Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-105190 | medium | 5.3 | No | The Easy Digital Downloads WordPress plugin before 3.7.1 does not consult the site's user registration setting before creating a WordPress a... | 2026-10-08 |
| CVE-2026-104671 | medium | 5.3 | No | The TutorStarter WordPress theme before 4.0.4 does not respect the site's user registration setting in one of its AJAX registration handlers... | 2026-10-08 |
| CVE-2026-103517 | medium | 5.3 | No | The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an incoming payment notification genuinely comes f... | 2026-10-08 |
| CVE-2026-94275 | medium | 5.3 | No | The Track Orders for WooCommerce WordPress plugin before 1.2.7 does not verify ownership of an order before returning its billing details, a... | 2026-10-08 |
| CVE-2026-94258 | low | 2.7 | No | The SMS Alert WordPress plugin before 4.0.1 does not check that the acting administrator is allowed to manage the selected users before retu... | 2026-10-08 |
| CVE-2026-94246 | medium | 6.3 | No | The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the wallet account named in a withdrawal submission bel... | 2026-10-08 |
| CVE-2026-94245 | medium | 6.5 | No | The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet b... | 2026-10-08 |
| CVE-2026-94244 | medium | 4.3 | No | The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not perform any capability check, and relies on a token any authenticat... | 2026-10-08 |
| CVE-2026-86828 | medium | 6.6 | No | The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when i... | 2026-10-08 |
| CVE-2026-86827 | medium | 5.3 | No | The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originates... | 2026-10-08 |
| CVE-2026-86826 | medium | 5.9 | No | The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, al... | 2026-10-08 |
| CVE-2026-105260 | medium | 4.3 | No | The Database Addon For WPForms ( wpforms entries ) WordPress plugin before 1.1.1 does not verify the CSRF nonce when the field is omitted an... | 2026-10-08 |
| CVE-2026-105198 | medium | 5.3 | No | The Appointment Booking Plugin WordPress plugin before 5.7.3 does not verify that the caller owns the order referenced by an order-item iden... | 2026-10-08 |
| CVE-2026-105197 | low | 2.7 | No | The Appointment Booking Plugin WordPress plugin before 5.6.5 does not verify that a backend staff user is authorized to act on the specific... | 2026-10-08 |
| CVE-2026-105196 | low | 3.3 | No | The Appointment Booking Plugin WordPress plugin before 5.6.9 does not enforce per-record authorization on several of its AI Abilities API ac... | 2026-10-08 |
| CVE-2026-105195 | low | 2.7 | No | The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user can load through one... | 2026-10-08 |
| CVE-2026-105194 | medium | 4.3 | No | The Easy Digital Downloads WordPress plugin before 3.7.1 does not restrict a block's order data to the current user, allowing users with sub... | 2026-10-08 |
| CVE-2026-105193 | medium | 4.8 | No | The Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes with sufficient entropy, deriving each fro... | 2026-10-08 |
| CVE-2026-104646 | medium | 6.8 | No | The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be o... | 2026-10-08 |
| CVE-2026-104645 | low | 2.7 | No | The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on several of its gallery and... | 2026-10-08 |