CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Stored XSS vulnerability in the Date counter plugin. Lack of input neutralization during web page generation allows persistent injection of malicious scripts.
The Publitio plugin in versions up to 2.2.5 contains an Insertion of Sensitive Information Into Sent Data vulnerability. This may allow retrieval of embedded sensitive data.
Missing Authorization vulnerability in everestthemes Everest Backup everest-backup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Everest Backup: from n/a through <= 2.3.8.
The MSTW CSV EXPORTER plugin for WordPress (versions up to and including 1.4) contains a Missing Authorization vulnerability. It allows exploitation of incorrectly configured access control security levels.
Stored XSS vulnerability in the Next Page, Not Next Post plugin. Lack of input neutralization during web page generation allows persistent injection of malicious scripts.
Stored XSS vulnerability in the WP Mapbox GL JS Maps plugin. Lack of input neutralization during web page generation allows persistent injection of malicious scripts.
The Events Maker by dFactory plugin (versions up to and including 1.6.14) is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This may allow persistent injection of malicious script.
Stored XSS vulnerability in the Blox Lite plugin. Lack of input neutralization during web page generation allows persistent injection of malicious scripts.
Stored XSS vulnerability in the Open Currency Converter plugin. Lack of input neutralization during web page generation allows persistent injection of malicious scripts.
A Missing Authorization vulnerability in Reoon Technology Reoon Email Verifier allows exploiting incorrectly configured access control security levels. This issue affects Reoon Email Verifier from n/a through <= 2.0.1.
The Post List Featured Image plugin (Johnny) contains a Stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through <= 0.5.9.
A basic XSS vulnerability in the xSmart theme (Jthemes) up to version 1.2.9.4. Improper neutralization of script-related HTML tags allows code injection.
The Open Close WooCommerce Store plugin (versions up to and including 5.0.0) contains a Missing Authorization vulnerability. It allows exploitation of incorrectly configured access control security levels.
The Table Block by RioVizual (riovizual) plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 3.0.0.
The MSN Partner Hub (microsoft-start) plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 2.9.
The MapSVG plugin for WordPress (versions up to 8.7.22) is vulnerable to DOM-Based Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. The vulnerability arises from insufficient encoding of user-supplied data, allowing execution of malicious scripts in the victim's browser.
The Testimonial Slider plugin by PickPlugins in versions up to 2.0.15 has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. Attackers can exploit this flaw for unauthorized actions.
The WordPress SEO Meta Description Updater plugin (versions up to 1.2.0) contains a Missing Authorization vulnerability due to incorrectly configured access control security levels. This allows exploitation of misconfigured security mechanisms.
The Nelio Content WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 4.0.5.
The Conversios.io plugin for WooCommerce up to version 7.2.13 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This enables unauthorized access to functionality.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS