Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-116761 | medium | 5.4 | No | The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cmb43ex1_grp[0][txt] (wysiwyg field inside group — field... | 2026-10-29 |
| CVE-2026-116750 | medium | 6.5 | No | The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to blind SQL Injection via the 'catid' parameter in all versi... | 2026-10-29 |
| CVE-2026-116749 | medium | 6.4 | No | The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'className' parameter... | 2026-10-29 |
| CVE-2026-15323 | high | 7.5 | No | The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and... | 2026-10-29 |
| CVE-2026-1928 | high | 8.8 | No | The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to,... | 2026-10-29 |
| CVE-2026-116839 | high | 7.1 | No | A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found... | 2026-10-29 |
| CVE-2026-116609 | medium | 6.5 | No | The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to SQL Injection via the 'from' (and sibling 'to'/'first'/'... | 2026-10-29 |
| CVE-2026-116613 | high | 7.5 | No | The Animated Text Block plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.6 via the... | 2026-10-29 |
| CVE-2026-115807 | high | 7.1 | No | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited... | 2026-10-29 |
| CVE-2026-115806 | critical | 9.8 | No | The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.... | 2026-10-29 |
| CVE-2026-115417 | high | 7.5 | No | Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2 might allow a remote act... | 2026-10-29 |
| CVE-2026-114645 | medium | 5.2 | No | A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to... | 2026-10-29 |
| CVE-2026-111372 | medium | 4.3 | No | The AI ChatBot for WooCommerce – WoowBot plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.... | 2026-10-29 |
| CVE-2026-111213 | medium | 4.3 | No | The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up t... | 2026-10-29 |
| CVE-2026-111111 | high | 7.2 | No | The Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site... | 2026-10-29 |
| CVE-2026-111068 | medium | 4.4 | No | The DesignSetGo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagName' parameter in all versions up to, and inc... | 2026-10-29 |
| CVE-2026-111727 | medium | 6.4 | No | The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vs_text_submitbtn' parameter in... | 2026-10-29 |
| CVE-2026-111314 | high | 7.2 | No | The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting v... | 2026-10-29 |
| CVE-2026-111820 | high | 7.2 | No | The Analytics Insights – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the... | 2026-10-29 |
| CVE-2026-110662 | high | 7.2 | No | The MxChat – AI Chatbot & Content Generation for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via t... | 2026-10-29 |