Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-86794 | high | 8.8 | No | The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks when processing public event submissions, and... | 2026-10-29 |
| CVE-2026-85007 | low | 3.8 | No | The Video Player for YouTube WordPress plugin before 2.1.4 does not perform a capability check on its player-preset AJAX handler, allowing u... | 2026-10-29 |
| CVE-2026-78396 | medium | 5.3 | No | The Link Library WordPress plugin before 7.10.0 does not verify that a requested link belongs to the settings set whose display template is... | 2026-10-29 |
| CVE-2026-78395 | medium | 5.3 | No | The Link Library WordPress plugin before 7.10.0 does not re-check the selected library's own login requirement when processing its front-end... | 2026-10-29 |
| CVE-2026-115302 | medium | 5.3 | No | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes stored form statistics... | 2026-10-29 |
| CVE-2026-115301 | high | 7.2 | No | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms and allows stored... | 2026-10-29 |
| CVE-2026-115300 | medium | 4.3 | No | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only acti... | 2026-10-29 |
| CVE-2026-115299 | medium | 5.4 | No | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail settings, allowing an attac... | 2026-10-29 |
| CVE-2026-115282 | medium | 5.3 | No | The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not perform an authorization check before rendering posts through its recipe... | 2026-10-29 |
| CVE-2026-115259 | medium | 4.9 | No | The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.0 does not have proper authorization checks when updating post da... | 2026-10-29 |
| CVE-2026-115245 | critical | 9.8 | No | The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, relying only on a spoofable client-suppli... | 2026-10-29 |
| CVE-2026-114270 | medium | 5.3 | No | The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing, allowing unauthenticated... | 2026-10-29 |
| CVE-2026-113617 | critical | 9.9 | No | The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before using it to read and... | 2026-10-29 |
| CVE-2026-113616 | critical | 9.8 | No | The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved account's own email addre... | 2026-10-29 |
| CVE-2026-111739 | high | 7.5 | No | The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS) WordPress plugin before 5.5.0 do not bind the accou... | 2026-10-29 |
| CVE-2026-110983 | medium | 4.3 | No | The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its comment-management... | 2026-10-29 |
| CVE-2026-110505 | medium | 6.8 | No | The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG files from changing a... | 2026-10-29 |
| CVE-2026-110504 | medium | 6.8 | No | The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content is not detected as SVG... | 2026-10-29 |
| CVE-2026-110030 | medium | 5.3 | No | The Hide Price Until Login WordPress plugin before 1.1.2 does not restrict a guest-registration handler and does not honour the site's user-... | 2026-10-29 |
| CVE-2026-108763 | medium | 4.3 | No | The Wallet System for WooCommerce WordPress plugin before 2.8.2 does not restrict its KYC document submission handler to the current user's... | 2026-10-29 |