CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.08)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Quiz Maker plugin (versions up to and including 6.7.0.82) contains a Cross-Site Request Forgery (CSRF) vulnerability. It allows an attacker to force an administrator to perform unwanted actions.
An authorization bypass vulnerability in Thim Elementor Kit (up to 1.3.3) allows exploiting incorrectly configured access control security levels.
The UsersWP plugin (versions up to and including 1.2.48) contains a Cross-Site Request Forgery (CSRF) vulnerability. It allows an attacker to force an administrator to perform unwanted actions.
The My Calendar plugin by Joe Dolson for WordPress up to version 3.6.16 contains a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. Attackers can exploit this to perform unauthorized actions.
The JNews Paywall plugin (versions before 12.0.1) contains a Cross-Site Request Forgery (CSRF) vulnerability. It allows an attacker to force an administrator to perform unwanted actions.
The Ultimate FAQ plugin (versions up to and including 2.4.3) contains a Cross-Site Request Forgery (CSRF) vulnerability. It allows an attacker to force an administrator to perform unwanted actions.
Missing Authorization vulnerability in WP Overnight WooCommerce PDF Invoices & Packing Slips (woocommerce-pdf-invoices-packing-slips) allows exploiting incorrectly configured access control security levels. This issue affects versions through 4.9.1.
The Elementor Website Builder plugin for WordPress in versions up to and including 3.33.0 contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels.
An open redirect vulnerability in WP Gravity Forms FreshDesk plugin (up to 1.3.5) allows phishing by redirecting users to untrusted sites.
Missing Authorization vulnerability in Highlight and Share plugin (up to 5.2.0) by Ronald Huereca allows exploiting incorrectly configured access control security levels.
An open redirect vulnerability in Flexmls® IDX plugin (up to 3.15.7) allows phishing by redirecting users to untrusted sites.
Missing Authorization vulnerability in rtCamp GoDAM (godam) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects GoDAM: from n/a through <= 1.4.6.
The IDonate plugin (idonate) up to version 2.1.15 contains a missing authorization vulnerability. It allows exploiting incorrectly configured access control security levels.
The Wbcom Designs plugin (lock-my-bp) up to version 2.1.1 contains a missing authorization vulnerability. It allows exploiting incorrectly configured access control security levels.
The TrueBooker plugin (truebooker-appointment-booking) up to version 1.1.0 contains a missing authorization vulnerability. It allows exploiting incorrectly configured access control security levels.
The Constant Contact + WooCommerce plugin (constant-contact-woocommerce) up to version 2.4.1 contains a missing authorization vulnerability. It allows exploiting incorrectly configured access control security levels.
Missing Authorization vulnerability in vanquish User Extra Fields (wp-user-extra-fields) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects User Extra Fields: from n/a through <= 16.8.
The WP Email Capture plugin (by Rhys Wynne) contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects WP Email Capture from n/a through <= 3.12.4.
The Easy Form Builder plugin (by hassantafreshi) contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects Easy Form Builder from n/a through <= 3.8.20.
The QuantumCloud Simple Link Directory plugin for WordPress has a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects Simple Link Directory from n/a through <= 8.8.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS