CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Sendle Shipping plugin for WordPress (official-sendle-shipping-method) has a Missing Authorization vulnerability that allows accessing functionality not properly constrained by ACLs. This issue affects Sendle Shipping from n/a through <= 6.02.
The Raychat WordPress plugin is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to and including 2.2.1. This may allow an attacker to force unintended actions on behalf of an authenticated user.
Stored Cross-site Scripting (XSS) vulnerability in Headline Analyzer (headline-analyzer) by CoSchedule. The issue is due to improper neutralization of input during web page generation. This affects versions from n/a through 1.3.7 inclusive.
BuddyForms (Themekraft plugin) up to version 2.10.2 contains a missing authorization vulnerability, allowing access to functionality not properly constrained by ACLs. Attackers can exploit this for unauthorized operations.
The WebinarPress plugin (wp-webinarsystem) contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through <= 1.33.28.
Stored Cross-site Scripting (XSS) vulnerability in Attesa Extra (attesa-extra) by CrestaProject. The issue is due to improper neutralization of input during web page generation. This affects versions from n/a through 1.4.7 inclusive.
The Link Whisper Free plugin by Spencer Haws has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 0.9.2.
Stored Cross-site Scripting (XSS) vulnerability in NextMove Lite (woo-thank-you-page-nextmove-lite) by XLPlugins. The issue is due to improper neutralization of input during web page generation. This affects versions from n/a through 2.23.0 inclusive.
Stored Cross-site Scripting (XSS) vulnerability in WP Last Modified Info (wp-last-modified-info) by Sayan Datta. The issue is due to improper neutralization of input during web page generation. This affects versions from n/a through 1.9.2 inclusive.
The DirectoryPress plugin (directorypress) is vulnerable to DOM-Based XSS due to improper neutralization of input during web page generation. This issue affects versions from n/a through <= 3.6.25.
The GoCache plugin for WordPress (versions up to and including 1.3.6) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthenticated or low-privileged user may perform actions they should not be allowed to.
Missing authorization in the Admin Management Xtended WordPress plugin. Incorrectly configured access control security levels allow exploitation.
The MDTF (wp-meta-data-filter-and-taxonomy-filter) plugin for WordPress in versions up to and including 1.3.6 contains a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This enables performing operations without the required privileges.
The Estatik plugin for WordPress (versions up to and including 4.3.1) is vulnerable to DOM-based Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This may allow execution of malicious script in the user's browser.
Cross-Site Request Forgery (CSRF) vulnerability in Clifton Griffin Simple Content Templates for Blog Posts & Pages simple-post-template allows Cross Site Request Forgery. This issue affects Simple Content Templates for Blog Posts & Pages: from n/a through <= 2.2.61.
The Revive Old Posts (tweet-old-post) plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 9.3.3.
The Welcart e-Commerce (usc-e-shop) plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 2.11.24.
The ChatBot (QuantumCloud) plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 7.7.3.
The H5P plugin (icc0rz) contains a Stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through <= 1.16.0.
Stored XSS vulnerability in the Activity Plus Reloaded for BuddyPress plugin. Lack of input neutralization during web page generation allows persistent injection of malicious scripts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS