September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-1256 The YS LeadGen plugin for WordPress is vulnerable to authorization bypass and St... |
medium | 6.4 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-5410 The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
medium | 6.4 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-76579 The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site S... |
medium | 4.7 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-8354 The Gum Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-S... |
medium | 6.4 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-9289 The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sen... |
medium | 5.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-18346 The TikTok plugin for WordPress is vulnerable to authorization bypass in all ver... |
medium | 5.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-9232 The Easy Appointments plugin for WordPress is vulnerable to Sensitive Informatio... |
medium | 6.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-9615 The Flex Import plugin for WordPress is vulnerable to Missing Authorization in a... |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-9832 The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable... |
medium | 5.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-9855 The Custom Field Template plugin for WordPress is vulnerable to generic SQL Inje... |
medium | 6.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-4792 The Bread plugin for WordPress is vulnerable to information exposure in versions... |
medium | 5.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-5400 The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
medium | 6.4 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-6295 The WP Optimizer plugin for WordPress is vulnerable to SQL Injection via the 's'... |
medium | 4.9 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-75959 The GoPay for WooCommerce plugin for WordPress is vulnerable to generic SQL Inje... |
medium | 4.9 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-7527 The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vu... |
medium | 4.7 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-87917 The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflect... |
medium | 6.1 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-15947 The Metasync plugin for WordPress is vulnerable to unauthorized modification of... |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-1242 The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to... |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-1641 The Wow Elements Addons for Elementor plugin for WordPress is vulnerable to Serv... |
medium | 6.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-1984 The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unau... |
medium | 5.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-2278 The VW Writer Blog theme for WordPress is vulnerable to unauthorized modificatio... |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-2422 The WP Composer – The Easiest Page Builder plugin for WordPress is vulnerable to... |
medium | 6.4 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-13191 The Create plugin for WordPress is vulnerable to generic SQL Injection via the '... |
medium | 6.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-13200 The Create plugin for WordPress is vulnerable to generic SQL Injection via the '... |
medium | 6.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-13770 The AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iO... |
medium | 6.4 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-15098 The Real3D Flipbook Lite plugin for WordPress is vulnerable to Stored Cross-Site... |
medium | 6.4 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-15463 The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress i... |
medium | 6.1 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-15946 The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrat... |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-11899 The PDF Builder for WooCommerce. |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-12402 The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Store... |
medium | 4.4 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-11608 The WP Customer Reviews plugin for WordPress is vulnerable to Reflected Cross-Si... |
medium | 6.1 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-92421 The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin b... |
medium | 4.7 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-92425 The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin b... |
medium | 5.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-92430 The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plu... |
medium | 5.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-92435 The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that... |
medium | 5.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-91847 The Online Scheduling and Appointment Booking System WordPress plugin before 28.... |
medium | 4.8 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-92099 The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authori... |
medium | 6.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-16557 The Nimble Page Builder WordPress plugin through 3.3.8 does not perform an autho... |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-19860 The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.3... |
medium | 5.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-84750 The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not vali... |
medium | 6.5 | — | — | 2026-09-19 | 2026-09-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.