Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-89051 | high | 7.2 | No | The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'replaceHead... | 2026-10-16 |
| CVE-2026-88963 | medium | 6.1 | No | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the 'redirect_... | 2026-10-16 |
| CVE-2026-85659 | high | 8.8 | No | The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43.... | 2026-10-16 |
| CVE-2026-89280 | medium | 4.3 | No | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to... | 2026-10-16 |
| CVE-2026-74923 | medium | 5.3 | No | The Document Gallery WordPress plugin through 5.1.1 does not perform any capability or ownership check when generating a gallery on demand,... | 2026-10-16 |
| CVE-2026-19798 | medium | 4.3 | No | The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_status... | 2026-10-16 |
| CVE-2026-15222 | medium | 5.4 | No | The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration... | 2026-10-16 |
| CVE-2026-111363 | medium | 6.5 | No | BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to rea... | 2026-10-16 |
| CVE-2026-111344 | medium | 4.3 | No | APITable through 1.14.0-beta contains an authorization bypass vulnerability that allows authenticated users to read node descriptions from o... | 2026-10-16 |
| CVE-2026-111178 | medium | 4.9 | No | The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to generic SQL Injection via the 'data[orderby]' parameter in al... | 2026-10-16 |
| CVE-2026-111122 | high | 7.2 | No | The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' parameter in all versions up t... | 2026-10-16 |
| CVE-2026-111106 | medium | 6.5 | No | The Mail Mint plugin for WordPress is vulnerable to SQL Injection via the 'filters' parameter of the /wp-json/mrm/v1/segments/contacts REST... | 2026-10-16 |
| CVE-2026-111277 | high | 7.5 | No | NivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of account/order that allows unauthenticated... | 2026-10-16 |
| CVE-2026-111069 | medium | 6.4 | No | The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Sc... | 2026-10-16 |
| CVE-2026-110891 | medium | 5.4 | No | Missing Authorization vulnerability in WordLift Srl WordLift wordlift allows Exploiting Incorrectly Configured Access Control Security Level... | 2026-10-16 |
| CVE-2026-110701 | high | 7.2 | No | The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'CalendarTitle' parameter in all... | 2026-10-16 |
| CVE-2026-110664 | medium | 6.4 | No | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note' param... | 2026-10-16 |
| CVE-2026-110721 | medium | 5.3 | No | The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and... | 2026-10-16 |
| CVE-2026-110590 | high | 7.5 | No | The Klarna for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.13.3 This is d... | 2026-10-16 |
| CVE-2026-110362 | medium | 5.3 | No | Missing Authorization vulnerability in Planet studio PlanetStudio Payment Gateway planetstudio-payment-gateway allows Exploiting Incorrectly... | 2026-10-16 |