Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-48707 | low | 3.1 | No | InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery (SSRF) vulnerabi... | 2026-09-11 |
| CVE-2026-19991 | high | 8.1 | No | The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the upload_file_remov... | 2026-09-11 |
| CVE-2026-2310 | high | 7.8 | No | IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable to an XML external entity injection (XXE) attack when proces... | 2026-09-11 |
| CVE-2026-19946 | medium | 4.3 | No | The Awesome Support plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.3.9. This is due to a mi... | 2026-09-11 |
| CVE-2026-18579 | high | 7.2 | No | The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_X_FORWARDED_FOR' parameter in all ve... | 2026-09-11 |
| CVE-2026-18561 | high | 7.5 | No | The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, an... | 2026-09-11 |
| CVE-2026-11496 | medium | 6.5 | No | The Woo PDF Invoice Builder plugin (also distributed as "PDF Builder for WooCommerce") for WordPress is vulnerable to Insecure Direct Object... | 2026-09-11 |
| CVE-2026-15823 | medium | 4.3 | No | The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t... | 2026-09-11 |
| CVE-2026-19797 | medium | 6.1 | No | The User Access Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab_group_section' parameter in all ve... | 2026-09-11 |
| CVE-2026-15406 | high | 7.5 | No | The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion... | 2026-09-11 |
| CVE-2026-62139 | medium | 4.3 | No | Unauthenticated Cross Site Request Forgery (CSRF) in Site Kit by Google <= 1.186.0 versions. | 2026-09-11 |
| CVE-2026-62138 | medium | 6.5 | No | Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.1 versions. | 2026-09-11 |
| CVE-2026-62134 | medium | 4.3 | No | Contributor Insecure Direct Object References (IDOR) in Starter Templates <= 4.7.5 versions. | 2026-09-11 |
| CVE-2026-62133 | medium | 5.4 | No | Subscriber Cross Site Request Forgery (CSRF) in RTMKit <= 2.1.5 versions. | 2026-09-11 |
| CVE-2026-62112 | high | 7.6 | No | Editor SQL Injection in Amelia <= 2.4.9 versions. | 2026-09-11 |
| CVE-2026-62111 | medium | 6.5 | No | Contributor Cross Site Scripting (XSS) in Simple Payment <= 2.5.4 versions. | 2026-09-11 |
| CVE-2026-62106 | high | 8.8 | No | Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.9 versions. | 2026-09-11 |
| CVE-2026-62105 | critical | 9.8 | No | Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions. | 2026-09-11 |
| CVE-2026-27378 | medium | 5.3 | No | Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCommerce <= 3.1.0 versions. | 2026-09-11 |
| CVE-2026-84651 | medium | 6.3 | No | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a subm... | 2026-09-11 |