Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-86303 | high | 7.3 | No | A vulnerability was determined in 92181 markdown up to 058cab0cb7fb245a0ccc6b8446963ff8d573558f. Affected by this issue is the function lds... | 2026-09-08 |
| CVE-2026-85702 | high | 7.3 | No | A security vulnerability has been detected in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected is the fun... | 2026-09-08 |
| CVE-2026-2520 | medium | 5.4 | No | The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to... | 2026-09-08 |
| CVE-2026-17509 | medium | 6.5 | No | The WPML Multilingual CMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘elementIds’ parameter in all versions up t... | 2026-09-08 |
| CVE-2026-2390 | medium | 6.4 | No | The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load module's image processing in all versions u... | 2026-09-08 |
| CVE-2026-12757 | medium | 6.5 | No | The The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vuln... | 2026-09-08 |
| CVE-2026-84820 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.17 versions. | 2026-09-08 |
| CVE-2026-84818 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Open User Map <= 1.4.50 versions. | 2026-09-08 |
| CVE-2026-84817 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.1 versions. | 2026-09-08 |
| CVE-2026-81806 | high | 7.2 | No | Server-Side Request Forgery (SSRF) vulnerability in John Darrel Hide My WP Ghost allows Server Side Request Forgery. This issue affects Hid... | 2026-09-08 |
| CVE-2026-81802 | medium | 6.5 | No | Unauthenticated Insecure Direct Object References (IDOR) in WpEvently <= 5.6.0 versions. | 2026-09-08 |
| CVE-2026-81798 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Easy Appointments allows DOM-Based XSS... | 2026-09-08 |
| CVE-2026-81790 | high | 7.5 | No | Missing Authorization vulnerability in Viszt Péter Csomagpontok és szállítási címkék WooCommerce-hez allows Exploiting Incorrectly Configure... | 2026-09-08 |
| CVE-2026-81781 | high | 7.1 | No | Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce allows Exploiting Incorrectly Configured Access Control Secu... | 2026-09-08 |
| CVE-2026-48888 | high | 7.5 | No | Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows HTTP DoS. This issue affects WooCommerc... | 2026-09-08 |
| CVE-2026-75816 | critical | 9.8 | No | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and... | 2026-09-08 |
| CVE-2026-18056 | high | 7.5 | No | The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the access_token parameter in all versions up t... | 2026-09-08 |
| CVE-2026-16310 | critical | 9.8 | No | The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'i... | 2026-09-08 |
| CVE-2026-15550 | medium | 4.3 | No | The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This i... | 2026-09-08 |
| CVE-2026-12843 | medium | 5.4 | No | The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to the plugin not prope... | 2026-09-08 |