Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-84252 | critical | 9.8 | No | The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST... | 2026-10-13 |
| CVE-2026-84251 | critical | 9.8 | No | The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating options via a... | 2026-10-13 |
| CVE-2026-81649 | critical | 9.1 | No | The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying ins... | 2026-10-13 |
| CVE-2026-81420 | high | 8.6 | No | The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its unauth... | 2026-10-13 |
| CVE-2026-81156 | medium | 6.8 | No | The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its gallery settings before outputting them on the galle... | 2026-10-13 |
| CVE-2026-81155 | medium | 6.8 | No | The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape a gallery setting before outputting it on a frontend page, allow... | 2026-10-13 |
| CVE-2026-81154 | medium | 6.8 | No | The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape image alt text before outputting it in one of its gallery layout... | 2026-10-13 |
| CVE-2026-81153 | medium | 6.8 | No | The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its image settings before outputting them in a gallery p... | 2026-10-13 |
| CVE-2026-14854 | high | 7.5 | No | The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of it... | 2026-10-13 |
| CVE-2026-12980 | medium | 6.8 | No | The Post Snippets WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets before outputting them,... | 2026-10-13 |
| CVE-2026-107694 | low | 2.7 | No | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.2.0 does not verify that the vendor a commissio... | 2026-10-13 |
| CVE-2026-107507 | low | 2.7 | No | The Squadeno WordPress plugin before 1.12.0 does not enforce its restrictions on every way a sport can be saved, allowing users with the low... | 2026-10-13 |
| CVE-2026-106029 | high | 7.5 | No | The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages and m... | 2026-10-13 |
| CVE-2026-104684 | low | 2.7 | No | The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user is authorized to read a gallery before rendering it, allowing... | 2026-10-13 |
| CVE-2026-104682 | low | 2.7 | No | The Envira Gallery WordPress plugin before 1.16.2 does not correctly check authorization on its gallery-conversion feature, verifying that t... | 2026-10-13 |
| CVE-2026-104681 | low | 2.7 | No | The Envira Gallery WordPress plugin before 1.16.2 does not verify that an image identifier added to a gallery refers to a media attachment t... | 2026-10-13 |
| CVE-2026-104680 | high | 7.2 | No | The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user holds the capability WordPress reserves for installing Envira... | 2026-10-13 |
| CVE-2026-104028 | critical | 9.8 | No | The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verification, or file-type validation befor... | 2026-10-13 |
| CVE-2026-103695 | high | 8.6 | No | The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unau... | 2026-10-13 |
| CVE-2026-103694 | high | 8.8 | No | The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in user can update through one of... | 2026-10-13 |