October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-118169 The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPre... |
medium | 4.9 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-2839 The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to unaut... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-76005 The WP Inventory Manager plugin for WordPress is vulnerable to time-based SQL In... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-76058 The PayPal Brasil para WooCommerce plugin for WordPress is vulnerable to authori... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-111372 The AI ChatBot for WooCommerce – WoowBot plugin for WordPress is vulnerable to a... |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116609 The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116610 The Clean Login plugin for WordPress is vulnerable to Missing Authorization in v... |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-116749 The VikRentCar Car Rental Management System plugin for WordPress is vulnerable t... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116750 The VikRentCar Car Rental Management System plugin for WordPress is vulnerable t... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116761 The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t... |
medium | 5.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-110071 The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-110185 The Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Goo... |
medium | 5.9 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-111068 The DesignSetGo plugin for WordPress is vulnerable to Stored Cross-Site Scriptin... |
medium | 4.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-111213 The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPres... |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-109972 The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywa... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-109975 The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks,... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-109978 The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks,... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-109979 The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive... |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-109980 The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive... |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-109988 The Product Addons for Woocommerce – Product Options with Custom Fields plugin f... |
medium | 4.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-110020 The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to autho... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-109370 The Document Embedder – let visitors read files without downloading plugin for W... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-109385 The UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and B... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-109590 The Tour Booking Manager plugin for WordPress is vulnerable to Stored Cross-Site... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-103370 The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress i... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-103996 The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-104729 The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Si... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-104740 The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-104743 The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all ve... |
medium | 4.9 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-107710 The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPre... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-108366 The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hi... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-100175 The Postie plugin for WordPress is vulnerable to Stored Cross-Site Scripting via... |
medium | 5.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-113486 The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-113487 The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or e... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-113488 The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-113813 The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not pe... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-115224 The Customer Engagement System WordPress plugin before 2.0.2 does not safely bui... |
medium | 4.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-115225 The Customer Engagement System WordPress plugin before 2.0.2 does not restrict a... |
medium | 5.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-115255 The WP Roster WordPress plugin before 2.35 does not perform any capability or no... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-115281 The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.