Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-7622 | medium | 4.3 | No | The ThumbPress plugin for WordPress is vulnerable to unauthorized access in versions up to and including 6.2.1. This is due to missing capab... | 2026-09-22 |
| CVE-2026-6922 | high | 7.1 | No | The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and in... | 2026-09-22 |
| CVE-2026-4123 | medium | 4.3 | No | The RW Elephant Rental Inventory plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.3.13. Thi... | 2026-09-22 |
| CVE-2026-1645 | medium | 4.4 | No | The Hostel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_currency' parameter and the 'locale_url' settin... | 2026-09-22 |
| CVE-2026-18345 | medium | 4.3 | No | The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect... | 2026-09-22 |
| CVE-2026-16778 | medium | 6.4 | No | The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dslc_module_downlo... | 2026-09-22 |
| CVE-2026-12995 | medium | 4.3 | No | The Custom Field Template plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.8... | 2026-09-22 |
| CVE-2026-94504 | high | 7.2 | No | Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An... | 2026-09-22 |
| CVE-2026-93655 | medium | 6.1 | No | The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpbc_auto_fill' parameter in all versions... | 2026-09-22 |
| CVE-2026-85653 | medium | 6.4 | No | The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'other_attributes' Block Parameter in all... | 2026-09-22 |
| CVE-2026-12470 | high | 7.2 | No | The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to unauthorized modification of data that can l... | 2026-09-22 |
| CVE-2026-19658 | critical | 9.8 | No | The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization... | 2026-09-22 |
| CVE-2026-13355 | critical | 9.8 | No | The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 3.11.0. This... | 2026-09-22 |
| CVE-2026-94492 | medium | 6.3 | No | A security vulnerability has been detected in Yonyou U8cloud 5.x. This vulnerability affects unknown code of the file /u8cloud/openapi/so.sa... | 2026-09-22 |
| CVE-2026-94425 | high | 8.8 | No | A vulnerability was found in Moore Threads MTT S80 Driver Package 340.150. The affected element is the function sub_140006F0C in the library... | 2026-09-22 |
| CVE-2026-94424 | high | 8.8 | No | A vulnerability has been found in Moore Threads MTT S80 Driver Package up to 340.150. Impacted is the function sub_140001000 in the library... | 2026-09-22 |
| CVE-2026-94403 | high | 8.8 | No | A weakness has been identified in ColorFul iGameCenter 1.0.3.4. This impacts the function sub_140001AF0 in the library ene.sys of the compon... | 2026-09-22 |
| CVE-2026-87153 | high | 8.1 | No | Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are aff... | 2026-09-22 |
| CVE-2026-87154 | high | 8.1 | No | Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are aff... | 2026-09-22 |
| CVE-2026-87155 | high | 8.8 | No | Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are aff... | 2026-09-22 |