Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-81810 | high | 7.2 | No | The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not perform any capability check on several of its AJAX actions, g... | 2026-09-18 |
| CVE-2026-81340 | low | 3.8 | No | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating... | 2026-09-18 |
| CVE-2026-87831 | medium | 4.3 | No | The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an a... | 2026-09-18 |
| CVE-2026-87829 | medium | 4.3 | No | The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an a... | 2026-09-18 |
| CVE-2026-91017 | low | 3.7 | No | The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notificatio... | 2026-09-18 |
| CVE-2026-86801 | high | 8.8 | No | The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress and therefore applies... | 2026-09-18 |
| CVE-2026-91019 | medium | 4.9 | No | The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configurat... | 2026-09-18 |
| CVE-2026-91016 | medium | 5.3 | No | The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published listings before retur... | 2026-09-18 |
| CVE-2026-91015 | medium | 5.3 | No | The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates it... | 2026-09-18 |
| CVE-2026-91014 | high | 7.1 | No | The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its parameters before r... | 2026-09-18 |
| CVE-2026-91011 | medium | 6.8 | No | The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowin... | 2026-09-18 |
| CVE-2026-91010 | medium | 4.3 | No | The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the user's capabilities... | 2026-09-18 |
| CVE-2026-91009 | medium | 4.3 | No | The Active Woot Products Tables for WooCommerce. 100% FREE WordPress plugin before 2.1.3 does not have authorisation and CSRF checks in some... | 2026-09-18 |
| CVE-2026-91008 | low | 3.7 | No | The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before renderin... | 2026-09-18 |
| CVE-2026-90923 | medium | 6.5 | No | The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to... | 2026-09-18 |
| CVE-2026-90922 | medium | 5.3 | No | The Paid Membership Subscriptions WordPress plugin before 3.0.9 does not verify that the amount and currency reported by the payment provide... | 2026-09-18 |
| CVE-2026-88904 | high | 8.8 | No | The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a ca... | 2026-09-18 |
| CVE-2026-88795 | critical | 9.0 | No | The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from dat... | 2026-09-18 |
| CVE-2026-88792 | high | 8.8 | No | The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionar... | 2026-09-18 |
| CVE-2026-87836 | low | 2.7 | No | The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scop... | 2026-09-18 |