Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-96817 | high | 8.2 | No | Subscriber Broken Access Control in MakeCommerce for WooCommerce <= 4.1.0 versions. | 2026-09-30 |
| CVE-2026-96816 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Trusted Shops Easy Integration for WooCommerce <= 2.0.6 versions. | 2026-09-30 |
| CVE-2026-96815 | high | 7.2 | No | Custom role Privilege Escalation in Vitepos <= 3.5.0 versions. | 2026-09-30 |
| CVE-2026-96814 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 5.6.7 versions. | 2026-09-30 |
| CVE-2026-96450 | medium | 5.4 | No | Contributor Cross Site Scripting (XSS) in pixfort Core < 4.3.3 versions. | 2026-09-30 |
| CVE-2026-96352 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in YITH WooCommerce Ajax Search <= 2.28.0 versions. | 2026-09-30 |
| CVE-2026-96351 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 6.1.3 versions. | 2026-09-30 |
| CVE-2026-96350 | critical | 9.8 | No | Subscriber Privilege Escalation in Estatik <= 4.3.5 versions. | 2026-09-30 |
| CVE-2026-96349 | critical | 10.0 | No | Unauthenticated Remote Code Execution (RCE) in SiteSkite <= 2.1.8 versions. | 2026-09-30 |
| CVE-2026-96348 | high | 7.5 | No | Unauthenticated Broken Access Control in Bookly <= 28.2 versions. | 2026-09-30 |
| CVE-2026-96347 | medium | 6.5 | No | Subscriber Insecure Direct Object References (IDOR) in Bookly <= 28.2 versions. | 2026-09-30 |
| CVE-2026-96346 | high | 7.6 | No | Author SQL Injection in WP ERP <= 1.17.9 versions. | 2026-09-30 |
| CVE-2026-96345 | high | 7.6 | No | Administrator SQL Injection in Estatik <= 4.3.5 versions. | 2026-09-30 |
| CVE-2026-96344 | high | 7.2 | No | Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions. | 2026-09-30 |
| CVE-2026-96343 | high | 7.2 | No | Custom role PHP Object Injection in WP ERP <= 1.17.9 versions. | 2026-09-30 |
| CVE-2026-96342 | not reported | — | No | Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Retrieve Embedded Sensitive Data.This issue affects WPMobile... | 2026-09-30 |
| CVE-2026-96338 | medium | 6.5 | No | Subscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.2 versions. | 2026-09-30 |
| CVE-2026-95587 | high | 7.5 | No | Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions. | 2026-09-30 |
| CVE-2026-95531 | high | 8.8 | No | Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions. | 2026-09-30 |
| CVE-2026-95104 | high | 7.5 | No | Stack-based buffer overflow vulnerability exists in BUFFALO Wi-Fi products. A non-authenticated crafted HTTP request may cause a denial-of-s... | 2026-09-30 |