CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The BizPrint plugin for WooCommerce contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 4.6.7.
A missing authorization vulnerability in the Discussion Board plugin (versions up to and including 2.5.7) allows exploitation of incorrectly configured access control security levels. An unauthorized user can perform actions requiring permissions.
A missing authorization vulnerability in the HR Management Lite plugin (versions up to and including 3.6) allows exploitation of incorrectly configured access control security levels. An unauthorized user can perform actions requiring permissions.
Cross-Site Request Forgery (CSRF) vulnerability in Popup box (WordPress plugin) allows an attacker to force a logged-in user to perform unwanted actions. Affects versions up to and including 6.0.7.
A Stored Cross-site Scripting vulnerability in the Newsletters plugin (versions up to and including 4.12) arises from improper neutralization of input during web page generation. An attacker can persistently inject a malicious script that executes for other users.
A DOM-Based Cross-Site Scripting (XSS) vulnerability in the FlippingBook plugin (flippingbook) up to version 2.0.1. It allows an attacker to inject a malicious script into the page, which executes in the victim's browser.
A DOM-Based Cross-site Scripting vulnerability in the Web Directory Free plugin (versions up to and including 1.7.12) arises from improper neutralization of input during web page generation. An attacker can inject a malicious script that executes in the user's browser.
Stored XSS vulnerability in RestroPress (WordPress plugin) allows an attacker to inject malicious script into the page, which executes in the user's browser. Affects versions up to and including 3.2.8.6.
Missing Authorization vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Shortcodes and extra features for Phlox theme from n/a through 2.17.22.
A Server-Side Request Forgery (SSRF) vulnerability in the Youzify plugin (youzify) up to version 1.3.7. It allows an attacker to send requests from the server to internal resources, potentially leading to unauthorized access to data or services.
The Stratum WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 1.6.1.
The Event Organiser WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 3.12.8.
The Themebeez Toolkit WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 1.3.5.
The Medicalequipment WordPress plugin (kamleshyadav) up to and including version 1.0.9 has a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels.
The Inboxify Sign Up Form WordPress plugin contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions up to and including 1.0.4.
The Popping Sidebars and Widgets Light WordPress plugin contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions up to and including 1.27.
The AM Events WordPress plugin contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions up to and including 1.13.1.
Cross-Site Request Forgery (CSRF) vulnerability in Heateor Support Heateor Social Login heateor-social-login allows Cross Site Request Forgery.This issue affects Heateor Social Login: from n/a through <= 1.1.39.
Authorization Bypass Through User-Controlled Key vulnerability in AdvancedCoding wpDiscuz (up to 7.6.43) allows exploiting incorrectly configured access control security levels.
The My Sticky Elements WordPress plugin (Premio) up to and including version 2.3.3 has a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS