Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-104405 | high | 8.1 | No | Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions. | 2026-10-06 |
| CVE-2026-104399 | not reported | — | No | Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Motors allows Retrieve Embedded Sensitive Data. This issu... | 2026-10-06 |
| CVE-2026-104395 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions. | 2026-10-06 |
| CVE-2026-104394 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions. | 2026-10-06 |
| CVE-2026-104387 | high | 7.2 | No | Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions. | 2026-10-06 |
| CVE-2026-104385 | high | 7.5 | No | Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions. | 2026-10-06 |
| CVE-2026-103346 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomlister Payflex Payment Gateway payf... | 2026-10-06 |
| CVE-2026-102915 | high | 8.5 | No | Subscriber Broken Access Control in WPO365 <= 44.1 versions. | 2026-10-06 |
| CVE-2026-102387 | high | 7.5 | No | Unauthenticated Sensitive Data Exposure in Xserver Migrator <= 1.6.6 versions. | 2026-10-06 |
| CVE-2026-100518 | medium | 5.3 | No | Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versions. | 2026-10-06 |
| CVE-2026-97300 | medium | 6.5 | No | Unauthenticated Broken Access Control in WP Event Solution <= 4.1.25 versions. | 2026-10-06 |
| CVE-2026-41563 | high | 7.5 | No | Unauthenticated Sensitive Data Exposure in Sitemovr <= 1.0.1 versions. | 2026-10-06 |
| CVE-2026-41558 | high | 7.5 | No | Subscriber Bypass Vulnerability in WP Migration Plugin DB & Files – WP Synchro <= 1.16.1 versions. | 2026-10-06 |
| CVE-2026-39789 | high | 7.5 | No | Unauthenticated Broken Access Control in Fluent Affiliate Pro <= 1.6.4 versions. | 2026-10-06 |
| CVE-2026-39760 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Real 3D FlipBook <= 5.5 versions. | 2026-10-06 |
| CVE-2026-39599 | medium | 4.3 | No | Contributor Broken Access Control in WDS MCP Content Manager <= 3.10.4 versions. | 2026-10-06 |
| CVE-2026-105072 | high | 7.5 | No | Unauthenticated Broken Access Control in FluentBooking Pro < 2.5.0 versions. | 2026-10-06 |
| CVE-2026-97257 | high | 8.8 | No | Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Planner simple-event-planner allows Object Injection.This issue... | 2026-10-06 |
| CVE-2026-93617 | high | 7.2 | No | Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue af... | 2026-10-06 |
| CVE-2026-103348 | high | 7.2 | No | Deserialization of Untrusted Data vulnerability in Smackcoders Inc. WP Ultimate Exporter wp-ultimate-exporter allows Object Injection.This i... | 2026-10-06 |