Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-4791 | medium | 6.4 | No | The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `logout-url` shortcode's '... | 2026-10-13 |
| CVE-2026-107657 | high | 7.2 | No | The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t... | 2026-10-13 |
| CVE-2026-104722 | medium | 4.9 | No | The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to arbitrary file deletion due t... | 2026-10-13 |
| CVE-2026-97396 | medium | 6.4 | No | The Email Marketing for WordPress and WooCommerce – Retainful plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dat... | 2026-10-13 |
| CVE-2026-97340 | medium | 6.4 | No | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Stored Cross-Site Scripting via the user profil... | 2026-10-13 |
| CVE-2026-96765 | high | 7.2 | No | The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Stored Cross-Site Scripting v... | 2026-10-13 |
| CVE-2026-96278 | high | 7.2 | No | The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Session History in all versions up... | 2026-10-13 |
| CVE-2026-104803 | critical | 9.8 | No | The WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.7.27 via the `uuid` and... | 2026-10-13 |
| CVE-2026-104759 | high | 8.1 | No | The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Authentication Bypass via OID... | 2026-10-13 |
| CVE-2026-104728 | medium | 4.3 | No | The AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI plugin for WordPress is vulnerable to authorizatio... | 2026-10-13 |
| CVE-2026-103478 | medium | 6.4 | No | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'checkout[bi... | 2026-10-13 |
| CVE-2026-102774 | medium | 6.4 | No | The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Image '... | 2026-10-13 |
| CVE-2026-102291 | medium | 5.4 | No | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary shortcode execution in all v... | 2026-10-13 |
| CVE-2026-101921 | medium | 4.7 | No | The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to R... | 2026-10-13 |
| CVE-2026-101920 | high | 7.2 | No | The Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cros... | 2026-10-13 |
| CVE-2026-96840 | high | 7.2 | No | The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via display_name User Field in all... | 2026-10-13 |
| CVE-2026-96574 | medium | 6.4 | No | The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin f... | 2026-10-13 |
| CVE-2026-96572 | high | 7.2 | No | The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in... | 2026-10-13 |
| CVE-2026-96558 | high | 7.2 | No | The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via... | 2026-10-13 |
| CVE-2026-95684 | high | 7.2 | No | The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'attachments[name]' Paramete... | 2026-10-13 |