CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Animation Addons for Elementor plugin for WordPress (versions up to and including 2.6.1) contains a DOM-Based Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. An attacker can inject a malicious script that executes in the victim's browser.
The WordPress plugin ShopWP (wpshopify) has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This affects versions up to and including 5.2.4.
Missing authorization in the WowOptin plugin allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 1.4.32.
The AI Workflow Automation plugin for WordPress up to version 1.4.2 has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels.
Missing authorization in the The Publisher Desk ads.txt plugin allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 1.5.0.
The MAIO – The new AI GEO / SEO tool plugin for WordPress up to version 6.2.8 has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels.
The Elfsight WhatsApp Chat CC plugin for WordPress (versions up to and including 1.2.0) contains a DOM-Based Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. An attacker can inject a malicious script that executes in the victim's browser.
Server-Side Request Forgery (SSRF) vulnerability in podigee Podigee podigee allows Server Side Request Forgery. This issue affects Podigee: from n/a through <= 1.4.0.
Missing authorization in the Simply Schedule Appointments plugin allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 1.6.10.2.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fesomia FSM Custom Featured Image Caption fsm-custom-featured-image-caption allows DOM-Based XSS. This issue affects FSM Custom Featured Image Caption: from n/a through <= 1.25.1.
The tagDiv Composer plugin for WordPress (versions up to and including 5.4.3) contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. An attacker can inject a malicious script that executes in other users' browsers.
Missing Authorization vulnerability in Cryptocurrency Donation Box – Bitcoin & Crypto Donations up to version 2.2.13 allows exploiting incorrectly configured access control security levels.
The Author Avatars List/Block plugin for WordPress (versions up to 2.1.25) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
The eShipper Commerce plugin for WordPress up to version 2.16.12 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
The WordPress plugin WP Frontend Profile up to version 1.3.9 suffers from a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
Missing Authorization vulnerability in Rapid Car Check Vehicle Data up to version 2.0 allows exploiting incorrectly configured access control security levels.
The BSK PDF Manager plugin for WordPress (versions up to 3.7.2) exposes sensitive system information to unauthorized entities, allowing retrieval of embedded sensitive data.
The Moneytizer plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 10.0.10.
The Garden Gnome Package plugin for WordPress versions up to and including 2.4.1 contains a DOM-Based XSS vulnerability due to improper input neutralization during page generation, allowing DOM-based XSS attacks.
Missing authorization in the linkPizza-Manager plugin (linkpizza-manager) allows exploiting incorrectly configured access control security levels. The vulnerability affects versions up to 5.5.5 inclusive.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS