Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-62073 | high | 7.5 | No | Unauthenticated Broken Access Control in WP Full Stripe Free <= 8.5.6 versions. | 2026-10-03 |
| CVE-2026-19652 | critical | 9.8 | No | The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.0. This is due to the `... | 2026-10-03 |
| CVE-2026-15897 | high | 8.8 | No | The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including,... | 2026-10-03 |
| CVE-2026-19660 | critical | 9.8 | No | The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.0. The `process_pa... | 2026-10-03 |
| CVE-2026-14378 | critical | 9.8 | No | The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to,... | 2026-10-03 |
| CVE-2026-15983 | high | 8.1 | No | The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in all versions up to, an... | 2026-10-03 |
| CVE-2026-19902 | medium | 6.1 | No | The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Referer header in al... | 2026-10-03 |
| CVE-2026-19807 | high | 8.8 | No | The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and includi... | 2026-10-03 |
| CVE-2026-104912 | not reported | — | No | MISP contains an authorization flaw in its correlation handling during attribute searches. When a user performs an attribute search that tri... | 2026-10-03 |
| CVE-2026-12951 | medium | 6.5 | No | The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection via the 'order_by' parameter of the /multivendorx/v1/com... | 2026-10-03 |
| CVE-2026-10026 | high | 7.2 | No | The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 7.6.12. This is due to insuffici... | 2026-10-03 |
| CVE-2026-12241 | medium | 5.4 | No | The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data du... | 2026-10-03 |
| CVE-2026-104910 | not reported | — | No | MISP contains an authorization bypass in the related events listing functionality. When a user requests the list of events correlated to a g... | 2026-10-03 |
| CVE-2026-103648 | critical | 9.1 | No | Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded response data to be written... | 2026-10-03 |
| CVE-2026-104403 | medium | 5.3 | No | Authorization Bypass Through User-Controlled Key vulnerability in ThimPress LearnPress allows Exploiting Incorrectly Configured Access Contr... | 2026-10-03 |
| CVE-2026-102772 | high | 7.2 | No | The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' (e.g. kl_code, kl_post_code)' parameter in all versions... | 2026-10-03 |
| CVE-2026-102002 | low | 3.1 | No | The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Sensitive Information Exp... | 2026-10-03 |
| CVE-2026-102565 | high | 7.2 | No | The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'booking_service_qty' parameter in all vers... | 2026-10-03 |
| CVE-2026-101104 | high | 7.7 | No | The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the config... | 2026-10-03 |
| CVE-2026-100184 | medium | 4.7 | No | The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Refl... | 2026-10-03 |