CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.08)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CSRF vulnerability in the Social Photo Fetcher WordPress plugin allows an attacker to perform unauthorized requests on behalf of a logged-in user. Affects versions up to and including 3.0.4.
The Just TinyMCE Custom Styles plugin (up to version 1.2.1) is vulnerable to Cross-Site Request Forgery (CSRF). An attacker can force an authenticated user to perform unwanted actions.
The Eupago Gateway For Woocommerce plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 4.7.1.
The WordPress plugin Gravitec.net – Web Push Notifications (gravitec-net-web-push-notifications) contains a Missing Authorization vulnerability due to incorrectly configured access control security levels. The issue affects versions up to and including 2.9.17.
The Ergonet Cache plugin from ergonet is vulnerable to missing authorization, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 1.0.13.
CSRF vulnerability in the Auto Alt Text WordPress plugin allows an attacker to perform unauthorized requests on behalf of a logged-in administrator. Affects versions up to and including 2.5.2.
Missing Authorization vulnerability in Evan Herman Post Cloner post-cloner allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post Cloner: from n/a through <= 1.0.0.
CSRF vulnerability in the SMTP Mail WordPress plugin allows an attacker to perform unauthorized requests on behalf of a logged-in administrator. Affects versions up to and including 1.3.51.
The WP-CRM System contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 3.4.6.
The Add Custom Codes plugin (by SaifuMak) is vulnerable to Cross-Site Request Forgery (CSRF). This issue affects Add Custom Codes versions from n/a through <= 4.80.
Formstack Online Forms plugin (versions up to 2.0.2) has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthenticated user can perform actions they are not permitted to.
A vulnerability in the Image Cleanup plugin (opicron) allows exposure of sensitive system information to unauthorized parties. The issue affects versions up to and including 1.9.2.
The Image Cleanup plugin up to version 1.9.2 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
A vulnerability in the User Spam Remover plugin (Joel) allows exposure of sensitive system information to unauthorized parties. The issue affects versions up to and including 1.1.
CSRF vulnerability in the Media Library Downloader WordPress plugin allows an attacker to perform unauthorized requests on behalf of a logged-in user. Affects versions up to and including 1.4.0.
Quick Interest Slider plugin (versions up to 3.1.7) contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user can perform actions reserved for privileged roles.
The Virtuaria PagBank / PagSeguro for WooCommerce plugin has a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 3.6.3.
A vulnerability in the Geo Controller plugin (INFINITUM FORM) allows insertion of sensitive information into sent data, enabling retrieval of embedded sensitive data. The issue affects versions up to and including 8.9.4.
CSRF vulnerability in the Media Library File Download WordPress plugin allows an attacker to perform unauthorized requests on behalf of a logged-in user. Affects versions up to and including 1.4.
The WordPress plugin DoFollow Case by Case in versions up to and including 3.5.1 is vulnerable to Cross-Site Request Forgery (CSRF). Missing proper request validation allows an attacker to trick an administrator into performing unauthorized actions on their behalf.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS