Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-88846 | medium | 5.3 | No | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not check whether user registration is enabled on the site before c... | 2026-09-24 |
| CVE-2026-88845 | medium | 4.3 | No | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform any capability or nonce checks on an administrative mai... | 2026-09-24 |
| CVE-2026-88843 | high | 7.2 | No | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to b... | 2026-09-24 |
| CVE-2026-84151 | low | 3.5 | No | The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it... | 2026-09-24 |
| CVE-2026-82850 | medium | 4.3 | No | The Masteriyo LMS WordPress plugin before 3.4.2 does not restrict access to quiz answer keys, allowing any authenticated user, such as a stu... | 2026-09-24 |
| CVE-2026-82849 | medium | 4.3 | No | The Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user making the request owns the course-progress records being retu... | 2026-09-24 |
| CVE-2026-82195 | medium | 6.5 | No | The 10Web Booster WordPress plugin before 2.34.0 does not restrict access to the routine which issues the shared secret that authenticates i... | 2026-09-24 |
| CVE-2026-80513 | high | 7.5 | No | The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied prof... | 2026-09-24 |
| CVE-2026-80338 | medium | 6.8 | No | The CMB2 WordPress plugin before 2.13.0 does not perform any capability check on one of its AJAX actions, allowing users with a role as low... | 2026-09-24 |
| CVE-2026-74991 | medium | 6.8 | No | The WPForms WordPress plugin before 2.0.2 does not verify that a Stripe payment object supplied during a public form submission belongs to i... | 2026-09-24 |
| CVE-2026-86583 | high | 8.8 | No | The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2... | 2026-09-24 |
| CVE-2026-19125 | high | 8.1 | No | The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.5. This is d... | 2026-09-24 |
| CVE-2026-84091 | medium | 5.3 | No | The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not verify with the payment provider that a payment notificatio... | 2026-09-24 |
| CVE-2026-16302 | medium | 4.3 | No | The Spectra Legacy – Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includ... | 2026-09-24 |
| CVE-2026-15731 | medium | 6.4 | No | The WP Multilang – Translation and Multilingual Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post conten... | 2026-09-24 |
| CVE-2026-77193 | high | 7.5 | No | The eesy_ID2WP – Publish InDesign HTML5 plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.3 via... | 2026-09-24 |
| CVE-2026-96892 | medium | 4.3 | No | A flaw has been found in Edimax BR-6428nC 1.16. The impacted element is the function websRedirect of the component goform Handler. Executing... | 2026-09-24 |
| CVE-2026-96884 | medium | 6.3 | No | A security flaw has been discovered in MantisZip up to 0.4.5. Affected by this issue is the function Path.Combine of the file MainWindow.UI.... | 2026-09-24 |
| CVE-2026-96881 | medium | 5.3 | No | A vulnerability was determined in TaleLin lin-cms-spring-boot up to 0.2.1. Affected is the function getBooks of the file src/main/java/io/gi... | 2026-09-24 |
| CVE-2026-96880 | medium | 5.3 | No | A vulnerability was found in TaleLin lin-cms-spring-boot up to 0.2.1. This impacts the function getBook of the file src/main/java/io/github/... | 2026-09-24 |