Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-108064 | medium | 6.5 | No | The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers that drives its SSL ce... | 2026-10-14 |
| CVE-2026-107594 | critical | 10.0 | No | The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data... | 2026-10-14 |
| CVE-2026-107508 | high | 8.6 | No | The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing una... | 2026-10-14 |
| CVE-2026-107320 | medium | 5.3 | No | The GamiPress WordPress plugin before 8.0.6 does not properly authorize access to private activity log entries, allowing unauthenticated use... | 2026-10-14 |
| CVE-2026-107319 | medium | 4.3 | No | The GamiPress WordPress plugin before 8.0.6 does not perform a capability check or ownership verification on one of its authenticated AJAX a... | 2026-10-14 |
| CVE-2026-107178 | medium | 6.8 | No | The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration values before printin... | 2026-10-14 |
| CVE-2026-107160 | medium | 5.3 | No | The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or input sanitization before storing certain... | 2026-10-14 |
| CVE-2026-107158 | medium | 5.3 | No | The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or validation on one of its REST routes that... | 2026-10-14 |
| CVE-2026-107126 | high | 8.8 | No | The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and... | 2026-10-14 |
| CVE-2026-106646 | medium | 5.9 | No | The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target listing when a gallery r... | 2026-10-14 |
| CVE-2026-106166 | medium | 5.3 | No | The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating store... | 2026-10-14 |
| CVE-2026-106099 | medium | 5.3 | No | The WP Data Access WordPress plugin before 5.5.84 does not restrict its database table export action to authorized users, gating it only wit... | 2026-10-14 |
| CVE-2026-106098 | medium | 5.3 | No | The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifying... | 2026-10-14 |
| CVE-2026-105975 | medium | 5.3 | No | The CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify the authenticity of Mobile Money payment confirmations and... | 2026-10-14 |
| CVE-2026-105969 | medium | 5.3 | No | The CodeAtoZ B2B Suite for WooCommerce WordPress plugin before 1.6.1 does not properly restrict access to guest-submitted quotes, allowing u... | 2026-10-14 |
| CVE-2026-105261 | medium | 6.8 | No | The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin before 4.10.... | 2026-10-14 |
| CVE-2026-104751 | medium | 5.3 | No | The Rank Math SEO WordPress plugin before 1.0.280 does not perform a capability or nonce check before clearing its stored SEO analysis data,... | 2026-10-14 |
| CVE-2026-104644 | medium | 6.8 | No | The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.15 does not sanitize or escape gallery configuration values before echo... | 2026-10-14 |
| CVE-2026-103307 | high | 8.6 | No | The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it... | 2026-10-14 |
| CVE-2025-69264 | critical | 9.8 | No | pnpm is a package manager. Versions 10.0.0 through 10.25 allow git-hosted dependencies to execute arbitrary code during pnpm install, circum... | 2026-10-14 |