Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-88802 | high | 7.5 | No | The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capa... | 2026-09-14 |
| CVE-2026-88793 | high | 8.8 | No | The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any authorisation check on one of its AJAX actions, relying only on a... | 2026-09-14 |
| CVE-2026-85129 | high | 8.8 | No | The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sa... | 2026-09-14 |
| CVE-2026-74933 | high | 8.8 | No | The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decod... | 2026-09-14 |
| CVE-2026-89080 | high | 7.5 | No | The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed e... | 2026-09-14 |
| CVE-2026-88995 | medium | 5.3 | No | The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.1 does not properly restrict the data returned by an availability-... | 2026-09-14 |
| CVE-2026-88912 | medium | 4.2 | No | The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level... | 2026-09-14 |
| CVE-2026-88764 | medium | 5.4 | No | The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal payment notification ma... | 2026-09-14 |
| CVE-2026-86407 | low | 3.7 | No | The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation pag... | 2026-09-14 |
| CVE-2026-86406 | high | 7.5 | No | The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and... | 2026-09-14 |
| CVE-2026-80072 | medium | 4.7 | No | The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecti... | 2026-09-14 |
| CVE-2026-80071 | high | 7.2 | No | The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the... | 2026-09-14 |
| CVE-2026-77773 | medium | 5.3 | No | The Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8 does not perform any capability, nonce or session chec... | 2026-09-14 |
| CVE-2026-87919 | medium | 4.9 | No | The Product XML Feed Manager for WooCommerce WordPress plugin before 3.1.1 does not restrict which object method its product shortcode may c... | 2026-09-14 |
| CVE-2026-87918 | medium | 5.3 | No | The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions that relay prompts to its... | 2026-09-14 |
| CVE-2026-87916 | medium | 5.3 | No | The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX action that lists stored chat sessions, a... | 2026-09-14 |
| CVE-2026-87894 | medium | 5.3 | No | The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's... | 2026-09-14 |
| CVE-2026-87892 | medium | 5.3 | No | The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own ser... | 2026-09-14 |
| CVE-2026-87891 | medium | 6.5 | No | The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday sch... | 2026-09-14 |
| CVE-2026-87888 | high | 8.0 | No | The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing... | 2026-09-14 |