Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-94117 | high | 7.6 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems HashBar – WordPress Notificat... | 2026-09-22 |
| CVE-2026-9231 | high | 7.5 | No | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versio... | 2026-09-22 |
| CVE-2026-93928 | high | 7.3 | No | Authentication Bypass Using an Alternate Path or Channel vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce allows Authen... | 2026-09-22 |
| CVE-2026-15095 | medium | 4.9 | No | The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress is vulnerable to Director... | 2026-09-22 |
| CVE-2026-9004 | medium | 4.3 | No | The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to,... | 2026-09-22 |
| CVE-2026-93836 | high | 7.2 | No | The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qty' parameter in all ver... | 2026-09-22 |
| CVE-2026-93778 | high | 7.2 | No | The WP Yelp Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Yelp Review Text (imported via wpyelp_downlo... | 2026-09-22 |
| CVE-2026-92969 | high | 8.1 | No | The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, a... | 2026-09-22 |
| CVE-2026-92235 | high | 8.1 | No | The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.2.... | 2026-09-22 |
| CVE-2026-7622 | medium | 4.3 | No | The ThumbPress plugin for WordPress is vulnerable to unauthorized access in versions up to and including 6.2.1. This is due to missing capab... | 2026-09-22 |
| CVE-2026-6922 | high | 7.1 | No | The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and in... | 2026-09-22 |
| CVE-2026-4123 | medium | 4.3 | No | The RW Elephant Rental Inventory plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.3.13. Thi... | 2026-09-22 |
| CVE-2026-1645 | medium | 4.4 | No | The Hostel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_currency' parameter and the 'locale_url' settin... | 2026-09-22 |
| CVE-2026-18345 | medium | 4.3 | No | The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect... | 2026-09-22 |
| CVE-2026-16778 | medium | 6.4 | No | The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dslc_module_downlo... | 2026-09-22 |
| CVE-2026-12995 | medium | 4.3 | No | The Custom Field Template plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.8... | 2026-09-22 |
| CVE-2026-94504 | high | 7.2 | No | Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An... | 2026-09-22 |
| CVE-2026-93655 | medium | 6.1 | No | The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpbc_auto_fill' parameter in all versions... | 2026-09-22 |
| CVE-2026-85653 | medium | 6.4 | No | The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'other_attributes' Block Parameter in all... | 2026-09-22 |
| CVE-2026-12470 | high | 7.2 | No | The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to unauthorized modification of data that can l... | 2026-09-22 |