September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-97077 Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.18 versions. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96830 Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96831 Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions. |
high | 8.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96832 Shop manager PHP Object Injection in Content Egg <= 6.3.1 versions. |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96833 Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 vers... |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96836 Unauthenticated Cross Site Scripting (XSS) in Parsi Date <= 6.3 versions. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96837 Contributor Remote Code Execution (RCE) in CartFlows <= 3.2.0 versions. |
high | 8.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96820 Subscriber Cross Site Scripting (XSS) in Awesome Support <= 6.3.9 versions. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96823 Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce <... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96827 Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions. |
high | 7.6 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96828 Administrator SQL Injection in Category Discount Woocommerce <= 5.18 versions. |
high | 7.6 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96352 Unauthenticated Cross Site Scripting (XSS) in YITH WooCommerce Ajax Search <= 2.... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96814 Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <=... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96815 Custom role Privilege Escalation in Vitepos <= 3.5.0 versions. |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96816 Unauthenticated Cross Site Scripting (XSS) in Trusted Shops Easy Integration for... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96817 Subscriber Broken Access Control in MakeCommerce for WooCommerce <= 4.1.0 versio... |
high | 8.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96818 Unauthenticated Broken Access Control in WP Express Checkout (Accept PayPal Paym... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96819 Subscriber Cross Site Scripting (XSS) in oik <= 4.15.4 versions. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96348 Unauthenticated Broken Access Control in Bookly <= 28.2 versions. |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96351 Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 6.1.3 versio... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96344 Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions. |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96345 Administrator SQL Injection in Estatik <= 4.3.5 versions. |
high | 7.6 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96346 Author SQL Injection in WP ERP <= 1.17.9 versions. |
high | 7.6 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96343 Custom role PHP Object Injection in WP ERP <= 1.17.9 versions. |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-95531 Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 ver... |
high | 8.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-95587 Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions. |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-95104 Stack-based buffer overflow vulnerability exists in BUFFALO Wi-Fi products. |
high | 7.5 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-94683 Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions. |
high | 8.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94677 Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.1... |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94678 Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions. |
high | 8.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94499 Subscriber Broken Access Control in FormGent <= 1.12.2 versions. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94178 Subscriber Privilege Escalation in Import and export users and customers <= 2.5.... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94120 Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <=... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94121 Contributor PHP Object Injection in 10Web Booster – Website speed optimization,... |
high | 8.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94122 Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions. |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94123 Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions. |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94082 Author SQL Injection in Quiz Cat <= 3.1.1 versions. |
high | 7.6 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94115 Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions. |
high | 8.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94078 Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.3.1 versions. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94081 Unauthenticated Cross Site Scripting (XSS) in WordPress Persistent Login <= 3.1.... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.