Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-103301 | medium | 5.3 | No | The Payment Gateway for Telcell WordPress plugin before 2.0.5 does not verify the authenticity of incoming payment notifications, because th... | 2026-10-21 |
| CVE-2026-101138 | medium | 5.3 | No | The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.21 does not correctly apply maintenance mode to pages added to its page whit... | 2026-10-21 |
| CVE-2026-96901 | low | 3.7 | No | The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.2.0 does not verify the integrity of its cart-recovery token before... | 2026-10-21 |
| CVE-2026-92999 | medium | 5.3 | No | The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not perform any authorization check on a lead-export handler,... | 2026-10-21 |
| CVE-2026-92998 | high | 8.6 | No | The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not sanitise sort parameters before using them in a SQL ORDER... | 2026-10-21 |
| CVE-2026-92997 | high | 8.6 | No | The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not properly validate a parameter before using it as a column... | 2026-10-21 |
| CVE-2026-88784 | high | 7.5 | No | The Translate WordPress with Weglot 2.0 WordPress plugin before 6.4.3 does not escape the URLs it re-inserts into a page when rewriting link... | 2026-10-21 |
| CVE-2026-87838 | medium | 6.5 | No | The Wava Payment Plugin WordPress plugin before 0.3.10 does not perform any authorisation, nonce or origin verification on one of its public... | 2026-10-21 |
| CVE-2026-87837 | medium | 5.3 | No | The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider notifications, nor rest... | 2026-10-21 |
| CVE-2026-86611 | medium | 4.3 | No | The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF checks in some places... | 2026-10-21 |
| CVE-2026-85642 | high | 7.5 | No | The Formidable Forms WordPress plugin before 7.0 does not verify the identity of the caller before recording the timestamp it uses to rate l... | 2026-10-21 |
| CVE-2026-81813 | medium | 6.8 | No | The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize the text content of SVG files, checking only their elements an... | 2026-10-21 |
| CVE-2026-81812 | medium | 6.4 | No | The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize uploaded SVG files on every upload route, allowing users with... | 2026-10-21 |
| CVE-2026-79627 | high | 7.1 | No | The Advanced File Manager WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, a... | 2026-10-21 |
| CVE-2026-15261 | medium | 5.3 | No | The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not enforce the same owner-only access control on its REST API that it appli... | 2026-10-21 |
| CVE-2026-111957 | medium | 5.3 | No | The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not bind the payment it confirms with the provider to the order... | 2026-10-21 |
| CVE-2026-111956 | medium | 5.9 | No | The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location unde... | 2026-10-21 |
| CVE-2026-111955 | medium | 6.5 | No | The WholesaleX WordPress plugin before 3.0.9 does not check that a stored account confirmation code is set before comparing it with the one... | 2026-10-21 |
| CVE-2026-111949 | high | 7.5 | No | The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an accou... | 2026-10-21 |
| CVE-2026-111948 | high | 7.1 | No | The User Profile Builder WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a JavaScript context on... | 2026-10-21 |