Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-81199 | medium | 5.3 | No | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning a student's lea... | 2026-09-03 |
| CVE-2026-81198 | low | 3.8 | No | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of a curriculum object before acting... | 2026-09-03 |
| CVE-2026-81197 | medium | 5.3 | No | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses,... | 2026-09-03 |
| CVE-2026-81196 | low | 2.7 | No | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of quiz question identifiers, allowin... | 2026-09-03 |
| CVE-2026-81195 | medium | 5.3 | No | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning per-student cou... | 2026-09-03 |
| CVE-2026-81194 | medium | 4.3 | No | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify authorization when retrieving order line-item d... | 2026-09-03 |
| CVE-2026-80467 | high | 8.1 | No | The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms t... | 2026-09-03 |
| CVE-2026-79621 | medium | 4.3 | No | The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it in... | 2026-09-03 |
| CVE-2026-78151 | medium | 5.3 | No | The FormLayer WordPress plugin before 1.0.9 does not perform any authorization check before returning a form's full stored configuration in... | 2026-09-03 |
| CVE-2026-77792 | high | 7.5 | No | The RegistrationMagic WordPress plugin before 6.0.9.9 does not escape a registration form field value before outputting it in an HTML attrib... | 2026-09-03 |
| CVE-2026-77788 | medium | 4.9 | No | The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the object the user was aut... | 2026-09-03 |
| CVE-2026-77787 | low | 2.7 | No | The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and... | 2026-09-03 |
| CVE-2026-77785 | low | 2.7 | No | The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the requesting user is permitted to read the specific post referenced... | 2026-09-03 |
| CVE-2026-77784 | low | 2.7 | No | The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modified before updating i... | 2026-09-03 |
| CVE-2026-77783 | low | 3.7 | No | The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewabl... | 2026-09-03 |
| CVE-2026-77782 | medium | 5.3 | No | The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build pu... | 2026-09-03 |
| CVE-2026-77764 | medium | 4.3 | No | The GamiPress WordPress plugin before 7.9.9.6 does not properly restrict its video watch-tracking functionality, allowing users with a role... | 2026-09-03 |
| CVE-2026-74927 | medium | 5.3 | No | The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API listing routes, allowing... | 2026-09-03 |
| CVE-2026-19723 | high | 7.1 | No | The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properly escape a value taken from the incoming... | 2026-09-03 |
| CVE-2026-19719 | medium | 6.8 | No | The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not escape the post title before outputting it in a... | 2026-09-03 |