Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-103111 | high | 7.6 | No | PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with ar... | 2026-10-04 |
| CVE-2026-100630 | medium | 5.4 | No | AVideo before 29.1.0 contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline... | 2026-10-04 |
| CVE-2026-97652 | medium | 6.1 | No | The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Reflected Cross-Site Scripti... | 2026-10-03 |
| CVE-2026-97641 | high | 7.2 | No | The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to... | 2026-10-03 |
| CVE-2026-97637 | critical | 9.8 | No | The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Cookie Disclosure in all versions up to, an... | 2026-10-03 |
| CVE-2026-97342 | high | 7.2 | No | The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta vi... | 2026-10-03 |
| CVE-2026-97338 | medium | 6.4 | No | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Display Name in all versions up to, and including... | 2026-10-03 |
| CVE-2026-96871 | high | 7.2 | No | The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all versions up to, and in... | 2026-10-03 |
| CVE-2026-97273 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions. | 2026-10-03 |
| CVE-2026-97258 | medium | 6.5 | No | Subscriber Broken Access Control in Aruba Migration Tool <= 1.0.4 versions. | 2026-10-03 |
| CVE-2026-96613 | medium | 6.5 | No | The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to access the complete d... | 2026-10-03 |
| CVE-2026-96647 | medium | 6.4 | No | The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting v... | 2026-10-03 |
| CVE-2026-96567 | high | 7.2 | No | The MW WP Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_id' parameter in all versions up to, and incl... | 2026-10-03 |
| CVE-2026-96566 | high | 7.2 | No | The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'np1' Custom Field... | 2026-10-03 |
| CVE-2026-96813 | high | 7.2 | No | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting... | 2026-10-03 |
| CVE-2026-95670 | high | 7.2 | No | The No External Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect in all versi... | 2026-10-03 |
| CVE-2026-96256 | medium | 6.4 | No | The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Script... | 2026-10-03 |
| CVE-2026-95687 | high | 8.8 | No | The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions u... | 2026-10-03 |
| CVE-2026-94432 | medium | 5.3 | No | The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Objec... | 2026-10-03 |
| CVE-2026-93756 | high | 7.2 | No | The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via... | 2026-10-03 |