CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The WordPress plugin Questionar for Elementor (questionar-elementor) up to version 1.1.7 has a Missing Authorization vulnerability. It allows exploiting incorrectly configured access control security levels.
The WordPress plugin Couponer for Elementor (couponer-elementor) up to version 1.1.7 has a Missing Authorization vulnerability. It allows exploiting incorrectly configured access control security levels.
The WP Custom Admin Interface plugin (wp-custom-admin-interface) in versions up to and including 7.40 contains a Missing Authorization vulnerability. It allows exploitation of incorrectly configured access control security levels.
The Valenti Engine plugin up to version 1.0.3 has a DOM-Based XSS vulnerability due to improper input neutralization during web page generation. An attacker can inject malicious scripts that execute in the victim's browser.
A Missing Authorization vulnerability in the AnyComment plugin (anycomment) allows exploiting incorrectly configured access control security levels. Affects versions up to and including 0.3.6.
The Hide Plugins plugin (hide-plugins) in versions up to and including 1.0.4 contains a Missing Authorization vulnerability. It allows exploitation of incorrectly configured access control security levels.
The Signature Add-On for Gravity Forms plugin up to version 1.8.6 contains a missing authorization vulnerability. It allows exploiting incorrectly configured access control security levels.
The WordPress & WooCommerce Scraper Plugin up to version 1.0.7 has a Server-Side Request Forgery (SSRF) vulnerability. This allows sending requests from the server to internal resources, which can lead to exposure of sensitive information.
The WordPress Coming Soon plugin by BoomDevs (coming-soon-by-boomdevs) up to version 1.0.4 has a vulnerability that exposes sensitive system information to unauthorized control spheres. It allows retrieving embedded sensitive data.
The Easy Upload Files During Checkout plugin up to version 3.0.0 contains a missing authorization vulnerability. It allows exploiting incorrectly configured access control security levels.
The Order Cancellation & Returns for WooCommerce plugin (wc-order-cancellation-return) in versions up to and including 1.1.11 contains an Authorization Bypass Through User-Controlled Key vulnerability. It allows exploitation of incorrectly configured access control security levels.
A vulnerability exposing sensitive system information in the Direct Payments WP plugin (direct-payments-wp) allows an unauthorized attacker to retrieve embedded sensitive data. Affects versions up to and including 1.3.2.
The WordPress plugin Direct Payments WP (direct-payments-wp) up to version 1.3.2 has a Missing Authorization vulnerability. It allows exploiting incorrectly configured access control security levels.
The GS Portfolio for Envato plugin (gs-envato-portfolio) up to version 1.4.2 contains a missing authorization vulnerability. It allows exploiting incorrectly configured access control security levels.
The Vireo theme up to version 1.0.24 contains a missing authorization vulnerability. It allows exploiting incorrectly configured access control security levels.
The Featured Image Generator plugin up to version 1.3.4 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control levels. This could enable unauthorized actions in the admin panel.
The AI Content Writing Assistant (All in One) plugin up to version 1.1.7 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control levels. This could enable unauthorized actions in the admin panel.
The History Timeline plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions from n/a through 1.0.6.
The Post Video Players plugin up to version 1.163 contains an exposure of sensitive system information to an unauthorized control sphere vulnerability. It allows retrieving embedded sensitive data.
The WordPress plugin Trash Duplicate and 301 Redirect (trash-duplicate-and-301-redirect) up to version 1.9.1 has a Missing Authorization vulnerability. It allows exploiting incorrectly configured access control security levels.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS