Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-96450 | medium | 5.4 | No | Contributor Cross Site Scripting (XSS) in pixfort Core < 4.3.3 versions. | 2026-09-30 |
| CVE-2026-96352 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in YITH WooCommerce Ajax Search <= 2.28.0 versions. | 2026-09-30 |
| CVE-2026-96351 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 6.1.3 versions. | 2026-09-30 |
| CVE-2026-96350 | critical | 9.8 | No | Subscriber Privilege Escalation in Estatik <= 4.3.5 versions. | 2026-09-30 |
| CVE-2026-96349 | critical | 10.0 | No | Unauthenticated Remote Code Execution (RCE) in SiteSkite <= 2.1.8 versions. | 2026-09-30 |
| CVE-2026-96348 | high | 7.5 | No | Unauthenticated Broken Access Control in Bookly <= 28.2 versions. | 2026-09-30 |
| CVE-2026-96347 | medium | 6.5 | No | Subscriber Insecure Direct Object References (IDOR) in Bookly <= 28.2 versions. | 2026-09-30 |
| CVE-2026-96346 | high | 7.6 | No | Author SQL Injection in WP ERP <= 1.17.9 versions. | 2026-09-30 |
| CVE-2026-96345 | high | 7.6 | No | Administrator SQL Injection in Estatik <= 4.3.5 versions. | 2026-09-30 |
| CVE-2026-96344 | high | 7.2 | No | Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions. | 2026-09-30 |
| CVE-2026-96343 | high | 7.2 | No | Custom role PHP Object Injection in WP ERP <= 1.17.9 versions. | 2026-09-30 |
| CVE-2026-96342 | not reported | — | No | Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Retrieve Embedded Sensitive Data.This issue affects WPMobile... | 2026-09-30 |
| CVE-2026-96338 | medium | 6.5 | No | Subscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.2 versions. | 2026-09-30 |
| CVE-2026-95587 | high | 7.5 | No | Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions. | 2026-09-30 |
| CVE-2026-95531 | high | 8.8 | No | Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions. | 2026-09-30 |
| CVE-2026-95104 | high | 7.5 | No | Stack-based buffer overflow vulnerability exists in BUFFALO Wi-Fi products. A non-authenticated crafted HTTP request may cause a denial-of-s... | 2026-09-30 |
| CVE-2026-94683 | high | 8.8 | No | Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions. | 2026-09-30 |
| CVE-2026-94681 | medium | 5.9 | No | Unauthenticated Denial of Service Attack in WP Store Locator < 3.0.0 versions. | 2026-09-30 |
| CVE-2026-94678 | high | 8.8 | No | Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions. | 2026-09-30 |
| CVE-2026-94677 | high | 7.2 | No | Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions. | 2026-09-30 |