Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-96514 | high | 7.3 | No | A weakness has been identified in Neethuharii CafeManagement. Impacted is an unknown function of the file CafePortalLogin.php of the compone... | 2026-09-23 |
| CVE-2026-95530 | medium | 6.5 | No | Subscriber Cross Site Scripting (XSS) in PixelYourSite – Your smart PIXEL (TAG) Manager <= 11.4.1 versions. | 2026-09-23 |
| CVE-2026-95528 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booster <= 1.0.31 versions. | 2026-09-23 |
| CVE-2026-95524 | medium | 5.3 | No | Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions. | 2026-09-23 |
| CVE-2026-95522 | high | 7.6 | No | Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions. | 2026-09-23 |
| CVE-2026-95513 | high | 7.5 | No | Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 versions. | 2026-09-23 |
| CVE-2026-94682 | medium | 6.5 | No | Contributor Cross Site Scripting (XSS) in Podcast Importer SecondLine <= 1.5.6 versions. | 2026-09-23 |
| CVE-2026-94671 | medium | 6.5 | No | Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions. | 2026-09-23 |
| CVE-2026-94498 | medium | 6.5 | No | Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions. | 2026-09-23 |
| CVE-2026-94457 | medium | 4.8 | No | Unauthenticated Bypass Vulnerability in Captcha Code <= 3.32 versions. | 2026-09-23 |
| CVE-2026-94179 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 versions. | 2026-09-23 |
| CVE-2026-94168 | medium | 6.5 | No | Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions. | 2026-09-23 |
| CVE-2026-94118 | medium | 6.5 | No | Contributor Cross Site Scripting (XSS) in Premium Blocks – Gutenberg Blocks for WordPress <= 2.3.17 versions. | 2026-09-23 |
| CVE-2026-93774 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.002 versions. | 2026-09-23 |
| CVE-2026-93772 | medium | 6.5 | No | Subscriber Cross Site Scripting (XSS) in wpForo Forum <= 3.1.5 versions. | 2026-09-23 |
| CVE-2026-93709 | medium | 5.3 | No | Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage han... | 2026-09-23 |
| CVE-2026-93620 | medium | 6.5 | No | Unauthenticated Broken Access Control in PayPlus Payment Gateway <= 8.2.5 versions. | 2026-09-23 |
| CVE-2026-93529 | medium | 6.5 | No | Contributor Broken Access Control in WSP MCP – AI Agents Connector <= 2.7.0 versions. | 2026-09-23 |
| CVE-2026-93526 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions. | 2026-09-23 |
| CVE-2026-93513 | medium | 4.3 | No | Contributor Insecure Direct Object References (IDOR) in SiteSkite <= 2.1.7 versions. | 2026-09-23 |