Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-87984 | not reported | — | No | An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside... | 2026-09-11 |
| CVE-2026-87983 | not reported | — | No | An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using... | 2026-09-11 |
| CVE-2026-86813 | medium | 4.8 | No | The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that are placed into noti... | 2026-09-11 |
| CVE-2026-86809 | medium | 5.3 | No | The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment... | 2026-09-11 |
| CVE-2026-85116 | medium | 6.5 | No | The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin from 1.2.2 before 1.42.3 runs the shortcode parser over the whole rendered Con... | 2026-09-11 |
| CVE-2026-82215 | medium | 5.9 | No | The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications... | 2026-09-11 |
| CVE-2026-82213 | medium | 5.3 | No | The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current... | 2026-09-11 |
| CVE-2026-86815 | medium | 5.5 | No | The BackWPup WordPress plugin before 5.7.5 does not properly restrict access to several of its REST API routes for job, backup-destination,... | 2026-09-11 |
| CVE-2026-86812 | medium | 6.5 | No | The WPCafe WordPress plugin before 3.0.18 does not correctly restrict access to a set of order-management REST endpoints because their permi... | 2026-09-11 |
| CVE-2026-86782 | medium | 5.5 | No | The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing users with the Contr... | 2026-09-11 |
| CVE-2026-86781 | medium | 5.3 | No | The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a ce... | 2026-09-11 |
| CVE-2026-86780 | medium | 6.8 | No | The Featured Image with URL WordPress plugin before 1.0.6 does not sanitise and escape a stored image attribute value before outputting it,... | 2026-09-11 |
| CVE-2026-86779 | low | 2.7 | No | The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability che... | 2026-09-11 |
| CVE-2026-85678 | medium | 6.8 | No | The AI Builder WordPress plugin before 2.7.8 does not sanitise custom JavaScript saved against a post before echoing it inside a script tag... | 2026-09-11 |
| CVE-2026-85677 | high | 8.8 | No | The Gutenverse News WordPress plugin before 3.3.3 does not restrict the extra HTML it adds to WordPress's allowed elements to the context it... | 2026-09-11 |
| CVE-2026-83546 | medium | 6.8 | No | The CoolClock WordPress plugin before 4.3.8 does not properly escape a skin setting before outputting it within an HTML attribute, allowing... | 2026-09-11 |
| CVE-2026-83545 | medium | 6.8 | No | The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, all... | 2026-09-11 |
| CVE-2026-82305 | medium | 5.3 | No | The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify that a user is authorised to rename a given wishlist, allowing... | 2026-09-11 |
| CVE-2026-74925 | high | 7.2 | No | The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding it... | 2026-09-11 |
| CVE-2026-14566 | medium | 4.3 | No | The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before updating Wo... | 2026-09-11 |