CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.09)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
WP EasyPay plugin version 4.5.0 and earlier allows a subscriber to arbitrarily delete content. A subscriber can delete any data in the system.
Knit Pay plugin version 9.6.0.0 and earlier has a broken access control vulnerability without authentication. An unauthenticated attacker can gain unauthorized access.
Broadcast Live Video plugin version 7.2.4 and earlier allows an unauthenticated attacker to arbitrarily delete files. The attacker can delete critical system files.
Sunshine Photo Cart plugin version 3.6.10.1 and earlier allows a subscriber to break access control. A subscriber can gain unauthorized privileges.
Autopay dla WooCommerce plugin version 2.2.27 and earlier has a broken access control vulnerability without authentication. An unauthenticated attacker can gain unauthorized access.
WishList Member X plugin version 3.32.0 and earlier is vulnerable to Cross Site Scripting (XSS) from a subscriber level. A subscriber can inject malicious script.
Funnel Kit Funnel Builder PRO plugin version 3.15.0.4 and earlier is vulnerable to Cross Site Scripting (XSS) from a customer level. A customer can inject malicious script.
The Participants Database plugin for WordPress versions 2.7.8.4 and earlier contains a broken access control vulnerability exploitable by a Subscriber-level user.
Missing Authorization vulnerability in bPlugins YT Player yt-player allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YT Player from n/a through 2.1.2.
The WP Fast Total Search plugin for WordPress versions 1.81.282 and earlier contains a broken access control vulnerability exploitable by an unauthenticated attacker.
The Hubbub Lite plugin for WordPress (versions up to 1.36.3) contains a stored XSS vulnerability due to improper input neutralization during page generation. An attacker can inject malicious scripts that execute in other users' browsers.
The MarketKing plugin for WordPress versions 2.1.40 and earlier contains a broken access control vulnerability exploitable by an unauthenticated attacker.
The uListing plugin for WordPress versions 2.2.0 and earlier contains a broken access control vulnerability exploitable by a Contributor-level user.
The uListing plugin for WordPress versions 2.2.0 and earlier contains a broken access control vulnerability exploitable by a Subscriber-level user.
The QuickCal - Appointment Booking Calendar plugin for WordPress versions 1.0.16 and earlier contains a broken access control vulnerability exploitable by a Booking Agent user.
The PeproDev Ultimate Invoice plugin for WordPress versions 2.2.6 and earlier contains an unauthenticated sensitive data exposure vulnerability.
The Ditty plugin for WordPress versions 3.1.66 and earlier contains a broken access control vulnerability exploitable by an unauthenticated attacker.
The WP Go Maps plugin for WordPress versions 10.1.04 and earlier contains a broken access control vulnerability exploitable by an unauthenticated attacker.
The eRoom plugin versions up to 1.7.1 contain a broken access control vulnerability, allowing subscribers unauthorized access to functions reserved for higher roles.
The Mediavine Control Panel plugin versions up to 2.10.10 contain a broken access control vulnerability, allowing contributors unauthorized access to functions intended for higher roles.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS