Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-62137 | medium | 5.3 | No | Unauthenticated Sensitive Data Exposure in bbPress <= 2.6.14 versions. | 2026-09-11 |
| CVE-2026-62136 | medium | 5.3 | No | Unauthenticated Broken Access Control in Flexible Quantity – Measurement Price Calculator for WooCommerce <= 2.3.21 versions. | 2026-09-11 |
| CVE-2026-62135 | medium | 5.3 | No | Unauthenticated Broken Access Control in Booktics <= 1.0.24 versions. | 2026-09-11 |
| CVE-2026-62132 | medium | 5.3 | No | Subscriber Broken Access Control in Masteriyo - LMS <= 3.4.0 versions. | 2026-09-11 |
| CVE-2026-62114 | medium | 5.3 | No | Unauthenticated Broken Access Control in Passster <= 4.3.13 versions. | 2026-09-11 |
| CVE-2026-62113 | medium | 4.3 | No | Contributor Insecure Direct Object References (IDOR) in Slim SEO <= 4.10.0 versions. | 2026-09-11 |
| CVE-2026-62110 | medium | 6.5 | No | Contributor Cross Site Scripting (XSS) in Bold Page Builder <= 5.9.9 versions. | 2026-09-11 |
| CVE-2026-62109 | high | 7.6 | No | Editor SQL Injection in Sky Addons for Elementor <= 3.8.4 versions. | 2026-09-11 |
| CVE-2026-62107 | high | 8.8 | No | Unauthenticated PHP Object Injection in Masteriyo - LMS <= 3.4.0 versions. | 2026-09-11 |
| CVE-2026-62103 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Everest Forms <= 3.6.0 versions. | 2026-09-11 |
| CVE-2026-62102 | high | 8.8 | No | Subscriber Privilege Escalation in Gato GraphQL <= 19.2.3 versions. | 2026-09-11 |
| CVE-2026-62089 | high | 7.1 | No | Missing Authorization vulnerability in Pixar Labs Master Addons for Elementor allows Privilege Abuse. This issue affects Master Addons for... | 2026-09-11 |
| CVE-2026-62088 | medium | 5.3 | No | Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded Sensitive Data. This issue af... | 2026-09-11 |
| CVE-2026-48707 | low | 3.1 | No | InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery (SSRF) vulnerabi... | 2026-09-11 |
| CVE-2026-19991 | high | 8.1 | No | The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the upload_file_remov... | 2026-09-11 |
| CVE-2026-2310 | high | 7.8 | No | IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable to an XML external entity injection (XXE) attack when proces... | 2026-09-11 |
| CVE-2026-19946 | medium | 4.3 | No | The Awesome Support plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.3.9. This is due to a mi... | 2026-09-11 |
| CVE-2026-18579 | high | 7.2 | No | The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_X_FORWARDED_FOR' parameter in all ve... | 2026-09-11 |
| CVE-2026-18561 | high | 7.5 | No | The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, an... | 2026-09-11 |
| CVE-2026-11496 | medium | 6.5 | No | The Woo PDF Invoice Builder plugin (also distributed as "PDF Builder for WooCommerce") for WordPress is vulnerable to Insecure Direct Object... | 2026-09-11 |