Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-92923 | medium | 6.3 | No | The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise and escape a parameter before using it in a SQL statem... | 2026-10-06 |
| CVE-2026-92437 | medium | 5.3 | No | The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication, a nonce or an ownership check before it acts on a... | 2026-10-06 |
| CVE-2026-91078 | high | 8.2 | No | The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on ac... | 2026-10-06 |
| CVE-2026-89236 | high | 8.6 | No | The SaveTo Wishlist Lite WordPress plugin before 1.1.5 does not sanitise and escape parameters before using them in the ORDER BY clause of a... | 2026-10-06 |
| CVE-2026-88783 | high | 8.8 | No | The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so t... | 2026-10-06 |
| CVE-2026-88782 | medium | 6.8 | No | The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a... | 2026-10-06 |
| CVE-2026-86834 | low | 3.7 | No | The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submissi... | 2026-10-06 |
| CVE-2026-86832 | medium | 5.3 | No | The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to v... | 2026-10-06 |
| CVE-2026-85568 | medium | 6.8 | No | The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not correctly handle a search value before rewriting an already pre... | 2026-10-06 |
| CVE-2026-85015 | medium | 6.6 | No | The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting... | 2026-10-06 |
| CVE-2026-80518 | low | 3.7 | No | The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the impor... | 2026-10-06 |
| CVE-2026-80517 | low | 3.5 | No | The WP Ultimate CSV Importer WordPress plugin before 9.2 does not properly validate the file types contained in an uploaded archive nor sani... | 2026-10-06 |
| CVE-2026-103514 | high | 7.5 | No | The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who... | 2026-10-06 |
| CVE-2026-103293 | medium | 6.8 | No | The MPG WordPress plugin before 4.2.3 does not validate that the dataset source supplied when importing a project is a remote URL before tre... | 2026-10-06 |
| CVE-2026-101162 | medium | 6.4 | No | The WP Ultimate Review WordPress plugin before 2.4.4 does not escape some of its review overview settings before outputting them in posts, w... | 2026-10-06 |
| CVE-2026-101161 | high | 7.5 | No | The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes t... | 2026-10-06 |
| CVE-2026-101160 | high | 7.5 | No | The WP Ultimate Review WordPress plugin before 2.4.4 does not validate that a submitted review rating is numeric before storing it and later... | 2026-10-06 |
| CVE-2026-101159 | high | 7.5 | No | The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews submitted through its public review form,... | 2026-10-06 |
| CVE-2026-103918 | medium | 6.5 | No | oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmart... | 2026-10-06 |
| CVE-2026-103036 | medium | 6.5 | No | oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema S... | 2026-10-06 |