Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-88993 | medium | 6.8 | No | The All Bootstrap Blocks WordPress plugin through 1.3.31 does not properly escape a block attribute before outputting it in HTML tag-name po... | 2026-09-18 |
| CVE-2026-88844 | low | 2.7 | No | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returnin... | 2026-09-18 |
| CVE-2026-88825 | high | 8.8 | No | The iGMS Direct Booking WordPress plugin before 2.0 does not authorise or escape its widget appearance settings, allowing unauthenticated us... | 2026-09-18 |
| CVE-2026-88798 | medium | 5.3 | No | The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key... | 2026-09-18 |
| CVE-2026-87966 | medium | 5.3 | No | The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointmen... | 2026-09-18 |
| CVE-2026-87965 | medium | 4.8 | No | The Easy Appointments WordPress plugin before 4.0.2.2 does not use an unguessable token to authorize its mail-link appointment cancellation... | 2026-09-18 |
| CVE-2026-87775 | high | 8.6 | No | The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on... | 2026-09-18 |
| CVE-2026-87774 | high | 8.6 | No | The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on... | 2026-09-18 |
| CVE-2026-87771 | high | 8.6 | No | The Product Question and Answer WordPress plugin through 1.1.0 does not sanitize and escape parameters before using them in SQL queries on A... | 2026-09-18 |
| CVE-2026-87770 | high | 8.6 | No | The Price Drop Alert for Woo Commerce WordPress plugin through 1.1 does not sanitize and escape parameters before using them in a SQL query... | 2026-09-18 |
| CVE-2026-87767 | high | 8.6 | No | The wp shortcut link and advertisement baner WordPress plugin through 1.2.0 does not sanitize and escape a parameter before using it in a SQ... | 2026-09-18 |
| CVE-2026-85350 | medium | 5.3 | No | The UpsellWP WordPress plugin before 2.2.10 does not check that products added to the cart through a Frequently Bought Together campaign bel... | 2026-09-18 |
| CVE-2026-85127 | high | 8.8 | No | The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.8.15 does not restrict the type of files unauthenticated visitors may at... | 2026-09-18 |
| CVE-2026-85123 | medium | 5.3 | No | The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for... | 2026-09-18 |
| CVE-2026-85122 | high | 8.8 | No | The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for... | 2026-09-18 |
| CVE-2026-85009 | medium | 6.5 | No | The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied or... | 2026-09-18 |
| CVE-2026-84904 | low | 3.8 | No | The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimizat... | 2026-09-18 |
| CVE-2026-84903 | low | 2.7 | No | The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password check before renderi... | 2026-09-18 |
| CVE-2026-84902 | medium | 6.8 | No | The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level authorization check when importing template c... | 2026-09-18 |
| CVE-2026-84738 | critical | 9.1 | No | The AF Companion WordPress plugin before 2.2.0 does not validate the type of files uploaded through one of its import features, allowing use... | 2026-09-18 |