CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.08)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The WordPress plugin Instantio (instantio) by Themefic has a vulnerability that exposes sensitive system information to unauthorized control spheres, allowing retrieval of embedded sensitive data. This affects versions up to and including 3.3.30.
The WordPress plugin 12 Step Meeting List (12-step-meeting-list) by AA Web Servant has a vulnerability that inserts sensitive information into sent data, allowing retrieval of embedded sensitive data. This affects versions up to and including 3.19.9.
The 12 Step Meeting List plugin for WordPress up to version 3.19.9 lacks authorization, allowing exploitation of incorrectly configured access control security levels. Attackers can gain unauthorized access to features.
The DirectoryPress plugin for WordPress exposes sensitive system information to unauthorized entities. The vulnerability allows retrieval of embedded sensitive data.
The WpTravelly tour booking manager plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 2.1.7.
The WordPress plugin Sunshine Photo Cart (sunshine-photo-cart) by sunshinephotocart has a vulnerability that inserts sensitive information into sent data, allowing retrieval of embedded sensitive data. This affects versions below 3.6.2.
The Share This Image plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
The Client Invoicing by Sprout Invoices plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 20.8.10.
The Revive.so plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
The WordPress plugin Tourfic up to version 2.21.4 suffers from a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
The WordPress plugin Doofinder for WooCommerce (doofinder-for-woocommerce) by Doofinder has a vulnerability that inserts sensitive information into sent data, allowing retrieval of embedded sensitive data. This affects versions up to and including 2.10.13.
The Hydra Booking plugin for WordPress is vulnerable to Stored XSS. An attacker can inject a malicious script that executes in other users' browsers.
The WordPress plugin RSVP and Event Management (rsvp) by WP Chill has a vulnerability that exposes sensitive system information to unauthorized control spheres, allowing retrieval of embedded sensitive data. This affects versions up to and including 2.7.16.
The Display Eventbrite Events plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
The WP Delicious plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects all versions from n/a through 1.9.5.
The WpStream plugin contains an authorization bypass vulnerability through a user-controlled key, allowing exploitation of incorrectly configured access control security levels. This issue affects all versions from n/a through 4.11.2 (excluding 4.11.2).
Server-Side Request Forgery (SSRF) vulnerability in Nelio Software Nelio Content allows Server Side Request Forgery. This issue affects Nelio Content from n/a through <= 4.3.1.
The weDocs plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
The Blog Filter plugin for WordPress up to version 1.7.6 contains a DOM-based XSS vulnerability. Improper input neutralization during page generation allows an attacker to inject malicious scripts in the DOM context.
The Nexter Blocks WordPress plugin exposes sensitive system information to unauthorized entities. The vulnerability allows retrieval of embedded sensitive data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS