Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-82183 | high | 8.1 | No | The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Steam single sign-on flow, all... | 2026-09-03 |
| CVE-2026-81807 | high | 8.8 | No | The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before rendering it, allowing unauthenticated use... | 2026-09-03 |
| CVE-2026-81737 | high | 8.8 | No | The FAQ Builder AYS WordPress plugin before 1.8.5 does not sanitize or escape content submitted by unauthenticated visitors before storing i... | 2026-09-03 |
| CVE-2026-81583 | medium | 5.4 | No | The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite ins... | 2026-09-03 |
| CVE-2026-81432 | medium | 4.3 | No | The JetStyleManager for Gutenberg WordPress plugin before 1.3.9 does not have CSRF protection on some of its AJAX actions, allowing attacker... | 2026-09-03 |
| CVE-2026-81428 | medium | 6.5 | No | The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variati... | 2026-09-03 |
| CVE-2026-81427 | medium | 4.3 | No | The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the... | 2026-09-03 |
| CVE-2026-81426 | medium | 4.3 | No | The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which c... | 2026-09-03 |
| CVE-2026-81199 | medium | 5.3 | No | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning a student's lea... | 2026-09-03 |
| CVE-2026-81198 | low | 3.8 | No | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of a curriculum object before acting... | 2026-09-03 |
| CVE-2026-81197 | medium | 5.3 | No | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses,... | 2026-09-03 |
| CVE-2026-81196 | low | 2.7 | No | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of quiz question identifiers, allowin... | 2026-09-03 |
| CVE-2026-81195 | medium | 5.3 | No | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning per-student cou... | 2026-09-03 |
| CVE-2026-81194 | medium | 4.3 | No | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify authorization when retrieving order line-item d... | 2026-09-03 |
| CVE-2026-80467 | high | 8.1 | No | The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms t... | 2026-09-03 |
| CVE-2026-79621 | medium | 4.3 | No | The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it in... | 2026-09-03 |
| CVE-2026-78151 | medium | 5.3 | No | The FormLayer WordPress plugin before 1.0.9 does not perform any authorization check before returning a form's full stored configuration in... | 2026-09-03 |
| CVE-2026-77792 | high | 7.5 | No | The RegistrationMagic WordPress plugin before 6.0.9.9 does not escape a registration form field value before outputting it in an HTML attrib... | 2026-09-03 |
| CVE-2026-77788 | medium | 4.9 | No | The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the object the user was aut... | 2026-09-03 |
| CVE-2026-77787 | low | 2.7 | No | The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and... | 2026-09-03 |