Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-109590 | medium | 6.4 | No | The Tour Booking Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width', 'height' and 'zoom' shortcode at... | 2026-10-29 |
| CVE-2026-109385 | medium | 6.4 | No | The UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks plugin for WordPress is vulnerable to Stored Cross-Sit... | 2026-10-29 |
| CVE-2026-109974 | medium | 6.4 | No | The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored... | 2026-10-29 |
| CVE-2026-109995 | high | 7.2 | No | The Advanced Views – Display Framework for Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '... | 2026-10-29 |
| CVE-2026-109384 | high | 8.8 | No | The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including,... | 2026-10-29 |
| CVE-2026-109370 | medium | 6.4 | No | The Document Embedder – let visitors read files without downloading plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Script... | 2026-10-29 |
| CVE-2026-109218 | critical | 9.8 | No | The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9.1.2 via the add_mess... | 2026-10-29 |
| CVE-2026-108366 | medium | 6.4 | No | The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin for WordPress is vulnerable to Authenti... | 2026-10-29 |
| CVE-2026-104743 | medium | 4.9 | No | The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'tmp_file' parame... | 2026-10-29 |
| CVE-2026-109209 | medium | 6.4 | No | The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored... | 2026-10-29 |
| CVE-2026-107745 | medium | 4.2 | No | The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insuf... | 2026-10-29 |
| CVE-2026-106013 | critical | 9.8 | No | The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler in all versions up to... | 2026-10-29 |
| CVE-2026-103410 | high | 7.5 | No | An Integer Overflow vulnerability in the DPI certificate scanner in Juniper Networks Session Smart Router allows an unauthenticated remote a... | 2026-10-29 |
| CVE-2026-103400 | medium | 5.5 | No | An Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the ember service in... | 2026-10-29 |
| CVE-2026-103394 | low | 3.7 | No | An Improper Initialization vulnerability in the SSR software in Juniper Networks Session Smart Router allows an attacker to decrypt traffic... | 2026-10-29 |
| CVE-2026-103390 | medium | 5.3 | No | An Out-of-Bounds Read vulnerability in the HttpParser component in Juniper Networks Session Smart Router and Session Smart Conductor allows... | 2026-10-29 |
| CVE-2026-101935 | medium | 6.1 | No | The Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via... | 2026-10-29 |
| CVE-2026-104740 | medium | 6.4 | No | The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting... | 2026-10-29 |
| CVE-2026-104729 | medium | 6.4 | No | The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tab_index, empty_notice' parameter in... | 2026-10-29 |
| CVE-2026-103370 | medium | 6.4 | No | The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpas_fi... | 2026-10-29 |