Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-97640 | high | 7.2 | No | The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) plugin for WordPress is vu... | 2026-10-16 |
| CVE-2026-97781 | high | 8.8 | No | Improper neutralization of special elements used in a command ('command injection') in Microsoft Office OneNote allows an unauthorized attac... | 2026-10-16 |
| CVE-2026-96768 | high | 7.2 | No | The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Email Log Body in all versions up t... | 2026-10-16 |
| CVE-2026-96870 | medium | 6.4 | No | The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name... | 2026-10-16 |
| CVE-2026-96570 | high | 7.2 | No | The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp_review_text' para... | 2026-10-16 |
| CVE-2026-95809 | high | 7.2 | No | The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to St... | 2026-10-16 |
| CVE-2026-95686 | high | 7.2 | No | The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to St... | 2026-10-16 |
| CVE-2026-96562 | medium | 6.5 | No | The The Broken Link Checker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.14... | 2026-10-16 |
| CVE-2026-96449 | medium | 5.3 | No | Missing Authorization vulnerability in WPExperts WP EasyPay wp-easy-pay allows Exploiting Incorrectly Configured Access Control Security Lev... | 2026-10-16 |
| CVE-2026-93681 | medium | 6.4 | No | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via display_name Para... | 2026-10-16 |
| CVE-2026-93953 | high | 8.0 | No | The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field (secon... | 2026-10-16 |
| CVE-2026-93535 | medium | 6.4 | No | The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '... | 2026-10-16 |
| CVE-2026-92766 | high | 7.5 | No | The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'src_by' parameter in... | 2026-10-16 |
| CVE-2026-92553 | high | 8.8 | No | The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to Arbitrary File Upload in all versions u... | 2026-10-16 |
| CVE-2026-92427 | medium | 5.3 | No | The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used to authenticate its payment gat... | 2026-10-16 |
| CVE-2026-92115 | high | 8.8 | No | The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.0... | 2026-10-16 |
| CVE-2026-91833 | medium | 6.8 | No | The WX Subscribe 微信支付付费订阅 WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL statement... | 2026-10-16 |
| CVE-2026-91830 | medium | 6.5 | No | The Subscribe to Comments WordPress plugin before 2.3.3 does not sign or validate a cookie it trusts to identify a commenter, allowing unaut... | 2026-10-16 |
| CVE-2026-87111 | high | 7.2 | No | The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to St... | 2026-10-16 |
| CVE-2026-75903 | high | 8.1 | No | The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.3 This is due to... | 2026-10-16 |