Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-108484 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Best Payments Plugin for... | 2026-10-15 |
| CVE-2026-108483 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hippooo Hippoo Mobile App for WooComme... | 2026-10-15 |
| CVE-2026-108480 | high | 8.2 | No | Missing Authorization vulnerability in Skydropx Skydropx skydropx allows Exploiting Incorrectly Configured Access Control Security Levels.Th... | 2026-10-15 |
| CVE-2026-108291 | critical | 9.8 | No | Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injection.This issue affects Affiliates: from... | 2026-10-15 |
| CVE-2026-110002 | critical | 9.8 | No | The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.5 via the (... | 2026-10-15 |
| CVE-2026-109898 | medium | 5.3 | No | Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control... | 2026-10-15 |
| CVE-2026-109896 | medium | 4.3 | No | Missing Authorization vulnerability in WP Chill Download Monitor integration for WooCommerce download-monitor-integration-for-woocommerce al... | 2026-10-15 |
| CVE-2026-108092 | medium | 4.3 | No | The Blog2Social – Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions... | 2026-10-15 |
| CVE-2026-108151 | medium | 5.3 | No | Improper Control of Generation of Code ('Code Injection') vulnerability in PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filter allows... | 2026-10-15 |
| CVE-2026-107870 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows... | 2026-10-15 |
| CVE-2026-107867 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetProductTables jet-produc... | 2026-10-15 |
| CVE-2026-107751 | high | 7.2 | No | The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_name' parameter in all versions up to, and in... | 2026-10-15 |
| CVE-2026-107631 | high | 7.2 | No | The Record of Consent Extension for Complianz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'uid' parameter in a... | 2026-10-15 |
| CVE-2026-107652 | medium | 5.3 | No | The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including... | 2026-10-15 |
| CVE-2026-107910 | high | 8.1 | No | An improper authentication vulnerability in the is_authenticated function (src/bolt/bolt_api.c) in FalkorDB before 4.20.0 allows a remote un... | 2026-10-15 |
| CVE-2026-104939 | high | 7.5 | No | Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may... | 2026-10-15 |
| CVE-2026-107425 | medium | 6.5 | No | Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation all... | 2026-10-15 |
| CVE-2026-107421 | high | 7.3 | No | Session Fixation vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Session Hijacking.Thi... | 2026-10-15 |
| CVE-2026-107417 | medium | 6.5 | No | Missing Authorization vulnerability in Muralidharan Ramasamy Push Notification for Post and BuddyPress push-notification-for-post-and-buddyp... | 2026-10-15 |
| CVE-2026-105874 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart all... | 2026-10-15 |