CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Extensions for Leaflet Map plugin for WordPress (versions up to 4.8) is vulnerable to DOM-Based XSS due to improper neutralization of input during web page generation. An attacker can inject malicious code that executes in a user's browser.
The Accordion Slider plugin for WordPress (versions up to 1.9.13) is vulnerable to stored XSS due to improper neutralization of input during web page generation. An attacker can store a malicious script that executes in a user's browser.
The Stylish Cost Calculator plugin for WordPress (versions up to 8.1.5) is vulnerable to DOM-Based XSS due to improper neutralization of input during web page generation. An attacker can inject malicious code that executes in a user's browser.
The SKT Skill Bar plugin for WordPress (versions up to 2.5) is vulnerable to DOM-Based XSS due to improper neutralization of input during web page generation. An attacker can inject malicious code that executes in a user's browser.
The WordPress plugin 'Product Feed for WooCommerce' has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 2.3.1.
Missing Authorization vulnerability in Property Hive (PropertyHive plugin) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PropertyHive from n/a through <= 2.1.12.
The Cozy Vision SMS Alert Order Notifications WordPress plugin in versions up to and including 3.8.8 contains a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
The Arconix Shortcodes plugin for WordPress contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 2.1.18.
Missing Authorization vulnerability in Shahjahan Jewel FluentCommunity fluent-community allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentCommunity: from n/a through <= 2.0.0.
The WpEvently (mage-eventpress) plugin up to version 5.0.4 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
The WordPress plugin WpEvently (up to version 5.0.4) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This may enable unauthorized actions within the plugin.
The WordPress plugin 'Head Meta Data' is vulnerable to stored XSS due to improper neutralization of input during web page generation. This affects versions up to and including 20250327.
The Gutenverse Form plugin for WordPress (versions up to and including 2.2.0) contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.
The Legal Pages (legal-pages) plugin up to version 1.4.6 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
The WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin (versions up to and including 4.0.3) contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.
The UsersWP (userswp) plugin up to version 1.2.47 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
Missing Authorization vulnerability in tychesoftwares Custom Order Numbers for WooCommerce custom-order-numbers-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Custom Order Numbers for WooCommerce: from n/a through <= 1.11.0.
Missing Authorization vulnerability in Themeisle PPOM for WooCommerce woocommerce-product-addon allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PPOM for WooCommerce: from n/a through <= 33.0.16.
The Funnel Builder by FunnelKit plugin through version 3.13.1.2 contains a DOM-Based XSS vulnerability due to improper neutralization of input during web page generation. Malicious code executes in the user's browser.
The WordPress plugin 'Envo Extra' is vulnerable to stored XSS due to improper neutralization of input during web page generation. This affects versions up to and including 1.9.11.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS