CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Advanced Views plugin for WordPress up to version 3.9.1 exposes sensitive admin-authored editor content via REST API routes. Authenticated attackers with subscriber-level access and above can extract template markup, CSS, JavaScript, and PHP controller variables for any Layout or Post Selection post.
The Fluent Forms plugin for WordPress up to version 6.2.8 contains a Reflected Cross-Site Scripting (XSS) vulnerability via the 'param' parameter. Unauthenticated attackers can inject arbitrary web scripts that execute if they trick a user into clicking a link.
The WPvivid Backup & Migration plugin for WordPress up to version 0.9.131 contains a SQL Injection vulnerability via the export_data parameter. Authenticated attackers with administrator-level access and above can append additional SQL queries to existing queries, allowing extraction of sensitive database information.
The Download Manager plugin for WordPress up to version 3.3.66 contains a Stored Cross-Site Scripting (XSS) vulnerability via the 'icon' shortcode attribute. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts that execute whenever a user accesses an injected page.
The Easy Property Listings plugin for WordPress up to version 3.5.24 contains a Stored Cross-Site Scripting (XSS) vulnerability via the 'facebook' user contact method. Authenticated attackers with subscriber-level access and above can inject arbitrary web scripts that execute whenever a user accesses an injected page.
The GSheetConnector plugin for WordPress up to version 5.2.1 contains a SQL Injection vulnerability via the 's' parameter. Authenticated attackers with administrator-level access and above can append additional SQL queries to existing queries, allowing extraction of sensitive database information.
The GamiPress plugin for WordPress up to version 7.9.9.1 contains a Stored Cross-Site Scripting (XSS) vulnerability via the 'gamipress_rank' shortcode. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts that execute whenever a user accesses an injected page.
The GamiPress plugin for WordPress is vulnerable to stored XSS via the 'heading_size' shortcode attribute in 'gamipress_achievement'. Attackers with contributor-level access can inject arbitrary scripts that execute when a user visits the page.
The Icegram Engage plugin for WordPress is vulnerable to second-order SQL injection via the 'messages[][id]' parameter. Attackers with editor-level access can store a malicious value that later executes as an SQL query, enabling data exfiltration.
The Icegram Mailer plugin for WordPress is vulnerable to SQL injection via the 'fields' parameter in the get_logs() function. Attackers with administrator access can append additional SQL queries, leading to data exfiltration.
The Cozy Blocks plugin for WordPress is vulnerable to stored XSS via the 'layoutCircle.alignment' block attribute. Attackers with contributor-level access can inject arbitrary scripts that execute when a user visits the page.
The Advanced Woo Labels plugin for WordPress is vulnerable to stored XSS via the 'bg_color' parameter. Attackers with contributor-level access can inject arbitrary scripts that execute when a user visits the page.
The Powerkit plugin for WordPress is vulnerable to stored XSS via shortcode attributes. Attackers with contributor-level access can inject arbitrary scripts that execute when a user visits the page.
The Powerkit plugin for WordPress is vulnerable to stored XSS via the 'nav' shortcode attribute. Attackers with contributor-level access can inject arbitrary scripts that execute when a user visits the page.
The Powerkit plugin for WordPress is vulnerable to stored XSS via the 'style' shortcode attribute. Attackers with contributor-level access can inject arbitrary scripts that execute when a user visits the page.
The Kirki plugin for WordPress is vulnerable to Path Traversal (Zip Slip) via the extract_zip_file function. Attackers with custom-level access can write arbitrary files on the server, potentially leading to remote code execution.
The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL injection via the 'force-collation-algorithm' parameter. Unauthenticated attackers can append additional SQL queries, enabling data exfiltration, but exploitation requires a trigger.txt file.
The GenerateBlocks plugin for WordPress is vulnerable to stored cross-site scripting via dynamic tag injection in HTML attributes in all versions up to and including 2.3.0 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access or above to inject arbitrary web scripts on pages.
The Gutena Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.9.0 due to improper verification of user permissions. This allows unauthenticated attackers to modify the read/unread status or permanently trash arbitrary form submission entries.
The RealHomes Memberships plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 3.0.9 due to improper verification of user permissions. This allows authenticated attackers with subscriber-level access or above to grant themselves any premium membership tier without completing a PayPal transaction.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS