October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,504
Critical
3,294
High
7,930
Medium
7,623
Low
739
Severity not reported
4,918
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-104021 The Fastcache by Host.it plugin for WordPress is vulnerable to Code Injection in... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104723 The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordP... |
high | 8.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104725 The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress... |
high | 8.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104766 The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress... |
high | 8.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104899 The GeoDirectory – WP Business Directory Plugin and Classified Listings Director... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-14335 The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plug... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93775 The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-96667 The Real Estate Manager – Property Listing and Agent Management plugin for WordP... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-96682 The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Script... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-107742 The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plu... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-12626 The Online Scheduling and Appointment Booking System – Bookly plugin for WordPre... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-95684 The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-96558 The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPres... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-96572 The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerabl... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-96840 The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Sto... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-101920 The Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104759 The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-96278 The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-96765 The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-107657 The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-89301 The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulner... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-77183 The FooSales – Point of Sale (POS) for WooCommerce plugin for WordPress is vulne... |
high | 8.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-92975 The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-100161 The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored D... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-100196 The LazyLoad Plugin – Lazy Load Images, Videos, and Iframes plugin for WordPress... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-94538 The WP File Download plugin for WordPress is vulnerable to authorization bypass... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-100147 The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-100178 The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Stored... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93746 The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93951 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-96662 The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-91136 The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versi... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-97263 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-97264 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-94160 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-78532 Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions. |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-78534 Unauthenticated Cross Site Scripting (XSS) in Educavo <= 3.4.2 versions. |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-106606 Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Affilia... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93949 Authentication Bypass Using an Alternate Path or Channel vulnerability in Omegat... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93950 Missing Authorization vulnerability in StylemixThemes Motors motors allows Explo... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.