CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Gutenberg Blocks by Kadence Blocks plugin (Liquid Web / StellarWP) up to version 3.8.0.2 contains a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation. This allows stored script injection.
The JetElements For Elementor plugin (Crocoblock) up to version 2.9.2.6 contains a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation. This allows stored script injection.
The Kit plugin (formerly ConvertKit) up to version 3.4.7 contains a Missing Authorization vulnerability due to insufficient access control checks. It allows exploitation of incorrectly configured access control security levels.
The WPFunnels plugin up to version 3.13.5 contains a Cross-Site Request Forgery (CSRF) vulnerability. It allows an attacker to force a logged-in user to perform unwanted actions.
The User Registration plugin (ThemeGrill) up to version 5.3.0 contains a Missing Authorization vulnerability due to insufficient access control checks. It allows exploitation of incorrectly configured access control security levels.
The WP ERP plugin (weDevs) up to version 1.17.10 contains a Missing Authorization vulnerability due to insufficient access control checks. It allows exploitation of incorrectly configured access control security levels.
The Flash & HTML5 Video plugin (bPlugins) up to version 2.14.0 contains a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation. This allows stored script injection.
The Media Library Assistant WordPress plugin (up to version 3.42) is vulnerable to DOM-Based Cross-site Scripting (XSS) due to improper neutralization of input during web page generation. The flaw allows injection of malicious script that executes in the user's browser.
The MasterStudy LMS WordPress plugin (up to version 3.7.55) has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may perform actions reserved for privileged roles.
The WPFunnels WordPress plugin (up to version 3.13.5) contains a missing authorization vulnerability enabling exploitation of incorrectly configured access control security levels. An unauthorized user may gain access to functions or data they should not have rights to.
The WPFunnels WordPress plugin (up to version 3.13.5) is vulnerable to a missing authorization flaw that allows exploitation of improperly configured access control security levels. The vulnerability enables unauthorized users to perform actions reserved for privileged roles.
The Flexible Quantity – Measurement Price Calculator for WooCommerce plugin (up to version 2.3.24) has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may perform actions requiring higher privileges.
The Happy Addons for Elementor plugin (up to version 3.50.1) is vulnerable to Stored Cross-site Scripting (XSS) due to improper neutralization of input during web page generation. A malicious script can be persistently stored and executed in the user's browser.
The StreamCast plugin (up to version 2.4.6) contains a Stored Cross-site Scripting (XSS) vulnerability resulting from improper neutralization of input during web page generation. Malicious JavaScript code can be stored and executed in the victim's browser.
The WP User Manager plugin (up to version 2.9.26) has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may perform operations requiring higher privileges.
The Webba Booking plugin (up to version 6.5.4) is vulnerable to a missing authorization flaw enabling exploitation of improperly configured access control security levels. An unauthorized user may perform actions reserved for privileged roles.
The SureForms plugin (up to version 2.12.9) contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may gain access to functions or data requiring higher privileges.
Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) allows an authenticated user with read-only access to change an installation-wide account setting that only platform administrators should be permitted to change.
Insertion of Sensitive Information into an Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to credential disclosure. ECE stores runtime information about platform service containers in a location readable by lower-privileged components, and this data includes secrets from container configuration, including role tokens.
Insertion of Sensitive Information into an Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation. After the ECE certificate rotation procedure runs, retained data contains platform credentials and certificate authority private keys readable by lower-privileged components.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS