Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-78295 | high | 8.8 | No | Unauthenticated Cross Site Request Forgery (CSRF) in Xagio SEO <= 7.1.0.43 versions. | 2026-09-17 |
| CVE-2026-74017 | medium | 5.3 | No | Unauthenticated Broken Access Control in User Registration <= 5.2.7 versions. | 2026-09-17 |
| CVE-2026-74005 | medium | 5.4 | No | Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Series <= 3.1.3 versions. | 2026-09-17 |
| CVE-2026-74000 | medium | 5.3 | No | Contributor Broken Access Control in Simple Membership <= 4.8.2 versions. | 2026-09-17 |
| CVE-2026-66676 | medium | 5.3 | No | Unauthenticated Broken Access Control in Easy Invoice <= 2.3.8 versions. | 2026-09-17 |
| CVE-2026-66631 | high | 7.6 | No | Administrator SQL Injection in MC Woocommerce Wishlist <= 1.9.21 versions. | 2026-09-17 |
| CVE-2026-66628 | high | 7.6 | No | Shop manager SQL Injection in WP-Lister Lite for eBay <= 3.8.11 versions. | 2026-09-17 |
| CVE-2026-66625 | high | 7.6 | No | Administrator SQL Injection in WC Vendors Marketplace <= 2.7.2.1 versions. | 2026-09-17 |
| CVE-2026-66624 | high | 7.6 | No | Administrator SQL Injection in WPMasterToolKit <= 2.22.0 versions. | 2026-09-17 |
| CVE-2026-66618 | high | 7.6 | No | Administrator SQL Injection in WP Maps <= 4.9.9 versions. | 2026-09-17 |
| CVE-2026-66608 | medium | 6.4 | No | Contributor Server Side Request Forgery (SSRF) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.19 versions. | 2026-09-17 |
| CVE-2026-66580 | high | 8.5 | No | Contributor SQL Injection in Product Feed Manager <= 7.12.0 versions. | 2026-09-17 |
| CVE-2026-66578 | medium | 6.5 | No | Contributor Cross Site Scripting (XSS) in PropertyHive <= 2.2.6 versions. | 2026-09-17 |
| CVE-2026-66576 | medium | 6.5 | No | Contributor Cross Site Scripting (XSS) in JetBlocks For Elementor <= 1.5.2 versions. | 2026-09-17 |
| CVE-2026-66575 | medium | 5.3 | No | Unauthenticated Insecure Direct Object References (IDOR) in King Addons for Elementor <= 51.1.81 versions. | 2026-09-17 |
| CVE-2026-66573 | medium | 6.5 | No | Contributor Cross Site Scripting (XSS) in JetTabs <= 2.3.3.1 versions. | 2026-09-17 |
| CVE-2026-66571 | high | 7.1 | No | Unauthenticated Cross Site Request Forgery (CSRF) in Asset CleanUp: Page Speed Booster <= 1.4.0.5 versions. | 2026-09-17 |
| CVE-2026-62108 | critical | 9.8 | No | Unauthenticated Broken Authentication in Headless Single Sign On <= 1.7.0 versions. | 2026-09-17 |
| CVE-2026-62101 | critical | 9.8 | No | Unauthenticated Broken Authentication in EduAdmin Booking <= 5.4.2 versions. | 2026-09-17 |
| CVE-2026-86311 | medium | 6.4 | No | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Shortco... | 2026-09-17 |