CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Media Library Assistant WordPress plugin (up to version 3.42) is vulnerable to DOM-Based Cross-site Scripting (XSS) due to improper neutralization of input during web page generation. The flaw allows injection of malicious script that executes in the user's browser.
The MasterStudy LMS WordPress plugin (up to version 3.7.55) has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may perform actions reserved for privileged roles.
The WPFunnels WordPress plugin (up to version 3.13.5) contains a missing authorization vulnerability enabling exploitation of incorrectly configured access control security levels. An unauthorized user may gain access to functions or data they should not have rights to.
The WPFunnels WordPress plugin (up to version 3.13.5) is vulnerable to a missing authorization flaw that allows exploitation of improperly configured access control security levels. The vulnerability enables unauthorized users to perform actions reserved for privileged roles.
The Flexible Quantity – Measurement Price Calculator for WooCommerce plugin (up to version 2.3.24) has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may perform actions requiring higher privileges.
The Happy Addons for Elementor plugin (up to version 3.50.1) is vulnerable to Stored Cross-site Scripting (XSS) due to improper neutralization of input during web page generation. A malicious script can be persistently stored and executed in the user's browser.
The StreamCast plugin (up to version 2.4.6) contains a Stored Cross-site Scripting (XSS) vulnerability resulting from improper neutralization of input during web page generation. Malicious JavaScript code can be stored and executed in the victim's browser.
The WP User Manager plugin (up to version 2.9.26) has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may perform operations requiring higher privileges.
The Webba Booking plugin (up to version 6.5.4) is vulnerable to a missing authorization flaw enabling exploitation of improperly configured access control security levels. An unauthorized user may perform actions reserved for privileged roles.
The SureForms plugin (up to version 2.12.9) contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may gain access to functions or data requiring higher privileges.
Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) allows an authenticated user with read-only access to change an installation-wide account setting that only platform administrators should be permitted to change.
Insertion of Sensitive Information into an Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to credential disclosure. ECE stores runtime information about platform service containers in a location readable by lower-privileged components, and this data includes secrets from container configuration, including role tokens.
Insertion of Sensitive Information into an Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation. After the ECE certificate rotation procedure runs, retained data contains platform credentials and certificate authority private keys readable by lower-privileged components.
Authorization Bypass Through a User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation. An attacker who controls any host in an ECE installation can obtain credentials reserved for other platform roles.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the PublishPress Authors plugin allows Stored XSS. This issue affects PublishPress Authors through version 4.17.0.
Missing Authorization in the Brainstorm Force SureDash plugin allows exploitation of incorrectly configured access control security levels. This issue affects SureDash through version 1.12.3.
Missing Authorization in the WP Desk Custom Price for WooCommerce plugin allows exploitation of incorrectly configured access control security levels. This issue affects Custom Price for WooCommerce through version 1.1.29.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the WP Chill Strong Testimonials plugin allows Stored XSS. This issue affects Strong Testimonials through version 3.3.15.
Missing Authorization in the Magepeople inc. Taxi Booking Manager for WooCommerce plugin allows exploitation of incorrectly configured access control security levels. This issue affects Taxi Booking Manager for WooCommerce through version 2.1.6.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the Brainstorm Force SureDash plugin allows Stored XSS. This issue affects SureDash through version 1.12.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS