Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-91153 | medium | 5.3 | No | The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Sensitive I... | 2026-10-29 |
| CVE-2026-91152 | medium | 6.1 | No | The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Reflected C... | 2026-10-29 |
| CVE-2026-118192 | medium | 6.5 | No | The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'team... | 2026-10-29 |
| CVE-2026-116763 | medium | 5.4 | No | The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and... | 2026-10-29 |
| CVE-2026-111318 | medium | 5.4 | No | The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Sc... | 2026-10-29 |
| CVE-2026-110707 | medium | 4.7 | No | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Store... | 2026-10-29 |
| CVE-2026-109215 | medium | 6.4 | No | The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bbp_reply_content' parameter in all versions... | 2026-10-29 |
| CVE-2026-107743 | high | 7.2 | No | The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.5. This is due t... | 2026-10-29 |
| CVE-2026-107629 | medium | 5.4 | No | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comm... | 2026-10-29 |
| CVE-2026-107627 | medium | 5.4 | No | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comm... | 2026-10-29 |
| CVE-2026-104727 | medium | 6.4 | No | The Sequential Order Numbers for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'condition' Post Meta Arr... | 2026-10-29 |
| CVE-2026-103875 | medium | 4.7 | No | The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search-string' parameter in all ve... | 2026-10-29 |
| CVE-2026-103485 | medium | 5.4 | No | The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'feature.properties[]' pa... | 2026-10-29 |
| CVE-2026-93293 | medium | 6.4 | No | The Password Protected plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bundled Freemius SDK's purchase-completion... | 2026-10-29 |
| CVE-2026-96741 | high | 7.2 | No | The DSGVO All in one for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Co... | 2026-10-29 |
| CVE-2026-96669 | high | 7.2 | No | The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'service_type' Cookie i... | 2026-10-29 |
| CVE-2026-96666 | high | 7.2 | No | The Schema App Structured Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via 'Remove Microdata'... | 2026-10-29 |
| CVE-2026-96228 | high | 8.1 | No | SSL Wireless SMS Notification for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.8.1. The public f... | 2026-10-29 |
| CVE-2026-93904 | high | 7.5 | No | The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to generic SQL Injection via the... | 2026-10-29 |
| CVE-2026-93855 | high | 7.5 | No | The SendPress Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'subscriberid' parameter in all versions up... | 2026-10-29 |