CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.09)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The TemplateSpare plugin for WordPress up to version 4.2.2 contains a Broken Access Control vulnerability exploitable by Subscribers.
Missing authorization vulnerability in Iqonic Designs Graphina – Charts and Graphs For Elementor allows exploiting incorrectly configured access control security levels. This issue affects Graphina – Charts and Graphs For Elementor: from n/a through 3.1.12.
The BSK PDF Manager plugin versions up to 3.8 contain a Cross Site Scripting (XSS) vulnerability exploitable by contributors. A contributor can inject malicious JavaScript code.
The LIQUID SPEECH BALLOON plugin versions up to 1.2.5 contain a Cross Site Scripting (XSS) vulnerability exploitable by contributors. A contributor can inject malicious script.
The Civi Framework versions up to 2.2.0 contain an unauthenticated broken access control vulnerability. An attacker without authentication can gain unauthorized access to administrative functions.
The Avada Custom Branding plugin versions up to 1.2 contain a broken access control vulnerability exploitable by contributors. A contributor can gain unauthorized access to administrative functions.
The Manual - Documentation, Knowledge Base & Education WordPress Theme versions up to 7.5.4 contain a Cross Site Scripting (XSS) vulnerability exploitable by contributors. A contributor can inject malicious JavaScript code.
The WP Social Ninja plugin versions up to 4.3.0 contain an unauthenticated sensitive data exposure vulnerability. An attacker without authentication can access confidential information.
The Photo Gallery plugin versions up to 2.7.7.29 contain a Cross Site Scripting (XSS) vulnerability exploitable by authors. An author can inject malicious JavaScript code.
The Accept Donations with PayPal & Stripe plugin versions up to 1.5.5 contain a Cross Site Scripting (XSS) vulnerability exploitable by contributors. A contributor can inject malicious JavaScript code.
The Appointment Hour Booking plugin versions up to 1.5.86 contain a Cross Site Scripting (XSS) vulnerability exploitable by contributors. A contributor can inject malicious JavaScript code.
A CSRF vulnerability in Melapress WP Activity Log and Melapress WP Activity Log Premium (up to version 5.6.4) allows an attacker to perform unauthorized actions in the context of a logged-in user.
The MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin versions 5.12 and earlier have an unauthenticated broken access control vulnerability. Unauthenticated users can gain unauthorized access to functions or data.
The Ultimate Store Kit Elementor Addons plugin versions 3.0.5 and earlier are vulnerable to unauthenticated sensitive data exposure. Unauthenticated attackers can access confidential information.
The Ultimate Store Kit Elementor Addons plugin versions 3.0.5 and earlier have a Cross-Site Scripting (XSS) vulnerability exploitable by a contributor. A user with contributor role can inject malicious script.
The Shiptastic for WooCommerce plugin versions 5.1.0 and earlier are vulnerable to unauthenticated Insecure Direct Object References (IDOR). Unauthenticated attackers can access objects they should not have access to.
The PeproDev Ultimate Invoice plugin versions 2.2.6 and earlier have an unauthenticated broken access control vulnerability. Unauthenticated users can gain unauthorized access to functions or data.
The Complianz plugin versions 7.5.0 and earlier are vulnerable to unauthenticated sensitive data exposure. Unauthenticated attackers can access confidential information.
The Complianz plugin versions 7.5.0 and earlier have a Server-Side Request Forgery (SSRF) vulnerability exploitable by an author. A user with author role can force the server to send requests to internal resources.
The Query Wrangler plugin versions 1.5.57 and earlier have a broken access control vulnerability exploitable by a subscriber. A user with subscriber role can gain unauthorized access to functions or data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS