CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Post Grid and Gutenberg Blocks WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 2.3.17.
The Marquee Addons for Elementor plugin (versions up to 3.8.2) is vulnerable to DOM-Based Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. The vulnerability allows execution of malicious JavaScript in the user's browser.
The Export Categories plugin (up to and including version 1.0) contains a missing authorization vulnerability that allows access to functionality not properly constrained by ACLs. An unauthenticated user can invoke functions that should be protected.
The Bulk Auto Image Title Attribute plugin (versions up to 2.0.1) is vulnerable to DOM-Based Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. The vulnerability enables execution of malicious script in the victim's browser.
The USERCENTRICS CMP plugin for WordPress in versions up to and including 1.0.9 is vulnerable to Stored Cross-site Scripting due to improper neutralization of input during web page generation. A malicious script can be stored and executed by users visiting the page.
The TS Demo Importer plugin for WordPress (versions up to and including 0.1.3) contains a Missing Authorization vulnerability. It allows exploitation of incorrectly configured access control security levels.
The IgnitionDeck plugin for WordPress (versions up to and including 2.0.15) contains a Missing Authorization vulnerability. It allows exploitation of incorrectly configured access control security levels.
The Tooltipy plugin (versions up to 5.5.9) is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. The vulnerability allows persistent injection of malicious JavaScript that executes in the user's browser.
A missing authorization vulnerability in the Flights & Hotels Booking WP Plugin (adiaha-hotel) up to version 3.1. It allows exploiting incorrectly configured access control security levels.
The SMS Contact Form 7 Notifications by ClickSend plugin through version 1.4.0 contains a missing authorization vulnerability allowing exploitation of incorrectly configured access control security levels.
The Opal Service plugin (versions up to 1.9.1) is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. The vulnerability enables persistent injection of malicious JavaScript that executes in the user's browser.
The SiteGround Email Marketing plugin (versions up to 1.7.1) is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. The vulnerability allows persistent injection of malicious JavaScript that executes in the user's browser.
The Rock Convert plugin (versions up to 3.0.1) is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. The vulnerability enables persistent injection of malicious JavaScript that executes in the user's browser.
The Video Gallery by Huzzaz plugin (versions up to 10.5) is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. The vulnerability allows persistent injection of malicious JavaScript that executes in the user's browser.
The Smart WeTransfer plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 1.3.
The Custom Post Type Attachment plugin (aviplugins.com) contains a Stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through <= 3.4.6.
The Referral Link Tracker plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 1.1.4.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Tadlock Query Posts allows Stored XSS. This issue affects Query Posts: from n/a through <= 0.3.2.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ben Huson WP Geo allows Stored XSS. This issue affects WP Geo: from n/a through <= 3.5.1.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPClever WPC Smart Messages for WooCommerce allows Stored XSS. This issue affects WPC Smart Messages for WooCommerce: from n/a through <= 4.2.8.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS