CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL Injection vulnerability in Events Manager plugin up to version 7.4.6, requiring subscriber privileges. Allows a user with subscriber role to inject malicious SQL queries into the database.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Qode Real Estate plugin up to version 1.1.7.3. Allows unauthorized users to inject malicious scripts into pages viewed by other users.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Qode Music plugin up to version 2.1.8.2. Allows unauthorized users to inject malicious scripts into pages viewed by other users.
Unauthenticated Sensitive Data Exposure vulnerability in Web Plura Backup & Restore Manager plugin up to version 0.2.25. Allows unauthorized users to access sensitive data.
The PeepSo plugin versions up to 9.0.5.4 allow a subscriber to delete arbitrary files on the server.
The Jotform – AI Chatbot plugin versions up to 3.8.2 contain an unauthenticated Cross-Site Scripting (XSS) vulnerability.
The Pubjet | پابجت plugin versions up to 5.4.8 allow a subscriber to change settings they should not have access to.
The Wordable plugin versions up to 8.2.10 have a Broken Access Control vulnerability that allows a subscriber to access functions they should not have permissions for.
The WPSection plugin versions up to 1.5.1 have a Broken Access Control vulnerability that allows a subscriber to access functions they should not have permissions for.
The Everest Backup plugin versions up to 2.3.13 contain an unauthenticated Remote Code Execution (RCE) vulnerability.
The Additional Order Filters for WooCommerce plugin versions up to 1.24 contain an unauthenticated Cross-Site Scripting (XSS) vulnerability.
The WP File Download plugin versions up to 6.3.6 contain an unauthenticated Cross-Site Scripting (XSS) vulnerability.
Builderius.io Builderius versions from 1.4 through 1.4-beta contain a Server-Side Request Forgery (SSRF) vulnerability.
The Forminator plugin by WPMU DEV versions up to 1.57.3 have an incorrect privilege assignment vulnerability that allows privilege escalation.
The Martfury - WooCommerce Marketplace WordPress theme contains a Reflected XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions up to and including 3.3.9.
Reflected XSS vulnerability in the ThemeStek Extras for LabtechCO Theme extension. Improper neutralization of input during web page generation allows reflected XSS. Affects versions up to 8.4.
Deserialization of untrusted data vulnerability in the Super Video Player plugin. Allows an attacker to perform object injection. Affects versions up to 1.8.13.
Missing authorization vulnerability in the Bayarcash WooCommerce plugin. Allows exploiting incorrectly configured access control security levels. Affects versions up to 4.4.2.
Incorrect privilege assignment vulnerability in WooCommerce. Allows privilege escalation. Affects versions from 9.8.0 through 11.1.2.
Code injection vulnerability in the Thank You Page Customizer for WooCommerce plugin. Allows code injection. Affects versions up to 1.2.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS