Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-108073 | medium | 5.3 | No | The SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include when reading a single up... | 2026-10-21 |
| CVE-2026-107790 | medium | 6.8 | No | The HireZoot WordPress plugin before 4.1.1 does not sanitise and escape some of its stored data before outputting it in the admin dashboard,... | 2026-10-21 |
| CVE-2026-107789 | medium | 5.3 | No | The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauth... | 2026-10-21 |
| CVE-2026-107788 | medium | 4.3 | No | The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any aut... | 2026-10-21 |
| CVE-2026-107506 | high | 7.5 | No | The Simple Banner WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles an administrator allow... | 2026-10-21 |
| CVE-2026-107237 | high | 8.2 | No | The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that de... | 2026-10-21 |
| CVE-2026-107128 | medium | 5.0 | No | The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to manage the targeted acc... | 2026-10-21 |
| CVE-2026-107127 | high | 7.5 | No | The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauth... | 2026-10-21 |
| CVE-2026-106932 | medium | 6.5 | No | The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce checks on several of its authenticated AJAX actions, relying... | 2026-10-21 |
| CVE-2026-105999 | medium | 5.3 | No | The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in... | 2026-10-21 |
| CVE-2026-105998 | medium | 5.3 | No | The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscri... | 2026-10-21 |
| CVE-2026-105996 | medium | 4.8 | No | The Booking Package WordPress plugin before 1.7.31 does not generate booking cancellation tokens using a secure source of randomness, derivi... | 2026-10-21 |
| CVE-2026-105992 | medium | 5.3 | No | The Ettrick Escape Room Booking WordPress plugin before 1.3.1 does not verify a booking's payment status against the payment provider before... | 2026-10-21 |
| CVE-2026-105262 | high | 8.0 | No | The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term translations, and exposes a... | 2026-10-21 |
| CVE-2026-105257 | low | 2.7 | No | The Appointment Booking Plugin WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is assigned to a custome... | 2026-10-21 |
| CVE-2026-103302 | medium | 5.3 | No | The Payment Gateway for Idram WordPress plugin before 2.1.6 does not verify the authenticity of incoming payment notifications, because the... | 2026-10-21 |
| CVE-2026-102499 | high | 7.7 | No | The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and... | 2026-10-21 |
| CVE-2026-100145 | medium | 6.5 | No | The Synchrony Financing WordPress plugin before 1.1.2 does not properly authorise requests to one of its REST routes that modifies WooCommer... | 2026-10-21 |
| CVE-2026-106569 | medium | 5.3 | No | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, missing validation and res... | 2026-10-21 |
| CVE-2026-106570 | medium | 6.5 | No | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, an unauthenticated adjacen... | 2026-10-21 |