Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-97188 | high | 8.8 | No | The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row save... | 2026-10-07 |
| CVE-2026-96530 | medium | 6.5 | No | The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored image-optimization account data i... | 2026-10-07 |
| CVE-2026-87971 | high | 7.1 | No | The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it i... | 2026-10-07 |
| CVE-2026-87782 | high | 8.8 | No | The Koinonia Link WordPress plugin before 1.1.5 does not check that a user is allowed to change roles before saving a role selection submitt... | 2026-10-07 |
| CVE-2026-86833 | medium | 5.4 | No | The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body o... | 2026-10-07 |
| CVE-2026-86816 | medium | 5.3 | No | The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to... | 2026-10-07 |
| CVE-2026-82212 | high | 7.5 | No | The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepti... | 2026-10-07 |
| CVE-2026-82211 | high | 8.2 | No | The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, all... | 2026-10-07 |
| CVE-2026-105322 | medium | 5.3 | No | The Magee Shortcodes WordPress plugin through 2.1.1 does not restrict the recipient of some of its unauthenticated contact-form actions, all... | 2026-10-07 |
| CVE-2026-105316 | high | 7.1 | No | The Magee Shortcodes WordPress plugin through 2.1.1 does not sanitise and escape user input in some of its AJAX actions, which are available... | 2026-10-07 |
| CVE-2026-104953 | medium | 6.8 | No | The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query,... | 2026-10-07 |
| CVE-2026-104678 | low | 2.7 | No | The CP Media Player WordPress plugin before 1.3.4 does not perform a capability check on its settings-page handler, allowing users with only... | 2026-10-07 |
| CVE-2026-104677 | high | 7.2 | No | The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a cont... | 2026-10-07 |
| CVE-2026-104667 | medium | 6.8 | No | The Animated Number Counters WordPress plugin before 3.1 does not sanitise or escape a value stored by an Editor-level user before concatena... | 2026-10-07 |
| CVE-2026-104653 | medium | 6.8 | No | The Envira Gallery WordPress plugin before 1.16.1 does not sanitise or escape user-supplied gallery display configuration values before stor... | 2026-10-07 |
| CVE-2026-104652 | medium | 6.8 | No | The Envira Gallery WordPress plugin before 1.16.1 does not sanitise and escape a gallery item identifier before outputting it in an image ta... | 2026-10-07 |
| CVE-2026-104651 | medium | 4.3 | No | The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requesting user owns the targ... | 2026-10-07 |
| CVE-2026-104050 | medium | 4.3 | No | The Academy LMS WordPress plugin before 4.0.0 does not verify that a quiz question belongs to the course the requesting user is authorized t... | 2026-10-07 |
| CVE-2026-104049 | medium | 4.3 | No | The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when returning a lesson's content throug... | 2026-10-07 |
| CVE-2026-103681 | medium | 4.3 | No | The Frontend Dashboard WordPress plugin before 3.0.0 does not perform a capability check in one of its AJAX actions, allowing authenticated... | 2026-10-07 |