Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-115282 | not reported | — | No | The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not perform an authorization check before rendering posts through its recipe... | 2026-10-29 |
| CVE-2026-115259 | not reported | — | No | The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.0 does not have proper authorization checks when updating post da... | 2026-10-29 |
| CVE-2026-115245 | not reported | — | No | The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, relying only on a spoofable client-suppli... | 2026-10-29 |
| CVE-2026-114488 | high | 7.4 | No | A flaw was found in Wildfly. A remote attacker can bypass authentication on IIOP EJB invocations as the CSIv2 security interceptor accepts I... | 2026-10-29 |
| CVE-2026-114270 | not reported | — | No | The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing, allowing unauthenticated... | 2026-10-29 |
| CVE-2026-113617 | not reported | — | No | The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before using it to read and... | 2026-10-29 |
| CVE-2026-113616 | not reported | — | No | The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved account's own email addre... | 2026-10-29 |
| CVE-2026-111739 | not reported | — | No | The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS) WordPress plugin before 5.5.0 do not bind the accou... | 2026-10-29 |
| CVE-2026-110983 | not reported | — | No | The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its comment-management... | 2026-10-29 |
| CVE-2026-110505 | not reported | — | No | The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG files from changing a... | 2026-10-29 |
| CVE-2026-110504 | not reported | — | No | The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content is not detected as SVG... | 2026-10-29 |
| CVE-2026-110030 | not reported | — | No | The Hide Price Until Login WordPress plugin before 1.1.2 does not restrict a guest-registration handler and does not honour the site's user-... | 2026-10-29 |
| CVE-2026-108763 | not reported | — | No | The Wallet System for WooCommerce WordPress plugin before 2.8.2 does not restrict its KYC document submission handler to the current user's... | 2026-10-29 |
| CVE-2026-108686 | not reported | — | No | The WP Post Author WordPress plugin before 4.2.0 does not restrict the integration settings it returns to visitors, allowing unauthenticated... | 2026-10-29 |
| CVE-2026-108685 | not reported | — | No | The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end re... | 2026-10-29 |
| CVE-2026-105258 | not reported | — | No | The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering the... | 2026-10-29 |
| CVE-2026-103693 | not reported | — | No | The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user fro... | 2026-10-29 |
| CVE-2026-109618 | critical | 9.8 | Listed | PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not prope... | 2026-10-29 |
| CVE-2024-3586 | not reported | — | No | The LetterPress WordPress plugin before 2.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such... | 2026-10-29 |
| CVE-2024-9355 | medium | 6.5 | No | A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variabl... | 2026-10-29 |