CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The wpDiscuz plugin up to version 7.6.33 has a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects the plugin's authorization mechanism.
The Media Library Assistant WordPress plugin contains a Stored XSS vulnerability due to improper input neutralization during web page generation. This allows persistent injection of malicious scripts.
The Soledad theme (up to version 8.6.8) contains a DOM-Based XSS vulnerability due to improper input neutralization during web page generation. An attacker can exploit this to execute scripts in the victim's browser.
The Penci Shortcodes & Performance plugin (versions below 6.1) contains a DOM-Based XSS vulnerability due to improper input neutralization. An attacker can exploit this to execute scripts in the victim's browser.
The Penci Portfolio plugin (up to version 3.5) contains a DOM-Based XSS vulnerability due to improper input neutralization. An attacker can exploit this to execute scripts in the victim's browser.
The Penci Recipe plugin (up to version 4.0) contains a DOM-Based XSS vulnerability due to improper input neutralization. An attacker can exploit this to execute scripts in the victim's browser.
The Penci Podcast plugin (up to version 1.6) contains a DOM-Based XSS vulnerability due to improper input neutralization. An attacker can exploit this to execute scripts in the victim's browser.
The Penci Filter Everything plugin (versions below 1.7) contains a DOM-Based XSS vulnerability due to improper input neutralization. An attacker can exploit this to execute scripts in the victim's browser.
The WordPress plugin Ajax Load More (versions up to and including 7.6.0.2) contains an Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability. This may allow retrieval of embedded sensitive data.
The Ibtana plugin for WordPress has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 1.2.5.3.
The MasterStudy LMS WordPress plugin contains a Race Condition vulnerability caused by concurrent execution using a shared resource with improper synchronization. The issue affects versions up to and including 3.6.20.
The MasterStudy LMS plugin up to version 3.6.20 contains a Missing Authorization vulnerability. This allows exploiting incorrectly configured access control security levels.
The WP Travel Engine plugin for WordPress is vulnerable to stored XSS due to improper neutralization of input during web page generation. This issue affects versions up to and including 1.4.2.
The Cozy Blocks plugin for CozyThemes has a basic XSS vulnerability due to improper neutralization of script-related HTML tags. This affects versions up to and including 2.1.29.
The CubeWP plugin up to version 1.1.26 is vulnerable to Stored XSS due to improper input neutralization during web page generation. This allows injection of malicious scripts that execute in the user's browser.
The Zoho Flow WordPress plugin is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to and including 2.14.1. This may allow an attacker to force unintended actions on behalf of an authenticated user.
The Coupon Affiliates plugin up to version 6.8.0 contains a Missing Authorization vulnerability. This allows exploiting incorrectly configured access control security levels.
The Upsell Order Bump Offer for WooCommerce plugin contains a Stored Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The issue affects versions up to and including 3.0.7.
The Academy LMS plugin by Kodezen LLC contains an authorization bypass through a user-controlled key, allowing exploitation of incorrectly configured access control security levels. This affects Academy LMS versions up to and including 3.3.4.
Missing Authorization vulnerability in Smart Blocks (versions up to 2.4) allows exploiting incorrectly configured access control security levels.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS