Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-108523 | medium | 4.3 | No | A vulnerability was determined in Studio-Saelix Sencho up to 0.94.1. This vulnerability affects unknown code of the file outboundTarget.ts o... | 2026-10-13 |
| CVE-2026-81797 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions. | 2026-10-13 |
| CVE-2026-78535 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions. | 2026-10-13 |
| CVE-2026-78534 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Educavo <= 3.4.2 versions. | 2026-10-13 |
| CVE-2026-78533 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions. | 2026-10-13 |
| CVE-2026-78532 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions. | 2026-10-13 |
| CVE-2026-78531 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions. | 2026-10-13 |
| CVE-2026-78529 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Alliance <= 3.11 versions. | 2026-10-13 |
| CVE-2026-66569 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions. | 2026-10-13 |
| CVE-2026-94160 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeStek ThemeStek Extras for Labtech... | 2026-10-13 |
| CVE-2026-97264 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts all... | 2026-10-13 |
| CVE-2026-97263 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts all... | 2026-10-13 |
| CVE-2026-91136 | high | 7.5 | No | The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svg_image' paramete... | 2026-10-13 |
| CVE-2026-96662 | high | 7.5 | No | The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection... | 2026-10-13 |
| CVE-2026-93951 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Zeinet zeinet allows Reflec... | 2026-10-13 |
| CVE-2026-93746 | high | 7.5 | No | The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Insecure Direc... | 2026-10-13 |
| CVE-2026-100178 | high | 7.2 | No | The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'adverts_location' parameter in... | 2026-10-13 |
| CVE-2026-100147 | high | 7.2 | No | The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shipping_... | 2026-10-13 |
| CVE-2026-97348 | medium | 6.5 | No | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.74.3 via the... | 2026-10-13 |
| CVE-2026-94538 | high | 8.1 | No | The WP File Download plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.3.9. This is due to... | 2026-10-13 |