Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-17025 | medium | 6.4 | No | The Graphene theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'Current location' and 'Author profile image URL' Profile... | 2026-10-13 |
| CVE-2026-16776 | medium | 6.4 | No | The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via... | 2026-10-13 |
| CVE-2026-14882 | medium | 6.4 | No | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'brizy-compiled-sections' parameter in al... | 2026-10-13 |
| CVE-2026-14877 | medium | 6.4 | No | The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the id attribute in all version... | 2026-10-13 |
| CVE-2026-14379 | medium | 6.4 | No | The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored... | 2026-10-13 |
| CVE-2026-14335 | high | 7.2 | No | The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scriptin... | 2026-10-13 |
| CVE-2026-12054 | medium | 6.1 | No | The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'REFERRER' parameter in all versions up to, an... | 2026-10-13 |
| CVE-2026-104899 | high | 8.1 | No | The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Local File Inclusion... | 2026-10-13 |
| CVE-2026-104766 | high | 8.8 | No | The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Privilege Escalation... | 2026-10-13 |
| CVE-2026-104763 | medium | 4.9 | No | The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.1 via... | 2026-10-13 |
| CVE-2026-104762 | medium | 6.4 | No | The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Block F... | 2026-10-13 |
| CVE-2026-104742 | low | 3.1 | No | The AI Puffer – Chat. Create. Automate. (formerly AI Power) plugin for WordPress is vulnerable to authorization bypass in all versions up to... | 2026-10-13 |
| CVE-2026-104741 | low | 3.1 | No | The AI Puffer – Chat. Create. Automate. (formerly AI Power) plugin for WordPress is vulnerable to authorization bypass in all versions up to... | 2026-10-13 |
| CVE-2026-104725 | high | 8.8 | No | The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to... | 2026-10-13 |
| CVE-2026-104723 | high | 8.8 | No | The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injection in all versions u... | 2026-10-13 |
| CVE-2026-104023 | medium | 4.9 | No | The Smart Popup by Supsystic plugin for WordPress is vulnerable to generic SQL Injection via the 'sidx' parameter in all versions up to, and... | 2026-10-13 |
| CVE-2026-103912 | medium | 4.7 | No | The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the '' p... | 2026-10-13 |
| CVE-2026-103520 | medium | 6.4 | No | The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t... | 2026-10-13 |
| CVE-2026-103482 | medium | 5.4 | No | The Simple Newsletter Plugin – Noptin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noptin_fields[] (e.g. first... | 2026-10-13 |
| CVE-2026-9696 | medium | 6.4 | No | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'not_found' parameter in all versions up to,... | 2026-10-13 |