Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-85117 | medium | 6.5 | No | The Contact Form 7 Captcha WordPress plugin before 0.1.9 runs the shortcode parser over the whole rendered Contact Form 7 form, including th... | 2026-09-09 |
| CVE-2026-85418 | medium | 5.4 | No | The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.9 does not validate a... | 2026-09-09 |
| CVE-2026-85133 | medium | 5.4 | No | The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its settings AJAX actions, a... | 2026-09-09 |
| CVE-2026-85132 | medium | 4.3 | No | The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on one of its cookie scanner AJAX actions,... | 2026-09-09 |
| CVE-2026-85037 | medium | 5.3 | No | The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purc... | 2026-09-09 |
| CVE-2026-83537 | medium | 5.3 | No | The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an or... | 2026-09-09 |
| CVE-2026-84222 | medium | 5.3 | No | The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its pa... | 2026-09-09 |
| CVE-2026-84113 | medium | 4.1 | No | The Quentn WP WordPress plugin before 1.2.15 does not properly sanitise and escape a parameter before using it in an SQL query, allowing hig... | 2026-09-09 |
| CVE-2026-84068 | high | 8.6 | No | The Quentn WP WordPress plugin before 1.2.15 does not adequately escape a request parameter before using it in an unprepared SQL query, allo... | 2026-09-09 |
| CVE-2026-83541 | medium | 6.8 | No | The Sina Extension for Elementor WordPress plugin before 3.10.4 does not properly escape a Table widget setting before outputting it within... | 2026-09-09 |
| CVE-2026-82848 | medium | 5.3 | No | The Masteriyo LMS WordPress plugin before 3.4.0 does not perform any authorization check before returning a course enrolment record over its... | 2026-09-09 |
| CVE-2026-82185 | medium | 4.3 | No | The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have capability or nonce checks on some of its A/B testing actions, allowing... | 2026-09-09 |
| CVE-2026-82184 | medium | 5.3 | No | The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have any authorisation or CSRF checks when storing visitor consent state, and... | 2026-09-09 |
| CVE-2026-81741 | medium | 4.7 | No | The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.7.2 does not restrict the redirect target of its email... | 2026-09-09 |
| CVE-2026-81022 | medium | 5.3 | No | The SupportCandy WordPress plugin before 3.5.3 does not validate a submitted per-ticket authorization code before disclosing the real code t... | 2026-09-09 |
| CVE-2026-80440 | medium | 4.8 | No | The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes tho... | 2026-09-09 |
| CVE-2026-81021 | medium | 5.3 | No | The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket attachment download path... | 2026-09-09 |
| CVE-2026-80341 | medium | 5.9 | No | The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not verify that a stored payment method belongs to the user a... | 2026-09-09 |
| CVE-2026-80340 | medium | 5.3 | No | The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not validate the order key before adding order data to the Ja... | 2026-09-09 |
| CVE-2026-80339 | medium | 5.3 | No | The Payment Plugins for Stripe WooCommerce WordPress plugin before 4.0.12 does not validate the order key before adding order data to the Ja... | 2026-09-09 |