CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
The Order Sync with Zendesk for WooCommerce WordPress plugin before 2.2.3 does not perform any capability check on one of its REST API endpoints, and does not verify that the requester owns the account being queried, allowing unauthenticated attackers to retrieve the order history and purchase totals of any customer whose email address they know or can enumerate.
The ProSolution WP Client WordPress plugin before 2.0.9 does not perform capability checks on two administrative AJAX actions, and the nonce they rely on is published on its public frontend, allowing any authenticated user, such as a subscriber, to trigger an administrative data synchronisation and to clear the plugin's activity records.
The ProSolution WP Client WordPress plugin before 2.0.9 does not validate a user-supplied URL or check the requester's capability or nonce before making a server-side HTTP request. This allows any authenticated user, such as a subscriber, to make the site issue arbitrary requests to internal hosts and services, including requests with attacker-chosen method, headers, and body.
The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when processing a front-end upload. This allows any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the administrator. Exploitation requires the plugin's front-end user upload feature to be enabled, which is not the default.
The WPC Admin Columns WordPress plugin before 2.3.4 lacks authorization checks in one of its AJAX actions, allowing users with a role as low as subscriber to read arbitrary user, post, and term metadata, including data belonging to administrators.
The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on the REST route that stores its geolocation service license key. The route falls back to an authentication-only gate, allowing any authenticated user such as a subscriber to overwrite the stored key and disrupt geolocation-based consent banner targeting.
The User Access Manager WordPress plugin before 2.3.15 does not apply its access restrictions to REST API requests, allowing unauthenticated attackers to read the content of posts, pages and custom post types that have been restricted to specific user groups.
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone who is tricked into opening a crafted link to a page displaying one of its galleries.
The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied booking identifier in one of its unauthenticated cart actions, allowing unauthenticated attackers to disclose any customer's booking order details and their stored billing information, and to overwrite that customer's booking record with their own data.
The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page.
The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate. Any authenticated user such as a subscriber can update consent settings and, on sites connected to the vendor's paid plan, read stored visitor consent logs.
The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page. Users with a role as low as Contributor can store a payload that executes in the browser of a user who views the content and clicks the affected element.
The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions. Any authenticated users such as Subscribers can create crowdfunding campaign posts despite not being granted that permission.
The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details. Any authenticated users such as Subscribers can read the personal data of any WooCommerce order and enumerate every order in the store.
The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers. Any authenticated users such as Subscribers can alter other users' campaigns.
The KiviCare WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed. Authenticated patient-level users can read other patients' bills, invoices and appointment details.
The Eventin WordPress plugin before version 4.1.20 does not properly restrict access to individual order records, allowing users with contributor-level access and above to read other customers' order data including personal information by iterating order identifiers.
The Eventin WordPress plugin before version 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and above to read other customers' personal data such as names and email addresses.
The LearnPress WordPress plugin before version 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson content, allowing any authenticated user such as a subscriber to obtain material from paid courses they have not enrolled in.