CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Last Updated Shortcode plugin by Luke Mlsna has a stored XSS vulnerability due to improper neutralization of input during web page generation. Affects versions up to and including 1.0.1.
The WordPress plugin Kama Click Counter (kama-clic-counter) up to version 4.0.4 is vulnerable to stored XSS due to improper input neutralization during page generation. An attacker can inject malicious code that gets stored and executed in the user's browser.
The Easy Quotes plugin for WordPress (versions up to and including 1.2.4) contains a Missing Authorization vulnerability allowing exploitation of incorrectly configured access control levels. An unauthorized user can perform operations reserved for higher roles.
The Gutentor plugin (versions up to and including 3.5.2) contains a missing authorization vulnerability. It allows exploitation of incorrectly configured access control security levels.
The AppMySite plugin (versions up to 3.15.0) has a missing authorization vulnerability. This allows exploitation of incorrectly configured access control security levels.
Missing Authorization vulnerability in PickPlugins Accordion allows exploiting incorrectly configured access control security levels. This issue affects Accordion from n/a through <= 2.3.15.
CSRF vulnerability in the Interact: Embed A Quiz On Your Site plugin. Allows an attacker to perform unauthorized actions.
Improper Control of Generation of Code ('Code Injection') vulnerability in weDevs WP User Frontend allows Code Injection. This issue affects WP User Frontend from n/a through <= 4.1.12.
The WP User Frontend plugin (versions up to and including 4.1.12) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. A low-privileged user may gain access to functionality reserved for higher roles.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Modern Minds Magento 2 WordPress Integration m2wp allows Stored XSS. This issue affects Magento 2 WordPress Integration from n/a through <= 1.4.2.1.
The WPLMS plugin for WordPress (versions up to and including 4.970) contains a Missing Authorization vulnerability allowing exploitation of incorrectly configured access control levels. An unauthorized user can perform operations reserved for higher roles.
The ListingPro Reviews plugin (versions below 2.9.11) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. A low-privileged user may perform actions they should not have access to.
Missing Authorization vulnerability in Kommo Website Chat Button: Kommo integration (versions up to 1.3.1) allows exploiting incorrectly configured access control security levels.
Stored XSS vulnerability in Form Generator for WordPress plugin (up to 1.52) due to improper input neutralization. Allows persistent script injection that executes in the user's browser.
The Text To Speech TTS Accessibility plugin for WordPress in versions up to and including 1.9.30 contains a Missing Authorization vulnerability. It allows exploitation of incorrectly configured access control security levels.
The Qubely plugin for WordPress has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. Affects versions up to and including 1.8.14.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eZee Technosys eZee Online Hotel Booking Engine allows Stored XSS. This issue affects eZee Online Hotel Booking Engine from n/a through <= 1.0.0.
The Oshine Core plugin (versions up to and including 1.5.5) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. A low-privileged user may gain access to functionality reserved for higher roles.
The Helpie FAQ plugin for WordPress up to version 1.45 uses hard-coded credentials, allowing retrieval of embedded sensitive data.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Proof Factor LLC Proof Factor – Social Proof Notifications allows Stored XSS. This issue affects Proof Factor – Social Proof Notifications from n/a through <= 1.0.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS