Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-93770 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions. | 2026-09-30 |
| CVE-2026-93651 | high | 7.2 | No | Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions. | 2026-09-30 |
| CVE-2026-93624 | high | 7.2 | No | Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions. | 2026-09-30 |
| CVE-2026-93621 | high | 8.2 | No | Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions. | 2026-09-30 |
| CVE-2026-93514 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5.2 versions. | 2026-09-30 |
| CVE-2026-93512 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress <= 2.3.11 versions. | 2026-09-30 |
| CVE-2026-81867 | not reported | — | No | A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Google Cloud Application Integration versions prior to 2026-06-2... | 2026-09-30 |
| CVE-2026-7172 | not reported | — | No | Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoint and parameter: * CVE-2026-7172: parameter 'Nombre Complet... | 2026-09-30 |
| CVE-2026-7171 | not reported | — | No | Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoint and parameter: * CVE-2026-7171: parameter 'Apellido 1' in... | 2026-09-30 |
| CVE-2026-7170 | not reported | — | No | Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoint and parameter: * CVE-2026-7170: parameter 'vendor_store_n... | 2026-09-30 |
| CVE-2026-62085 | high | 7.6 | No | Administrator SQL Injection in WP Activity Log <= 5.6.6 versions. | 2026-09-30 |
| CVE-2026-6223 | critical | 9.4 | No | Improper restriction of excessive authentication attempts vulnerability in Bahçelievler Muncipality BiHayat App allows Authentication Bypass... | 2026-09-30 |
| CVE-2026-62083 | medium | 5.4 | No | Subscriber Other Vulnerability Type in Creator LMS <= 1.2.19 versions. | 2026-09-30 |
| CVE-2026-62081 | medium | 5.4 | No | Contributor Insecure Direct Object References (IDOR) in Flexible PDF Coupons <= 1.14.11 versions. | 2026-09-30 |
| CVE-2026-62080 | medium | 6.5 | No | Contributor Cross Site Scripting (XSS) in Happy Addons for Elementor <= 3.23.1 versions. | 2026-09-30 |
| CVE-2026-62079 | medium | 6.5 | No | Contributor Cross Site Scripting (XSS) in Qi Addons For Elementor <= 1.11 versions. | 2026-09-30 |
| CVE-2026-62078 | medium | 6.5 | No | Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions. | 2026-09-30 |
| CVE-2026-27371 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions. | 2026-09-30 |
| CVE-2026-27085 | low | 2.7 | No | Shop manager Content Injection in Astra WordPress Theme <= 4.13.12 versions. | 2026-09-30 |
| CVE-2026-103117 | medium | 4.7 | No | A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function db_properties of the file functions/... | 2026-09-30 |