Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-96838 | high | 8.8 | No | Unauthenticated Cross Site Request Forgery (CSRF) in Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification <= 2.3.1... | 2026-09-30 |
| CVE-2026-96837 | high | 8.8 | No | Contributor Remote Code Execution (RCE) in CartFlows <= 3.2.0 versions. | 2026-09-30 |
| CVE-2026-96836 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Parsi Date <= 6.3 versions. | 2026-09-30 |
| CVE-2026-96835 | medium | 6.5 | No | Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.85 versions. | 2026-09-30 |
| CVE-2026-96834 | medium | 6.5 | No | Subscriber Sensitive Data Exposure in GiveWP <= 4.16.9 versions. | 2026-09-30 |
| CVE-2026-96833 | high | 7.2 | No | Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions. | 2026-09-30 |
| CVE-2026-96832 | high | 7.2 | No | Shop manager PHP Object Injection in Content Egg <= 6.3.1 versions. | 2026-09-30 |
| CVE-2026-96831 | high | 8.8 | No | Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions. | 2026-09-30 |
| CVE-2026-96830 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions. | 2026-09-30 |
| CVE-2026-96829 | medium | 6.5 | No | Contributor Cross Site Scripting (XSS) in The Plus Addons for Elementor Page Builder Lite <= 6.5.1 versions. | 2026-09-30 |
| CVE-2026-96828 | high | 7.6 | No | Administrator SQL Injection in Category Discount Woocommerce <= 5.18 versions. | 2026-09-30 |
| CVE-2026-96827 | high | 7.6 | No | Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions. | 2026-09-30 |
| CVE-2026-96825 | medium | 4.2 | No | Subscriber Bypass Vulnerability in All In One WP Security & Firewall <= 5.4.8 versions. | 2026-09-30 |
| CVE-2026-96824 | medium | 6.8 | No | Editor Arbitrary File Deletion in Template Kit – Import <= 1.0.16 versions. | 2026-09-30 |
| CVE-2026-96823 | high | 7.5 | No | Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce <= 5.120.0 versions. | 2026-09-30 |
| CVE-2026-96822 | critical | 9.3 | No | Unauthenticated SQL Injection in Books Gallery <= 4.8.3 versions. | 2026-09-30 |
| CVE-2026-96821 | medium | 6.3 | No | Subscriber Privilege Escalation in FluentBoards <= 2.0.12 versions. | 2026-09-30 |
| CVE-2026-96820 | high | 7.1 | No | Subscriber Cross Site Scripting (XSS) in Awesome Support <= 6.3.9 versions. | 2026-09-30 |
| CVE-2026-96819 | high | 7.1 | No | Subscriber Cross Site Scripting (XSS) in oik <= 4.15.4 versions. | 2026-09-30 |
| CVE-2026-96818 | high | 7.5 | No | Unauthenticated Broken Access Control in WP Express Checkout (Accept PayPal Payments) <= 2.4.9 versions. | 2026-09-30 |