CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Divi WordPress theme before version 5.9.0 does not properly escape some Social Media Follow module settings before outputting them in link attributes, allowing users with contributor role or above to store JavaScript that executes when a higher-privileged user, such as an admin, views the post.
The Turnkey bbPress by WeaverTheme plugin for WordPress up to version 1.7.1 is vulnerable to PHP Object Injection via deserialization of untrusted input in the wvrbbp_set_to_serialized_values() function. The function reads raw file contents and passes them directly to unserialize() without validation, allowing authenticated attackers with administrator-level access and above to inject a PHP Object.
A weakness has been identified in DefaultFuction Customer-Relationship-Management-In-C-Project 2.0. It affects the gets function in the Customer Search Module, causing a stack-based buffer overflow. The attack can be initiated remotely, and the exploit has been made public.
A security flaw has been discovered in DefaultFuction Notice-System-Managent 2.0. The issue affects the GroovyShell.evaluate function in the /execute file of the NoticeController component, leading to code injection. The attack can be launched remotely, and the exploit has been released.
The ProfilePress plugin for WordPress up to version 4.16.19 is vulnerable to arbitrary shortcode execution. This is due to improper validation before running do_shortcode. Authenticated attackers with subscriber-level access can execute arbitrary shortcodes, and partial mitigations can be bypassed via various render paths.
The Kubio AI Page Builder plugin for WordPress up to version 2.8.5 is vulnerable to authorization bypass. Improper permission verification allows authenticated attackers with contributor-level access to overwrite front-page configuration, rewrite navigation menus, replace template parts, and overwrite global data. The nonce is available to all block editor users, making it ineffective.
The Fullscreen Galleria plugin for WordPress up to version 1.6.12 is vulnerable to generic SQL Injection via the 'href' attribute in post content. Insufficient escaping and lack of query preparation allow authenticated attackers with contributor-level access to append additional SQL queries to extract sensitive information.
The Quiz and Survey Master (QSM) plugin for WordPress up to version 11.2.1 is vulnerable to generic SQL Injection via the 'randon_category' quiz option. Insufficient escaping and lack of query preparation allow authenticated attackers with custom-level access to append additional SQL queries to extract sensitive information.
The Serious Slider plugin for WordPress up to version 1.4.0 is vulnerable to Stored Cross-Site Scripting via the 'theme' shortcode attribute. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access to inject arbitrary web scripts that execute when a user accesses an injected page.
The NEX-Forms plugin for WordPress up to version 9.2.4 is vulnerable to generic SQL Injection via the 'additional_params' parameter. Insufficient escaping and lack of query preparation allow authenticated attackers with admin-level access to append additional SQL queries. This is a second-order vulnerability triggered during CSV export.
The WC Product Table Lite plugin for WordPress up to version 5.6.0 is vulnerable to CSS Injection via the 'laptop_scroll_offset' shortcode attribute exposed through the unauthenticated AJAX handler. Lack of value validation and CSS escaping allows unauthenticated attackers to inject arbitrary CSS rules, leading to data exfiltration, UI redressing, and phishing.
The Loco Translate plugin for WordPress up to version 2.8.7 is vulnerable to Stored Cross-Site Scripting via PO File Extracted Comments. Insufficient input sanitization and output escaping allow authenticated attackers with translator-level access to inject arbitrary web scripts that execute when a user accesses an injected page.
The Advanced File Manager plugin for WordPress up to version 5.4.12 is vulnerable to Stored Cross-Site Scripting via the 'soundFile' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation requires control of a domain with a prefix matching the backend URL and an authenticated admin visiting the page with the File Manager open.
The Appointment Booking Calendar plugin for WordPress up to version 1.6.12.10 is vulnerable to Insecure Direct Object Reference via the ssa_past_appointments parameter due to missing validation on a user-controlled key. Authenticated attackers with contributor-level access can access appointment records of arbitrary users, including ownership tokens and full customer PII. The REST endpoint is registered unconditionally and only requires edit_posts capability.
The Everest Forms plugin for WordPress up to version 3.5.2 is vulnerable to authorization bypass due to improper verification of user permissions. Authenticated attackers with delegated form management access can activate arbitrary already-installed WordPress plugins, including previously deactivated or vulnerable ones, without holding the activate_plugins capability. This requires holding a delegated Everest Forms capability, which administrators can assign to non-administrators.
The Bookly plugin for WordPress up to version 27.7 is vulnerable to Insecure Direct Object Reference in the appointment() method of the Mobile Staff Cabinet API. The handler loads an Appointment by the attacker-supplied id without verifying that the appointment's staff_id matches the authenticated staff member. Authenticated attackers with staff-level mobile cabinet access can read appointment details of other staff members, including internal notes and customer data, by enumerating sequential IDs.
The Gravity Booster plugin for WordPress up to version 5.26 is vulnerable to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. Authenticated attackers with editor-level permissions can inject arbitrary web scripts that execute when a user accesses an injected page. This only affects multi-site installations and those where unfiltered_html has been disabled.
The Quiz and Survey Master plugin for WordPress up to version 11.2.1 is vulnerable to Stored Cross-Site Scripting via the 'question_title' parameter due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access can inject arbitrary web scripts that execute when a user accesses an injected page.
The PPWP plugin for WordPress up to version 1.9.20 is vulnerable to Insecure Direct Object Reference via the ppw_free_set_password AJAX action due to missing validation on a user-controlled key. Authenticated attackers with Contributor-level access can update the password on any password-protected post and subsequently access the content.
The Admin Custom Login plugin for WordPress up to version 3.6.4 is vulnerable to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. Authenticated attackers with administrator-level permissions can inject arbitrary web scripts that execute when a user accesses an injected page. This only affects multi-site installations and those where unfiltered_html has been disabled.