September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-92421 The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin b... |
medium | 4.7 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-92425 The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin b... |
medium | 5.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-92430 The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plu... |
medium | 5.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-92435 The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that... |
medium | 5.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-14844 The Master Slider WordPress plugin through 3.11.2 does not sanitise and escape s... |
medium | 6.8 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-16542 The Import and export users and customers WordPress plugin before 2.4.5 does not... |
medium | 4.1 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-81653 The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not... |
medium | 4.2 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-84223 The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files whi... |
medium | 6.8 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-87068 The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role va... |
medium | 6.6 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-87840 The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or own... |
medium | 5.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-92410 The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the... |
medium | 4.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-92422 The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user... |
medium | 6.5 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-77820 The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
medium | 6.4 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-12042 The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Si... |
medium | 4.4 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-15660 The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in v... |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-15760 The Divi Essential plugin for WordPress is vulnerable to sensitive information e... |
medium | 6.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-88944 The Tutor LMS – eLearning and online course solution plugin for WordPress is vul... |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-89081 The Tutor LMS – eLearning and online course solution plugin for WordPress is vul... |
medium | 6.1 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-89093 The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots pl... |
medium | 5.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-89333 The Tutor LMS – eLearning and online course solution plugin for WordPress is vul... |
medium | 6.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-89334 The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots pl... |
medium | 6.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-92967 The Pochipp plugin for WordPress is vulnerable to Reflected Cross-Site Scripting... |
medium | 6.1 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-11608 The WP Customer Reviews plugin for WordPress is vulnerable to Reflected Cross-Si... |
medium | 6.1 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-11899 The PDF Builder for WooCommerce. |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-12402 The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Store... |
medium | 4.4 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-13191 The Create plugin for WordPress is vulnerable to generic SQL Injection via the '... |
medium | 6.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-13200 The Create plugin for WordPress is vulnerable to generic SQL Injection via the '... |
medium | 6.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-13770 The AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iO... |
medium | 6.4 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-15098 The Real3D Flipbook Lite plugin for WordPress is vulnerable to Stored Cross-Site... |
medium | 6.4 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-15463 The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress i... |
medium | 6.1 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-15946 The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrat... |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-15947 The Metasync plugin for WordPress is vulnerable to unauthorized modification of... |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-1242 The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to... |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-1641 The Wow Elements Addons for Elementor plugin for WordPress is vulnerable to Serv... |
medium | 6.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-1984 The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unau... |
medium | 5.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-2278 The VW Writer Blog theme for WordPress is vulnerable to unauthorized modificatio... |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-2422 The WP Composer – The Easiest Page Builder plugin for WordPress is vulnerable to... |
medium | 6.4 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-4792 The Bread plugin for WordPress is vulnerable to information exposure in versions... |
medium | 5.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-5400 The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
medium | 6.4 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-6295 The WP Optimizer plugin for WordPress is vulnerable to SQL Injection via the 's'... |
medium | 4.9 | — | — | 2026-09-19 | 2026-09-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.