CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.14)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The JetBlocks For Elementor WordPress plugin version 1.5.0 and earlier exposes sensitive system information to unauthorized parties. The vulnerability allows reading embedded confidential data.
The JetReviews WordPress plugin (versions up to 3.0.1) contains a vulnerability that exposes sensitive system information to unauthorized parties. An attacker can exploit this flaw to retrieve embedded confidential data.
The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress up to version 5.0.4 contains a Server-Side Request Forgery (SSRF) vulnerability. It allows an attacker to send requests from the server to internal network resources.
The myCred WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 3.1.2.
The License Manager for WooCommerce WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 3.0.17.
The WooCommerce Bulk Edit Products – WP Sheet Editor plugin (versions up to 1.8.21) has a missing authorization vulnerability, allowing an attacker to exploit incorrectly configured access control security levels. This flaw enables unauthorized operations on products in the WooCommerce store.
Missing authorization vulnerability in the Simply Schedule Appointments WordPress plugin, allowing exploitation of incorrectly configured access control security levels.
The Simply Schedule Appointments WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 1.6.12.4.
The EduMall WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 4.5.1.
The Speaker WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. This affects all versions up to and including 4.1.13.
The Universal Clocks WordPress plugin contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 1.2.0.
The MeetingHub plugin for WordPress contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 1.25.10.
The Envision Page Builder plugin for WordPress contains a DOM-Based Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. The flaw affects all versions up to and including 0.22.
The Fascinate WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 1.1.5.
The Booking calendar, Appointment Booking System plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 3.2.36.
The VW Wedding WordPress plugin contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 1.3.7.
The VW Food Corner WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 1.1.0.
The SupportCandy plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 3.4.8. The issue is due to improper input neutralization during web page generation.
The Abandoned Cart Recovery for WooCommerce plugin (woo-abandoned-cart-recovery) versions up to 1.1.12 contain an authentication bypass vulnerability via an alternate path or channel. This allows an attacker to abuse the authentication mechanism without valid credentials.
The Tutor LMS plugin for WordPress contains an authorization bypass vulnerability through a user-controlled key. This flaw allows exploiting incorrectly configured access control security levels.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS