CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.09)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Create plugin (mediavine-create) by John-Michael L'Allier contains a vulnerability that exposes sensitive system information to an unauthorized control sphere. The issue affects versions from n/a through 2.6.0 and allows retrieval of embedded sensitive data.
Missing Authorization vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2.
The Photography plugin versions up to 7.7.6 contain an unauthenticated broken access control vulnerability. An attacker without authentication can bypass access control mechanisms.
The Event post plugin versions up to 6.0.1 contain an unauthenticated broken access control vulnerability. An attacker without authentication can bypass access control mechanisms.
The Content Control plugin versions up to 2.6.5 contain an unauthenticated broken access control vulnerability. An attacker without authentication can bypass access control mechanisms.
The Style Kits plugin versions up to 2.6.5 contain a contributor broken access control vulnerability. An attacker with contributor privileges can bypass access control mechanisms.
The HashThemes Demo Importer plugin versions up to 1.4.2 contain an author Cross Site Scripting (XSS) vulnerability. An attacker with author privileges can inject malicious script.
The LA-Studio Element Kit for Elementor plugin contains a DOM-Based XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions up to and including 1.6.3.
The TheGem theme by CodexThemes contains a DOM-Based XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions before 5.12.1.1.
The Reviewer plugin versions up to 3.14.2 contain a subscriber broken access control vulnerability. An attacker with subscriber privileges can bypass access control mechanisms.
The ListingPro plugin versions up to 2.9.10 contain a subscriber broken access control vulnerability. An attacker with subscriber privileges can bypass access control mechanisms.
The Civi plugin version 2.2.4 and earlier contains a broken access control vulnerability that can be exploited without authentication. An attacker can gain unauthorized access to functions or data.
The Modula Image Gallery plugin versions 2.14.25 through 2.14.30 are vulnerable to stored XSS attacks. An attacker can inject a malicious script that executes in other users' browsers.
The Ninja Tables plugin version 5.2.10 and earlier allows unauthenticated attackers to access sensitive data. The vulnerability is due to a lack of proper data protection against unauthorized reading.
The Virtue/Ascend/Pinnacle Toolkit plugin version 4.9.12 and earlier is vulnerable to XSS attacks from a contributor role. A user with contributor privileges can inject a malicious script.
The Kit (formerly ConvertKit) plugin version 3.3.5 and earlier contains a broken access control vulnerability that can be exploited without authentication. An attacker can gain unauthorized access to functions or data.
The Fluent Support plugin version 2.3.0 and earlier is vulnerable to XSS attacks from a contributor role. A user with contributor privileges can inject a malicious script.
The AWP Classifieds plugin version 4.4.7 and earlier contains a broken access control vulnerability that can be exploited without authentication. An attacker can gain unauthorized access to functions or data.
The JetBooking plugin version 4.1.2 and earlier contains a broken access control vulnerability that can be exploited without authentication. An attacker can gain unauthorized access to functions or data.
The JetEngine plugin version 3.8.11 and earlier is vulnerable to SSRF attacks from a contributor role. A user with contributor privileges can send requests to internal network resources.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS