CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
PHP Object Injection vulnerability in the Motorix theme in versions up to and including 1.11. It can be exploited by an unauthenticated attacker.
PHP Object Injection vulnerability in the Mission theme in versions up to and including 1.22. It can be exploited by an unauthenticated attacker.
PHP Object Injection vulnerability in the Meals & Wheels theme in versions up to and including 1.1.13. It can be exploited by an unauthenticated attacker.
PHP Object Injection vulnerability in the Marcell theme in versions up to and including 1.2.14. It can be exploited by an unauthenticated attacker.
PHP Object Injection vulnerability in the Le Truffe theme in versions up to and including 1.1.7. It can be exploited by an unauthenticated attacker.
PHP Object Injection vulnerability in the Legal Stone theme in versions up to and including 1.2.11. It can be exploited by an unauthenticated attacker.
Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions.
Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1.0 versions.
Unauthenticated Cross Site Scripting (XSS) in Blockonomics 3.11.0 versions.
PHP Object Injection vulnerability in the GEO my WordPress plugin in versions up to and including 4.5.5.3. It can be exploited by an unauthenticated attacker.
Remote Code Execution (RCE) vulnerability in the AjaxLoadMore Cache plugin in versions up to and including 3.1.1. It can be exploited by an unauthenticated attacker.
The Easy Property Listings WordPress plugin in versions up to 3.5.25 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject malicious script that executes in the user's browser.
The Auction Nudge – Your eBay on Your Site WordPress plugin in versions up to 8.4.0 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript that executes in the victim's browser.
The Razorpay Payment Button Elementor WordPress plugin in versions up to 1.2.8 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. Malicious script injected by an attacker executes in the user's browser.
The Podamibe Custom User Gravatar WordPress plugin in versions up to 1.0.8 contains a Cross Site Scripting (XSS) vulnerability accessible to subscriber-level users. It allows injection of a malicious script that may execute in another user's browser.
The Post Video Players WordPress plugin in versions up to 1.165 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script that executes in the victim's browser.
PHP Object Injection vulnerability in the Ozisti theme in versions up to and including 1.1.10. It can be exploited by an unauthenticated attacker.
The Preservation plugin in versions up to and including 1.15 contains an unauthenticated PHP Object Injection vulnerability.
The Printy plugin in versions up to and including 1.13.0 contains an unauthenticated PHP Object Injection vulnerability.
The Quirky plugin in versions up to and including 1.23 contains an unauthenticated PHP Object Injection vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS