Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-97315 | medium | 5.4 | No | The Responsive Blocks WordPress plugin before 2.3.0 does not sanitise or escape some of the values submitted with its Form block before addi... | 2026-10-14 |
| CVE-2026-88998 | medium | 5.3 | No | The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming payment notifications, and the validated sig... | 2026-10-14 |
| CVE-2026-82844 | medium | 5.3 | No | The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on f... | 2026-10-14 |
| CVE-2026-103308 | medium | 6.5 | No | The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the authenticity of payment gateway return requests, relying on... | 2026-10-14 |
| CVE-2026-101301 | medium | 5.3 | No | The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen before entering its snip... | 2026-10-14 |
| CVE-2026-96904 | medium | 5.3 | No | The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when a payment transaction... | 2026-10-14 |
| CVE-2026-96900 | medium | 5.3 | No | The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does not verify ownership of the email address used to select an... | 2026-10-14 |
| CVE-2026-94360 | medium | 5.3 | No | The Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not verify the authenticity of an inbound payment notification bef... | 2026-10-14 |
| CVE-2026-94261 | medium | 5.3 | No | The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier belongs to the order it is confirming, no... | 2026-10-14 |
| CVE-2026-94260 | medium | 5.3 | No | The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order being updated when it handles a p... | 2026-10-14 |
| CVE-2026-88927 | medium | 4.3 | No | The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.14 does not verify that a user owns or may write to the album... | 2026-10-14 |
| CVE-2026-87974 | medium | 5.3 | No | The Asaas Gateway for WooCommerce WordPress plugin before 2.7.8 does not properly authenticate its payment webhook, accepting an empty acces... | 2026-10-14 |
| CVE-2026-87968 | medium | 5.3 | No | The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2 does not... | 2026-10-14 |
| CVE-2026-87843 | medium | 6.5 | No | The Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does not verify the authenticity of the payment provider's response... | 2026-10-14 |
| CVE-2026-86799 | high | 8.8 | No | The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outputting them on the fo... | 2026-10-14 |
| CVE-2026-86797 | medium | 6.8 | No | The Pricing Table WordPress plugin before 2.1.5 does not validate the scheme of a user-supplied link value in one of its blocks before rende... | 2026-10-14 |
| CVE-2026-86787 | high | 7.2 | No | The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled t... | 2026-10-14 |
| CVE-2026-85345 | medium | 4.1 | No | The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied URL before performing a server... | 2026-10-14 |
| CVE-2026-85000 | medium | 5.3 | No | The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthenticated request that triggers a se... | 2026-10-14 |
| CVE-2026-108069 | medium | 5.3 | No | The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access a restricted gallery before ac... | 2026-10-14 |