CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Verowa Connect WordPress plugin contains a stored XSS vulnerability. An attacker can inject malicious script that executes in the admin's browser.
Stored XSS vulnerability in DOAJ Export plugin (up to 1.0.4) due to improper input neutralization. Allows persistent script injection that executes in the victim's browser.
The StylePress for Elementor WordPress plugin contains a stored XSS vulnerability. An attacker can inject malicious script that executes in the admin's browser.
The Real Estate Manager WordPress plugin contains a DOM-Based XSS vulnerability. An attacker can inject malicious script that executes in the victim's browser.
The Getwid plugin (versions up to and including 2.1.2) contains an Insertion of Sensitive Information Into Sent Data vulnerability that allows retrieval of embedded sensitive data. An attacker may gain access to information that should not be disclosed.
The Sticky Header Effects for Elementor plugin has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. Affects versions up to and including 2.1.2.
The Qubely plugin (versions up to and including 1.8.14) contains an Insertion of Sensitive Information Into Sent Data vulnerability that allows retrieval of embedded sensitive data. An attacker may gain access to information that should not be disclosed.
The Pinterest Pinboard Widget WordPress plugin contains a stored XSS vulnerability. An attacker can inject malicious script that executes in the admin's browser.
The TI WooCommerce Wishlist plugin for WordPress (versions up to and including 2.10.0) contains a Missing Authorization vulnerability allowing exploitation of incorrectly configured access control levels. An unauthorized user can perform operations reserved for higher roles.
The Portfolio plugin for WordPress up to version 2.58 contains a DOM-Based XSS vulnerability. The issue arises from improper neutralization of input during web page generation.
The Bg Church Memos WordPress plugin contains a DOM-Based XSS vulnerability due to improper input neutralization during web page generation. This allows malicious script execution in the user's browser.
The SnapWidget Social Photo Feed Widget WordPress plugin contains a DOM-Based XSS vulnerability. An attacker can inject malicious script that executes in the victim's browser.
The WordPress plugin xili-tidy-tags up to version 1.12.06 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Malicious JavaScript can be persistently stored and executed in a user's browser.
The WP Category Dropdown WordPress plugin is vulnerable to Stored XSS due to improper input neutralization. The issue affects versions up to and including 1.9.
The PilotPress plugin for WordPress (versions up to and including 2.0.36) contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. A malicious script can be persistently stored and executed in the user's browser.
The LC Wizard WordPress plugin contains a stored XSS vulnerability. An attacker can inject malicious script that executes in the admin's browser.
CSRF vulnerability in the Force Update Translations plugin. An attacker can exploit this to force translation updates.
The Front End Users WordPress plugin contains a Stored XSS vulnerability due to improper input neutralization during web page generation. This allows persistent injection of malicious scripts.
The JS Job Manager plugin for Joomla contains a Stored XSS vulnerability in versions up to and including 2.0.2. An attacker can inject malicious script into the page, which executes in the user's browser.
The SQL Chart Builder plugin contains a DOM-Based XSS vulnerability in versions up to and including 2.3.7.2. An attacker can exploit this to execute malicious scripts in the victim's browser.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS