Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-91832 | high | 7.1 | No | The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attacker can import arbitra... | 2026-09-30 |
| CVE-2026-91072 | medium | 4.4 | No | The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own u... | 2026-09-30 |
| CVE-2026-91051 | medium | 6.6 | No | The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a ser... | 2026-09-30 |
| CVE-2026-90953 | medium | 4.3 | No | The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read REST routes, allowin... | 2026-09-30 |
| CVE-2026-89193 | high | 7.5 | No | The Robin Image Optimizer WordPress plugin before 2.0.8 does not escape values that its bundled HTML parser re-emits into element attributes... | 2026-09-30 |
| CVE-2026-89190 | medium | 4.3 | No | The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin f... | 2026-09-30 |
| CVE-2026-88797 | high | 7.1 | No | The Vayu X WordPress theme before 1.0.6 does not perform any capability check on one of its AJAX actions and exposes the nonce guarding it t... | 2026-09-30 |
| CVE-2026-88791 | low | 3.4 | No | The Safe Redirect Manager WordPress plugin before 2.3.0 does not properly validate the redirect destination when a wildcard redirect rule to... | 2026-09-30 |
| CVE-2026-87777 | medium | 6.8 | No | The Hostinger Reach WordPress plugin before 1.8.3 does not sanitize and escape a widget setting before outputting it in the editor preview,... | 2026-09-30 |
| CVE-2026-86789 | medium | 5.3 | No | The Connections Business Directory WordPress plugin through 10.4.67 does not apply its visibility and moderation-status restrictions on cert... | 2026-09-30 |
| CVE-2026-85576 | medium | 4.3 | No | The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the r... | 2026-09-30 |
| CVE-2026-85573 | high | 8.8 | No | The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files... | 2026-09-30 |
| CVE-2026-85415 | medium | 6.8 | No | The Audio Player Block WordPress plugin before 1.6.3 does not validate the scheme of a user-supplied URL before using it as a link target, a... | 2026-09-30 |
| CVE-2026-85001 | medium | 6.8 | No | The EmbedPress WordPress plugin before 4.6.7 does not sanitise and escape one of its Elementor widget settings before outputting it into an... | 2026-09-30 |
| CVE-2026-83560 | medium | 5.3 | No | The New User Approve WordPress plugin before 3.2.10 does not properly verify authentication on a set of integration REST API routes when the... | 2026-09-30 |
| CVE-2026-82127 | low | 3.5 | No | The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields... | 2026-09-30 |
| CVE-2026-80333 | medium | 5.3 | No | The Solace Extra WordPress plugin before 1.7.2 does not perform any authorization or post-status checks on its front-end preview routes, all... | 2026-09-30 |
| CVE-2026-75873 | critical | 9.8 | No | The Zella Theme WordPress theme before 2.6.3 does not perform any capability or nonce check on one of its font upload actions, which is avai... | 2026-09-30 |
| CVE-2026-75824 | medium | 5.3 | No | The User Frontend WordPress plugin before 4.3.12 does not check whether the site allows user registration before creating an account, allowi... | 2026-09-30 |
| CVE-2026-75823 | high | 7.4 | No | The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauth... | 2026-09-30 |