CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Broken Access Control vulnerability in Simple Membership plugin up to version 4.8.2, allowing Contributor accounts to access admin functions. This enables privilege escalation.
Insecure Direct Object References (IDOR) vulnerability in Cooked plugin up to version 1.16.0, affecting Contributor accounts. It allows unauthorized access to objects (e.g., posts, recipes), potentially exposing data.
In BMCtest, Ironic is started without authentication and TLS for the duration of the test. Exploiting the problem requires winning the race with bmctest itself, which reduces the attack window and significantly increases its complexity.
Unauthenticated Broken Access Control vulnerability in Easy Invoice plugin up to version 2.3.8. Unauthenticated users can access invoice and management functions that should be protected.
The MC Woocommerce Wishlist plugin in versions up to and including 1.9.21 contains an Administrator SQL Injection vulnerability. This allows an administrator-level user to inject malicious SQL code into database queries.
The PublishPress Series plugin in versions up to and including 3.1.3 contains an Administrator SQL Injection vulnerability. This enables an administrator-level user to inject malicious SQL code into database queries.
The WP-Lister Lite for eBay plugin in versions up to and including 3.8.11 contains a Shop manager SQL Injection vulnerability. This allows a shop manager-level user to inject malicious SQL code into database queries.
The SKT Addons for Elementor plugin in versions up to and including 4.0 contains an Editor SQL Injection vulnerability. This enables an editor-level user to inject malicious SQL code into database queries.
The WC Vendors Marketplace plugin in versions up to and including 2.7.2.1 contains an Administrator SQL Injection vulnerability. This allows an administrator-level user to inject malicious SQL code into database queries.
The WordPress plugin WPMasterToolKit in versions up to 2.22.0 contains an SQL Injection vulnerability accessible to users with administrator privileges. An administrator can inject malicious SQL queries through a vulnerable parameter.
The WordPress plugin Newsletters in versions up to 4.18 contains an SQL Injection vulnerability accessible to users with administrator privileges. An administrator can inject malicious SQL queries through a vulnerable parameter.
The WordPress plugin WP Maps in versions up to 4.9.9 contains an SQL Injection vulnerability accessible to users with administrator privileges. An administrator can inject malicious SQL queries through a vulnerable parameter.
Cross Site Scripting (XSS) vulnerability in PublishPress Series plugin up to version 3.1.3, affecting Contributor accounts. It allows injection of malicious JavaScript into publication content, which executes in other users' browsers.
The Unlimited Elements For Elementor plugin in versions up to and including 2.0.19 contains a Server Side Request Forgery (SSRF) vulnerability. A user with Contributor privileges can force the server to make requests to arbitrary resources.
The WordPress plugin Product Feed Manager in versions up to 7.12.0 contains an SQL Injection vulnerability accessible to users with Contributor privileges. A Contributor can inject malicious SQL queries through a vulnerable parameter.
The JetElements For Elementor plugin in versions up to and including 2.9.2.1 is vulnerable to Cross Site Scripting (XSS). A user with Contributor privileges can inject a malicious script.
The PropertyHive plugin in versions up to and including 2.2.6 contains a Cross Site Scripting (XSS) vulnerability. A user with Contributor privileges can inject malicious script code.
The JetSearch plugin in versions up to and including 3.6.3 is vulnerable to Cross Site Scripting (XSS). A user with Contributor privileges can inject a malicious script.
The JetBlocks For Elementor plugin in versions up to and including 1.5.2 contains a Cross Site Scripting (XSS) vulnerability. A user with Contributor privileges can inject malicious script code.
The King Addons for Elementor plugin in versions up to and including 51.1.81 contains an Insecure Direct Object References (IDOR) vulnerability. An unauthenticated attacker can access objects they should not have access to.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS