contains an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
The Slider Pro plugin version 4.8.13 and earlier contains a Cross-Site Scripting (XSS) vulnerability exploitable by users with the Subscriber role. An attacker can inject a malicious script that executes in the victim's browser.
The Picture Gallery plugin version 1.6.5 and earlier contains an Arbitrary File Deletion vulnerability exploitable by users with the Contributor role. An attacker can delete arbitrary files on the server.
The MailPoet plugin versions 5.30.0 through 5.33.0 contain a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can force an authenticated user to perform unwanted actions.
The Sprout Clients plugin version 3.2.3 and earlier contains an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
The Download Monitor - WPForms Lock plugin version 1.0.4 and earlier contains an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
The Coaching plugin version 3.9.2 and earlier contains an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
The Funnel Kit Funnel Builder PRO plugin version 3.15.0.7 and earlier contains an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
The Visitor Traffic Real Time Statistics Pro plugin version 11.9.1 and earlier contains an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
The WP Booking System plugin versions below 5.12.8.1 contain a Broken Access Control vulnerability that allows subscribers unauthorized access to functions.
The eRoom plugin version 1.7.1 and earlier contains an SQL Injection vulnerability exploitable by users with Contributor role.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS