Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-107764 | high | 7.2 | No | The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url (comment_author_url)' parameter... | 2026-10-16 |
| CVE-2026-107748 | medium | 6.4 | No | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored... | 2026-10-16 |
| CVE-2026-107758 | high | 7.2 | No | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to... | 2026-10-16 |
| CVE-2026-105974 | medium | 4.3 | No | The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data i... | 2026-10-16 |
| CVE-2026-105973 | medium | 4.3 | No | The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing an... | 2026-10-16 |
| CVE-2026-106604 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Compare yith-woo... | 2026-10-16 |
| CVE-2026-107350 | high | 8.8 | No | Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to... | 2026-10-16 |
| CVE-2026-104726 | medium | 6.4 | No | The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dir' Shortcode Attribute in all versions up to, an... | 2026-10-16 |
| CVE-2026-104003 | medium | 5.4 | No | The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.17... | 2026-10-16 |
| CVE-2026-104755 | medium | 4.8 | No | The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to,... | 2026-10-16 |
| CVE-2026-104730 | critical | 9.8 | No | The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection... | 2026-10-16 |
| CVE-2026-104932 | high | 8.0 | No | The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the rep... | 2026-10-16 |
| CVE-2026-104745 | high | 8.1 | No | The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the `alg_wc_ev_verify_email`... | 2026-10-16 |
| CVE-2026-105065 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme.com XStore xstore allows Reflec... | 2026-10-16 |
| CVE-2026-103696 | medium | 6.8 | No | The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unau... | 2026-10-16 |
| CVE-2026-104001 | medium | 5.4 | No | The The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress is vulnerable to arbitrary shortcode execution in all v... | 2026-10-16 |
| CVE-2026-103999 | high | 7.2 | No | The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to,... | 2026-10-16 |
| CVE-2026-103896 | high | 7.5 | No | The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via... | 2026-10-16 |
| CVE-2026-103768 | critical | 9.8 | No | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, a... | 2026-10-16 |
| CVE-2026-103911 | medium | 6.5 | No | The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execut... | 2026-10-16 |