Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-116409 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Swings Upsell Order Bump Offer for... | 2026-10-29 |
| CVE-2026-115967 | high | 8.8 | No | Weak Authentication vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Authentication Abuse.This issue aff... | 2026-10-29 |
| CVE-2026-115965 | high | 8.5 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress BuddyPress buddypress allow... | 2026-10-29 |
| CVE-2026-115964 | critical | 9.3 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Motors motors-car-deale... | 2026-10-29 |
| CVE-2026-115963 | high | 7.1 | No | Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incor... | 2026-10-29 |
| CVE-2026-115962 | medium | 4.3 | No | Authentication Bypass by Spoofing vulnerability in myCred myCred mycred allows Identity Spoofing.This issue affects myCred: from n/a through... | 2026-10-29 |
| CVE-2026-115611 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net TableOn posts-table-filte... | 2026-10-29 |
| CVE-2026-115599 | high | 7.5 | No | Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Leve... | 2026-10-29 |
| CVE-2026-115592 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OceanWP OceanWP oceanwp allows Reflect... | 2026-10-29 |
| CVE-2026-114193 | high | 7.5 | No | Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp allows Exploiting Incorrectly Configured Access Control Secu... | 2026-10-29 |
| CVE-2026-112827 | high | 7.1 | No | Missing Authorization vulnerability in VillaTheme HANDMADE – Dropshipping for Etsy and WooCommerce handmade-dropshipping-for-etsy-and-woo al... | 2026-10-29 |
| CVE-2026-91153 | medium | 5.3 | No | The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Sensitive I... | 2026-10-29 |
| CVE-2026-91152 | medium | 6.1 | No | The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Reflected C... | 2026-10-29 |
| CVE-2026-118192 | medium | 6.5 | No | The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'team... | 2026-10-29 |
| CVE-2026-116763 | medium | 5.4 | No | The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and... | 2026-10-29 |
| CVE-2026-111318 | medium | 5.4 | No | The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Sc... | 2026-10-29 |
| CVE-2026-110707 | medium | 4.7 | No | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Store... | 2026-10-29 |
| CVE-2026-109215 | medium | 6.4 | No | The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bbp_reply_content' parameter in all versions... | 2026-10-29 |
| CVE-2026-107743 | high | 7.2 | No | The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.5. This is due t... | 2026-10-29 |
| CVE-2026-107629 | medium | 5.4 | No | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comm... | 2026-10-29 |