October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,401
High
6,159
Medium
6,457
Low
659
Severity not reported
2,805
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (403), apple (325), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-109988 The Product Addons for Woocommerce – Product Options with Custom Fields plugin f... |
medium | 4.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-110020 The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to autho... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-109370 The Document Embedder – let visitors read files without downloading plugin for W... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-109385 The UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and B... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-109590 The Tour Booking Manager plugin for WordPress is vulnerable to Stored Cross-Site... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-103370 The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress i... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-103996 The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-104729 The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Si... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-104740 The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-104743 The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all ve... |
medium | 4.9 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-107710 The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPre... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-108366 The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hi... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-100175 The Postie plugin for WordPress is vulnerable to Stored Cross-Site Scripting via... |
medium | 5.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-113486 The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-113487 The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or e... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-113488 The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-113813 The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not pe... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-115224 The Customer Engagement System WordPress plugin before 2.0.2 does not safely bui... |
medium | 4.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-115225 The Customer Engagement System WordPress plugin before 2.0.2 does not restrict a... |
medium | 5.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-115255 The WP Roster WordPress plugin before 2.35 does not perform any capability or no... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-115281 The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-111027 The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-111031 The Welcart e-Commerce WordPress plugin before 2.12.6 does not validate a user-s... |
medium | 4.7 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-111960 The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or po... |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-111967 The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its aud... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-113485 The Media Library Assistant WordPress plugin before 3.42 does not consistently v... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-107098 The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitis... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-107100 The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not verify... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-109236 The Customer Email Verification for WooCommerce plugin for WordPress is vulnerab... |
medium | 4.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-110292 The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not ve... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-110506 The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-110509 The Essential Addons for Elementor WordPress plugin before 6.8.7 does not restri... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-110524 The Copy Anything to Clipboard for WordPress WordPress plugin before 5.5.5 does... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-110691 The WPOrLogin WordPress plugin before 3.1.0 does not perform a capability check... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103382 The Casso Flow WordPress plugin before 4.2.0 does not properly authenticate inco... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-104694 The Thrive Automator WordPress plugin before 11.2 does not properly sanitize and... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-105997 The Booking Package WordPress plugin before 1.7.33 does not restrict who can tri... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-106002 The Court Reservation WordPress plugin before 1.12.4 does not perform any author... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-106003 The Court Reservation WordPress plugin before 1.12.4 does not perform any author... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-107097 The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.