Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-84088 | medium | 6.8 | No | The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link setting before storin... | 2026-09-17 |
| CVE-2026-82126 | low | 2.7 | No | The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check that a user is allowed to edit the specific post they... | 2026-09-17 |
| CVE-2026-83420 | high | 7.8 | No | Vulnerability in the PeopleSoft Enterprise FIN Engineering Brazil product of Oracle PeopleSoft (component: Engineering). The supported versi... | 2026-09-17 |
| CVE-2026-83353 | high | 7.8 | No | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are a... | 2026-09-17 |
| CVE-2026-83342 | high | 7.8 | No | Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: System Wide). Supported... | 2026-09-17 |
| CVE-2026-83118 | high | 7.8 | No | Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities). Supported versions that are affected are... | 2026-09-17 |
| CVE-2026-82125 | medium | 5.3 | No | The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not correctly verify the ownership or the moderation status of a... | 2026-09-17 |
| CVE-2026-82124 | medium | 5.3 | No | The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check whether a post is password protected before including... | 2026-09-17 |
| CVE-2026-78474 | medium | 5.3 | No | The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not have any authentication or authorisation checks on one of its report-... | 2026-09-17 |
| CVE-2026-78472 | high | 8.6 | No | The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement, a... | 2026-09-17 |
| CVE-2026-77702 | medium | 5.3 | No | The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's t... | 2026-09-17 |
| CVE-2026-76559 | medium | 4.1 | No | The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, a... | 2026-09-17 |
| CVE-2026-76558 | medium | 6.8 | No | The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting the... | 2026-09-17 |
| CVE-2026-76557 | medium | 6.8 | No | The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration values before using... | 2026-09-17 |
| CVE-2026-76556 | medium | 6.8 | No | The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them i... | 2026-09-17 |
| CVE-2026-76555 | medium | 6.8 | No | The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it and copying it into a... | 2026-09-17 |
| CVE-2026-76553 | medium | 6.5 | No | The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively d... | 2026-09-17 |
| CVE-2026-53681 | not reported | — | No | Rejected reason: Red Hat Product Security has come to the conclusion that this CVE is not needed. | 2026-09-17 |
| CVE-2026-76552 | high | 8.8 | No | The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-... | 2026-09-17 |
| CVE-2026-76551 | high | 7.2 | No | The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allow... | 2026-09-17 |