Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-107712 | medium | 6.5 | No | The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'current_month' parameter in... | 2026-10-13 |
| CVE-2026-100196 | high | 7.2 | No | The LazyLoad Plugin – Lazy Load Images, Videos, and Iframes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comme... | 2026-10-13 |
| CVE-2026-100161 | high | 7.2 | No | The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'wcpr_image_upload_id'... | 2026-10-13 |
| CVE-2026-94375 | medium | 5.3 | No | The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to,... | 2026-10-13 |
| CVE-2026-92975 | high | 8.1 | No | The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to... | 2026-10-13 |
| CVE-2026-91050 | medium | 4.3 | No | The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Objec... | 2026-10-13 |
| CVE-2026-77183 | high | 8.8 | No | The FooSales – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all ve... | 2026-10-13 |
| CVE-2026-97670 | critical | 9.1 | No | The Avada (Fusion) Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16.1. This is... | 2026-10-13 |
| CVE-2026-89301 | high | 7.5 | No | The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to limited file deletion due to insufficient file path... | 2026-10-13 |
| CVE-2026-6723 | medium | 5.3 | No | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Incorrect Authorization... | 2026-10-13 |
| CVE-2026-101324 | medium | 4.7 | No | The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Reflected C... | 2026-10-13 |
| CVE-2026-94589 | critical | 9.8 | No | The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to Arbitrary File Up... | 2026-10-13 |
| CVE-2026-109699 | medium | 5.4 | No | Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Contro... | 2026-10-13 |
| CVE-2026-109697 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart all... | 2026-10-13 |
| CVE-2026-109696 | medium | 5.4 | No | Missing Authorization vulnerability in WP ManageNinja LLC FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control... | 2026-10-13 |
| CVE-2026-109691 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Prime Slider – Addons For Ele... | 2026-10-13 |
| CVE-2026-109687 | high | 7.6 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free lin... | 2026-10-13 |
| CVE-2026-109684 | medium | 5.3 | No | Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This... | 2026-10-13 |
| CVE-2026-108495 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureForms sureforms a... | 2026-10-13 |
| CVE-2026-108493 | medium | 5.3 | No | Missing Authorization vulnerability in Karolína Vyskočilová Pay for Payment for WooCommerce woocommerce-pay-for-payment allows Exploiting In... | 2026-10-13 |