CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.08)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
There is an unauthenticated Cross Site Request Forgery (CSRF) vulnerability in WP Migrate Lite versions <= 2.7.8. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.
There is a vulnerability in XCloner versions up to 4.8.6 that allows for the exposure of subscriber sensitive data.
JS Help Desk versions up to 3.0.9 contain a vulnerability in access control that allows unauthorized access to resources.
The WP Job Portal plugin versions up to 2.5.2 contain a Cross Site Scripting (XSS) vulnerability that can be exploited by subscribers.
There is a vulnerability in versions of Visual Link Preview up to 2.4.1 that exposes sensitive subscriber data.
The King Addons plugin for Elementor versions up to 51.1.62 contains a Subscriber Cross Site Scripting (XSS) vulnerability.
MultiJuicer versions 8.0.0 through 10.0.0 have a vulnerability in the team join endpoint that accepts requests with any Content-Type, including text/plain. This allows attackers to embed an HTML form that auto-submits to the endpoint, enabling identity takeover of the victim.
Versions of Stripe Payments up to 2.0.98 contain a vulnerability that allows for unauthenticated bypass.
Masteriyo - LMS versions up to 2.1.8 contain a vulnerability in authentication that allows unauthorized access.
There is a Subscriber Cross Site Scripting (XSS) vulnerability in Modula Image Gallery versions up to 2.14.23.
There is an unauthenticated Cross Site Scripting (XSS) vulnerability in Simple Membership versions <= 4.7.2. An attacker can exploit this flaw to inject malicious scripts.
Event Tickets versions up to 5.27.5 contain a vulnerability that allows unauthenticated bypass of security measures.
Contest Gallery versions up to 28.1.7 have a vulnerability that allows for the exposure of subscriber sensitive data.
Versions of Advanced Form Integration up to 1.126.12 have a vulnerability in access control that may allow subscribers unauthorized access to resources.
Contest Gallery versions up to 28.1.7 contain an unauthenticated vulnerability that may be exploited by attackers.
There is a Cross Site Scripting (XSS) vulnerability affecting subscribers in Contest Gallery versions up to 28.1.6.
Unauthenticated bypass vulnerability in Best Payments plugin for WordPress versions up to 4.6.19.
Classified Listing versions up to 5.3.9 have a vulnerability in access control that may allow unauthorized subscribers to access resources.
Classified Listing versions up to 5.3.8 have a vulnerability in access control that allows unauthorized access.
There is a broken authentication issue in WP Full Stripe Free versions up to 8.4.1, which may lead to unauthorized access to user accounts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS