Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-81571 | medium | 4.8 | No | The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shor... | 2026-09-03 |
| CVE-2026-78153 | medium | 5.3 | No | The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its conte... | 2026-09-03 |
| CVE-2026-77794 | medium | 5.3 | No | The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate a client-supplied quantity multiplier when calculating the total pri... | 2026-09-03 |
| CVE-2026-77793 | medium | 5.3 | No | The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate the total price of a paid registration server-side, allowing unauthe... | 2026-09-03 |
| CVE-2026-77009 | critical | 9.9 | No | The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code,... | 2026-09-03 |
| CVE-2026-4357 | critical | 10.0 | No | The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be upl... | 2026-09-03 |
| CVE-2026-2811 | medium | 5.4 | No | The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output es... | 2026-09-03 |
| CVE-2026-2688 | medium | 6.5 | No | The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX reques... | 2026-09-03 |
| CVE-2026-19698 | low | 3.5 | No | The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before using them to build the CS... | 2026-09-03 |
| CVE-2026-17563 | medium | 5.3 | No | The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submis... | 2026-09-03 |
| CVE-2026-14326 | low | 3.8 | No | The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing... | 2026-09-03 |
| CVE-2026-10821 | medium | 6.6 | No | The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the s... | 2026-09-03 |
| CVE-2026-82183 | high | 8.1 | No | The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Steam single sign-on flow, all... | 2026-09-03 |
| CVE-2026-81807 | high | 8.8 | No | The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before rendering it, allowing unauthenticated use... | 2026-09-03 |
| CVE-2026-81737 | high | 8.8 | No | The FAQ Builder AYS WordPress plugin before 1.8.5 does not sanitize or escape content submitted by unauthenticated visitors before storing i... | 2026-09-03 |
| CVE-2026-81583 | medium | 5.4 | No | The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite ins... | 2026-09-03 |
| CVE-2026-81432 | medium | 4.3 | No | The JetStyleManager for Gutenberg WordPress plugin before 1.3.9 does not have CSRF protection on some of its AJAX actions, allowing attacker... | 2026-09-03 |
| CVE-2026-81428 | medium | 6.5 | No | The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variati... | 2026-09-03 |
| CVE-2026-81427 | medium | 4.3 | No | The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the... | 2026-09-03 |
| CVE-2026-81426 | medium | 4.3 | No | The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which c... | 2026-09-03 |