Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-96566 | high | 7.2 | No | The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'np1' Custom Field... | 2026-10-03 |
| CVE-2026-96813 | high | 7.2 | No | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting... | 2026-10-03 |
| CVE-2026-95670 | high | 7.2 | No | The No External Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect in all versi... | 2026-10-03 |
| CVE-2026-96256 | medium | 6.4 | No | The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Script... | 2026-10-03 |
| CVE-2026-95687 | high | 8.8 | No | The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions u... | 2026-10-03 |
| CVE-2026-94432 | medium | 5.3 | No | The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Objec... | 2026-10-03 |
| CVE-2026-93756 | high | 7.2 | No | The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via... | 2026-10-03 |
| CVE-2026-93882 | high | 7.5 | No | The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Refere... | 2026-10-03 |
| CVE-2026-92548 | medium | 5.3 | No | The WP Popular Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.4.2 via th... | 2026-10-03 |
| CVE-2026-92174 | high | 7.5 | No | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.73.2 via th... | 2026-10-03 |
| CVE-2026-90438 | high | 7.2 | No | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Paragra... | 2026-10-03 |
| CVE-2026-92245 | high | 7.5 | No | The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including,... | 2026-10-03 |
| CVE-2026-91109 | medium | 6.5 | No | The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including... | 2026-10-03 |
| CVE-2026-87920 | high | 7.2 | No | The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output-Buffer Regex Rewrite in... | 2026-10-03 |
| CVE-2026-89427 | medium | 6.1 | No | The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 's' Search Parameter in... | 2026-10-03 |
| CVE-2026-89047 | medium | 6.1 | No | The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL in all ve... | 2026-10-03 |
| CVE-2026-88999 | medium | 4.3 | No | The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to t... | 2026-10-03 |
| CVE-2026-85492 | medium | 6.1 | No | The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin for WordPress is vulne... | 2026-10-03 |
| CVE-2026-85679 | high | 7.2 | No | The Extendify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'styles.blocks' Block Type Key in all versions up to, an... | 2026-10-03 |
| CVE-2026-66331 | not reported | — | No | Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Delphi bindings buffered transport. This issue affects... | 2026-10-03 |