Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-86608 | high | 8.2 | No | The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor does it bound what t... | 2026-09-23 |
| CVE-2026-86603 | medium | 4.3 | No | The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its AJAX actions, allowing any authentica... | 2026-09-23 |
| CVE-2026-86602 | medium | 4.3 | No | The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions, allowing any authentica... | 2026-09-23 |
| CVE-2026-85006 | medium | 6.8 | No | The HappyAddons for Elementor WordPress plugin before 3.50.0 does not escape an icon value on one of its button widgets before outputting it... | 2026-09-23 |
| CVE-2026-84743 | low | 3.8 | No | The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, al... | 2026-09-23 |
| CVE-2026-84742 | low | 2.7 | No | The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it... | 2026-09-23 |
| CVE-2026-84741 | medium | 5.3 | No | The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details in... | 2026-09-23 |
| CVE-2026-84168 | medium | 5.3 | No | The Easy Hide Login WordPress plugin before 1.7 does not fully enforce its hidden-login protection, allowing an unauthenticated attacker to... | 2026-09-23 |
| CVE-2026-84150 | medium | 5.4 | No | The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user... | 2026-09-23 |
| CVE-2026-84098 | medium | 6.5 | No | The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not properly verify a listing's... | 2026-09-23 |
| CVE-2026-84046 | medium | 5.0 | No | The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not validate a user-supplied UR... | 2026-09-23 |
| CVE-2026-84027 | medium | 4.3 | No | The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not check user capabilities whe... | 2026-09-23 |
| CVE-2026-84026 | medium | 5.3 | No | The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not restrict access to a REST e... | 2026-09-23 |
| CVE-2026-83555 | medium | 5.3 | No | The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a sub... | 2026-09-23 |
| CVE-2026-81339 | medium | 4.3 | No | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform a per-object ownership check when returning a quiz atte... | 2026-09-23 |
| CVE-2026-81338 | medium | 4.6 | No | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content b... | 2026-09-23 |
| CVE-2026-80342 | medium | 6.5 | No | The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.27 does not verify that a PayPal order supplied in a payment request... | 2026-09-23 |
| CVE-2026-77766 | medium | 4.3 | No | The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not scope one of its REST colle... | 2026-09-23 |
| CVE-2026-77765 | medium | 5.3 | No | The Better Payment WordPress plugin before 2.3.4 does not validate the submitted payment amount server-side against the merchant's configure... | 2026-09-23 |
| CVE-2026-75799 | critical | 9.0 | No | The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate the type of the remote files it caches in a publicly accessible director... | 2026-09-23 |