CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The JetFormBuilder plugin for WordPress up to version 3.5.3 has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels.
Stored Cross-Site Scripting (XSS) vulnerability in Qi Blocks (versions up to 1.4.3). Allows an attacker to inject a persistent script that executes in the victim's browser.
The Order Export & Order Import plugin for WooCommerce has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 2.6.7.
The Booking Calendar plugin (by wpdevelop) is vulnerable to Stored Cross-site Scripting (XSS) due to improper neutralization of input during web page generation. This issue affects Booking Calendar versions from n/a through <= 10.14.7.
Stored Cross-Site Scripting (XSS) vulnerability in Booster for WooCommerce (versions up to 7.3.2). Allows an attacker to inject a persistent script that executes in the victim's browser.
Missing Authorization vulnerability in Pluggabl Booster for WooCommerce woocommerce-jetpack allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Booster for WooCommerce: from n/a through <= 7.4.0.
The YOP Poll plugin for WordPress has a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects YOP Poll from n/a through <= 6.5.38.
The Contact Form Email plugin (codepeople) in versions up to and including 1.3.58 has a missing authorization vulnerability resulting from incorrectly configured access control security levels.
The Analytics Germanized for Google Analytics (ga-germanized) plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting (XSS) in all versions up to and including 1.6.2. The vulnerability is due to improper neutralization of input during web page generation.
Missing Authorization vulnerability in QuantumCloud ChatBot chatbot allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ChatBot from n/a through <= 7.3.9.
The WordPress plugin Survey Maker (survey-maker) by Ays Pro contains a Missing Authorization vulnerability due to incorrectly configured access control security levels. The issue affects versions up to and including 5.1.9.4.
The Booking Manager plugin (by wpdevelop) is vulnerable to Stored Cross-site Scripting (XSS) due to improper neutralization of input during web page generation. This issue affects Booking Manager versions from n/a through <= 2.1.17.
Missing Authorization vulnerability in wpkoithemes WPKoi Templates for Elementor (wpkoi-templates-for-elementor) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WPKoi Templates for Elementor: from n/a through <= 3.4.4.
Cross-Site Request Forgery (CSRF) vulnerability in HasThemes WP Plugin Manager allows CSRF attacks. Affects versions up to and including 1.4.7.
Missing Authorization vulnerability in EDGARROJAS WooCommerce PDF Invoice Builder woo-pdf-invoice-builder allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WooCommerce PDF Invoice Builder: from n/a through <= 1.2.150.
The WooCommerce Ultimate Points And Rewards plugin (versions up to 2.10.2) exposes sensitive system information to an unauthorized control sphere, allowing retrieval of embedded sensitive data. This may lead to system information leakage.
The Frontend File Manager plugin for WordPress (nmedia-user-file-uploader) contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions from n/a through 23.2.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aman Popup addon for Ninja Forms popup-addon-for-ninja-forms allows Stored XSS. This issue affects Popup addon for Ninja Forms: from n/a through <= 3.5.1.
The WP Content Pilot plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 2.1.7.
The WordPress plugin Auto Prune Posts in versions up to and including 3.0.0 is vulnerable to Cross-Site Request Forgery (CSRF). Missing proper request validation allows an attacker to trick an administrator into performing unauthorized actions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS