Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-118235 | critical | 9.8 | No | The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Arbitrary File U... | 2026-11-02 |
| CVE-2026-110530 | high | 7.2 | No | The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2026.0517 via syndicat... | 2026-11-02 |
| CVE-2026-101325 | medium | 5.3 | No | The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including,... | 2026-11-02 |
| CVE-2026-118057 | high | 7.2 | No | The Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning plugin for WordPress is vulnerable to Stored Cross-Si... | 2026-11-02 |
| CVE-2026-116535 | medium | 6.4 | No | The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' paramete... | 2026-11-02 |
| CVE-2026-116512 | critical | 9.8 | No | The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remo... | 2026-11-02 |
| CVE-2026-111592 | medium | 6.4 | No | The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored C... | 2026-11-02 |
| CVE-2026-111070 | medium | 5.4 | No | The Content Pilot – Autoblogging & Affiliate Marketing Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions u... | 2026-11-02 |
| CVE-2026-107759 | high | 7.2 | No | The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject (via wp_mail/PHPM... | 2026-11-02 |
| CVE-2026-104012 | high | 8.8 | No | The Rox Appointment Booking – Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege Escalation via Mass As... | 2026-11-02 |
| CVE-2026-103962 | medium | 6.1 | No | The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin f... | 2026-11-02 |
| CVE-2026-88942 | medium | 6.1 | No | The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'wpf_fid' JSON Parameter... | 2026-11-02 |
| CVE-2026-120019 | medium | 5.4 | No | The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and... | 2026-11-02 |
| CVE-2026-119162 | high | 7.2 | No | The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site... | 2026-11-02 |
| CVE-2026-119089 | high | 7.2 | No | The ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to Stored Cross-... | 2026-11-02 |
| CVE-2026-119065 | high | 7.2 | No | The Shipping Zones by Drawing for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'szbd-picked' checko... | 2026-11-02 |
| CVE-2026-118070 | high | 7.2 | No | The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gid' parameter in all versions up to, and... | 2026-11-02 |
| CVE-2026-116548 | high | 7.2 | No | The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'optionals' parameter... | 2026-11-02 |
| CVE-2026-116546 | medium | 6.4 | No | The WP Job Portal – AI-Powered Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Stored Cross-Site S... | 2026-11-02 |
| CVE-2026-116522 | high | 7.2 | No | The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versio... | 2026-11-02 |