Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-110017 | medium | 6.4 | No | The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form' parameter... | 2026-10-16 |
| CVE-2026-109930 | medium | 5.3 | No | The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a credential value shipped verbati... | 2026-10-16 |
| CVE-2026-110014 | medium | 5.3 | No | The Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creating a booking and trusts a caller... | 2026-10-16 |
| CVE-2026-110013 | medium | 4.8 | No | The Salon Booking System WordPress plugin before 10.31.9 does not generate its booking-API access tokens from a secure random source, instea... | 2026-10-16 |
| CVE-2026-110012 | medium | 4.3 | No | The Salon Booking System WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to users with the appropri... | 2026-10-16 |
| CVE-2026-109982 | medium | 4.2 | No | The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2 does not perform a capability check or validate a nonce on its m... | 2026-10-16 |
| CVE-2026-109998 | high | 7.2 | No | The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and incl... | 2026-10-16 |
| CVE-2026-109990 | high | 7.2 | No | The Flying Scripts: Delay JavaScript to Improve Site Speed & Performance plugin for WordPress is vulnerable to Stored Cross-Site Scripting v... | 2026-10-16 |
| CVE-2026-109693 | high | 8.8 | No | Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Flue... | 2026-10-16 |
| CVE-2026-109685 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Whisper INC Link Whisper Free lin... | 2026-10-16 |
| CVE-2026-109401 | low | 2.7 | No | The WP Mail Logging plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.17.0 via th... | 2026-10-16 |
| CVE-2026-109388 | medium | 6.4 | No | The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t... | 2026-10-16 |
| CVE-2026-109382 | medium | 6.5 | No | The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.9... | 2026-10-16 |
| CVE-2026-109513 | high | 7.2 | No | The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification... | 2026-10-16 |
| CVE-2026-109447 | high | 8.1 | No | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privile... | 2026-10-16 |
| CVE-2026-109414 | medium | 6.5 | No | The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'src_by[].val.start / sr... | 2026-10-16 |
| CVE-2026-109232 | high | 7.2 | No | The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Script... | 2026-10-16 |
| CVE-2026-109515 | critical | 9.8 | No | The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege E... | 2026-10-16 |
| CVE-2026-109512 | medium | 6.4 | No | The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and incl... | 2026-10-16 |
| CVE-2026-109224 | high | 7.2 | No | The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPre... | 2026-10-16 |