CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Creator LMS plugin in versions up to and including 1.2.19 contains a Path Traversal vulnerability exploitable by a user with Contributor privileges.
The BackupEase plugin in versions up to and including 2.2.2 contains a Sensitive Data Exposure vulnerability exploitable by an unauthenticated attacker.
The StifLi Backup Tools plugin in versions up to and including 2.2.7 contains a Sensitive Data Exposure vulnerability exploitable by an unauthenticated attacker.
The Crocoblock JetEngine plugin contains a DOM-based cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects JetEngine through version 3.8.14.3.
Unauthenticated XSS attack in ThemeREX Addons plugin versions prior to 2.45.0. An attacker can inject malicious script without authentication.
Unauthenticated Broken Access Control vulnerability in WordPress Backup & Migration plugin up to version 1.6.0. An unauthenticated user can gain unauthorized access to functionality.
Unauthenticated XSS attack in Ad Inserter plugin up to version 2.8.18. An attacker can inject malicious script without authentication.
Unauthenticated XSS attack in Happyforms plugin up to version 1.26.15. An attacker can inject malicious script without authentication.
Unauthenticated CSRF attack in Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification plugin up to version 2.3.1. An attacker can perform unauthorized actions on behalf of a logged-in user.
Remote Code Execution (RCE) vulnerability exploitable by users with Contributor role in CartFlows plugin up to version 3.2.0. A low-privileged user can execute code on the server.
Unauthenticated XSS attack in Parsi Date plugin up to version 6.3. An attacker can inject malicious script without authentication.
PHP Object Injection vulnerability in Ultimate Addons for Contact Form 7 plugin up to version 3.5.51, exploitable by users with Editor role. May lead to execution of malicious PHP objects.
PHP Object Injection vulnerability in Content Egg plugin up to version 6.3.1, exploitable by users with Shop manager role. May lead to execution of malicious PHP objects.
Themify Builder plugin in versions up to and including 7.8.1 contains a PHP Object Injection vulnerability. A contributor-level user can inject a malicious PHP object, potentially leading to further exploitation.
GiveWP plugin in versions up to and including 4.16.9 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker. The lack of required authentication significantly increases the exploitation risk.
Category Discount Woocommerce plugin in versions up to and including 5.18 contains an SQL Injection vulnerability. It can be exploited by an administrator-level user.
Admin Notices Manager plugin in versions up to and including 1.6.0 contains an SQL Injection vulnerability. It can be exploited by an administrator-level user.
Customer Reviews for WooCommerce plugin in versions up to and including 5.120.0 contains an unauthenticated arbitrary content deletion vulnerability. An attacker does not need to be logged in to exploit it.
Awesome Support plugin in versions up to and including 6.3.9 contains a Cross Site Scripting (XSS) vulnerability. It can be exploited by a subscriber-level user.
oik plugin in versions up to and including 4.15.4 contains a Cross Site Scripting (XSS) vulnerability. It can be exploited by a subscriber-level user.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS