Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-89100 | medium | 6.1 | No | The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '#response' URL Fragment... | 2026-10-13 |
| CVE-2026-6243 | medium | 6.4 | No | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all ver... | 2026-10-13 |
| CVE-2026-5725 | medium | 6.1 | No | The Favicon Rotator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'fvrt_' prefixed request parameters in all... | 2026-10-13 |
| CVE-2026-3717 | medium | 5.3 | No | The CV Builder – Professional Resume Builder SaaS plugin for WordPress is vulnerable to unauthorized arbitrary file upload due to a missing... | 2026-10-13 |
| CVE-2026-15178 | medium | 5.4 | No | The Fluent Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.2.5. This is due to the... | 2026-10-13 |
| CVE-2026-12626 | high | 7.2 | No | The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to PHP Object Injection in all versions up... | 2026-10-13 |
| CVE-2026-107742 | high | 7.2 | No | The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripti... | 2026-10-13 |
| CVE-2026-104801 | critical | 9.1 | No | The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient... | 2026-10-13 |
| CVE-2026-104006 | low | 3.7 | No | The SpeedyCache – Cache, Optimization, Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up t... | 2026-10-13 |
| CVE-2026-103897 | medium | 4.4 | No | The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versi... | 2026-10-13 |
| CVE-2026-103427 | medium | 6.4 | No | The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'country' parameter in all versions up to, a... | 2026-10-13 |
| CVE-2026-97643 | medium | 6.4 | No | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `gi... | 2026-10-13 |
| CVE-2026-96682 | high | 7.2 | No | The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Tag in all versions up to, and i... | 2026-10-13 |
| CVE-2026-96667 | high | 7.2 | No | The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'f... | 2026-10-13 |
| CVE-2026-94421 | medium | 6.4 | No | The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and incl... | 2026-10-13 |
| CVE-2026-93775 | high | 7.2 | No | The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Auphonic Webhook in all versions up to,... | 2026-10-13 |
| CVE-2026-91862 | medium | 6.4 | No | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-image-points' parameter in all... | 2026-10-13 |
| CVE-2026-78068 | medium | 6.4 | No | The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Cell Content in all versi... | 2026-10-13 |
| CVE-2026-18558 | medium | 6.4 | No | The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t... | 2026-10-13 |
| CVE-2026-18496 | medium | 5.3 | No | The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.4.3 via t... | 2026-10-13 |