Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-110071 | medium | 6.4 | No | The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' parameter in all versions up to, and includ... | 2026-10-29 |
| CVE-2026-110020 | medium | 6.5 | No | The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.1.6... | 2026-10-29 |
| CVE-2026-10752 | medium | 4.8 | No | The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 0.9.2.... | 2026-10-29 |
| CVE-2026-10511 | medium | 6.4 | No | The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'forget_password_link' parameter in all version... | 2026-10-29 |
| CVE-2026-109988 | medium | 4.4 | No | The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi... | 2026-10-29 |
| CVE-2026-109979 | medium | 4.3 | No | The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.0.0... | 2026-10-29 |
| CVE-2026-109978 | medium | 6.4 | No | The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to... | 2026-10-29 |
| CVE-2026-109975 | medium | 6.4 | No | The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to... | 2026-10-29 |
| CVE-2026-109590 | medium | 6.4 | No | The Tour Booking Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width', 'height' and 'zoom' shortcode at... | 2026-10-29 |
| CVE-2026-109385 | medium | 6.4 | No | The UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks plugin for WordPress is vulnerable to Stored Cross-Sit... | 2026-10-29 |
| CVE-2026-109974 | medium | 6.4 | No | The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored... | 2026-10-29 |
| CVE-2026-109995 | high | 7.2 | No | The Advanced Views – Display Framework for Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '... | 2026-10-29 |
| CVE-2026-106484 | medium | 4.4 | No | Insufficient policy enforcement in chrome-devtools-mcp in Google Chrome on Linux prior to 1.5.0 allowed a local attacker to perform arbitrar... | 2026-10-29 |
| CVE-2026-109384 | high | 8.8 | No | The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including,... | 2026-10-29 |
| CVE-2026-109370 | medium | 6.4 | No | The Document Embedder – let visitors read files without downloading plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Script... | 2026-10-29 |
| CVE-2026-109218 | critical | 9.8 | No | The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9.1.2 via the add_mess... | 2026-10-29 |
| CVE-2026-108366 | medium | 6.4 | No | The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin for WordPress is vulnerable to Authenti... | 2026-10-29 |
| CVE-2026-104743 | medium | 4.9 | No | The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'tmp_file' parame... | 2026-10-29 |
| CVE-2026-109209 | medium | 6.4 | No | The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored... | 2026-10-29 |
| CVE-2026-107745 | medium | 4.2 | No | The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insuf... | 2026-10-29 |