Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-77788 | medium | 4.9 | No | The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the object the user was aut... | 2026-09-03 |
| CVE-2026-77787 | low | 2.7 | No | The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and... | 2026-09-03 |
| CVE-2026-77785 | low | 2.7 | No | The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the requesting user is permitted to read the specific post referenced... | 2026-09-03 |
| CVE-2026-77784 | low | 2.7 | No | The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modified before updating i... | 2026-09-03 |
| CVE-2026-77783 | low | 3.7 | No | The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewabl... | 2026-09-03 |
| CVE-2026-77782 | medium | 5.3 | No | The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build pu... | 2026-09-03 |
| CVE-2026-77764 | medium | 4.3 | No | The GamiPress WordPress plugin before 7.9.9.6 does not properly restrict its video watch-tracking functionality, allowing users with a role... | 2026-09-03 |
| CVE-2026-74927 | medium | 5.3 | No | The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API listing routes, allowing... | 2026-09-03 |
| CVE-2026-19723 | high | 7.1 | No | The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properly escape a value taken from the incoming... | 2026-09-03 |
| CVE-2026-19719 | medium | 6.8 | No | The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not escape the post title before outputting it in a... | 2026-09-03 |
| CVE-2026-19704 | medium | 5.3 | No | The Comments WordPress plugin before 7.6.66 does not validate a value used to build a database query, allowing unauthenticated users to inje... | 2026-09-03 |
| CVE-2026-19453 | high | 7.1 | No | The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migr... | 2026-09-03 |
| CVE-2026-19251 | medium | 5.3 | No | The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to... | 2026-09-03 |
| CVE-2026-19116 | high | 8.8 | No | The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post i... | 2026-09-03 |
| CVE-2023-3360 | low | 3.3 | No | The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections... | 2026-09-03 |
| CVE-2026-82182 | medium | 4.1 | No | The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not sanitise a user supplied list of identifiers before using... | 2026-09-03 |
| CVE-2026-16983 | medium | 4.3 | No | The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plainte... | 2026-09-03 |
| CVE-2026-16966 | medium | 5.3 | No | The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its AJAX actions, allowing... | 2026-09-03 |
| CVE-2026-15232 | medium | 5.3 | No | The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-su... | 2026-09-03 |
| CVE-2026-14215 | medium | 6.5 | No | The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token befo... | 2026-09-03 |