Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-110509 | medium | 5.3 | No | The Essential Addons for Elementor WordPress plugin before 6.8.7 does not restrict the post type or meta query an unauthenticated visitor ca... | 2026-10-28 |
| CVE-2026-110507 | low | 2.7 | No | The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict the query arguments users can add to its Post Loop widget or... | 2026-10-28 |
| CVE-2026-110506 | medium | 6.8 | No | The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before storing it and outputting... | 2026-10-28 |
| CVE-2026-110292 | medium | 6.5 | No | The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the WooCommerce order named in... | 2026-10-28 |
| CVE-2026-107100 | medium | 5.3 | No | The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not verify that a requested post is publicly viewable before returning... | 2026-10-28 |
| CVE-2026-107098 | medium | 6.8 | No | The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise and escape one of its map widget's size settings before co... | 2026-10-28 |
| CVE-2026-107097 | medium | 5.3 | No | The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization check before using the site owner's store... | 2026-10-28 |
| CVE-2026-106648 | medium | 5.3 | No | The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted form field values before substituting them into the... | 2026-10-28 |
| CVE-2026-106647 | low | 3.8 | No | The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not scope a contact form's email delivery configuration to the form's o... | 2026-10-28 |
| CVE-2026-106003 | medium | 5.3 | No | The Court Reservation WordPress plugin before 1.12.4 does not perform any authorization, authentication or nonce validation on one of its AJ... | 2026-10-28 |
| CVE-2026-106002 | medium | 5.3 | No | The Court Reservation WordPress plugin before 1.12.4 does not perform any authorisation or nonce verification on one of its challenge-manage... | 2026-10-28 |
| CVE-2026-105997 | medium | 5.3 | No | The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code emails nor bind the recip... | 2026-10-28 |
| CVE-2026-105972 | high | 7.5 | No | The Menu Cart for WooCommerce WordPress plugin before 3.2.1 does not sanitise and escape cart item variation data before outputting it in it... | 2026-10-28 |
| CVE-2026-104694 | medium | 6.8 | No | The Thrive Automator WordPress plugin before 11.2 does not properly sanitize and escape a parameter's array key before using it in a SQL que... | 2026-10-28 |
| CVE-2026-103688 | critical | 9.8 | No | The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its accepted file types s... | 2026-10-28 |
| CVE-2026-103382 | medium | 5.3 | No | The Casso Flow WordPress plugin before 4.2.0 does not properly authenticate incoming bank-transfer payment notifications, as the token used... | 2026-10-28 |
| CVE-2026-103372 | medium | 5.3 | No | The Payconiq WordPress plugin through 1.0.4 does not check that a visitor is allowed to see an order before returning its confirmation link,... | 2026-10-28 |
| CVE-2026-103359 | medium | 5.3 | No | The PayDunya WooCommerce Payment Gateway WordPress plugin through 1.1.6 does not verify the authenticity of incoming payment notifications a... | 2026-10-28 |
| CVE-2026-103330 | medium | 5.3 | No | The Sadad QA Payment WordPress plugin through 1.28 does not correctly verify the authenticity of incoming payment notifications, as the veri... | 2026-10-28 |
| CVE-2026-103313 | medium | 5.3 | No | The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not bind the payment provider's transaction confirmation to the order... | 2026-10-28 |