Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-4357 | critical | 10.0 | No | The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be upl... | 2026-09-03 |
| CVE-2026-2811 | medium | 5.4 | No | The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output es... | 2026-09-03 |
| CVE-2026-2688 | medium | 6.5 | No | The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX reques... | 2026-09-03 |
| CVE-2026-19698 | low | 3.5 | No | The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before using them to build the CS... | 2026-09-03 |
| CVE-2026-17563 | medium | 5.3 | No | The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submis... | 2026-09-03 |
| CVE-2026-14326 | low | 3.8 | No | The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing... | 2026-09-03 |
| CVE-2026-10821 | medium | 6.6 | No | The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the s... | 2026-09-03 |
| CVE-2026-82183 | high | 8.1 | No | The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Steam single sign-on flow, all... | 2026-09-03 |
| CVE-2026-81807 | high | 8.8 | No | The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before rendering it, allowing unauthenticated use... | 2026-09-03 |
| CVE-2026-81737 | high | 8.8 | No | The FAQ Builder AYS WordPress plugin before 1.8.5 does not sanitize or escape content submitted by unauthenticated visitors before storing i... | 2026-09-03 |
| CVE-2026-81583 | medium | 5.4 | No | The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite ins... | 2026-09-03 |
| CVE-2026-81432 | medium | 4.3 | No | The JetStyleManager for Gutenberg WordPress plugin before 1.3.9 does not have CSRF protection on some of its AJAX actions, allowing attacker... | 2026-09-03 |
| CVE-2026-81428 | medium | 6.5 | No | The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variati... | 2026-09-03 |
| CVE-2026-81427 | medium | 4.3 | No | The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the... | 2026-09-03 |
| CVE-2026-81426 | medium | 4.3 | No | The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which c... | 2026-09-03 |
| CVE-2026-81199 | medium | 5.3 | No | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning a student's lea... | 2026-09-03 |
| CVE-2026-81198 | low | 3.8 | No | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of a curriculum object before acting... | 2026-09-03 |
| CVE-2026-81197 | medium | 5.3 | No | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses,... | 2026-09-03 |
| CVE-2026-81196 | low | 2.7 | No | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of quiz question identifiers, allowin... | 2026-09-03 |
| CVE-2026-81195 | medium | 5.3 | No | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning per-student cou... | 2026-09-03 |