Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-32572 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 versions. | 2026-10-06 |
| CVE-2026-32571 | medium | 6.5 | No | Subscriber Cross Site Scripting (XSS) in Ohio Extra <= 3.6.8 versions. | 2026-10-06 |
| CVE-2026-32570 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Progressify - Progressive Web App (PWA) <= 1.6.0 versions. | 2026-10-06 |
| CVE-2026-32569 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions. | 2026-10-06 |
| CVE-2026-32568 | critical | 9.9 | No | Subscriber Remote Code Execution (RCE) in WooCommerce Designer Pro <= 1.9.33 versions. | 2026-10-06 |
| CVE-2026-25434 | high | 8.5 | No | Subscriber SQL Injection in WP2LEADS <= 3.5.7 versions. | 2026-10-06 |
| CVE-2026-25433 | high | 7.1 | No | Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions. | 2026-10-06 |
| CVE-2026-105879 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor j... | 2026-10-06 |
| CVE-2026-105317 | high | 8.5 | No | Subscriber SQL Injection in Paid Member Subscriptions <= 3.1.1 versions. | 2026-10-06 |
| CVE-2026-105071 | high | 7.5 | No | Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration & Cloning <= 1.5.17 versions. | 2026-10-06 |
| CVE-2026-105070 | high | 8.8 | No | Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions. | 2026-10-06 |
| CVE-2026-105061 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 versions. | 2026-10-06 |
| CVE-2026-105058 | high | 8.8 | No | Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions. | 2026-10-06 |
| CVE-2026-105057 | medium | 5.3 | No | Unauthenticated Bypass Vulnerability in Zero Spam <= 5.7.11 versions. | 2026-10-06 |
| CVE-2026-104814 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions. | 2026-10-06 |
| CVE-2026-104757 | high | 7.2 | No | Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions. | 2026-10-06 |
| CVE-2026-104747 | high | 8.1 | No | Unauthenticated PHP Object Injection in Haaken <= 1.5 versions. | 2026-10-06 |
| CVE-2026-104672 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions. | 2026-10-06 |
| CVE-2026-104670 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions. | 2026-10-06 |
| CVE-2026-104406 | high | 7.3 | No | Unauthenticated Broken Access Control in picu <= 3.10.1 versions. | 2026-10-06 |