CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Cross Site Scripting (XSS) vulnerability in SEO Plugin by Squirrly SEO up to version 14.2.0, allowing an unauthenticated attacker to inject malicious scripts into pages.
Cross Site Scripting (XSS) vulnerability in WP Data Access plugin up to version 5.5.79, allowing an unauthenticated attacker to inject malicious scripts into pages.
Broken Access Control vulnerability in Frontend Admin by DynamiApps plugin up to version 3.29.10, allowing a subscriber user to access administrative functions without authorization.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS. This issue affects Events Manager: from n/a through 7.4.2.
Unauthenticated Cross Site Scripting (XSS) in WPIDE – File Manager & Code Editor versions up to 3.5.7.
Unauthenticated Cross Site Scripting (XSS) in Advanced AJAX Product Filters versions up to 3.2.0.3.
Unauthenticated Bypass Vulnerability in Login with phone number versions up to 1.8.70.
Subscriber SQL Injection in WP Job Portal versions up to 2.5.6.
Unauthenticated Cross Site Scripting (XSS) in Survey Maker versions up to 5.2.3.3.
Unauthenticated Cross Site Scripting (XSS) in Houzez Property Feed versions up to 2.5.48.
Shop manager Privilege Escalation in Order Delivery Date for WooCommerce versions up to 4.6.0.
Subscriber Broken Access Control in AnsPress – Question and answer version 4.4.4.
Author PHP Object Injection in Jeg Kit for Elementor versions up to 3.2.10.
Unauthenticated Cross Site Scripting (XSS) vulnerability in AI Engine plugin up to version 3.6.8. An unauthenticated attacker can inject malicious scripts.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Super Socializer plugin up to version 7.14.5. An unauthenticated attacker can inject malicious scripts.
Sensitive Data Exposure vulnerability in Vimeo plugin up to version 1.2.2. A subscriber user can access sensitive information.
Unauthenticated Broken Authentication vulnerability in Super Socializer plugin up to version 7.14.5. An unauthenticated attacker can bypass authentication mechanisms.
Unauthenticated Broken Access Control vulnerability in Staff Training plugin up to version 1.0.7. An unauthenticated attacker can access functions they should not have permissions for.
Unauthenticated Insecure Direct Object References (IDOR) vulnerability in Formidable Forms Signature Online Contract Automation plugin up to version 2.0.1. An unauthenticated attacker can access objects (e.g., files, data) by manipulating identifiers.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Easy PayPal Buy Now Button plugin up to version 2.0.4. An unauthenticated attacker can inject malicious scripts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS