Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-118093 | medium | 5.3 | No | Missing Authorization vulnerability in WPFunnels Team Product Feed Manager best-woocommerce-feed allows Exploiting Incorrectly Configured Ac... | 2026-10-29 |
| CVE-2026-118087 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site Reviews site-reviews... | 2026-10-29 |
| CVE-2026-96767 | high | 7.2 | No | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' paramet... | 2026-10-29 |
| CVE-2026-92086 | medium | 5.3 | No | The MW WP Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.7 via the 'pos... | 2026-10-29 |
| CVE-2026-27401 | medium | 5.3 | No | Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows... | 2026-10-29 |
| CVE-2026-115821 | high | 7.2 | No | The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billing_first_name, billing_last_name' parameter i... | 2026-10-29 |
| CVE-2026-110184 | high | 7.5 | No | The Newsmatic theme for WordPress is vulnerable to blind SQL Injection via the 'slug' parameter in all versions up to, and including, 1.5.0... | 2026-10-29 |
| CVE-2026-109216 | medium | 4.9 | No | The Meta Box – A Framework for Dynamic Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'profile_backgroun... | 2026-10-29 |
| CVE-2026-116409 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Swings Upsell Order Bump Offer for... | 2026-10-29 |
| CVE-2026-115967 | high | 8.8 | No | Weak Authentication vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Authentication Abuse.This issue aff... | 2026-10-29 |
| CVE-2026-115965 | high | 8.5 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress BuddyPress buddypress allow... | 2026-10-29 |
| CVE-2026-115964 | critical | 9.3 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Motors motors-car-deale... | 2026-10-29 |
| CVE-2026-115963 | high | 7.1 | No | Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incor... | 2026-10-29 |
| CVE-2026-115962 | medium | 4.3 | No | Authentication Bypass by Spoofing vulnerability in myCred myCred mycred allows Identity Spoofing.This issue affects myCred: from n/a through... | 2026-10-29 |
| CVE-2026-115611 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net TableOn posts-table-filte... | 2026-10-29 |
| CVE-2026-115599 | high | 7.5 | No | Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Leve... | 2026-10-29 |
| CVE-2026-115592 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OceanWP OceanWP oceanwp allows Reflect... | 2026-10-29 |
| CVE-2026-114193 | high | 7.5 | No | Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp allows Exploiting Incorrectly Configured Access Control Secu... | 2026-10-29 |
| CVE-2026-112827 | high | 7.1 | No | Missing Authorization vulnerability in VillaTheme HANDMADE – Dropshipping for Etsy and WooCommerce handmade-dropshipping-for-etsy-and-woo al... | 2026-10-29 |
| CVE-2026-91153 | medium | 5.3 | No | The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Sensitive I... | 2026-10-29 |