Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-112820 | high | 8.1 | No | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Acade... | 2026-10-22 |
| CVE-2026-112313 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ACF Extended ACF Extended acf-extended... | 2026-10-22 |
| CVE-2026-114703 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hupe13 Extensions for Leaflet Map exte... | 2026-10-22 |
| CVE-2026-114702 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicdark ND Shortcodes For Visual Compo... | 2026-10-22 |
| CVE-2026-114701 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xootix Waitlist Woocommerce ( Back in... | 2026-10-22 |
| CVE-2026-114700 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gloriafood Restaurant Menu – Food Orde... | 2026-10-22 |
| CVE-2026-114699 | medium | 5.3 | No | Missing Authorization vulnerability in yoomoney ЮKassa для WooCommerce yookassa allows Exploiting Incorrectly Configured Access Control Secu... | 2026-10-22 |
| CVE-2026-114698 | medium | 5.4 | No | Authorization Bypass Through User-Controlled Key vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Contr... | 2026-10-22 |
| CVE-2026-114696 | medium | 5.3 | No | Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-restriction allows Exploiting Incorrectly Co... | 2026-10-22 |
| CVE-2026-114195 | medium | 5.3 | No | Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in WP Desk ShopMagic shopmagic-for-woocommerce... | 2026-10-22 |
| CVE-2026-112845 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jory Hogeveen Off-Canvas Sidebars & Me... | 2026-10-22 |
| CVE-2026-112379 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codepeople Contact Form Email contact-... | 2026-10-22 |
| CVE-2026-112327 | critical | 9.3 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL In... | 2026-10-22 |
| CVE-2026-112312 | high | 7.5 | No | Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended allows Exploiting Incorrectly Configured Access Control Securi... | 2026-10-22 |
| CVE-2026-112311 | medium | 6.5 | No | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ACF Extended ACF Extended acf-extended allow... | 2026-10-22 |
| CVE-2026-112242 | high | 8.8 | No | Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profile-builder allows Privilege Escalation.This issue affects Pr... | 2026-10-22 |
| CVE-2026-112241 | critical | 9.8 | No | Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart surecart allows Authentication Abuse.This issue affects SureCar... | 2026-10-22 |
| CVE-2026-112218 | medium | 5.3 | No | Missing Authorization vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Secur... | 2026-10-22 |
| CVE-2026-111842 | medium | 5.3 | No | Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access C... | 2026-10-22 |
| CVE-2026-111830 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Mailster WP Mailster wp-mailster al... | 2026-10-22 |