CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The SureCart plugin in versions up to and including 4.7.2 contains a Privilege Escalation vulnerability exploitable by a user with Shop Worker privileges.
The Creator LMS plugin in versions up to and including 1.2.19 contains a Path Traversal vulnerability exploitable by a user with Contributor privileges.
Broken Access Control vulnerability in AllAble Connector versions up to 0.13.4, exploitable by a subscriber.
Arbitrary File Deletion vulnerability in WEBO MCP versions up to 3.0.18, exploitable by an author.
The BackupEase plugin in versions up to and including 2.2.2 contains a Sensitive Data Exposure vulnerability exploitable by an unauthenticated attacker.
The StifLi Backup Tools plugin in versions up to and including 2.2.7 contains a Sensitive Data Exposure vulnerability exploitable by an unauthenticated attacker.
Broken Access Control vulnerability in MCP Content Manager Lite up to version 1.1.0. A subscriber can gain unauthorized access to administrative functions.
Cross Site Scripting (XSS) vulnerability in JetEngine up to version 3.8.14.3. A subscriber can inject malicious scripts.
The Crocoblock JetEngine plugin contains a DOM-based cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects JetEngine through version 3.8.14.3.
Cross Site Scripting (XSS) vulnerability in ThemeREX Addons before version 2.45.0. A subscriber can inject malicious scripts.
Unauthenticated XSS attack in ThemeREX Addons plugin versions prior to 2.45.0. An attacker can inject malicious script without authentication.
Unauthenticated Broken Access Control vulnerability in WordPress Backup & Migration plugin up to version 1.6.0. An unauthenticated user can gain unauthorized access to functionality.
Insecure Direct Object References (IDOR) vulnerability in Webba Booking up to version 6.5.0. A subscriber can access objects without authorization.
Insecure Direct Object References (IDOR) vulnerability in Client Invoicing by Sprout Invoices up to version 20.8.17. An unauthenticated user can access objects without logging in.
Unauthenticated XSS attack in Ad Inserter plugin up to version 2.8.18. An attacker can inject malicious script without authentication.
Insecure Direct Object References (IDOR) vulnerability in Newsletters, Email Marketing, SMS and Popups by Omnisend up to version 1.9.0. A subscriber can access objects without authorization.
Cross Site Scripting (XSS) vulnerability in EWWW Image Optimizer up to version 8.7.7. A contributor can inject malicious scripts.
Insecure Direct Object References (IDOR) vulnerability in GiveWP up to version 4.16.9. An unauthenticated user can access objects without logging in.
Unauthenticated XSS attack in Happyforms plugin up to version 1.26.15. An attacker can inject malicious script without authentication.
Unauthenticated CSRF attack in Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification plugin up to version 2.3.1. An attacker can perform unauthorized actions on behalf of a logged-in user.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS