Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-94262 | high | 8.1 | No | The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 d... | 2026-10-23 |
| CVE-2026-113501 | low | 3.1 | No | The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability check on its admin-notice dismissal handler, and the nonce i... | 2026-10-23 |
| CVE-2026-113500 | high | 7.5 | No | The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can dele... | 2026-10-23 |
| CVE-2026-113499 | high | 7.5 | No | The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes... | 2026-10-23 |
| CVE-2026-113472 | medium | 5.4 | No | The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploaded files in its editor media-upload end... | 2026-10-23 |
| CVE-2026-112230 | low | 3.7 | No | The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine... | 2026-10-23 |
| CVE-2026-112219 | medium | 4.9 | No | The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of filesystem locations it may serve f... | 2026-10-23 |
| CVE-2026-111982 | high | 7.2 | No | The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on it... | 2026-10-23 |
| CVE-2026-111966 | medium | 6.8 | No | The User Profile Builder WordPress plugin before 4.0.5 does not sanitise and escape one of its shortcode attributes before outputting it bac... | 2026-10-23 |
| CVE-2026-111738 | medium | 5.5 | No | The Speed Optimizer WordPress plugin before 7.8.5 does not verify network-level privilege before applying an option change to the whole mult... | 2026-10-23 |
| CVE-2026-111737 | low | 3.5 | No | The Speed Optimizer WordPress plugin before 7.8.5 does not sanitise or escape some of its settings before outputting them in the head of fro... | 2026-10-23 |
| CVE-2026-110537 | low | 3.8 | No | The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the specific user accounts... | 2026-10-23 |
| CVE-2026-110510 | low | 3.5 | No | The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its widgets before using... | 2026-10-23 |
| CVE-2026-109936 | high | 7.5 | No | The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while render... | 2026-10-23 |
| CVE-2026-109934 | medium | 5.3 | No | The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data th... | 2026-10-23 |
| CVE-2026-109933 | medium | 6.8 | No | The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them... | 2026-10-23 |
| CVE-2026-115497 | high | 7.5 | No | The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7... | 2026-10-23 |
| CVE-2026-109198 | high | 7.2 | No | The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user... | 2026-10-23 |
| CVE-2026-113682 | high | 7.4 | No | Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that allows unauthenticated a... | 2026-10-23 |
| CVE-2026-113600 | medium | 5.4 | No | Fat Free CRM before 0.26.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify or delete ot... | 2026-10-23 |