Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-75028 | high | 7.5 | No | The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all... | 2026-10-06 |
| CVE-2026-18443 | high | 8.8 | No | The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via th... | 2026-10-06 |
| CVE-2026-15795 | medium | 6.4 | No | The Responsive Plus – Elementor Templates & Starter Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode At... | 2026-10-06 |
| CVE-2026-11601 | medium | 5.3 | No | The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all... | 2026-10-06 |
| CVE-2026-104313 | medium | 6.1 | No | The WPC Estimated Delivery Date for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'rule_data' par... | 2026-10-06 |
| CVE-2026-103519 | medium | 5.4 | No | The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3.... | 2026-10-06 |
| CVE-2026-103421 | medium | 5.4 | No | The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'REQUEST_URI (path... | 2026-10-06 |
| CVE-2026-100157 | medium | 6.5 | No | The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3.... | 2026-10-06 |
| CVE-2026-97344 | medium | 6.4 | No | The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Alt Attribute v... | 2026-10-06 |
| CVE-2026-97341 | high | 7.2 | No | The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP He... | 2026-10-06 |
| CVE-2026-97337 | high | 7.5 | No | The Simple Membership plugin for WordPress is vulnerable to unauthorized modification of data and sensitive information disclosure in versio... | 2026-10-06 |
| CVE-2026-96650 | high | 7.2 | No | The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'platform_user_photo' Custom Field in all vers... | 2026-10-06 |
| CVE-2026-96575 | high | 7.2 | No | The Transliterator – Multilingual and Multi-script Text Conversion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Com... | 2026-10-06 |
| CVE-2026-96564 | high | 7.2 | No | The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Author Display Name in all... | 2026-10-06 |
| CVE-2026-93430 | high | 7.2 | No | The GD Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'title' and 'url' Render Args in gdrts_live_handl... | 2026-10-06 |
| CVE-2026-91108 | medium | 4.3 | No | The Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress is vulnerable to authorization bypass... | 2026-10-06 |
| CVE-2026-87091 | high | 7.2 | No | The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Settlement Notification Parameters in all versi... | 2026-10-06 |
| CVE-2026-11399 | medium | 4.3 | No | The Helpdesk Support Ticket System for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up... | 2026-10-06 |
| CVE-2026-103913 | high | 7.5 | No | The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the stored latitude/longitude coordinates of a listing in versions... | 2026-10-06 |
| CVE-2026-103909 | medium | 6.1 | No | The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Refl... | 2026-10-06 |