Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-42417 | critical | 9.3 | No | Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions. | 2026-10-06 |
| CVE-2026-42416 | high | 8.5 | No | Subscriber SQL Injection in UDesign Core <= 4.15.0 versions. | 2026-10-06 |
| CVE-2026-42415 | critical | 9.3 | No | Unauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 versions. | 2026-10-06 |
| CVE-2026-42414 | high | 8.5 | No | Subscriber SQL Injection in ListingPro <= 2.9.12 versions. | 2026-10-06 |
| CVE-2026-42413 | high | 7.5 | No | Unauthenticated Sensitive Data Exposure in Snapshotify – All-in-One Backup & Restore & Migrate <= 1.3.2 versions. | 2026-10-06 |
| CVE-2026-41562 | high | 7.5 | No | Unauthenticated Sensitive Data Exposure in Norvis Backup <= 1.1.0 versions. | 2026-10-06 |
| CVE-2026-41561 | high | 7.5 | No | Unauthenticated Sensitive Data Exposure in Museder RestoreOne <= 2.7.276 versions. | 2026-10-06 |
| CVE-2026-41560 | high | 7.5 | No | Unauthenticated Broken Access Control in WXD Backup Lite <= 1.0.2 versions. | 2026-10-06 |
| CVE-2026-41559 | high | 7.5 | No | Unauthenticated Sensitive Data Exposure in SafeSnap – Verified WordPress Backup & Restore <= 2.1.2 versions. | 2026-10-06 |
| CVE-2026-41555 | critical | 9.3 | No | Unauthenticated SQL Injection in Newsletter Subscription Form – User Subscriptions Form, Capture Email <= 1.5.9 versions. | 2026-10-06 |
| CVE-2026-40807 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.6 versions. | 2026-10-06 |
| CVE-2026-40806 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Blog, Posts and Category Filter for Elementor <= 2.1.0 versions. | 2026-10-06 |
| CVE-2026-39798 | medium | 6.5 | No | Unauthenticated Settings Change in TrueBooker <= 1.2.9 versions. | 2026-10-06 |
| CVE-2026-39797 | critical | 9.8 | No | Unauthenticated PHP Object Injection in GDPR Framework By Data443 <= 2.5.0 versions. | 2026-10-06 |
| CVE-2026-39796 | high | 7.5 | No | Unauthenticated Broken Access Control in Advanced Posts Listing – Show Post List Easily <= 1.0.8 versions. | 2026-10-06 |
| CVE-2026-39794 | high | 7.5 | No | Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API <= 1.6.3 versions. | 2026-10-06 |
| CVE-2026-39793 | high | 8.8 | No | Subscriber Broken Authentication in Simple JWT Login 4.0.0 versions. | 2026-10-06 |
| CVE-2026-39792 | high | 8.6 | No | Unauthenticated Arbitrary File Deletion in Simple File List <= 6.3.11 versions. | 2026-10-06 |
| CVE-2026-39791 | medium | 5.3 | No | Unauthenticated Sensitive Data Exposure in Mailjet Email Marketing <= 6.2.3 versions. | 2026-10-06 |
| CVE-2026-39788 | medium | 6.5 | No | Subscriber Cross Site Scripting (XSS) in Front End PM <= 11.4.6 versions. | 2026-10-06 |