Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-93681 | medium | 6.4 | No | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via display_name Para... | 2026-10-16 |
| CVE-2026-93953 | high | 8.0 | No | The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field (secon... | 2026-10-16 |
| CVE-2026-93535 | medium | 6.4 | No | The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '... | 2026-10-16 |
| CVE-2026-92766 | high | 7.5 | No | The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'src_by' parameter in... | 2026-10-16 |
| CVE-2026-92553 | high | 8.8 | No | The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to Arbitrary File Upload in all versions u... | 2026-10-16 |
| CVE-2026-92427 | medium | 5.3 | No | The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used to authenticate its payment gat... | 2026-10-16 |
| CVE-2026-92115 | high | 8.8 | No | The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.0... | 2026-10-16 |
| CVE-2026-91833 | medium | 6.8 | No | The WX Subscribe 微信支付付费订阅 WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL statement... | 2026-10-16 |
| CVE-2026-91830 | medium | 6.5 | No | The Subscribe to Comments WordPress plugin before 2.3.3 does not sign or validate a cookie it trusts to identify a commenter, allowing unaut... | 2026-10-16 |
| CVE-2026-87111 | high | 7.2 | No | The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to St... | 2026-10-16 |
| CVE-2026-75903 | high | 8.1 | No | The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.3 This is due to... | 2026-10-16 |
| CVE-2026-89051 | high | 7.2 | No | The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'replaceHead... | 2026-10-16 |
| CVE-2026-88963 | medium | 6.1 | No | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the 'redirect_... | 2026-10-16 |
| CVE-2026-85659 | high | 8.8 | No | The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43.... | 2026-10-16 |
| CVE-2026-89280 | medium | 4.3 | No | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to... | 2026-10-16 |
| CVE-2026-74923 | medium | 5.3 | No | The Document Gallery WordPress plugin through 5.1.1 does not perform any capability or ownership check when generating a gallery on demand,... | 2026-10-16 |
| CVE-2026-19798 | medium | 4.3 | No | The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_status... | 2026-10-16 |
| CVE-2026-15222 | medium | 5.4 | No | The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration... | 2026-10-16 |
| CVE-2026-111363 | medium | 6.5 | No | BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to rea... | 2026-10-16 |
| CVE-2026-111344 | medium | 4.3 | No | APITable through 1.14.0-beta contains an authorization bypass vulnerability that allows authenticated users to read node descriptions from o... | 2026-10-16 |