Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-103337 | medium | 6.5 | No | Missing Authorization vulnerability in Kirillbdev WC Ukraine Shipping wc-ukr-shipping allows Exploiting Incorrectly Configured Access Contro... | 2026-10-06 |
| CVE-2026-103066 | high | 8.5 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-bookin... | 2026-10-06 |
| CVE-2026-100511 | high | 8.8 | No | Deserialization of Untrusted Data vulnerability in Vektor Inc. VK Google Job Posting Manager vk-google-job-posting-manager allows Object Inj... | 2026-10-06 |
| CVE-2026-100506 | high | 7.2 | No | Deserialization of Untrusted Data vulnerability in WP Spell Check WP Spell Check wp-spell-check allows Object Injection.This issue affects W... | 2026-10-06 |
| CVE-2026-97305 | not reported | — | No | Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite allows Exploiting... | 2026-10-06 |
| CVE-2026-97304 | medium | 6.5 | No | Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.T... | 2026-10-06 |
| CVE-2026-97303 | high | 7.6 | No | Missing Authorization vulnerability in Apps Mav Scratch & Win – Giveaways and Contests scratch-win-giveaways-for-website-facebook allows Exp... | 2026-10-06 |
| CVE-2026-97283 | critical | 9.8 | No | Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Object Injectio... | 2026-10-06 |
| CVE-2026-97275 | medium | 5.3 | No | Improper Validation of Specified Quantity in Input vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builde... | 2026-10-06 |
| CVE-2026-97070 | not reported | — | No | Authorization Bypass Through User-Controlled Key vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly Configure... | 2026-10-06 |
| CVE-2026-103352 | critical | 9.3 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-bookin... | 2026-10-06 |
| CVE-2026-103349 | high | 7.2 | No | Deserialization of Untrusted Data vulnerability in Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro allows Object Injecti... | 2026-10-06 |
| CVE-2026-103334 | high | 7.5 | No | Insertion of Sensitive Information Into Sent Data vulnerability in Etoile Web Design Incorporated Five Star Restaurant Reservations restaura... | 2026-10-06 |
| CVE-2026-103086 | medium | 6.5 | No | Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This... | 2026-10-06 |
| CVE-2026-103085 | medium | 6.5 | No | Improper Access Control vulnerability in WP User Manager WP User Manager wp-user-manager allows Privilege Abuse.This issue affects WP User M... | 2026-10-06 |
| CVE-2026-102383 | medium | 6.5 | No | Missing Authorization vulnerability in VillaTheme Lookzy woo-lookbook allows Exploiting Incorrectly Configured Access Control Security Level... | 2026-10-06 |
| CVE-2026-100515 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Photo Reviews for WooCommer... | 2026-10-06 |
| CVE-2026-100509 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webful Creations RepairBuddy computer-... | 2026-10-06 |
| CVE-2026-42700 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Image Slider Widget image-sli... | 2026-10-06 |
| CVE-2026-105421 | medium | 5.3 | No | Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) for WooCommerce convertkit-for-woocommerce allows Exploiting Incorrectl... | 2026-10-06 |