Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-115214 | critical | 9.8 | No | The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts... | 2026-10-26 |
| CVE-2026-83924 | high | 7.0 | No | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. | 2026-10-26 |
| CVE-2026-103381 | medium | 6.5 | No | The Mintpay for WooCommerce WordPress plugin through 2.2.3 does not verify the authenticity of the payment callback it processes, allowing u... | 2026-10-26 |
| CVE-2026-103319 | medium | 5.3 | No | The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not properly verify that payment notifications originate from t... | 2026-10-26 |
| CVE-2026-103306 | medium | 5.3 | No | The Online Payments with iK Pay Gateway WordPress plugin before 3.0.4 does not properly verify the authenticity of its payment gateway callb... | 2026-10-26 |
| CVE-2026-103298 | medium | 5.3 | No | The CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does not verify that a payment-confirmation request genuinely orig... | 2026-10-26 |
| CVE-2026-115183 | low | 2.4 | No | The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities i... | 2026-10-26 |
| CVE-2026-114743 | low | 3.1 | No | The InstaWP Connect WordPress plugin before 0.1.4.2 does not perform a capability check on its InstaWP Connect WordPress plugin before 0.1.4... | 2026-10-26 |
| CVE-2026-114742 | low | 2.7 | No | The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contr... | 2026-10-26 |
| CVE-2026-114741 | low | 3.8 | No | The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing... | 2026-10-26 |
| CVE-2026-114740 | medium | 4.9 | No | The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing us... | 2026-10-26 |
| CVE-2026-111981 | low | 2.7 | No | The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes, allowing users who have... | 2026-10-26 |
| CVE-2026-111980 | medium | 5.5 | No | The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request applies to, allowing users wit... | 2026-10-26 |
| CVE-2026-111979 | medium | 6.8 | No | The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template settings before outputti... | 2026-10-26 |
| CVE-2026-111978 | medium | 6.0 | No | The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-supplied filename before reading it from disk, allowing users... | 2026-10-26 |
| CVE-2026-111976 | medium | 5.3 | No | The GiveWP WordPress plugin before 4.19.0.1 does not perform any status or capability check when rendering a donation form on a public front... | 2026-10-26 |
| CVE-2026-110285 | medium | 5.3 | No | The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stripe webhook signature when no signing secret is configured, w... | 2026-10-26 |
| CVE-2026-97353 | medium | 5.4 | No | The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metada... | 2026-10-26 |
| CVE-2026-97352 | medium | 4.3 | No | The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of its AJAX actions, allowing aut... | 2026-10-26 |
| CVE-2026-87835 | medium | 6.5 | No | The Front End Users WordPress plugin through 3.2.35 does not restrict which account attributes a visitor may set when registering through it... | 2026-10-26 |