CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.08)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Sitewide Notice WP plugin in versions up to 2.4.1 has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. Attackers can exploit this flaw for unauthorized actions.
The Booking calendar, Appointment Booking System plugin (by wpdevart) contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects Booking calendar, Appointment Booking System from n/a through <= 3.2.30.
The Sailing plugin (by ThimPress) contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects Sailing from n/a through < 4.4.6.
The PenNews plugin (by PenciDesign) contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects PenNews from n/a through < 6.7.4.
The WPForms Google Sheet Connector plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 4.0.0.
Missing Authorization vulnerability in scriptsbundle AdForest theme allows exploiting incorrectly configured access control security levels. This issue affects AdForest from n/a through <= 6.0.11.
Missing Authorization vulnerability in xtemos Basel theme allows exploiting incorrectly configured access control security levels. This issue affects Basel from n/a through <= 5.9.1.
The Sober theme from uixthemes is vulnerable to exposure of sensitive system information to unauthorized control sphere. This affects versions up to and including 3.5.11, allowing retrieval of embedded sensitive data.
The Woffice Core plugin (woffice-core) by WofficeIO has a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 5.4.30.
The Rehub theme from sizam is vulnerable to exposure of sensitive system information to unauthorized control sphere. This affects versions up to and including 19.9.9.1, allowing retrieval of embedded sensitive data.
The Pixel Manager for WooCommerce plugin (woocommerce-google-adwords-conversion-tracking-tag) by alekv in versions up to, and including, 1.51.1 is vulnerable to exposure of sensitive system information to an unauthorized control sphere. This may allow retrieval of embedded sensitive data.
The Post SMTP plugin by Saad Iqbal is vulnerable to Missing Authorization, allowing exploitation of incorrectly configured access control security levels. This issue affects Post SMTP from n/a through <= 3.6.1.
The Image Caption Hover Pro plugin (WebCodingPlace) up to version 20.0 (exclusive) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
The Debug Log Viewer plugin for WordPress (up to version 2.0.3) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. An attacker can access functions without proper permissions.
The Listdom plugin (Webilia Inc.) up to version 5.0.1 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacques Malgrange Rencontre rencontre allows Stored XSS. This issue affects Rencontre: from n/a through <= 3.13.7.
The WP eBay Product Feeds plugin by Rhys Wynne contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. This issue affects WP eBay Product Feeds from n/a through <= 3.4.9.
The Advanced FAQ Manager plugin for WordPress (versions up to 1.5.2) is vulnerable to stored XSS due to improper neutralization of input during web page generation. An attacker can inject malicious scripts that are stored and executed in other users' browsers.
The UseStrict's Calendly Embedder plugin (versions up to 1.1.7.2) contains a stored XSS vulnerability due to improper neutralization of input during web page generation. A malicious script can be stored and executed in users' browsers.
The Cookie Notice & Compliance for GDPR / CCPA plugin (versions up to 2.5.8) is vulnerable to stored XSS due to improper neutralization of input during web page generation. An attacker can inject a malicious script that is stored and executed in other users' browsers.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS