Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-105115 | high | 8.6 | No | OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allow... | 2026-10-06 |
| CVE-2026-96962 | low | 3.7 | No | The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors w... | 2026-10-06 |
| CVE-2026-94239 | medium | 6.8 | No | The Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape some bundle configuration values before outputting them back i... | 2026-10-06 |
| CVE-2026-94238 | medium | 6.8 | No | The Loco Translate WordPress plugin before 2.8.9 does not restrict which file paths its translation file routes will read, allowing users gr... | 2026-10-06 |
| CVE-2026-92923 | medium | 6.3 | No | The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise and escape a parameter before using it in a SQL statem... | 2026-10-06 |
| CVE-2026-92437 | medium | 5.3 | No | The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication, a nonce or an ownership check before it acts on a... | 2026-10-06 |
| CVE-2026-91078 | high | 8.2 | No | The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on ac... | 2026-10-06 |
| CVE-2026-89236 | high | 8.6 | No | The SaveTo Wishlist Lite WordPress plugin before 1.1.5 does not sanitise and escape parameters before using them in the ORDER BY clause of a... | 2026-10-06 |
| CVE-2026-88783 | high | 8.8 | No | The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so t... | 2026-10-06 |
| CVE-2026-88782 | medium | 6.8 | No | The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a... | 2026-10-06 |
| CVE-2026-86834 | low | 3.7 | No | The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submissi... | 2026-10-06 |
| CVE-2026-86832 | medium | 5.3 | No | The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to v... | 2026-10-06 |
| CVE-2026-85568 | medium | 6.8 | No | The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not correctly handle a search value before rewriting an already pre... | 2026-10-06 |
| CVE-2026-85015 | medium | 6.6 | No | The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting... | 2026-10-06 |
| CVE-2026-80518 | low | 3.7 | No | The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the impor... | 2026-10-06 |
| CVE-2026-80517 | low | 3.5 | No | The WP Ultimate CSV Importer WordPress plugin before 9.2 does not properly validate the file types contained in an uploaded archive nor sani... | 2026-10-06 |
| CVE-2026-103514 | high | 7.5 | No | The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who... | 2026-10-06 |
| CVE-2026-103293 | medium | 6.8 | No | The MPG WordPress plugin before 4.2.3 does not validate that the dataset source supplied when importing a project is a remote URL before tre... | 2026-10-06 |
| CVE-2026-101162 | medium | 6.4 | No | The WP Ultimate Review WordPress plugin before 2.4.4 does not escape some of its review overview settings before outputting them in posts, w... | 2026-10-06 |
| CVE-2026-101161 | high | 7.5 | No | The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes t... | 2026-10-06 |