By publication date

Exploited and new serious CVEs: September 2026

7,965 records · 32 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 77 of 80

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
34Monitor	CVE-2026-86134No exploit	Fireware OS Pre-Authentication NULL Pointer Dereference Allows Remote Denial of Servicewatchguard · fireware · CWE-476 Pre-auth Memory safety	High8.7	—	0.4%	Sep 30, 2026
30Monitor	CVE-2026-103111No exploit	PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arpcre · pcre2 · CWE-787 Memory safety	High7.6	—	0.2%	Sep 30, 2026
29Monitor	CVE-2026-75823No exploit	WP User Frontend 3.5.29 - 4.3.11 - Unauthenticated Privilege Escalation via Registration Role Encryptionunknown · user frontend · CWE-269 Pre-auth	High7.4	—	0.2%	Sep 30, 2026
39Monitor	CVE-2026-75873No exploit	Zella Theme < 2.6.3 - Unauthenticated Arbitrary File Uploadunknown · zella theme · CWE-434 pre-auth RCE File upload	Critical9.8	—	0.5%	Sep 30, 2026
35Monitor	CVE-2026-85573No exploit	All in One Files Upload for WooCommerce 2.0.3 - 2.0.16 - Unauthenticated Stored XSS via SVG Uploadunknown · all in one files upload · CWE-79 Pre-auth XSS	High8.8	—	0.2%	Sep 30, 2026
28Monitor	CVE-2026-88797No exploit	Vayu X < 1.0.6 - Subscriber+ Arbitrary WordPress.org Plugin Installation and Activationunknown · vayu x · CWE-284 Broken access control (IDOR)	High7.1	—	0.1%	Sep 30, 2026
30Monitor	CVE-2026-89193No exploit	Robin Image Optimizer 2.0.0 - 2.0.7 - Unauthenticated Stored XSS via WebP URL Delivery HTML Parserunknown · robin image optimizer · CWE-79 Pre-auth XSS	High7.5	—	0.2%	Sep 30, 2026
28Monitor	CVE-2026-91832No exploit	WP Mobile Menu 2.7.4 - 2.8.8 - Stored XSS via CSRFunknown · wp mobile menu · CWE-79 Pre-auth XSS CSRF	High7.1	—	0.0%	Sep 30, 2026
27Monitor	CVE-2026-92424Proof of concept	Content Egg < 11.9.0 - Contributor+ Stored XSS via Import Queueunknown · content egg · CWE-79 XSS	Medium6.8	—	0.2%	Sep 30, 2026
35Monitor	CVE-2026-92994No exploit	Verge3D < 4.13.1 - Unauthenticated Stored XSS via File Storage APIunknown · verge3d publishing and e-commerce · CWE-79 Pre-auth XSS	High8.8	—	0.2%	Sep 30, 2026
30Monitor	CVE-2026-89294No exploit	Simply Schedule Appointments <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parametercroixhaug · simply schedule appointments · CWE-98 RCE	High7.5	—	0.9%	Sep 30, 2026
36Monitor	CVE-2026-97196No exploit	WordPress GiveWP plugin <= 4.16.9 - Broken Authentication vulnerabilityliquid web / stellarwp · givewp · CWE-1289 Pre-auth Auth bypass	Critical9.1	—	0.4%	Sep 30, 2026
36Monitor	CVE-2026-102508No exploit	Apache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgradeapache software foundation · apache plc4x · CWE-295 Pre-auth Weak crypto	Critical9.2	—	0.1%	Sep 30, 2026
30Monitor	CVE-2026-6806No exploit	Motors <= 1.4.109 - Unauthenticated Blind SQL Injection via 'stm_lat'/'stm_lng' Parametersstylemix · motors – car dealership & classified listings plugin · CWE-89 Pre-auth SQL injection	High7.5	—	0.2%	Sep 30, 2026
34Monitor	CVE-2026-92867No exploit	An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticated attacker to cause abnormal process termination opgpool global development group · pgpool-ii · CWE-787 RCE Memory safety	High8.7	—	0.3%	Sep 30, 2026
28Monitor	CVE-2026-92869No exploit	An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated attacker to cause abnormal process termination.pgpool global development group · pgpool-ii · CWE-787 Memory safety	High7.1	—	0.2%	Sep 30, 2026
34Monitor	CVE-2026-92870No exploit	A stack-based buffer overflow vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal process termipgpool global development group · pgpool-ii · CWE-121 Pre-auth Memory safety	High8.7	—	0.3%	Sep 30, 2026
34Monitor	CVE-2026-92871No exploit	A NULL pointer dereference vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal termination of tpgpool global development group · pgpool-ii · CWE-476 Pre-auth Memory safety	High8.7	—	0.2%	Sep 30, 2026
34Monitor	CVE-2026-97150No exploit	When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP cbasercms users community · bcaddonmigrator · CWE-829	High8.6	—	0.3%	Sep 30, 2026
34Monitor	CVE-2026-102454No exploit	DigiWin｜EasyFlow .NET - Arbitrary File Uploaddigiwin · easyflow .net · CWE-434 RCE File upload	High8.6	—	0.5%	Sep 30, 2026
37Monitor	CVE-2026-102455No exploit	DigiWin｜EasyFlow .NET - Insecure Deserializationdigiwin · easyflow .net · CWE-502 pre-auth RCE Deserialization	Critical9.3	—	0.5%	Sep 30, 2026
28Monitor	CVE-2026-102456No exploit	DigiWin｜EasyFlow .NET - SQL Injectiondigiwin · easyflow .net · CWE-89 SQL injection	High7.1	—	0.2%	Sep 30, 2026
28Monitor	CVE-2026-102457No exploit	DigiWin｜EasyFlow .NET - Arbitrary File Readdigiwin · easyflow .net · CWE-22 Path traversal	High7.1	—	0.3%	Sep 30, 2026
37Monitor	CVE-2026-102458No exploit	DigiWin｜EasyFlow .NET - Missing Authenticationdigiwin · easyflow .net · CWE-306 Pre-auth Auth bypass	Critical9.3	—	0.4%	Sep 30, 2026
34Monitor	CVE-2026-102509No exploit	Apache PLC4X, Apache PLC4X: Pre-authentication resource exhaustion in the OPC UA driver and the Java SPI parserapache software foundation · apache plc4x · CWE-674 Pre-auth Denial of service	High8.7	—	0.4%	Sep 30, 2026
34Monitor	CVE-2026-102510No exploit	Apache PLC4X: Go binding: unbounded allocation and framing failures on wire-controlled lengthsapache software foundation · apache plc4x · CWE-129 Pre-auth	High8.7	—	0.3%	Sep 30, 2026
34Monitor	CVE-2026-102511No exploit	Apache PLC4X, Apache PLC4X, Apache PLC4X, Apache PLC4X: ADS discovery accepts spoofed responses and derives the connection target from themapache software foundation · apache plc4x · CWE-129 Pre-auth	High8.5	—	0.1%	Sep 30, 2026
35Monitor	CVE-2026-102578Proof of concept	Moodle: sql injection in question bank web servicemoodle · moodle · CWE-89 SQL injection	High8.8	—	0.3%	Sep 30, 2026
30Monitor	CVE-2026-75098No exploit	Product Designer App <= 1.1.3 - Unauthenticated Arbitrary File Read via 'svg' Parameter in pdapp-render-designproductdesignerapp · product designer app · CWE-22 Pre-auth Path traversal	High7.5	—	0.9%	Sep 30, 2026
28Monitor	CVE-2026-97347Proof of concept	Post Views Stats Counter <= 1.1.7 - Unauthenticated Stored Cross-Site Scripting via User-Agent Headerkazukiyanamoto · post views stats counter · CWE-79 Pre-auth XSS	High7.2	—	0.3%	Sep 30, 2026
34Monitor	CVE-2026-103235No exploit	MISP Event Delegation Mass Assignment Allows Retargeting Delegation to Arbitrary Eventsmisp · misp · CWE-639 Broken access control (IDOR)	High8.7	—	0.2%	Sep 30, 2026
33Monitor	CVE-2026-103237No exploit	MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rowsmisp · misp · CWE-20	High8.3	—	0.2%	Sep 30, 2026
34Monitor	CVE-2026-10764No exploit	Information disclosure in BVMS 4.5 up to 12.3iqsight · bvms · CWE-321 Pre-auth Hard-coded credentials	High8.7	—	0.1%	Sep 30, 2026
36Monitor	CVE-2026-77185No exploit	Apache MINA SSHD: Asynchronous authentication can bypass signature verificationapache software foundation · apache mina sshd · CWE-305 Pre-auth Auth bypass	Critical9.1	—	0.5%	Sep 30, 2026
28Monitor	CVE-2026-79625No exploit	Improper Synchronization in Monitoring in CODESYS Control Runtimecodesys · control rte (sl) · CWE-362 Race condition	High7.2	—	0.2%	Sep 30, 2026
32Monitor	CVE-2026-93994No exploit	Apache MINA SSHD: Repeated-publickey policy bypass on serverapache software foundation · apache mina sshd · CWE-304 Auth bypass	High8.1	—	0.3%	Sep 30, 2026
30Monitor	CVE-2026-94002No exploit	Apache MINA SSHD: Memory exhaustion in SFTP client via unsolicited SFTP repliesapache software foundation · apache mina sshd · CWE-770 Pre-auth Denial of service	High7.5	—	0.3%	Sep 30, 2026
36Monitor	CVE-2026-94052No exploit	Apache MINA SSHD: LDAP password authentication ineffectiveapache software foundation · apache mina sshd · CWE-304 Pre-auth	Critical9.1	—	0.3%	Sep 30, 2026
36Monitor	CVE-2026-94053No exploit	Apache MINA SSHD: LDAP injection in sshd-ldapapache software foundation · apache mina sshd · CWE-90 Pre-auth Auth bypass	Critical9.1	—	0.3%	Sep 30, 2026
34Monitor	CVE-2026-103239No exploit	MISP Tag Collection Save Allows Privilege Escalation via Sibling Model Injectionmisp · misp · CWE-284 Broken access control (IDOR)	High8.6	—	0.2%	Sep 30, 2026
34Monitor	CVE-2026-76992No exploit	Uncontrolled Memory Allocation in CODESYS Gateway Clientcodesys · development system 3 · CWE-770 Pre-auth Denial of service	High8.7	—	0.3%	Sep 30, 2026
28Monitor	CVE-2026-103242No exploit	Rpm: heap-based buffer overflow write in hex2binv() via a mistyped rpmtag_filesignatures header tagred hat · red hat enterprise linux 10 · CWE-122 Memory safety	High7.1	—	0.1%	Sep 30, 2026
34Monitor	CVE-2026-10739No exploit	Cato Networks SDP Client for Windows is vulnerable to Local Privilege Escalationcato networks · sdp client · CWE-23 Path traversal Local privilege escalation	High8.5	—	0.1%	Sep 30, 2026
31Monitor	CVE-2026-62146Proof of concept	Cri-o: cri-o: sandbox state poisoning via pod annotations may expose runtime socketred hat · red hat openshift container platform 4 · CWE-501	High7.8	—	0.1%	Sep 30, 2026
30Monitor	CVE-2026-85532No exploit	Apache WSS4J: Insufficient Validation of Derived-Key Parametersapache · wss4j · CWE-20 Pre-auth Denial of service	High7.5	—	0.5%	Sep 30, 2026
36Monitor	CVE-2026-87830No exploit	Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks.apache · wss4j · CWE-917 pre-auth RCE	Critical9.1	—	0.2%	Sep 30, 2026
39Monitor	CVE-2026-88920No exploit	Apache WSS4J: SAML Sender-Vouches Authentication Bypassapache · wss4j · CWE-287 Pre-auth Auth bypass	Critical9.8	—	0.5%	Sep 30, 2026
28Monitor	CVE-2026-100507No exploit	WordPress If-So Dynamic Content Personalization plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerabilityif-so dynamic content · if-so dynamic content personalization · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Sep 30, 2026
28Monitor	CVE-2026-102385No exploit	WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerabilitykevin stover · ninja forms · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Sep 30, 2026
28Monitor	CVE-2026-102395No exploit	WordPress Easy Google Maps plugin <= 1.14.6 - Cross Site Scripting (XSS) vulnerabilitysupsystic · easy google maps · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Sep 30, 2026
28Monitor	CVE-2026-102396No exploit	WordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerabilitysupsystic · ultimate maps by supsystic · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Sep 30, 2026
28Monitor	CVE-2026-102398No exploit	WordPress Popup by Supsystic plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerabilitysupsystic · popup by supsystic · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Sep 30, 2026
33Monitor	CVE-2026-103321No exploit	MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Imagemisp · misp · CWE-20 XSS	High8.3	—	0.3%	Sep 30, 2026
10Monitor	CVE-2026-27085No exploit	WordPress Astra WordPress theme theme <= 4.13.12 - Content Injection vulnerabilitybrainstorm force · astra wordpress theme · CWE-80 XSS	Low2.7	—	0.2%	Sep 30, 2026
28Monitor	CVE-2026-27371No exploit	WordPress WPFunnels plugin <= 3.13.1 - Reflected Cross Site Scripting (XSS) vulnerabilitywpfunnels · wpfunnels · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Sep 30, 2026
30Monitor	CVE-2026-62085No exploit	WordPress WP Activity Log plugin <= 5.6.6 - SQL Injection vulnerabilitymelapress · wp activity log · CWE-89 SQL injection	High7.6	—	0.3%	Sep 30, 2026
37Monitor	CVE-2026-74864No exploit	Authentication Bypass in sogo_yhnyunohost-apps · sogo_yhn · CWE-639 Pre-auth Auth bypass Broken access control (IDOR)	Critical9.3	—	0.4%	Sep 30, 2026
36Monitor	CVE-2026-74865No exploit	Authentication Bypass in sogo_yhnyunohost-apps · sogo_yhn · CWE-639 Pre-auth Auth bypass Broken access control (IDOR)	Critical9.2	—	0.3%	Sep 30, 2026
81Now	CVE-2026-76504Weaponized	Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerabilitycisco · catalyst sd-wan manager · CWE-177 Pre-auth Auth bypass	Critical9.8	KEV	38.9%	Sep 30, 2026
36Monitor	CVE-2026-89238No exploit	Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selectionapache · wss4j · CWE-345 Pre-auth	Critical9.1	—	0.3%	Sep 30, 2026
30Monitor	CVE-2026-92121No exploit	Apache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform referenceapache · wss4j · CWE-693 Pre-auth	High7.5	—	0.5%	Sep 30, 2026
28Monitor	CVE-2026-93512No exploit	WordPress JW Player for WordPress plugin <= 2.3.11 - Cross Site Scripting (XSS) vulnerabilityilghera · jw player for wordpress · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Sep 30, 2026
28Monitor	CVE-2026-93514No exploit	WordPress Notification for Telegram plugin <= 3.5.2 - Cross Site Scripting (XSS) vulnerabilityrainafarai · notification for telegram · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Sep 30, 2026
32Monitor	CVE-2026-93621No exploit	WordPress WP Data Access plugin <= 5.5.84 - SQL Injection vulnerabilitypassionate programmer peter · wp data access · CWE-89 Pre-auth SQL injection	High8.2	—	0.2%	Sep 30, 2026
28Monitor	CVE-2026-93624No exploit	WordPress Music Player for WooCommerce plugin <= 1.9.1 - PHP Object Injection vulnerabilitycodepeople · music player for woocommerce · CWE-502 Deserialization	High7.2	—	0.3%	Sep 30, 2026
28Monitor	CVE-2026-93651No exploit	WordPress Minimum and Maximum Quantity for WooCommerce plugin <= 2.1.2 - PHP Object Injection vulnerabilitydotstore · minimum and maximum quantity for woocommerce · CWE-502 Deserialization	High7.2	—	0.3%	Sep 30, 2026
28Monitor	CVE-2026-93770No exploit	WordPress WP Statistics plugin <= 14.16.13 - Cross Site Scripting (XSS) vulnerabilityveronalabs · wp statistics · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Sep 30, 2026
28Monitor	CVE-2026-93771No exploit	WordPress Cost of Goods for WooCommerce plugin <= 3.5.2 - PHP Object Injection vulnerabilitywpfactory · cost of goods for woocommerce · CWE-502 Deserialization	High7.2	—	0.3%	Sep 30, 2026
26Monitor	CVE-2026-94074Proof of concept	WordPress Simply Schedule Appointments plugin <= 1.6.12.29 - Broken Access Control vulnerabilitynsquared · simply schedule appointments · CWE-862 Pre-auth Broken access control (IDOR)	Medium6.5	—	0.2%	Sep 30, 2026
35Monitor	CVE-2026-94076No exploit	WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.5 - PHP Object Injection vulnerabilityseo squirrly · seo plugin by squirrly seo · CWE-502 Deserialization	High8.8	—	0.3%	Sep 30, 2026
28Monitor	CVE-2026-94078No exploit	WordPress Site Reviews plugin <= 8.3.1 - Cross Site Scripting (XSS) vulnerabilitygemini labs · site reviews · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Sep 30, 2026
28Monitor	CVE-2026-94081No exploit	WordPress WordPress Persistent Login plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerabilitylukeseager · wordpress persistent login · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Sep 30, 2026
30Monitor	CVE-2026-94082No exploit	WordPress Quiz Cat plugin <= 3.1.1 - SQL Injection vulnerabilityfatcatapps · quiz cat · CWE-89 SQL injection	High7.6	—	0.2%	Sep 30, 2026
34Monitor	CVE-2026-94115No exploit	WordPress Easy Pricing Tables plugin <= 4.1.2 - SQL Injection vulnerabilityfatcatapps · easy pricing tables · CWE-89 SQL injection	High8.5	—	0.2%	Sep 30, 2026
30Monitor	CVE-2026-94120No exploit	WordPress GravityExport Lite for Gravity Forms plugin <= 2.7.2 - Broken Access Control vulnerabilitygravitykit · gravityexport lite for gravity forms · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.2%	Sep 30, 2026
35Monitor	CVE-2026-94121No exploit	WordPress 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin <= 2.33.6 - PHP Object Injection vulnerability10web · 10web booster – website speed optimization, cache & page speed optimizer · CWE-502 Deserialization	High8.8	—	0.3%	Sep 30, 2026
28Monitor	CVE-2026-94122No exploit	WordPress Responsive Slider Gallery plugin <= 1.5.5 - PHP Object Injection vulnerabilitya wp life · responsive slider gallery · CWE-502 Deserialization	High7.2	—	0.3%	Sep 30, 2026
30Monitor	CVE-2026-94123No exploit	WordPress NextGEN Gallery plugin <= 4.5.0 - Arbitrary File Download vulnerabilitysyed balkhi · nextgen gallery · CWE-22 Pre-auth Path traversal	High7.5	—	0.3%	Sep 30, 2026
34Monitor	CVE-2026-94177No exploit	WordPress GamiPress plugin <= 8.0.2 - SQL Injection vulnerabilityruben garcia · gamipress · CWE-89 SQL injection	High8.5	—	0.2%	Sep 30, 2026
30Monitor	CVE-2026-94178No exploit	WordPress Import and export users and customers plugin <= 2.5.2 - Privilege Escalation vulnerabilityjavier carazo · import and export users and customers · CWE-266	High7.5	—	0.2%	Sep 30, 2026
36Monitor	CVE-2026-94389No exploit	WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Remote Code Execution (RCE) vulnerabilityacymailing newsletter team · acymailing smtp newsletter · CWE-94 pre-auth RCE	Critical9.0	—	0.4%	Sep 30, 2026
28Monitor	CVE-2026-94499No exploit	WordPress FormGent plugin <= 1.12.2 - Broken Access Control vulnerabilitywpwax · formgent · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Sep 30, 2026
28Monitor	CVE-2026-94677No exploit	WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19.1 - PHP Object Injection vulnerabilitynexcess · kadence woocommerce email designer · CWE-502 Deserialization	High7.2	—	0.3%	Sep 30, 2026
35Monitor	CVE-2026-94678No exploit	WordPress Go Live Update Urls plugin <= 7.0.8 - PHP Object Injection vulnerabilitymat lipe · go live update urls · CWE-502 Deserialization	High8.8	—	0.3%	Sep 30, 2026
35Monitor	CVE-2026-94683No exploit	WordPress DesignSetGo plugin <= 2.8.0 - PHP Object Injection vulnerabilityjustin nealey · designsetgo · CWE-502 Deserialization	High8.8	—	0.3%	Sep 30, 2026
35Monitor	CVE-2026-95531No exploit	WordPress Conversational Forms for ChatBot plugin <= 1.5.0 - PHP Object Injection vulnerabilityquantumcloud · conversational forms for chatbot · CWE-502 Deserialization	High8.8	—	0.4%	Sep 30, 2026
30Monitor	CVE-2026-95587No exploit	WordPress Hostinger Migrator plugin <= 1.0 - Broken Access Control vulnerabilityhostinger · hostinger migrator · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.2%	Sep 30, 2026
30Monitor	CVE-2026-95616No exploit	Apache WSS4J: Unauthenticated denial of service via integer overflow in DER parsing of X.509 certificate extensionsapache · wss4j · CWE-190 Pre-auth Memory safety Denial of service	High7.5	—	0.4%	Sep 30, 2026
28Monitor	CVE-2026-96343No exploit	WordPress WP ERP plugin <= 1.17.9 - PHP Object Injection vulnerabilitywedevs · wp erp · CWE-502 Deserialization	High7.2	—	0.3%	Sep 30, 2026
28Monitor	CVE-2026-96344No exploit	WordPress eCommerce Product Catalog plugin <= 3.6.0 - PHP Object Injection vulnerabilityimplecode · ecommerce product catalog · CWE-502 Deserialization	High7.2	—	0.3%	Sep 30, 2026
30Monitor	CVE-2026-96345No exploit	WordPress Estatik plugin <= 4.3.5 - SQL Injection vulnerabilityestatik · estatik · CWE-89 SQL injection	High7.6	—	0.2%	Sep 30, 2026
30Monitor	CVE-2026-96346No exploit	WordPress WP ERP plugin <= 1.17.9 - SQL Injection vulnerabilitywedevs · wp erp · CWE-89 SQL injection	High7.6	—	0.2%	Sep 30, 2026
30Monitor	CVE-2026-96348No exploit	WordPress Bookly plugin <= 28.2 - Broken Access Control vulnerabilitybookly · bookly · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.2%	Sep 30, 2026
40Plan	CVE-2026-96349Proof of concept	WordPress SiteSkite plugin <= 2.1.8 - Remote Code Execution (RCE) vulnerabilitysiteskite · siteskite · CWE-94 pre-auth RCE	Critical10.0	—	0.7%	Sep 30, 2026
39Monitor	CVE-2026-96350No exploit	WordPress Estatik plugin <= 4.3.5 - Privilege Escalation vulnerabilityestatik · estatik · CWE-266 Pre-auth	Critical9.8	—	0.4%	Sep 30, 2026
28Monitor	CVE-2026-96351No exploit	WordPress Classified Listing plugin <= 6.1.3 - Cross Site Scripting (XSS) vulnerabilityradiustheme · classified listing · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Sep 30, 2026
28Monitor	CVE-2026-96352No exploit	WordPress YITH WooCommerce Ajax Search plugin <= 2.28.0 - Cross Site Scripting (XSS) vulnerabilityyithemes · yith woocommerce ajax search · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Sep 30, 2026
28Monitor	CVE-2026-96814No exploit	WordPress WooCommerce Product Table Lite plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerabilitywp titan labs · woocommerce product table lite · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Sep 30, 2026
28Monitor	CVE-2026-96815No exploit	WordPress Vitepos plugin <= 3.5.0 - Privilege Escalation vulnerabilityappsbd · vitepos · CWE-266	High7.2	—	0.3%	Sep 30, 2026
28Monitor	CVE-2026-96816No exploit	WordPress Trusted Shops Easy Integration for WooCommerce plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerabilityvendidero · trusted shops easy integration for woocommerce · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Sep 30, 2026

CVE-2026-86134
34Monitor
Fireware OS Pre-Authentication NULL Pointer Dereference Allows Remote Denial of Service
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
watchguard · firewareSep 30, 2026
CVE-2026-103111
30Monitor
PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with ar
HighCVSS 7.6No exploitEPSS 0%
- Memory safety
pcre · pcre2Sep 30, 2026
CVE-2026-75823
29Monitor
WP User Frontend 3.5.29 - 4.3.11 - Unauthenticated Privilege Escalation via Registration Role Encryption
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
unknown · user frontendSep 30, 2026
CVE-2026-75873
39Monitor
Zella Theme < 2.6.3 - Unauthenticated Arbitrary File Upload
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- File upload
unknown · zella themeSep 30, 2026
CVE-2026-85573
35Monitor
All in One Files Upload for WooCommerce 2.0.3 - 2.0.16 - Unauthenticated Stored XSS via SVG Upload
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- XSS
unknown · all in one files uploadSep 30, 2026
CVE-2026-88797
28Monitor
Vayu X < 1.0.6 - Subscriber+ Arbitrary WordPress.org Plugin Installation and Activation
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
unknown · vayu xSep 30, 2026
CVE-2026-89193
30Monitor
Robin Image Optimizer 2.0.0 - 2.0.7 - Unauthenticated Stored XSS via WebP URL Delivery HTML Parser
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- XSS
unknown · robin image optimizerSep 30, 2026
CVE-2026-91832
28Monitor
WP Mobile Menu 2.7.4 - 2.8.8 - Stored XSS via CSRF
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
- CSRF
unknown · wp mobile menuSep 30, 2026
CVE-2026-92424
27Monitor
Content Egg < 11.9.0 - Contributor+ Stored XSS via Import Queue
MediumCVSS 6.8Proof of conceptEPSS 0%
- XSS
unknown · content eggSep 30, 2026
CVE-2026-92994
35Monitor
Verge3D < 4.13.1 - Unauthenticated Stored XSS via File Storage API
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- XSS
unknown · verge3d publishing and e-commerceSep 30, 2026
CVE-2026-89294
30Monitor
Simply Schedule Appointments <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parameter
HighCVSS 7.5No exploitEPSS 0%
- RCE
croixhaug · simply schedule appointmentsSep 30, 2026
CVE-2026-97196
36Monitor
WordPress GiveWP plugin <= 4.16.9 - Broken Authentication vulnerability
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
liquid web / stellarwp · givewpSep 30, 2026
CVE-2026-102508
36Monitor
Apache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgrade
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- Weak crypto
apache software foundation · apache plc4xSep 30, 2026
CVE-2026-6806
30Monitor
Motors <= 1.4.109 - Unauthenticated Blind SQL Injection via 'stm_lat'/'stm_lng' Parameters
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- SQL injection
stylemix · motors – car dealership & classified listings pluginSep 30, 2026
CVE-2026-92867
34Monitor
An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticated attacker to cause abnormal process termination o
HighCVSS 8.7No exploitEPSS 0%
- RCE
- Memory safety
pgpool global development group · pgpool-iiSep 30, 2026
CVE-2026-92869
28Monitor
An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated attacker to cause abnormal process termination.
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
pgpool global development group · pgpool-iiSep 30, 2026
CVE-2026-92870
34Monitor
A stack-based buffer overflow vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal process termi
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
pgpool global development group · pgpool-iiSep 30, 2026
CVE-2026-92871
34Monitor
A NULL pointer dereference vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal termination of t
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
pgpool global development group · pgpool-iiSep 30, 2026
CVE-2026-97150
34Monitor
When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP c
HighCVSS 8.6No exploitEPSS 0%
basercms users community · bcaddonmigratorSep 30, 2026
CVE-2026-102454
34Monitor
DigiWin｜EasyFlow .NET - Arbitrary File Upload
HighCVSS 8.6No exploitEPSS 0%
- RCE
- File upload
digiwin · easyflow .netSep 30, 2026
CVE-2026-102455
37Monitor
DigiWin｜EasyFlow .NET - Insecure Deserialization
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
- Deserialization
digiwin · easyflow .netSep 30, 2026
CVE-2026-102456
28Monitor
DigiWin｜EasyFlow .NET - SQL Injection
HighCVSS 7.1No exploitEPSS 0%
- SQL injection
digiwin · easyflow .netSep 30, 2026
CVE-2026-102457
28Monitor
DigiWin｜EasyFlow .NET - Arbitrary File Read
HighCVSS 7.1No exploitEPSS 0%
- Path traversal
digiwin · easyflow .netSep 30, 2026
CVE-2026-102458
37Monitor
DigiWin｜EasyFlow .NET - Missing Authentication
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
digiwin · easyflow .netSep 30, 2026
CVE-2026-102509
34Monitor
Apache PLC4X, Apache PLC4X: Pre-authentication resource exhaustion in the OPC UA driver and the Java SPI parser
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
apache software foundation · apache plc4xSep 30, 2026
CVE-2026-102510
34Monitor
Apache PLC4X: Go binding: unbounded allocation and framing failures on wire-controlled lengths
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
apache software foundation · apache plc4xSep 30, 2026
CVE-2026-102511
34Monitor
Apache PLC4X, Apache PLC4X, Apache PLC4X, Apache PLC4X: ADS discovery accepts spoofed responses and derives the connection target from them
HighCVSS 8.5No exploitEPSS 0%
- Pre-auth
apache software foundation · apache plc4xSep 30, 2026
CVE-2026-102578
35Monitor
Moodle: sql injection in question bank web service
HighCVSS 8.8Proof of conceptEPSS 0%
- SQL injection
moodle · moodleSep 30, 2026
CVE-2026-75098
30Monitor
Product Designer App <= 1.1.3 - Unauthenticated Arbitrary File Read via 'svg' Parameter in pdapp-render-design
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
productdesignerapp · product designer appSep 30, 2026
CVE-2026-97347
28Monitor
Post Views Stats Counter <= 1.1.7 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header
HighCVSS 7.2Proof of conceptEPSS 0%
- Pre-auth
- XSS
kazukiyanamoto · post views stats counterSep 30, 2026
CVE-2026-103235
34Monitor
MISP Event Delegation Mass Assignment Allows Retargeting Delegation to Arbitrary Events
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
misp · mispSep 30, 2026
CVE-2026-103237
33Monitor
MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rows
HighCVSS 8.3No exploitEPSS 0%
misp · mispSep 30, 2026
CVE-2026-10764
34Monitor
Information disclosure in BVMS 4.5 up to 12.3
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
iqsight · bvmsSep 30, 2026
CVE-2026-77185
36Monitor
Apache MINA SSHD: Asynchronous authentication can bypass signature verification
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
apache software foundation · apache mina sshdSep 30, 2026
CVE-2026-79625
28Monitor
Improper Synchronization in Monitoring in CODESYS Control Runtime
HighCVSS 7.2No exploitEPSS 0%
- Race condition
codesys · control rte (sl)Sep 30, 2026
CVE-2026-93994
32Monitor
Apache MINA SSHD: Repeated-publickey policy bypass on server
HighCVSS 8.1No exploitEPSS 0%
- Auth bypass
apache software foundation · apache mina sshdSep 30, 2026
CVE-2026-94002
30Monitor
Apache MINA SSHD: Memory exhaustion in SFTP client via unsolicited SFTP replies
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache software foundation · apache mina sshdSep 30, 2026
CVE-2026-94052
36Monitor
Apache MINA SSHD: LDAP password authentication ineffective
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
apache software foundation · apache mina sshdSep 30, 2026
CVE-2026-94053
36Monitor
Apache MINA SSHD: LDAP injection in sshd-ldap
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
apache software foundation · apache mina sshdSep 30, 2026
CVE-2026-103239
34Monitor
MISP Tag Collection Save Allows Privilege Escalation via Sibling Model Injection
HighCVSS 8.6No exploitEPSS 0%
- Broken access control (IDOR)
misp · mispSep 30, 2026
CVE-2026-76992
34Monitor
Uncontrolled Memory Allocation in CODESYS Gateway Client
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
codesys · development system 3Sep 30, 2026
CVE-2026-103242
28Monitor
Rpm: heap-based buffer overflow write in hex2binv() via a mistyped rpmtag_filesignatures header tag
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
red hat · red hat enterprise linux 10Sep 30, 2026
CVE-2026-10739
34Monitor
Cato Networks SDP Client for Windows is vulnerable to Local Privilege Escalation
HighCVSS 8.5No exploitEPSS 0%
- Path traversal
- Local privilege escalation
cato networks · sdp clientSep 30, 2026
CVE-2026-62146
31Monitor
Cri-o: cri-o: sandbox state poisoning via pod annotations may expose runtime socket
HighCVSS 7.8Proof of conceptEPSS 0%
red hat · red hat openshift container platform 4Sep 30, 2026
CVE-2026-85532
30Monitor
Apache WSS4J: Insufficient Validation of Derived-Key Parameters
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache · wss4jSep 30, 2026
CVE-2026-87830
36Monitor
Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks.
CriticalCVSS 9.1No exploitEPSS 0%
- pre-auth RCE
apache · wss4jSep 30, 2026
CVE-2026-88920
39Monitor
Apache WSS4J: SAML Sender-Vouches Authentication Bypass
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
apache · wss4jSep 30, 2026
CVE-2026-100507
28Monitor
WordPress If-So Dynamic Content Personalization plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
if-so dynamic content · if-so dynamic content personalizationSep 30, 2026
CVE-2026-102385
28Monitor
WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
kevin stover · ninja formsSep 30, 2026
CVE-2026-102395
28Monitor
WordPress Easy Google Maps plugin <= 1.14.6 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
supsystic · easy google mapsSep 30, 2026
CVE-2026-102396
28Monitor
WordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
supsystic · ultimate maps by supsysticSep 30, 2026
CVE-2026-102398
28Monitor
WordPress Popup by Supsystic plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
supsystic · popup by supsysticSep 30, 2026
CVE-2026-103321
33Monitor
MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image
HighCVSS 8.3No exploitEPSS 0%
- XSS
misp · mispSep 30, 2026
CVE-2026-27085
10Monitor
WordPress Astra WordPress theme theme <= 4.13.12 - Content Injection vulnerability
LowCVSS 2.7No exploitEPSS 0%
- XSS
brainstorm force · astra wordpress themeSep 30, 2026
CVE-2026-27371
28Monitor
WordPress WPFunnels plugin <= 3.13.1 - Reflected Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
wpfunnels · wpfunnelsSep 30, 2026
CVE-2026-62085
30Monitor
WordPress WP Activity Log plugin <= 5.6.6 - SQL Injection vulnerability
HighCVSS 7.6No exploitEPSS 0%
- SQL injection
melapress · wp activity logSep 30, 2026
CVE-2026-74864
37Monitor
Authentication Bypass in sogo_yhn
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Broken access control (IDOR)
yunohost-apps · sogo_yhnSep 30, 2026
CVE-2026-74865
36Monitor
Authentication Bypass in sogo_yhn
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Broken access control (IDOR)
yunohost-apps · sogo_yhnSep 30, 2026
CVE-2026-76504
81Now
Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability
CriticalCVSS 9.8KEVWeaponizedEPSS 38%
- Pre-auth
- Auth bypass
cisco · catalyst sd-wan managerSep 30, 2026
CVE-2026-89238
36Monitor
Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
apache · wss4jSep 30, 2026
CVE-2026-92121
30Monitor
Apache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform reference
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
apache · wss4jSep 30, 2026
CVE-2026-93512
28Monitor
WordPress JW Player for WordPress plugin <= 2.3.11 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
ilghera · jw player for wordpressSep 30, 2026
CVE-2026-93514
28Monitor
WordPress Notification for Telegram plugin <= 3.5.2 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
rainafarai · notification for telegramSep 30, 2026
CVE-2026-93621
32Monitor
WordPress WP Data Access plugin <= 5.5.84 - SQL Injection vulnerability
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- SQL injection
passionate programmer peter · wp data accessSep 30, 2026
CVE-2026-93624
28Monitor
WordPress Music Player for WooCommerce plugin <= 1.9.1 - PHP Object Injection vulnerability
HighCVSS 7.2No exploitEPSS 0%
- Deserialization
codepeople · music player for woocommerceSep 30, 2026
CVE-2026-93651
28Monitor
WordPress Minimum and Maximum Quantity for WooCommerce plugin <= 2.1.2 - PHP Object Injection vulnerability
HighCVSS 7.2No exploitEPSS 0%
- Deserialization
dotstore · minimum and maximum quantity for woocommerceSep 30, 2026
CVE-2026-93770
28Monitor
WordPress WP Statistics plugin <= 14.16.13 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
veronalabs · wp statisticsSep 30, 2026
CVE-2026-93771
28Monitor
WordPress Cost of Goods for WooCommerce plugin <= 3.5.2 - PHP Object Injection vulnerability
HighCVSS 7.2No exploitEPSS 0%
- Deserialization
wpfactory · cost of goods for woocommerceSep 30, 2026
CVE-2026-94074
26Monitor
WordPress Simply Schedule Appointments plugin <= 1.6.12.29 - Broken Access Control vulnerability
MediumCVSS 6.5Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
nsquared · simply schedule appointmentsSep 30, 2026
CVE-2026-94076
35Monitor
WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.5 - PHP Object Injection vulnerability
HighCVSS 8.8No exploitEPSS 0%
- Deserialization
seo squirrly · seo plugin by squirrly seoSep 30, 2026
CVE-2026-94078
28Monitor
WordPress Site Reviews plugin <= 8.3.1 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
gemini labs · site reviewsSep 30, 2026
CVE-2026-94081
28Monitor
WordPress WordPress Persistent Login plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
lukeseager · wordpress persistent loginSep 30, 2026
CVE-2026-94082
30Monitor
WordPress Quiz Cat plugin <= 3.1.1 - SQL Injection vulnerability
HighCVSS 7.6No exploitEPSS 0%
- SQL injection
fatcatapps · quiz catSep 30, 2026
CVE-2026-94115
34Monitor
WordPress Easy Pricing Tables plugin <= 4.1.2 - SQL Injection vulnerability
HighCVSS 8.5No exploitEPSS 0%
- SQL injection
fatcatapps · easy pricing tablesSep 30, 2026
CVE-2026-94120
30Monitor
WordPress GravityExport Lite for Gravity Forms plugin <= 2.7.2 - Broken Access Control vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
gravitykit · gravityexport lite for gravity formsSep 30, 2026
CVE-2026-94121
35Monitor
WordPress 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin <= 2.33.6 - PHP Object Injection vulnerability
HighCVSS 8.8No exploitEPSS 0%
- Deserialization
10web · 10web booster – website speed optimization, cache & page speed optimizerSep 30, 2026
CVE-2026-94122
28Monitor
WordPress Responsive Slider Gallery plugin <= 1.5.5 - PHP Object Injection vulnerability
HighCVSS 7.2No exploitEPSS 0%
- Deserialization
a wp life · responsive slider gallerySep 30, 2026
CVE-2026-94123
30Monitor
WordPress NextGEN Gallery plugin <= 4.5.0 - Arbitrary File Download vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
syed balkhi · nextgen gallerySep 30, 2026
CVE-2026-94177
34Monitor
WordPress GamiPress plugin <= 8.0.2 - SQL Injection vulnerability
HighCVSS 8.5No exploitEPSS 0%
- SQL injection
ruben garcia · gamipressSep 30, 2026
CVE-2026-94178
30Monitor
WordPress Import and export users and customers plugin <= 2.5.2 - Privilege Escalation vulnerability
HighCVSS 7.5No exploitEPSS 0%
javier carazo · import and export users and customersSep 30, 2026
CVE-2026-94389
36Monitor
WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Remote Code Execution (RCE) vulnerability
CriticalCVSS 9.0No exploitEPSS 0%
- pre-auth RCE
acymailing newsletter team · acymailing smtp newsletterSep 30, 2026
CVE-2026-94499
28Monitor
WordPress FormGent plugin <= 1.12.2 - Broken Access Control vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
wpwax · formgentSep 30, 2026
CVE-2026-94677
28Monitor
WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19.1 - PHP Object Injection vulnerability
HighCVSS 7.2No exploitEPSS 0%
- Deserialization
nexcess · kadence woocommerce email designerSep 30, 2026
CVE-2026-94678
35Monitor
WordPress Go Live Update Urls plugin <= 7.0.8 - PHP Object Injection vulnerability
HighCVSS 8.8No exploitEPSS 0%
- Deserialization
mat lipe · go live update urlsSep 30, 2026
CVE-2026-94683
35Monitor
WordPress DesignSetGo plugin <= 2.8.0 - PHP Object Injection vulnerability
HighCVSS 8.8No exploitEPSS 0%
- Deserialization
justin nealey · designsetgoSep 30, 2026
CVE-2026-95531
35Monitor
WordPress Conversational Forms for ChatBot plugin <= 1.5.0 - PHP Object Injection vulnerability
HighCVSS 8.8No exploitEPSS 0%
- Deserialization
quantumcloud · conversational forms for chatbotSep 30, 2026
CVE-2026-95587
30Monitor
WordPress Hostinger Migrator plugin <= 1.0 - Broken Access Control vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
hostinger · hostinger migratorSep 30, 2026
CVE-2026-95616
30Monitor
Apache WSS4J: Unauthenticated denial of service via integer overflow in DER parsing of X.509 certificate extensions
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
apache · wss4jSep 30, 2026
CVE-2026-96343
28Monitor
WordPress WP ERP plugin <= 1.17.9 - PHP Object Injection vulnerability
HighCVSS 7.2No exploitEPSS 0%
- Deserialization
wedevs · wp erpSep 30, 2026
CVE-2026-96344
28Monitor
WordPress eCommerce Product Catalog plugin <= 3.6.0 - PHP Object Injection vulnerability
HighCVSS 7.2No exploitEPSS 0%
- Deserialization
implecode · ecommerce product catalogSep 30, 2026
CVE-2026-96345
30Monitor
WordPress Estatik plugin <= 4.3.5 - SQL Injection vulnerability
HighCVSS 7.6No exploitEPSS 0%
- SQL injection
estatik · estatikSep 30, 2026
CVE-2026-96346
30Monitor
WordPress WP ERP plugin <= 1.17.9 - SQL Injection vulnerability
HighCVSS 7.6No exploitEPSS 0%
- SQL injection
wedevs · wp erpSep 30, 2026
CVE-2026-96348
30Monitor
WordPress Bookly plugin <= 28.2 - Broken Access Control vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
bookly · booklySep 30, 2026
CVE-2026-96349
40Plan
WordPress SiteSkite plugin <= 2.1.8 - Remote Code Execution (RCE) vulnerability
CriticalCVSS 10.0Proof of conceptEPSS 0%
- pre-auth RCE
siteskite · siteskiteSep 30, 2026
CVE-2026-96350
39Monitor
WordPress Estatik plugin <= 4.3.5 - Privilege Escalation vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
estatik · estatikSep 30, 2026
CVE-2026-96351
28Monitor
WordPress Classified Listing plugin <= 6.1.3 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
radiustheme · classified listingSep 30, 2026
CVE-2026-96352
28Monitor
WordPress YITH WooCommerce Ajax Search plugin <= 2.28.0 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
yithemes · yith woocommerce ajax searchSep 30, 2026
CVE-2026-96814
28Monitor
WordPress WooCommerce Product Table Lite plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
wp titan labs · woocommerce product table liteSep 30, 2026
CVE-2026-96815
28Monitor
WordPress Vitepos plugin <= 3.5.0 - Privilege Escalation vulnerability
HighCVSS 7.2No exploitEPSS 0%
appsbd · viteposSep 30, 2026
CVE-2026-96816
28Monitor
WordPress Trusted Shops Easy Integration for WooCommerce plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
vendidero · trusted shops easy integration for woocommerceSep 30, 2026