Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-86782 | medium | 5.5 | No | The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing users with the Contr... | 2026-09-11 |
| CVE-2026-86781 | medium | 5.3 | No | The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a ce... | 2026-09-11 |
| CVE-2026-86780 | medium | 6.8 | No | The Featured Image with URL WordPress plugin before 1.0.6 does not sanitise and escape a stored image attribute value before outputting it,... | 2026-09-11 |
| CVE-2026-86779 | low | 2.7 | No | The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability che... | 2026-09-11 |
| CVE-2026-85678 | medium | 6.8 | No | The AI Builder WordPress plugin before 2.7.8 does not sanitise custom JavaScript saved against a post before echoing it inside a script tag... | 2026-09-11 |
| CVE-2026-85677 | high | 8.8 | No | The Gutenverse News WordPress plugin before 3.3.3 does not restrict the extra HTML it adds to WordPress's allowed elements to the context it... | 2026-09-11 |
| CVE-2026-83546 | medium | 6.8 | No | The CoolClock WordPress plugin before 4.3.8 does not properly escape a skin setting before outputting it within an HTML attribute, allowing... | 2026-09-11 |
| CVE-2026-83545 | medium | 6.8 | No | The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, all... | 2026-09-11 |
| CVE-2026-82305 | medium | 5.3 | No | The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify that a user is authorised to rename a given wishlist, allowing... | 2026-09-11 |
| CVE-2026-74925 | high | 7.2 | No | The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding it... | 2026-09-11 |
| CVE-2026-14566 | medium | 4.3 | No | The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before updating Wo... | 2026-09-11 |
| CVE-2026-14565 | medium | 5.4 | No | The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before saving popu... | 2026-09-11 |
| CVE-2026-14563 | critical | 9.8 | No | The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a su... | 2026-09-11 |
| CVE-2026-14562 | medium | 5.3 | No | The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not perform any authorization or ownership checks before returning WooCom... | 2026-09-11 |
| CVE-2026-14560 | critical | 10.0 | No | The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied conten... | 2026-09-11 |
| CVE-2026-14559 | critical | 9.8 | No | The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's password before authenticating them, allowing unauthe... | 2026-09-11 |
| CVE-2026-89173 | medium | 5.3 | No | Smart Video Intercom System developed by Kingdom Communication Associated has a Sensitive Data Exposure vulnerability. Unauthenticated remot... | 2026-09-11 |
| CVE-2026-84960 | medium | 6.1 | No | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Query String in all versions u... | 2026-09-11 |
| CVE-2026-77150 | medium | 6.1 | No | The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data[name]' Parameter in all... | 2026-09-11 |
| CVE-2026-11446 | medium | 5.3 | No | The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of d... | 2026-09-11 |