Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-110651 | medium | 6.8 | No | The Swift Performance Lite WordPress plugin before 2.3.7.4 does not properly sanitize and escape a value before using it in a SQL statement,... | 2026-10-21 |
| CVE-2026-110523 | high | 8.1 | No | The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gat... | 2026-10-21 |
| CVE-2026-110514 | medium | 4.9 | No | The WPZOOM Portfolio Lite WordPress plugin before 1.4.34 does not check that a user is allowed to edit a post before changing its type and o... | 2026-10-21 |
| CVE-2026-109926 | medium | 4.3 | No | The Productive Commerce WordPress plugin before 1.1.49 does not perform a capability check in one of its AJAX actions and exposes the nonce... | 2026-10-21 |
| CVE-2026-109147 | high | 7.1 | No | The WP Booking System WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflecting it back in an adm... | 2026-10-21 |
| CVE-2026-108073 | medium | 5.3 | No | The SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include when reading a single up... | 2026-10-21 |
| CVE-2026-107790 | medium | 6.8 | No | The HireZoot WordPress plugin before 4.1.1 does not sanitise and escape some of its stored data before outputting it in the admin dashboard,... | 2026-10-21 |
| CVE-2026-107789 | medium | 5.3 | No | The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauth... | 2026-10-21 |
| CVE-2026-107788 | medium | 4.3 | No | The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any aut... | 2026-10-21 |
| CVE-2026-107506 | high | 7.5 | No | The Simple Banner WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles an administrator allow... | 2026-10-21 |
| CVE-2026-107237 | high | 8.2 | No | The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that de... | 2026-10-21 |
| CVE-2026-107128 | medium | 5.0 | No | The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to manage the targeted acc... | 2026-10-21 |
| CVE-2026-107127 | high | 7.5 | No | The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauth... | 2026-10-21 |
| CVE-2026-106932 | medium | 6.5 | No | The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce checks on several of its authenticated AJAX actions, relying... | 2026-10-21 |
| CVE-2026-105999 | medium | 5.3 | No | The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in... | 2026-10-21 |
| CVE-2026-105998 | medium | 5.3 | No | The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscri... | 2026-10-21 |
| CVE-2026-105996 | medium | 4.8 | No | The Booking Package WordPress plugin before 1.7.31 does not generate booking cancellation tokens using a secure source of randomness, derivi... | 2026-10-21 |
| CVE-2026-105992 | medium | 5.3 | No | The Ettrick Escape Room Booking WordPress plugin before 1.3.1 does not verify a booking's payment status against the payment provider before... | 2026-10-21 |
| CVE-2026-105262 | high | 8.0 | No | The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term translations, and exposes a... | 2026-10-21 |
| CVE-2026-105257 | low | 2.7 | No | The Appointment Booking Plugin WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is assigned to a custome... | 2026-10-21 |