CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In geesondog RhaPHP (up to commit 7ae639ccf8dcb627faace096d030bd4cb4cfb905), the image function in application/mp/controller/Show.php (Mp Module Media Proxy component) allows manipulation of the url argument, resulting in server-side request forgery. The attack can be launched remotely, and a public exploit is available. The vendor did not respond to the disclosure.
The B Slider plugin (through 2.2.2) contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Malicious code can be stored and executed in a user's browser.
The APIExperts Square for WooCommerce (woosquare) plugin through version 4.7.5 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.
The APIExperts Square for WooCommerce (woosquare) plugin through version 4.7.5 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.
The Panorama Viewer – 360 Degree Image + Video Viewer plugin through version 1.8.3 contains a Stored XSS vulnerability caused by improper neutralization of input during web page generation.
The Advanced Post Block - Post Grid for WordPress block editor plugin through version 2.5.1 contains a Stored XSS vulnerability caused by improper neutralization of input during web page generation.
The Geo Mashup plugin through version 1.13.22 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.
The Geo Mashup plugin through version 1.13.22 contains a Stored XSS vulnerability caused by improper neutralization of input during web page generation.
The Lazy Load for Videos plugin through version 2.18.11 contains a Stored XSS vulnerability caused by improper neutralization of input during web page generation.
The Better Post & Filter Widgets for Elementor plugin through version 1.9.1 contains a Stored XSS vulnerability caused by improper neutralization of input during web page generation.
The WordPress Media Library Assistant plugin in versions up to 3.42 contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This may allow an attacker to perform blind SQL injection.
The Crocoblock JetEngine WordPress plugin in versions up to 3.9.0 contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This may allow an attacker to inject malicious SQL code.
The Contact Form by Supsystic plugin through version 1.10.7 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.
The Media Library Assistant plugin through version 3.42 contains an insertion of sensitive information into sent data vulnerability that allows retrieval of embedded sensitive data.
The JetSmartFilters plugin by Crocoblock contains a Stored XSS vulnerability caused by improper neutralization of input during web page generation. The issue affects versions from n/a through 3.8.6.1.
The JetElements For Elementor plugin by Crocoblock contains a Stored XSS vulnerability caused by improper neutralization of input during web page generation. The issue affects versions from n/a through 2.9.2.5.
The Media Library Assistant WordPress plugin contains a Cross-Site Request Forgery (CSRF) vulnerability. The issue affects versions up to and including 3.42.
The Royal Elementor Addons WordPress plugin contains an authorization bypass through a user-controlled key vulnerability. The issue affects versions up to and including 1.7.1069.
The Royal Elementor Addons WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. The issue affects versions up to and including 1.7.1069.
IsMyGym by Zuinq Studio contains a Reflected Cross-Site Scripting (XSS) vulnerability in the reservation endpoint, where the 'ret' parameter is reflected in the HTTP response without proper sanitization. Successful exploitation could allow an attacker to inject arbitrary JavaScript executed in the victim's browser context.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS