Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-113485 | medium | 6.5 | No | The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media Library bulk-action hand... | 2026-10-28 |
| CVE-2026-111967 | medium | 6.8 | No | The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before outputting it into an... | 2026-10-28 |
| CVE-2026-111961 | low | 3.8 | No | The Royal MCP WordPress plugin before 1.5.10 does not perform an object-level permission check before duplicating a requested page, relying... | 2026-10-28 |
| CVE-2026-111960 | medium | 4.3 | No | The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one of its search tools, all... | 2026-10-28 |
| CVE-2026-111577 | high | 7.2 | No | The GoSMTP WordPress plugin before 1.2.5 does not perform a settings-management authorization check on its SMTP configuration page, which is... | 2026-10-28 |
| CVE-2026-111032 | low | 3.8 | No | The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against the targeted product before processing... | 2026-10-28 |
| CVE-2026-111031 | medium | 4.7 | No | The Welcart e-Commerce WordPress plugin before 2.12.6 does not validate a user-supplied URL before using it in a redirect, allowing unauthen... | 2026-10-28 |
| CVE-2026-111027 | medium | 6.8 | No | The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it in a SQL query, and... | 2026-10-28 |
| CVE-2026-110508 | medium | 5.3 | No | The Essential Addons for Elementor WordPress plugin before 6.8.7 does not apply its administrator approval requirement to accounts registere... | 2026-10-28 |
| CVE-2026-111021 | high | 7.1 | No | The افزونه پیامک ووکامرس | Persian WooCommerce SMS WordPress plugin before 7.3.2 does not sanitise and escape a parameter before reflecting... | 2026-10-28 |
| CVE-2026-110691 | medium | 6.5 | No | The WPOrLogin WordPress plugin before 3.1.0 does not perform a capability check or validate a nonce before updating its hidden-login URL set... | 2026-10-28 |
| CVE-2026-110524 | medium | 6.8 | No | The Copy Anything to Clipboard for WordPress WordPress plugin before 5.5.5 does not sanitize and escape a shortcode attribute before storing... | 2026-10-28 |
| CVE-2026-110509 | medium | 5.3 | No | The Essential Addons for Elementor WordPress plugin before 6.8.7 does not restrict the post type or meta query an unauthenticated visitor ca... | 2026-10-28 |
| CVE-2026-110507 | low | 2.7 | No | The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict the query arguments users can add to its Post Loop widget or... | 2026-10-28 |
| CVE-2026-110506 | medium | 6.8 | No | The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before storing it and outputting... | 2026-10-28 |
| CVE-2026-110292 | medium | 6.5 | No | The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the WooCommerce order named in... | 2026-10-28 |
| CVE-2026-107100 | medium | 5.3 | No | The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not verify that a requested post is publicly viewable before returning... | 2026-10-28 |
| CVE-2026-107098 | medium | 6.8 | No | The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise and escape one of its map widget's size settings before co... | 2026-10-28 |
| CVE-2026-107097 | medium | 5.3 | No | The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization check before using the site owner's store... | 2026-10-28 |
| CVE-2026-106648 | medium | 5.3 | No | The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted form field values before substituting them into the... | 2026-10-28 |