Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-115949 | medium | 6.5 | No | Missing Authorization vulnerability in WP Smart Widgets Better Post & Filter Widgets for Elementor better-post-filter-widgets-for-elementor... | 2026-10-26 |
| CVE-2026-115614 | medium | 5.3 | No | Missing Authorization vulnerability in Magepeople inc. Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiti... | 2026-10-26 |
| CVE-2026-115613 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Image Gallery block – Create... | 2026-10-26 |
| CVE-2026-115602 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Block... | 2026-10-26 |
| CVE-2026-114709 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allo... | 2026-10-26 |
| CVE-2026-110377 | medium | 5.3 | No | Missing Authorization vulnerability in VillaTheme Bopo – WooCommerce Product Bundle Builder bopo-woo-product-bundle-builder allows Exploitin... | 2026-10-26 |
| CVE-2026-112828 | medium | 4.3 | No | Missing Authorization vulnerability in Meow Apps AI Engine ai-engine allows Exploiting Incorrectly Configured Access Control Security Levels... | 2026-10-26 |
| CVE-2026-111841 | high | 8.8 | No | Cross-Site Request Forgery (CSRF) vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Cross Site Request Forgery.Thi... | 2026-10-26 |
| CVE-2026-110376 | medium | 4.3 | No | Missing Authorization vulnerability in VillaTheme DEPART depart-deposit-and-part-payment-for-woo allows Exploiting Incorrectly Configured Ac... | 2026-10-26 |
| CVE-2026-114704 | high | 7.2 | No | Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi relevanssi allows Object Injection.This issue affects Rel... | 2026-10-26 |
| CVE-2026-114192 | medium | 6.5 | No | Missing Authorization vulnerability in Magepeople inc. WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Sec... | 2026-10-26 |
| CVE-2026-114191 | high | 7.5 | No | Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Explo... | 2026-10-26 |
| CVE-2026-114705 | medium | 6.5 | No | Missing Authorization vulnerability in quadlayers WP Social Feed Gallery insta-gallery allows Exploiting Incorrectly Configured Access Contr... | 2026-10-26 |
| CVE-2026-114194 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allo... | 2026-10-26 |
| CVE-2026-94075 | critical | 9.8 | No | Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affect... | 2026-10-26 |
| CVE-2026-114697 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuarkA QA Analytics qa-heatmap-analyti... | 2026-10-26 |
| CVE-2026-114695 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infomaniak Network VOD Infomaniak vod-... | 2026-10-26 |
| CVE-2026-114694 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager... | 2026-10-26 |
| CVE-2026-114693 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugins360 Labs All-in-One Video Galle... | 2026-10-26 |
| CVE-2026-114196 | critical | 9.8 | No | Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue affects Paytium: from n... | 2026-10-26 |