Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-109193 | high | 7.2 | No | The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t... | 2026-10-16 |
| CVE-2026-109191 | medium | 4.3 | No | The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress is vulnerable to Sensitive Information Ex... | 2026-10-16 |
| CVE-2026-109207 | high | 7.2 | No | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Store... | 2026-10-16 |
| CVE-2026-108497 | critical | 9.3 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL In... | 2026-10-16 |
| CVE-2026-107918 | medium | 4.5 | No | Insufficient input validation vulnerability in the LAN Setup feature of NETGEAR R7300 router allows authenticated administrators connected t... | 2026-10-16 |
| CVE-2026-107917 | medium | 4.5 | No | Insufficient input validation vulnerability in the PPPoE Setup feature of NETGEAR R7300 router allows authenticated administrators connected... | 2026-10-16 |
| CVE-2026-107648 | high | 7.2 | No | The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action (also funct... | 2026-10-16 |
| CVE-2026-107649 | medium | 5.4 | No | The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'event[location_name]' parameter in all versi... | 2026-10-16 |
| CVE-2026-107770 | medium | 6.8 | No | The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and includi... | 2026-10-16 |
| CVE-2026-107768 | high | 7.2 | No | The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via... | 2026-10-16 |
| CVE-2026-107646 | medium | 5.3 | No | The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information Exposure in all version... | 2026-10-16 |
| CVE-2026-107764 | high | 7.2 | No | The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url (comment_author_url)' parameter... | 2026-10-16 |
| CVE-2026-107748 | medium | 6.4 | No | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored... | 2026-10-16 |
| CVE-2026-107758 | high | 7.2 | No | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to... | 2026-10-16 |
| CVE-2026-105974 | medium | 4.3 | No | The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data i... | 2026-10-16 |
| CVE-2026-105973 | medium | 4.3 | No | The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing an... | 2026-10-16 |
| CVE-2026-106604 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Compare yith-woo... | 2026-10-16 |
| CVE-2026-107350 | high | 8.8 | No | Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to... | 2026-10-16 |
| CVE-2026-104726 | medium | 6.4 | No | The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dir' Shortcode Attribute in all versions up to, an... | 2026-10-16 |
| CVE-2026-104003 | medium | 5.4 | No | The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.17... | 2026-10-16 |