Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-92435 | medium | 5.3 | No | The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the pe... | 2026-09-21 |
| CVE-2026-92430 | medium | 5.3 | No | The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX... | 2026-09-21 |
| CVE-2026-92425 | medium | 5.5 | No | The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation chec... | 2026-09-21 |
| CVE-2026-92421 | medium | 4.7 | No | The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modif... | 2026-09-21 |
| CVE-2026-92420 | low | 3.8 | No | The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the re... | 2026-09-21 |
| CVE-2026-92404 | high | 7.5 | No | The MgoSync WordPress plugin before 2.1.7 does not have authorization controls on one of its REST API endpoints, allowing unauthenticated us... | 2026-09-21 |
| CVE-2026-92403 | low | 3.7 | No | The Secure Custom Fields WordPress plugin before 6.9.4 does not properly verify that a front-end form submission corresponds to the form tha... | 2026-09-21 |
| CVE-2026-92099 | medium | 6.5 | No | The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before... | 2026-09-21 |
| CVE-2026-91847 | medium | 4.8 | No | The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester owns the AI booking-ass... | 2026-09-21 |
| CVE-2026-88926 | high | 8.6 | No | The VikRentItems Flexible Rental Management System WordPress plugin before 1.2.4 does not sanitise and escape some of its parameters before... | 2026-09-21 |
| CVE-2026-88824 | high | 8.8 | No | The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST routes, allowing unauthenticated users to upd... | 2026-09-21 |
| CVE-2026-86814 | high | 8.1 | No | The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before u... | 2026-09-21 |
| CVE-2026-86591 | critical | 9.8 | No | The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated u... | 2026-09-21 |
| CVE-2026-85680 | high | 8.8 | No | The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in... | 2026-09-21 |
| CVE-2026-85574 | high | 8.0 | No | The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-... | 2026-09-21 |
| CVE-2026-84750 | medium | 6.5 | No | The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of... | 2026-09-21 |
| CVE-2026-76790 | high | 7.1 | No | The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter be... | 2026-09-21 |
| CVE-2026-76554 | high | 7.2 | No | The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify us... | 2026-09-21 |
| CVE-2026-19860 | medium | 5.5 | No | The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.3 does not sufficiently restrict which PHP functions can be u... | 2026-09-21 |
| CVE-2026-16557 | medium | 4.3 | No | The Nimble Page Builder WordPress plugin through 3.3.8 does not perform an authorization check when returning page-builder content through a... | 2026-09-21 |