Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-85414 | medium | 6.4 | No | The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute in all... | 2026-09-08 |
| CVE-2026-83625 | high | 7.2 | No | The Contact Form by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via IP Address Header in all versions up to,... | 2026-09-08 |
| CVE-2026-81543 | high | 8.8 | No | The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.7... | 2026-09-08 |
| CVE-2026-75586 | medium | 6.1 | No | The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'formData[id]' Parameter in al... | 2026-09-08 |
| CVE-2026-75018 | medium | 4.3 | No | The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16. This is due... | 2026-09-08 |
| CVE-2026-78438 | high | 7.2 | No | The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via LazyLoad Background Mutator in... | 2026-09-08 |
| CVE-2026-4361 | medium | 5.0 | No | The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.27.6. This is due to the `... | 2026-09-08 |
| CVE-2026-3853 | medium | 6.4 | No | The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the `image_src` attribute of the `et_pb_video_slider... | 2026-09-08 |
| CVE-2026-18843 | medium | 6.1 | No | The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'no_results_message' no... | 2026-09-08 |
| CVE-2026-18406 | high | 7.2 | No | The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scriptin... | 2026-09-08 |
| CVE-2026-14975 | medium | 6.5 | No | The WP File Download plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.8 via the 'remoteur... | 2026-09-08 |
| CVE-2026-8625 | medium | 6.4 | No | The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t... | 2026-09-08 |
| CVE-2026-8623 | medium | 6.4 | No | The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t... | 2026-09-08 |
| CVE-2026-83628 | medium | 4.3 | No | The Theme My Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.1.15 on Multisite install... | 2026-09-08 |
| CVE-2026-83627 | critical | 9.8 | No | The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulnerable to Remote Code Execution in all ver... | 2026-09-08 |
| CVE-2026-18404 | medium | 6.4 | No | The Social Chat – Click To Chat App Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'consent_message' JSON Attr... | 2026-09-08 |
| CVE-2026-13447 | critical | 9.8 | No | The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is... | 2026-09-08 |
| CVE-2026-85637 | medium | 5.3 | No | A security flaw has been discovered in jofpin trape 1.0.0/2.0. Affected by this issue is the function join_room of the file core/sockets.py... | 2026-09-08 |
| CVE-2026-85522 | medium | 5.3 | No | A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of th... | 2026-09-08 |
| CVE-2026-85517 | medium | 5.3 | No | A flaw has been found in code-projects Vehicle Management System 1.0. The impacted element is an unknown function of the file /vehicle_manag... | 2026-09-08 |