CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.08)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Directorist plugin for WordPress has an authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 8.5.10.
The Advanced Coupons for WooCommerce Coupons plugin for WordPress up to version 4.7.1.1 contains a DOM-based XSS vulnerability. Improper input neutralization during page generation allows an attacker to inject malicious scripts in the DOM context.
The AI Engine (Pro) plugin for WordPress lacks authorization, allowing an attacker to exploit incorrectly configured access control security levels.
The WordPress plugin Seriously Simple Podcasting up to version 3.14.2 suffers from a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
The InstaWP Connect plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 0.1.2.5.
The FOX woocommerce-currency-switcher plugin for WordPress up to version 1.4.5 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
The themesflat-addons-for-elementor plugin for WordPress up to version 2.3.2 contains a stored XSS vulnerability. Improper input neutralization during page generation allows an attacker to inject malicious scripts.
The SureCart plugin for WordPress up to version 4.0.2 has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels.
The Youtube Embed Plus plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 14.2.4.
The Hide My WP Ghost plugin for WordPress has an open redirect vulnerability to untrusted sites, enabling phishing attacks. This affects versions below 7.0.00.
The VK All in One Expansion Unit plugin for WordPress up to version 9.113.3 contains a stored XSS vulnerability. Improper input neutralization during page generation allows an attacker to inject malicious scripts.
The Post Expirator plugin for WordPress up to version 4.9.4 contains a DOM-based XSS vulnerability. Improper input neutralization during page generation allows an attacker to inject malicious scripts in the DOM context.
The CartFlows WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 2.2.3.
The User Feedback plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 1.10.1.
The Simple History WordPress plugin inserts sensitive information into sent data. The vulnerability allows retrieval of embedded sensitive data.
The PageLayer plugin for WordPress up to version 2.0.8 has an exposure of sensitive system information vulnerability that allows retrieving embedded sensitive data.
The Coming Soon Page, Under Construction & Maintenance Mode by SeedProd plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF).
The Magic Conversation For Gravity Forms plugin for WordPress up to version 3.0.97 contains a stored XSS vulnerability via the 'magic-conversation' shortcode due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary scripts.
The Element Pack Addons for Elementor plugin for WordPress (up to version 8.4.2) is vulnerable to Stored Cross-Site Scripting via the SVG Image Widget. The render_svg() function fetches SVG content from remote URLs without proper sanitization, allowing authenticated attackers (Contributor level and above) to inject arbitrary JavaScript in SVG files.
The Awesome Support plugin for WordPress up to version 6.3.7 contains an Insecure Direct Object Reference vulnerability. The wpas_get_ticket_replies_ajax() function fails to verify if the authenticated user has permission to view the specific ticket, allowing attackers with subscriber-level access or higher to access sensitive information from all tickets.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS