Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-86839 | low | 3.8 | No | The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records reque... | 2026-09-28 |
| CVE-2026-86609 | high | 8.8 | No | The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its email-locked download subscriptio... | 2026-09-28 |
| CVE-2026-85002 | medium | 6.8 | No | The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an HTML attribute, whic... | 2026-09-28 |
| CVE-2026-84069 | medium | 5.3 | No | The WebFacing™ WordPress plugin before 5.4 does not restrict access to one of its bundled scripts and does not validate a user-supplied path... | 2026-09-28 |
| CVE-2026-82841 | medium | 5.3 | No | The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration Plugin WordPress plugin bef... | 2026-09-28 |
| CVE-2026-81655 | high | 7.5 | No | The Ad Inserter WordPress plugin before 2.8.19 does not correctly restrict access to one of its settings pages, making it reachable by every... | 2026-09-28 |
| CVE-2026-92411 | medium | 6.8 | No | The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data bef... | 2026-09-28 |
| CVE-2026-89237 | medium | 6.8 | No | The Bluff Post WordPress plugin through 1.1.1 does not sanitise and escape parameters before using them as identifiers in a SQL query, allow... | 2026-09-28 |
| CVE-2026-85081 | high | 7.5 | No | The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3... | 2026-09-28 |
| CVE-2026-84097 | medium | 6.5 | No | The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a ca... | 2026-09-28 |
| CVE-2026-84096 | high | 8.0 | No | The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on the AJAX handler that saves its review submi... | 2026-09-28 |
| CVE-2026-84095 | high | 8.0 | No | The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on one of its AJAX handlers, and the nonce prot... | 2026-09-28 |
| CVE-2026-19708 | medium | 5.9 | No | The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database backup archives, and in... | 2026-09-28 |
| CVE-2026-100383 | not reported | — | No | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki... | 2026-09-28 |
| CVE-2026-100382 | not reported | — | No | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Wikimedia Foundation Mediawiki -... | 2026-09-28 |
| CVE-2026-100381 | not reported | — | No | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki... | 2026-09-28 |
| CVE-2026-100380 | not reported | — | No | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki... | 2026-09-28 |
| CVE-2026-100379 | not reported | — | No | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Wikipedia Android App allows Accessing/Inte... | 2026-09-28 |
| CVE-2026-100378 | not reported | — | No | Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - Translate Extension allows Accessing Functionality Not Properly Cons... | 2026-09-28 |
| CVE-2026-100377 | not reported | — | No | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Exc... | 2026-09-28 |