Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-120114 | high | 7.2 | No | The Debug Log Manager – Conveniently Monitor and Inspect Errors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'm... | 2026-11-02 |
| CVE-2026-116752 | medium | 6.4 | No | The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Sc... | 2026-11-02 |
| CVE-2026-107711 | medium | 6.4 | No | The FlexStock – Product Stock Sync with Google Sheets for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via... | 2026-11-02 |
| CVE-2026-104926 | medium | 6.1 | No | The WooCommerce Extra Product Options Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '_start / _end' param... | 2026-11-02 |
| CVE-2026-100151 | medium | 6.1 | No | The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to Reflect... | 2026-11-02 |
| CVE-2026-120075 | high | 7.2 | No | The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.6.1 due to ins... | 2026-11-02 |
| CVE-2026-119160 | medium | 6.4 | No | The Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News plugin for WordPress is vulnerable to Stored Cross-S... | 2026-11-02 |
| CVE-2026-118235 | critical | 9.8 | No | The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Arbitrary File U... | 2026-11-02 |
| CVE-2026-110530 | high | 7.2 | No | The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2026.0517 via syndicat... | 2026-11-02 |
| CVE-2026-101325 | medium | 5.3 | No | The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including,... | 2026-11-02 |
| CVE-2026-118057 | high | 7.2 | No | The Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning plugin for WordPress is vulnerable to Stored Cross-Si... | 2026-11-02 |
| CVE-2026-116535 | medium | 6.4 | No | The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' paramete... | 2026-11-02 |
| CVE-2026-116512 | critical | 9.8 | No | The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remo... | 2026-11-02 |
| CVE-2026-111592 | medium | 6.4 | No | The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored C... | 2026-11-02 |
| CVE-2026-111070 | medium | 5.4 | No | The Content Pilot – Autoblogging & Affiliate Marketing Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions u... | 2026-11-02 |
| CVE-2026-107759 | high | 7.2 | No | The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject (via wp_mail/PHPM... | 2026-11-02 |
| CVE-2026-104012 | high | 8.8 | No | The Rox Appointment Booking – Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege Escalation via Mass As... | 2026-11-02 |
| CVE-2026-103962 | medium | 6.1 | No | The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin f... | 2026-11-02 |
| CVE-2026-88942 | medium | 6.1 | No | The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'wpf_fid' JSON Parameter... | 2026-11-02 |
| CVE-2026-120019 | medium | 5.4 | No | The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and... | 2026-11-02 |