Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-110882 | medium | 4.3 | No | Missing Authorization vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Exploiting Incorrec... | 2026-10-19 |
| CVE-2026-109701 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PAYCOMET PAYCOMET for WooCommerce payt... | 2026-10-19 |
| CVE-2026-110889 | high | 7.5 | No | Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows Retrieve Embedded Sen... | 2026-10-19 |
| CVE-2026-111110 | high | 7.2 | No | The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the... | 2026-10-19 |
| CVE-2026-110253 | medium | 5.4 | No | The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to i... | 2026-10-19 |
| CVE-2026-109983 | medium | 6.4 | No | The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'post_title' parameter in all versions up... | 2026-10-19 |
| CVE-2026-100316 | high | 7.2 | No | The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CF-IPCountry Hea... | 2026-10-19 |
| CVE-2026-110384 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Fancy Comments WordPre... | 2026-10-19 |
| CVE-2026-96660 | high | 7.2 | No | The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & L... | 2026-10-19 |
| CVE-2026-92978 | medium | 4.3 | No | The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & L... | 2026-10-19 |
| CVE-2026-92798 | high | 8.1 | No | The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2... | 2026-10-19 |
| CVE-2026-92715 | medium | 4.3 | No | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions... | 2026-10-19 |
| CVE-2026-111726 | medium | 6.4 | No | The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute in all versions up t... | 2026-10-19 |
| CVE-2026-110268 | medium | 4.9 | No | The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.2 via... | 2026-10-19 |
| CVE-2026-109989 | medium | 6.4 | No | The Themify Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'popup_width_unit' parameter in all versions up... | 2026-10-19 |
| CVE-2026-109985 | medium | 6.4 | No | The xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t... | 2026-10-19 |
| CVE-2026-109369 | medium | 6.8 | No | The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.... | 2026-10-19 |
| CVE-2026-109368 | medium | 6.5 | No | The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inc... | 2026-10-19 |
| CVE-2026-108123 | high | 7.5 | No | The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.... | 2026-10-19 |
| CVE-2026-107752 | medium | 4.9 | No | The Welcart e-Commerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wp_usces_order_old (JSON fields searchSql / sear... | 2026-10-19 |