CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.09)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The YayPricing plugin up to version 3.5.6 has a Broken Access Control vulnerability exploitable by a subscriber. This allows unauthorized access to functions or data.
The Exclusive Addons Elementor plugin up to version 2.8.0 exposes sensitive data to unauthenticated users (Unauthenticated Sensitive Data Exposure).
The Feedzy plugin up to version 5.2.4 contains a Server Side Request Forgery (SSRF) vulnerability exploitable by a contributor. This allows sending requests from the server to internal resources.
The Photonic Gallery & Lightbox plugin up to version 3.33 contains a Cross Site Scripting (XSS) vulnerability exploitable by a contributor. This allows injection of malicious scripts.
The Location Weather plugin up to version 3.0.6 contains a Cross Site Scripting (XSS) vulnerability exploitable by a contributor. This allows injection of malicious scripts.
The WP Google Review Slider plugin version 18.4 and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability without authentication. An attacker can trick an administrator into performing unwanted actions.
The Visual Composer Website Builder plugin version 45.15.0 and earlier has a broken access control vulnerability for users with the Contributor role. A low-privileged user can gain unauthorized access to functions.
The Event Tickets plugin version 5.29.0.1 and earlier has a broken access control vulnerability without authentication. An unauthenticated attacker can access functions intended for authorized users.
The MapPress Maps for WordPress plugin version 2.97.6 and earlier exposes sensitive data without authentication. An unauthenticated attacker can access confidential information.
The Orbit Fox by ThemeIsle plugin version 3.0.7 and earlier contains a Cross-Site Scripting (XSS) vulnerability for users with the Author role. An Author can inject malicious scripts.
The BetterDocs plugin version 4.6.2 and earlier has a Cross-Site Scripting (XSS) vulnerability for users with the Contributor role. A Contributor can inject malicious JavaScript code.
The WordPress Social Login and Register plugin version 7.8.0 and earlier contains a Cross-Site Scripting (XSS) vulnerability for users with the Contributor role. A Contributor can inject malicious scripts.
The AffiliateX plugin version 2.3.5 and earlier has a Server-Side Request Forgery (SSRF) vulnerability without authentication. An unauthenticated attacker can send requests to internal resources.
The Abandoned Cart Lite for WooCommerce plugin version 6.8.0 and earlier contains a Cross-Site Scripting (XSS) vulnerability for users with the Shop Manager role. A Shop Manager can inject malicious scripts.
The Kirki plugin version 6.0.13 and earlier has an arbitrary file deletion vulnerability for users with the Editor role. An Editor can delete any file on the server.
The Thrive Leads plugin version 10.9.2 and earlier contains an unauthenticated broken access control vulnerability. An attacker without authentication can gain unauthorized access to functions or data.
The ЮKassa for WooCommerce plugin version 2.16.1 and earlier allows Subscriber-level users to access sensitive data. The vulnerability involves unauthorized data exposure.
The RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin version 1.5.1 and earlier contains a broken access control vulnerability exploitable by Subscriber-level users. An attacker can gain unauthorized access to functions.
The FundEngine plugin version 1.7.8 and earlier contains a broken access control vulnerability exploitable by Subscriber-level users. An attacker can gain unauthorized access to functions or data.
The RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin version 1.5.1 and earlier contains a Cross Site Scripting (XSS) vulnerability exploitable by Subscriber-level users. An attacker can inject malicious scripts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS