CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.09)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The JetBooking plugin version 4.1.2 and earlier is vulnerable to SSRF attacks from a custom role. A user with a custom role can send requests to internal network resources.
The JetElements for Elementor plugin version 2.9.1.1 and earlier contains a Cross Site Scripting (XSS) vulnerability exploitable by a contributor. An attacker with contributor role can inject malicious JavaScript.
The GiveWP plugin version 4.16.3 and earlier is vulnerable to unauthenticated Cross Site Request Forgery (CSRF). An attacker can trick an administrator into performing unwanted actions.
The Masteriyo - LMS plugin version 2.3.1 and earlier contains an Insecure Direct Object References (IDOR) vulnerability exploitable by a subscriber. A subscriber can access other users' resources.
The Zarinpal Gateway plugin version 5.1.0 and earlier is vulnerable to unauthenticated Cross Site Request Forgery (CSRF). An attacker can trick an administrator into performing unwanted actions.
A vulnerability in Polylang and Polylang Pro (up to version 3.8.5) allows exposure of sensitive system information to unauthorized control spheres, enabling retrieval of embedded sensitive data.
The ЮKassa for WooCommerce plugin version 2.16.1 and earlier contains a Broken Access Control vulnerability exploitable by a subscriber. A subscriber can gain unauthorized access to administrative functions.
The Product Slider for WooCommerce plugin version 1.13.62 and earlier contains an Insecure Direct Object References (IDOR) vulnerability exploitable by a contributor. A contributor can access other users' sliders.
The Ebook Store plugin version 6.19 and earlier is vulnerable to unauthenticated Broken Access Control. An unauthenticated attacker can access administrative functions.
The Ebook Store plugin version 6.19 and earlier is vulnerable to unauthenticated Broken Access Control. An unauthenticated attacker can access administrative functions.
The MapSVG plugin version 8.14.0 and earlier contains a Cross Site Scripting (XSS) vulnerability exploitable by a contributor. An attacker with contributor role can inject malicious JavaScript.
In JetBrains IntelliJ IDEA before version 2026.2, HTML injection was possible in IDE notifications, allowing silent user activity tracking.
The Simple Link Directory Pro plugin versions 15.0.8 and earlier are vulnerable to unauthenticated Cross-Site Request Forgery (CSRF).
The ShopLentor Pro plugin versions 2.8.5 and earlier have a broken access control vulnerability exploitable by Subscriber-level users.
The ShopLentor Pro plugin versions 2.8.5 and earlier have an unauthenticated broken access control vulnerability.
The Easy Appointments plugin versions 3.12.27 and earlier are vulnerable to unauthenticated Insecure Direct Object References (IDOR).
The WooCommerce Product Stock Alert plugin by MultiVendorX versions 3.0.6 and earlier expose sensitive system information to unauthorized parties.
Easy Digital Downloads plugin version 3.6.7 and earlier contains a broken authentication vulnerability that does not require authentication. An attacker can gain unauthorized access to administrative functions.
WP ERP plugin version 1.17.5 and earlier allows subscribers to break access control. A subscriber can gain unauthorized privileges.
Masteriyo - LMS plugin version 2.3.0 and earlier is vulnerable to Cross Site Scripting (XSS) from a subscriber level. A subscriber can inject malicious script.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS