CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Events Calendar plugin in versions up to and including 6.17.5 contains a Broken Access Control vulnerability exploitable by a user with Contributor privileges. This allows bypassing access control mechanisms.
The Review Schema plugin in versions up to and including 3.1.0 contains an Insecure Direct Object References (IDOR) vulnerability accessible without authentication. An unauthenticated attacker can access objects they should not have access to.
The Polylang plugin in versions up to and including 3.8.9 contains a Cross Site Scripting (XSS) vulnerability exploitable by a user with Contributor privileges. This enables injection of a malicious script into the site.
Cross Site Scripting (XSS) vulnerability in CMB2 versions up to 2.13.0, exploitable by a subscriber.
Broken Access Control vulnerability in Prevent files / folders access versions up to 2.6.7, exploitable by a subscriber.
Cross Site Scripting (XSS) vulnerability in Virtue/Ascend/Pinnacle Toolkit versions up to 4.9.12.1, exploitable by a contributor.
Cross Site Scripting (XSS) vulnerability in Visual Composer Website Builder versions up to 45.16.2, exploitable by a contributor.
Unauthenticated Sensitive Data Exposure vulnerability in Notivo versions up to 1.4.2.
Unauthenticated Bypass Vulnerability in Paid Member Subscriptions versions up to 3.0.9.
Unauthenticated Broken Access Control vulnerability in Blocksy Companion versions up to 2.1.55.
The ShortPixel Image Optimizer plugin through 6.5.5 contains a deserialization of untrusted data vulnerability allowing object injection. This may lead to unauthorized actions within the WordPress application context.
Broken Access Control vulnerability in AllAble Connector versions up to 0.13.4, exploitable by a subscriber.
Arbitrary File Deletion vulnerability in WEBO MCP versions up to 3.0.18, exploitable by an author.
Broken Access Control vulnerability in MCP Content Manager Lite up to version 1.1.0. A subscriber can gain unauthorized access to administrative functions.
Cross Site Scripting (XSS) vulnerability in JetEngine up to version 3.8.14.3. A subscriber can inject malicious scripts.
Cross Site Scripting (XSS) vulnerability in ThemeREX Addons before version 2.45.0. A subscriber can inject malicious scripts.
Insecure Direct Object References (IDOR) vulnerability in Webba Booking up to version 6.5.0. A subscriber can access objects without authorization.
Insecure Direct Object References (IDOR) vulnerability in Client Invoicing by Sprout Invoices up to version 20.8.17. An unauthenticated user can access objects without logging in.
Insecure Direct Object References (IDOR) vulnerability in Newsletters, Email Marketing, SMS and Popups by Omnisend up to version 1.9.0. A subscriber can access objects without authorization.
Cross Site Scripting (XSS) vulnerability in EWWW Image Optimizer up to version 8.7.7. A contributor can inject malicious scripts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS