Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-95525 | medium | 6.5 | No | Subscriber Arbitrary File Deletion in WP User Frontend <= 4.3.11 versions. | 2026-09-23 |
| CVE-2026-95523 | medium | 6.5 | No | Subscriber Bypass Vulnerability in WP User Frontend <= 4.3.11 versions. | 2026-09-23 |
| CVE-2026-95515 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions. | 2026-09-23 |
| CVE-2026-95514 | medium | 5.3 | No | Unauthenticated Bypass Vulnerability in Netgsm <= 2.10.0 versions. | 2026-09-23 |
| CVE-2026-94680 | medium | 6.5 | No | Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions. | 2026-09-23 |
| CVE-2026-94679 | medium | 5.4 | No | Subscriber Broken Access Control in Fluent Support <= 2.3.2 versions. | 2026-09-23 |
| CVE-2026-94500 | medium | 6.5 | No | Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4.0.5 versions. | 2026-09-23 |
| CVE-2026-94487 | high | 8.1 | No | Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <= 2.50.1 versions. | 2026-09-23 |
| CVE-2026-94461 | medium | 6.5 | No | Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions. | 2026-09-23 |
| CVE-2026-94391 | medium | 6.5 | No | Contributor Cross Site Scripting (XSS) in Ultimate FAQ <= 2.4.14 versions. | 2026-09-23 |
| CVE-2026-94176 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.1 versions. | 2026-09-23 |
| CVE-2026-94174 | high | 7.6 | No | Administrator SQL Injection in Email Log <= 2.63 versions. | 2026-09-23 |
| CVE-2026-94124 | high | 8.5 | No | Contributor SQL Injection in WP EasyCart <= 5.9.4 versions. | 2026-09-23 |
| CVE-2026-94080 | medium | 5.3 | No | Unauthenticated Broken Access Control in MarketKing <= 2.1.70 versions. | 2026-09-23 |
| CVE-2026-94079 | medium | 5.3 | No | Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions. | 2026-09-23 |
| CVE-2026-93773 | high | 8.5 | No | Contributor SQL Injection in Mollie Forms <= 2.11.0 versions. | 2026-09-23 |
| CVE-2026-93623 | medium | 5.3 | No | Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 versions. | 2026-09-23 |
| CVE-2026-93622 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login <= 1.5.9.3 versions. | 2026-09-23 |
| CVE-2026-93618 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetTricks al... | 2026-09-23 |
| CVE-2026-93527 | high | 8.5 | No | Contributor SQL Injection in Live Copy Paste for Elementor <= 1.5.10 versions. | 2026-09-23 |