Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-84225 | low | 2.2 | No | The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to act on a collaboration comment before changing its state, a... | 2026-09-08 |
| CVE-2026-84221 | medium | 6.8 | No | The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with edito... | 2026-09-08 |
| CVE-2026-84022 | medium | 6.8 | No | The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML... | 2026-09-08 |
| CVE-2026-84021 | medium | 6.8 | No | The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before outputting it in an HTML attribute, relying... | 2026-09-08 |
| CVE-2026-83544 | medium | 6.8 | No | The Greenshift WordPress plugin before 13.2.0 does not properly escape a block animation attribute before outputting it within an HTML attri... | 2026-09-08 |
| CVE-2026-83543 | medium | 4.1 | No | The Greenshift WordPress plugin before 13.2.0 does not validate a user-supplied URL before fetching it server-side, allowing users with cont... | 2026-09-08 |
| CVE-2026-82846 | medium | 6.8 | No | The Masteriyo LMS WordPress plugin before 3.4.0 does not sanitise and escape some course settings before outputting them in a page available... | 2026-09-08 |
| CVE-2026-82304 | high | 8.6 | No | The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user input before using it in a SQL statement, leading to a SQL i... | 2026-09-08 |
| CVE-2026-81424 | medium | 5.3 | No | The Accept Stripe Payments WordPress plugin before 2.1.4 does not verify that the product fulfilled when a checkout is completed matches the... | 2026-09-08 |
| CVE-2026-81423 | medium | 4.3 | No | The Accept Stripe Payments WordPress plugin before 2.1.4 does not validate a user-supplied URL before using it in a redirect, allowing unaut... | 2026-09-08 |
| CVE-2026-81404 | high | 7.1 | No | The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape user input before reflecting it back in the HTTP response,... | 2026-09-08 |
| CVE-2026-81348 | low | 3.7 | No | The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read s... | 2026-09-08 |
| CVE-2026-78362 | critical | 9.8 | No | The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing... | 2026-09-08 |
| CVE-2026-78150 | low | 2.7 | No | The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing use... | 2026-09-08 |
| CVE-2026-78149 | medium | 5.3 | No | The Smart Post WordPress plugin before 4.0.8 does not check whether a post is password protected before returning its content and its stored... | 2026-09-08 |
| CVE-2026-77826 | high | 8.8 | No | The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepti... | 2026-09-08 |
| CVE-2026-19861 | medium | 4.7 | No | The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly sanitise and escape a form field's value... | 2026-09-08 |
| CVE-2026-19858 | high | 7.5 | No | The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving reques... | 2026-09-08 |
| CVE-2026-15247 | medium | 5.4 | No | The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a settings update in one... | 2026-09-08 |
| CVE-2026-85541 | medium | 5.4 | No | DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can execute arbitrary J... | 2026-09-08 |