Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-103888 | medium | 6.1 | No | The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'woosq-redirect' param... | 2026-10-06 |
| CVE-2026-101928 | high | 7.2 | No | The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all ve... | 2026-10-06 |
| CVE-2026-101923 | high | 8.1 | No | The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Arbitrary Content Deletion in versions up to, and including, 1.2.30.... | 2026-10-06 |
| CVE-2026-101357 | medium | 4.9 | No | The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'seopress_google_analyt... | 2026-10-06 |
| CVE-2026-100152 | medium | 6.5 | No | The The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin for WordPress is v... | 2026-10-06 |
| CVE-2026-100149 | medium | 5.3 | No | The WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons plugin for WordPress is vulnerable to Sensitive Information Exposur... | 2026-10-06 |
| CVE-2026-100148 | medium | 6.4 | No | The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'reviews[].text' parameter in... | 2026-10-06 |
| CVE-2026-97644 | high | 8.8 | No | The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation via Contact Identity... | 2026-10-06 |
| CVE-2026-92977 | high | 7.2 | No | The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all... | 2026-10-06 |
| CVE-2026-92826 | medium | 6.1 | No | The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Parameter Key in all versions... | 2026-10-06 |
| CVE-2026-92727 | medium | 6.4 | No | The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnera... | 2026-10-06 |
| CVE-2026-92551 | medium | 6.1 | No | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPre... | 2026-10-06 |
| CVE-2026-92538 | medium | 6.1 | No | The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Sit... | 2026-10-06 |
| CVE-2026-92536 | high | 8.8 | No | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPre... | 2026-10-06 |
| CVE-2026-96270 | high | 7.2 | No | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v... | 2026-10-06 |
| CVE-2026-95865 | medium | 6.5 | No | The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to blind SQL Injection via 'fields[][valu... | 2026-10-06 |
| CVE-2026-94539 | medium | 6.5 | No | The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to time-based SQL Injection via... | 2026-10-06 |
| CVE-2026-94378 | medium | 6.4 | No | The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to Stored Cross-Site Scripting... | 2026-10-06 |
| CVE-2026-93428 | high | 7.5 | No | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v... | 2026-10-06 |
| CVE-2026-92243 | medium | 6.1 | No | The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all... | 2026-10-06 |