Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-13159 | medium | 4.3 | No | The Real Estate Papi WordPress theme through 1.0.5 does not perform capability or CSRF checks on one of its AJAX actions, allowing any authe... | 2026-09-08 |
| CVE-2026-84927 | low | 2.7 | No | The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes,... | 2026-09-08 |
| CVE-2026-84926 | low | 2.7 | No | The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators,... | 2026-09-08 |
| CVE-2026-84901 | medium | 4.9 | No | The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing us... | 2026-09-08 |
| CVE-2026-84899 | medium | 6.8 | No | The VikWidgetsLoader WordPress plugin before 1.12.0 does not sanitise or escape a block attribute before outputting it inside an inline scri... | 2026-09-08 |
| CVE-2026-84898 | medium | 6.6 | No | The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include a local file, allowin... | 2026-09-08 |
| CVE-2026-84896 | medium | 6.8 | No | The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before outputting it in an HTML... | 2026-09-08 |
| CVE-2026-84745 | low | 2.7 | No | The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public RES... | 2026-09-08 |
| CVE-2026-84225 | low | 2.2 | No | The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to act on a collaboration comment before changing its state, a... | 2026-09-08 |
| CVE-2026-84221 | medium | 6.8 | No | The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with edito... | 2026-09-08 |
| CVE-2026-84022 | medium | 6.8 | No | The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML... | 2026-09-08 |
| CVE-2026-84021 | medium | 6.8 | No | The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before outputting it in an HTML attribute, relying... | 2026-09-08 |
| CVE-2026-83544 | medium | 6.8 | No | The Greenshift WordPress plugin before 13.2.0 does not properly escape a block animation attribute before outputting it within an HTML attri... | 2026-09-08 |
| CVE-2026-83543 | medium | 4.1 | No | The Greenshift WordPress plugin before 13.2.0 does not validate a user-supplied URL before fetching it server-side, allowing users with cont... | 2026-09-08 |
| CVE-2026-82846 | medium | 6.8 | No | The Masteriyo LMS WordPress plugin before 3.4.0 does not sanitise and escape some course settings before outputting them in a page available... | 2026-09-08 |
| CVE-2026-82304 | high | 8.6 | No | The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user input before using it in a SQL statement, leading to a SQL i... | 2026-09-08 |
| CVE-2026-81424 | medium | 5.3 | No | The Accept Stripe Payments WordPress plugin before 2.1.4 does not verify that the product fulfilled when a checkout is completed matches the... | 2026-09-08 |
| CVE-2026-81423 | medium | 4.3 | No | The Accept Stripe Payments WordPress plugin before 2.1.4 does not validate a user-supplied URL before using it in a redirect, allowing unaut... | 2026-09-08 |
| CVE-2026-81404 | high | 7.1 | No | The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape user input before reflecting it back in the HTTP response,... | 2026-09-08 |
| CVE-2026-81348 | low | 3.7 | No | The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read s... | 2026-09-08 |