Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-40801 | high | 8.1 | No | Subscriber Broken Access Control in Wordable <= 8.2.10 versions. | 2026-10-13 |
| CVE-2026-40800 | critical | 9.3 | No | Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.5.3 versions. | 2026-10-13 |
| CVE-2026-40777 | high | 8.1 | No | Subscriber Broken Access Control in WPSection <= 1.5.1 versions. | 2026-10-13 |
| CVE-2026-39802 | high | 8.1 | No | Unauthenticated Remote Code Execution (RCE) in Everest Backup <= 2.3.13 versions. | 2026-10-13 |
| CVE-2026-39801 | critical | 9.8 | No | Subscriber Privilege Escalation in AIWU <= 1.5.9 versions. | 2026-10-13 |
| CVE-2026-39800 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Additional Order Filters for WooCommerce <= 1.24 versions. | 2026-10-13 |
| CVE-2026-39799 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions. | 2026-10-13 |
| CVE-2026-27350 | high | 7.2 | No | Server-Side Request Forgery (SSRF) vulnerability in Builderius.io Builderius allows Server Side Request Forgery. This issue affects Builder... | 2026-10-13 |
| CVE-2026-107434 | medium | 5.4 | No | Subscriber Bypass Vulnerability in MicroPayments <= 3.2.9 versions. | 2026-10-13 |
| CVE-2026-107420 | medium | 5.3 | No | Unauthenticated Bypass Vulnerability in Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway <= 1.7.2 versions. | 2026-10-13 |
| CVE-2026-103685 | medium | 4.3 | No | Missing Authorization vulnerability in VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce woo-alidropship allows E... | 2026-10-13 |
| CVE-2026-96341 | high | 8.2 | No | Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Escalation.This issue affects Forminator: fr... | 2026-10-13 |
| CVE-2026-94590 | medium | 6.5 | No | Improper Verification of Source of a Communication Channel vulnerability in CodePeople2 Sell Downloads sell-downloads allows Exploitation of... | 2026-10-13 |
| CVE-2026-57806 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in drfuri Martfury - WooCommerce Marketpl... | 2026-10-13 |
| CVE-2026-106610 | critical | 9.8 | No | Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalati... | 2026-10-13 |
| CVE-2026-105892 | critical | 9.8 | No | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPres... | 2026-10-13 |
| CVE-2026-62044 | high | 7.2 | No | Deserialization of Untrusted Data vulnerability in bPlugins Super Video Player super-video-player allows Object Injection.This issue affects... | 2026-10-13 |
| CVE-2026-106609 | high | 7.5 | No | Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control... | 2026-10-13 |
| CVE-2026-106608 | high | 7.2 | No | Incorrect Privilege Assignment vulnerability in Automattic WooCommerce woocommerce allows Privilege Escalation.This issue affects WooCommerc... | 2026-10-13 |
| CVE-2026-105889 | critical | 9.3 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tickera Tickera tickera-event-ticketin... | 2026-10-13 |