CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Awesome Support plugin in versions up to and including 6.3.9 contains a Cross Site Scripting (XSS) vulnerability. It can be exploited by a subscriber-level user.
oik plugin in versions up to and including 4.15.4 contains a Cross Site Scripting (XSS) vulnerability. It can be exploited by a subscriber-level user.
WP Express Checkout (Accept PayPal Payments) plugin in versions up to and including 2.4.9 contains a Broken Access Control vulnerability. It can be exploited by an unauthenticated attacker.
MakeCommerce for WooCommerce plugin in versions up to and including 4.1.0 contains a Broken Access Control vulnerability. It can be exploited by a subscriber-level user.
Trusted Shops Easy Integration for WooCommerce plugin in versions up to and including 2.0.6 contains a Cross Site Scripting (XSS) vulnerability. It can be exploited by an unauthenticated attacker.
Vulnerability in Vitepos plugin up to version 3.5.0 allows privilege escalation through a custom user role.
Unauthenticated Cross Site Scripting (XSS) vulnerability in WooCommerce Product Table Lite up to version 5.6.7.
Unauthenticated Cross Site Scripting (XSS) vulnerability in YITH WooCommerce Ajax Search up to version 2.28.0.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Classified Listing up to version 6.1.3.
Unauthenticated Broken Access Control vulnerability in Bookly up to version 28.2.
Author SQL Injection vulnerability in WP ERP up to version 1.17.9.
Administrator SQL Injection vulnerability in Estatik up to version 4.3.5.
Custom role PHP Object Injection vulnerability in eCommerce Product Catalog up to version 3.6.0.
Custom role PHP Object Injection vulnerability in WP ERP up to version 1.17.9.
An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes this while resolving the signature's key reference, before the message is authenticated, so an eleven-byte extension triggers a 2 GB allocation. Repeated requests exhaust server memory.
The Hostinger Migrator plugin in versions up to and including 1.0 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker. Missing access control checks allow unauthorized operations to be performed.
The Conversational Forms for ChatBot plugin in versions up to and including 1.5.0 contains a PHP Object Injection vulnerability exploitable by a Subscriber-level user. This allows injection of a malicious PHP object.
The DesignSetGo plugin in versions up to and including 2.8.0 contains a PHP Object Injection vulnerability exploitable by a Contributor-level user. This enables injection of a malicious PHP object.
The Go Live Update Urls plugin in versions up to and including 7.0.8 contains a PHP Object Injection vulnerability exploitable by a Contributor-level user. This allows injection of a malicious PHP object.
The Kadence WooCommerce Email Designer plugin in versions up to and including 1.5.19.1 contains a PHP Object Injection vulnerability exploitable by a Shop manager-level user. This enables injection of a malicious PHP object.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS