CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Estonian Shipping Methods for WooCommerce plugin up to version 1.7.2 uses hard-coded credentials, allowing retrieval of embedded sensitive data.
The Category Featured Images plugin up to version 1.1.8 contains a Stored XSS vulnerability. The issue arises from improper neutralization of input during web page generation.
The WordPress plugin xili-language (xili-language) up to version 2.21.3 contains a DOM-Based XSS vulnerability due to improper input neutralization during page generation. An attacker can exploit this to execute a malicious script in the victim's browser.
The JSM file_get_contents() Shortcode WordPress plugin contains a stored XSS vulnerability. An attacker can inject malicious script that executes in the admin's browser.
The Carousel Ultimate plugin up to version 1.8 is vulnerable to Stored XSS due to improper input neutralization during web page generation. This allows injection of malicious scripts that execute in the user's browser.
The PlayerJS plugin (versions up to 2.24) is vulnerable to DOM-Based Cross-site Scripting (XSS). This is due to improper neutralization of input during web page generation.
The All In One SEO Pack plugin (versions up to and including 4.8.7.1) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. A low-privileged user may perform actions they should not have access to.
The All In One SEO Pack plugin (versions up to and including 4.8.7.1) contains an Insertion of Sensitive Information Into Sent Data vulnerability that allows retrieval of embedded sensitive data. An attacker may gain access to information that should not be disclosed.
The Simple JWT Login WordPress plugin contains a stored XSS vulnerability. An attacker can inject malicious script that executes in the admin's browser.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Will.I.am Simple Restaurant Menu allows Stored XSS. This issue affects Simple Restaurant Menu from n/a through <= 1.2.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in chtombleson Mobi2Go allows Stored XSS. This issue affects Mobi2Go from n/a through <= 1.0.0.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gravitate Gravitate Automated Tester allows Stored XSS. This issue affects Gravitate Automated Tester from n/a through <= 1.4.5.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AnyClip Video Platform AnyClip Luminous Studio allows Stored XSS. This issue affects AnyClip Luminous Studio from n/a through <= 1.3.3.
The WP Project Manager plugin for WordPress contains a vulnerability involving the use of hard-coded credentials, allowing an attacker to retrieve sensitive data embedded in the application. The issue affects versions up to and including 2.6.25.
The WordPress plugin Gianism (versions up to 6.0.0) has a Stored XSS vulnerability due to improper input neutralization during web page generation.
The Events Manager – OpenStreetMaps plugin up to version 4.2.1 is vulnerable to Stored XSS due to improper input neutralization during web page generation. This allows injection of malicious scripts that execute in the user's browser.
The JupiterX Core WordPress plugin contains a stored XSS vulnerability. An attacker can inject malicious script that executes in the admin's browser.
The BuddyPress Notification Widget WordPress plugin contains a stored XSS vulnerability. An attacker can inject malicious script that executes in the admin's browser.
The Highlight and Share plugin up to version 5.1.1 is vulnerable to Stored XSS due to improper input neutralization during web page generation. This allows injection of malicious scripts that execute in the user's browser.
Missing Authorization vulnerability in Lazy Blocks (versions up to 4.1.0) allows exploiting incorrectly configured access control security levels.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS