Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-54862 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codection Import and export users and... | 2026-10-29 |
| CVE-2026-48195 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster pdf-poster allows... | 2026-10-29 |
| CVE-2026-42707 | medium | 4.3 | No | Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured... | 2026-10-29 |
| CVE-2026-56056 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid The Post Grid the-post-... | 2026-10-29 |
| CVE-2026-52709 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Video Gallery Block video-gal... | 2026-10-29 |
| CVE-2026-48196 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kaliforms Kali Forms kali-forms allows... | 2026-10-29 |
| CVE-2026-42703 | medium | 6.5 | No | Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Exploiting Incorrectly Configured Access Control Security Leve... | 2026-10-29 |
| CVE-2026-39741 | medium | 5.3 | No | Missing Authorization vulnerability in RelyWP Simple Cloudflare Turnstile simple-cloudflare-turnstile allows Exploiting Incorrectly Configur... | 2026-10-29 |
| CVE-2026-39735 | medium | 6.5 | No | Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Leve... | 2026-10-29 |
| CVE-2026-24533 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons all... | 2026-10-29 |
| CVE-2026-22386 | medium | 4.3 | No | Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Le... | 2026-10-29 |
| CVE-2026-118094 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allo... | 2026-10-29 |
| CVE-2026-118093 | medium | 5.3 | No | Missing Authorization vulnerability in WPFunnels Team Product Feed Manager best-woocommerce-feed allows Exploiting Incorrectly Configured Ac... | 2026-10-29 |
| CVE-2026-118087 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site Reviews site-reviews... | 2026-10-29 |
| CVE-2026-96767 | high | 7.2 | No | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' paramet... | 2026-10-29 |
| CVE-2026-92086 | medium | 5.3 | No | The MW WP Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.7 via the 'pos... | 2026-10-29 |
| CVE-2026-27401 | medium | 5.3 | No | Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows... | 2026-10-29 |
| CVE-2026-115821 | high | 7.2 | No | The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billing_first_name, billing_last_name' parameter i... | 2026-10-29 |
| CVE-2026-110184 | high | 7.5 | No | The Newsmatic theme for WordPress is vulnerable to blind SQL Injection via the 'slug' parameter in all versions up to, and including, 1.5.0... | 2026-10-29 |
| CVE-2026-109216 | medium | 4.9 | No | The Meta Box – A Framework for Dynamic Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'profile_backgroun... | 2026-10-29 |