Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-18364 | medium | 4.3 | No | The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users wit... | 2026-09-23 |
| CVE-2026-16264 | medium | 6.5 | No | The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber management actions, and issues... | 2026-09-23 |
| CVE-2026-14321 | high | 8.2 | No | The divi-dash WordPress plugin before 1.0.7 does not validate the source of the client IP address it uses for rate limiting and banning, all... | 2026-09-23 |
| CVE-2022-4997 | high | 8.6 | No | The jet-form-builder-stripe-gateway WordPress plugin before 1.1.0 does not sanitise and escape a payment token before using it in a SQL stat... | 2026-09-23 |
| CVE-2026-78574 | medium | 6.3 | No | The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current user's hive without integrity v... | 2026-09-23 |
| CVE-2026-90950 | medium | 5.3 | No | The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not verify the reCAPTCHA on its registration handler when a form field... | 2026-09-23 |
| CVE-2026-93528 | low | 3.7 | No | The NP Quote Request for WooCommerce WordPress plugin before 2.4.16 does not verify order ownership before rendering an order's details, all... | 2026-09-23 |
| CVE-2026-93511 | medium | 5.3 | No | The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment and subscription not... | 2026-09-23 |
| CVE-2026-93510 | medium | 4.3 | No | The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call i... | 2026-09-23 |
| CVE-2026-93508 | high | 8.1 | No | The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authent... | 2026-09-23 |
| CVE-2026-93507 | low | 3.3 | No | The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, all... | 2026-09-23 |
| CVE-2026-91077 | low | 2.7 | No | The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting u... | 2026-09-23 |
| CVE-2026-91073 | medium | 6.8 | No | The Subscribe Forms WordPress plugin before 1.6.3 does not sanitise and escape one of its form settings before outputting it in a page, allo... | 2026-09-23 |
| CVE-2026-91025 | medium | 4.3 | No | The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before... | 2026-09-23 |
| CVE-2026-91024 | medium | 6.8 | No | The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before u... | 2026-09-23 |
| CVE-2026-90985 | medium | 5.3 | No | The WPC Smart Compare for WooCommerce WordPress plugin before 6.6.1 does not apply WordPress's post-password protection when returning produ... | 2026-09-23 |
| CVE-2026-90951 | low | 3.7 | No | The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting u... | 2026-09-23 |
| CVE-2026-89331 | medium | 5.3 | No | The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token-shared board feature... | 2026-09-23 |
| CVE-2026-88997 | medium | 6.8 | No | The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escape a post meta key before outputting it into an inline event-... | 2026-09-23 |
| CVE-2026-88929 | medium | 5.3 | No | The Product Badge, Label, Countdown Timer for WooCommerce WordPress plugin before 7.5.2 does not check whether a product is published before... | 2026-09-23 |