October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,675
Critical
3,172
High
7,258
Medium
7,101
Low
646
Severity not reported
4,498
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-111405 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111409 Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for Woo... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-97470 The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for W... |
medium | 6.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-96449 Missing Authorization vulnerability in WPExperts WP EasyPay wp-easy-pay allows E... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-96562 The The Broken Link Checker plugin for WordPress is vulnerable to arbitrary shor... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-96870 The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vul... |
medium | 6.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-93535 The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for Word... |
medium | 6.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-93681 The Tutor LMS – eLearning and online course solution plugin for WordPress is vul... |
medium | 6.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-91833 The WX Subscribe 微信支付付费订阅 WordPress plugin through 1.2.1 does not saniti... |
medium | 6.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-92427 The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restri... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-91830 The Subscribe to Comments WordPress plugin before 2.3.3 does not sign or validat... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-89280 The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-88963 The Tutor LMS – eLearning and online course solution plugin for WordPress is vul... |
medium | 6.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-74923 The Document Gallery WordPress plugin through 5.1.1 does not perform any capabil... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-15222 The The User Registration & Membership – Free & Paid Memberships, Subscriptions,... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-19798 The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111344 APITable through 1.14.0-beta contains an authorization bypass vulnerability that... |
medium | 4.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111363 BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnera... |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111106 The Mail Mint plugin for WordPress is vulnerable to SQL Injection via the 'filte... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111178 The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to g... |
medium | 4.9 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110891 Missing Authorization vulnerability in WordLift Srl WordLift wordlift allows Exp... |
medium | 5.4 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111069 The GeoDirectory – WP Business Directory Plugin and Classified Listings Director... |
medium | 6.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110360 Missing Authorization vulnerability in WPdreams Ajax Search Lite ajax-search-lit... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-110362 Missing Authorization vulnerability in Planet studio PlanetStudio Payment Gatewa... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-110721 The NotificationX plugin for WordPress is vulnerable to Missing Authorization le... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110664 The Premium Packages – Sell Digital Products Securely plugin for WordPress is vu... |
medium | 6.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110252 The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cros... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110290 The WebberZone Top 10 — Popular Posts plugin for WordPress is vulnerable to Stor... |
medium | 6.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110017 The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnera... |
medium | 6.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110179 The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-sup... |
medium | 6.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110029 The Squeeze WordPress plugin before 1.8.1 does not perform a capability check on... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109982 The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2 does... |
medium | 4.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110012 The Salon Booking System WordPress plugin before 10.31.3 does not restrict sever... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110013 The Salon Booking System WordPress plugin before 10.31.9 does not generate its b... |
medium | 4.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110014 The Salon Booking System WordPress plugin before 10.31.9 does not properly check... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109930 The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109512 The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
medium | 6.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109414 The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulner... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109382 The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109388 The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for... |
medium | 6.4 | — | — | 2026-10-16 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.