Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-115806 | critical | 9.8 | No | The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.... | 2026-10-29 |
| CVE-2026-115417 | high | 7.5 | No | Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2 might allow a remote act... | 2026-10-29 |
| CVE-2026-114645 | medium | 5.2 | No | A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to... | 2026-10-29 |
| CVE-2026-111372 | medium | 4.3 | No | The AI ChatBot for WooCommerce – WoowBot plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.... | 2026-10-29 |
| CVE-2026-111213 | medium | 4.3 | No | The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up t... | 2026-10-29 |
| CVE-2026-111111 | high | 7.2 | No | The Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site... | 2026-10-29 |
| CVE-2026-111068 | medium | 4.4 | No | The DesignSetGo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagName' parameter in all versions up to, and inc... | 2026-10-29 |
| CVE-2026-111727 | medium | 6.4 | No | The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vs_text_submitbtn' parameter in... | 2026-10-29 |
| CVE-2026-111314 | high | 7.2 | No | The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting v... | 2026-10-29 |
| CVE-2026-111820 | high | 7.2 | No | The Analytics Insights – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the... | 2026-10-29 |
| CVE-2026-110662 | high | 7.2 | No | The MxChat – AI Chatbot & Content Generation for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via t... | 2026-10-29 |
| CVE-2026-110071 | medium | 6.4 | No | The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' parameter in all versions up to, and includ... | 2026-10-29 |
| CVE-2026-110020 | medium | 6.5 | No | The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.1.6... | 2026-10-29 |
| CVE-2026-10752 | medium | 4.8 | No | The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 0.9.2.... | 2026-10-29 |
| CVE-2026-10511 | medium | 6.4 | No | The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'forget_password_link' parameter in all version... | 2026-10-29 |
| CVE-2026-109988 | medium | 4.4 | No | The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi... | 2026-10-29 |
| CVE-2026-109979 | medium | 4.3 | No | The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.0.0... | 2026-10-29 |
| CVE-2026-109978 | medium | 6.4 | No | The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to... | 2026-10-29 |
| CVE-2026-109975 | medium | 6.4 | No | The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to... | 2026-10-29 |
| CVE-2026-109590 | medium | 6.4 | No | The Tour Booking Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width', 'height' and 'zoom' shortcode at... | 2026-10-29 |