CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.08)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Watu Quiz plugin for WordPress has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 3.4.5.
Missing Authorization vulnerability in Cooked (through version 1.11.3) allows exploiting incorrectly configured access control security levels.
The Constantin Boiangiu WordPress Vimeotheque plugin (codeflavors-vimeo-video-post-lite) contains a Cross-Site Request Forgery (CSRF) vulnerability. This issue affects versions from n/a through 2.3.5.2. The vulnerability may allow an attacker to force a logged-in user to perform unwanted actions.
The Tikweb Management WordPress Fast User Switching plugin (fast-user-switching) contains a Cross-Site Request Forgery (CSRF) vulnerability. This issue affects versions from n/a through 1.4.10. The vulnerability may allow an attacker to force a logged-in user to perform unwanted actions.
Missing Authorization vulnerability in Funnelforms Free (through version 3.8) allows exploiting incorrectly configured access control security levels.
Missing Authorization vulnerability in YITH Slider for page builders (up to 1.0.11) allows exploiting incorrectly configured access control security levels.
CSRF vulnerability in Advanced Classifieds & Directory Pro up to version 3.2.9. Allows an attacker to perform unauthorized actions in the context of a logged-in user.
The FV Simpler SEO plugin (up to version 1.9.6) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. An attacker can leverage this to perform unauthorized actions.
The WPBakery Visual Composer WHMCS Elements plugin for WordPress has a DOM-Based XSS vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through 1.0.4.3.
The Simple Keyword to Link plugin (up to version 1.5) is vulnerable to Cross-Site Request Forgery (CSRF). An attacker can trick an authenticated user into performing unwanted actions within the application.
The BBP Core plugin (up to version 1.4.1) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. An attacker can gain unauthorized access to plugin functionality.
The SALESmanago & Leadoo plugin (up to version 3.9.0) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. An attacker can leverage this to perform unauthorized actions.
The Claspo – Popups, Spin the Wheel & Email Capture plugin (up to version 1.0.7) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. An attacker can gain unauthorized access to plugin functionality.
CSRF vulnerability in My auctions allegro up to version 3.6.33. Allows an attacker to perform unauthorized actions in the context of a logged-in user.
Stored XSS vulnerability in the My auctions allegro plugin (up to version 3.6.35) allows an attacker to inject malicious script into a page, which will be executed in another user's browser.
The Twitch Player plugin (ttv-easy-embed-player) in versions up to and including 2.1.3 contains a missing authorization vulnerability. This allows exploitation of incorrectly configured access control security levels.
Missing Authorization vulnerability in Sunshine Photo Cart (up to 3.5.7.1) allows exploiting incorrectly configured access control security levels.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes WC Builder wc-builder allows Stored XSS. This issue affects WC Builder: from n/a through <= 1.2.0.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in modeltheme ModelTheme Addons for WPBakery and Elementor modeltheme-addons-for-wpbakery allows Stored XSS. This issue affects ModelTheme Addons for WPBakery and Elementor: from n/a through < 1.5.6.
CSRF vulnerability in WP Email Capture up to version 3.12.5. Allows an attacker to perform unauthorized actions in the context of a logged-in user.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS