Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-15027 | high | 8.8 | No | CGServiSign developed by Changing has a OS Command Injection vulnerability. Unauthenticated remote attackers can induce victims to visit a m... | 2026-09-24 |
| CVE-2026-82843 | critical | 9.0 | No | The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to... | 2026-09-24 |
| CVE-2026-93662 | medium | 4.3 | No | The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies... | 2026-09-24 |
| CVE-2026-93661 | low | 2.7 | No | The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was a... | 2026-09-24 |
| CVE-2026-89005 | medium | 6.8 | No | The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitise and escape one of its campaign configuration fields when a c... | 2026-09-24 |
| CVE-2026-89004 | low | 2.7 | No | The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not verify ownership or authorization before returning a campaign's store... | 2026-09-24 |
| CVE-2026-89002 | medium | 6.8 | No | The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitize and escape content it retrieves from a user-supplied source... | 2026-09-24 |
| CVE-2026-88847 | medium | 4.3 | No | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that a user is enrolled in a course before recording les... | 2026-09-24 |
| CVE-2026-88846 | medium | 5.3 | No | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not check whether user registration is enabled on the site before c... | 2026-09-24 |
| CVE-2026-88845 | medium | 4.3 | No | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform any capability or nonce checks on an administrative mai... | 2026-09-24 |
| CVE-2026-88843 | high | 7.2 | No | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to b... | 2026-09-24 |
| CVE-2026-84151 | low | 3.5 | No | The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it... | 2026-09-24 |
| CVE-2026-82850 | medium | 4.3 | No | The Masteriyo LMS WordPress plugin before 3.4.2 does not restrict access to quiz answer keys, allowing any authenticated user, such as a stu... | 2026-09-24 |
| CVE-2026-82849 | medium | 4.3 | No | The Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user making the request owns the course-progress records being retu... | 2026-09-24 |
| CVE-2026-82195 | medium | 6.5 | No | The 10Web Booster WordPress plugin before 2.34.0 does not restrict access to the routine which issues the shared secret that authenticates i... | 2026-09-24 |
| CVE-2026-80513 | high | 7.5 | No | The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied prof... | 2026-09-24 |
| CVE-2026-80338 | medium | 6.8 | No | The CMB2 WordPress plugin before 2.13.0 does not perform any capability check on one of its AJAX actions, allowing users with a role as low... | 2026-09-24 |
| CVE-2026-74991 | medium | 6.8 | No | The WPForms WordPress plugin before 2.0.2 does not verify that a Stripe payment object supplied during a public form submission belongs to i... | 2026-09-24 |
| CVE-2026-86583 | high | 8.8 | No | The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2... | 2026-09-24 |
| CVE-2026-19125 | high | 8.1 | No | The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.5. This is d... | 2026-09-24 |