Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-62121 | medium | 6.5 | No | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Unlimited Elements... | 2026-10-30 |
| CVE-2026-62057 | medium | 5.3 | No | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Fahim Reza Divi Contact Form 7 cf7-styler-for... | 2026-10-30 |
| CVE-2026-62056 | medium | 5.3 | No | Missing Authorization vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Exploiting Incorrectly Configured Access Control Secu... | 2026-10-30 |
| CVE-2026-62047 | medium | 4.3 | No | Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Co... | 2026-10-30 |
| CVE-2026-62023 | medium | 4.3 | No | Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-eleme... | 2026-10-30 |
| CVE-2026-62019 | medium | 4.3 | No | Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control Security... | 2026-10-30 |
| CVE-2026-54855 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions. | 2026-10-30 |
| CVE-2026-54854 | medium | 6.3 | No | Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions. | 2026-10-30 |
| CVE-2026-54850 | medium | 6.5 | No | Subscriber Broken Access Control in Booking and Rental Manager <= 2.8.2 versions. | 2026-10-30 |
| CVE-2026-52710 | medium | 5.3 | No | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ithemelandco GIFTiT – Free Gifts for WooComme... | 2026-10-30 |
| CVE-2026-39786 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions. | 2026-10-30 |
| CVE-2026-39739 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Ultimate Addons for E... | 2026-10-30 |
| CVE-2026-39734 | high | 7.5 | No | Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions. | 2026-10-30 |
| CVE-2026-27061 | medium | 6.5 | No | Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 versions. | 2026-10-30 |
| CVE-2026-119526 | critical | 9.8 | No | Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection. This issue affects Royal Event: from n/a t... | 2026-10-30 |
| CVE-2026-118090 | high | 8.8 | No | Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions. | 2026-10-30 |
| CVE-2026-118089 | high | 7.2 | No | Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions. | 2026-10-30 |
| CVE-2026-116862 | high | 7.5 | No | Unauthenticated Broken Access Control in WP REST Cache <= 2026.3.1 versions. | 2026-10-30 |
| CVE-2026-116861 | high | 7.5 | No | Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions. | 2026-10-30 |
| CVE-2026-116854 | medium | 6.5 | No | Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 versions. | 2026-10-30 |