Skip to content
Noroxi
By publication date

Exploited and new serious CVEs: October 2026

8,751 records · 22 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 20 of 88

  • CVE-2026-93951
    28Monitor

    WordPress Zeinet theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    bracketweb · zeinetOct 10, 2026

  • CVE-2026-96278
    28Monitor

    WP Photo Album Plus <= 9.3.03.002 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session History

    HighCVSS 7.2No exploitEPSS 0%

    opajaap · wp photo album plusOct 10, 2026

  • CVE-2026-96662
    30Monitor

    Appointment Booking Plugin <= 5.7.2 - Unauthenticated SQL Injection via 'booking[service_id]' Parameter

    HighCVSS 7.5No exploitEPSS 0%

    latepoint · appointment booking plugin – latepoint | calendar & scheduling for wordpressOct 10, 2026

  • CVE-2026-96765
    28Monitor

    WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthenticated Stored Cross-Site Scripting via 'id_token' Parameter (iss / uniqu

    HighCVSS 7.2No exploitEPSS 0%

    wpo365 · wpo365 | seamless wordpress + microsoft integration (wpo365 | login)Oct 10, 2026

  • CVE-2026-107657
    28Monitor

    HivePress <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form

    HighCVSS 7.2No exploitEPSS 0%

    hivepress · hivepress – business directory, listings & classified ads pluginOct 10, 2026

  • CVE-2026-91136
    31Monitor

    Divi Plus <= 2.4.0 - Unauthenticated Arbitrary File Read via 'svg_image' Parameter

    HighCVSS 7.5Proof of conceptEPSS 2%

    divi essential · divi plusOct 10, 2026

  • CVE-2026-103501
    39Monitor

    Apache DataSketches: datasketches-cpp: HLL CouponList Deserialization Buffer Overflow allows memory corruption via a crafted sketch

    CriticalCVSS 9.8No exploitEPSS 0%

    apache software foundation · apache datasketchesOct 10, 2026

  • CVE-2026-103513
    39Monitor

    Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in the CPC sketch deserialization allows memory corruption via a crafted sketch

    CriticalCVSS 9.8No exploitEPSS 0%

    apache software foundation · apache datasketchesOct 10, 2026

  • CVE-2026-103635
    36Monitor

    Apache DataSketches: datasketches-cpp: Out-of-bounds read in compact Theta sketch deserialization allows denial of service via a crafted sketch

    CriticalCVSS 9.1No exploitEPSS 0%

    apache software foundation · apache datasketchesOct 10, 2026

  • CVE-2026-103636
    30Monitor

    Apache DataSketches: datasketches-cpp: Out-of-bounds read in VarOpt union deserialization allows denial of service via a truncated sketch

    HighCVSS 7.5No exploitEPSS 0%

    apache software foundation · apache datasketchesOct 10, 2026

  • GHSA-4684-h2q9-2vcp
    36Monitor

    ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target

    CriticalCVSS 9.1No exploit

    Oct 10, 2026

  • CVE-2013-10076
    30Monitor

    ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty list

    HighCVSS 7.5No exploitEPSS 0%

    Oct 10, 2026

  • CVE-2026-107373
    36Monitor

    ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument

    CriticalCVSS 9.1No exploitEPSS 0%

    Oct 10, 2026

  • CVE-2026-107794
    30Monitor

    ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list

    HighCVSS 7.5No exploitEPSS 0%

    Oct 10, 2026

  • CVE-2026-102388
    28Monitor

    WordPress Forminator plugin <= 1.57.3 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    wpmu dev · forminatorOct 10, 2026

  • CVE-2026-105885
    35Monitor

    WordPress Slider by 10Web plugin <= 1.2.62 - PHP Object Injection vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    10web · slider by 10webOct 10, 2026

  • CVE-2026-108161
    30Monitor

    FusionPBX through 5.6.5 OS Command Injection via Caller ID in Recording ZIP Download

    HighCVSS 7.7No exploitEPSS 1%

    fusionpbx · fusionpbxOct 10, 2026

  • CVE-2026-108164
    28Monitor

    Open Source Social Network (OSSN) through 10.1 IDOR via Message Attachment Route

    HighCVSS 7.1No exploitEPSS 0%

    opensource-socialnetwork · opensource-socialnetworkOct 10, 2026

  • CVE-2026-94676
    28Monitor

    WordPress Tainacan plugin <= 1.3.0 - PHP Object Injection vulnerability

    HighCVSS 7.2No exploitEPSS 0%

    tainacan community · tainacanOct 10, 2026

  • CVE-2026-97263
    28Monitor

    WordPress WPAdverts plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    greg winiarski · wpadvertsOct 10, 2026

  • CVE-2026-97264
    28Monitor

    WordPress WPAdverts plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    greg winiarski · wpadvertsOct 10, 2026

  • CVE-2026-108545
    32Monitor

    SillyTavern 1.12.13 through 1.19.0 Pre-Authentication Denial of Service via Body Parsing

    HighCVSS 8.2No exploitEPSS 0%

    sillytavern · sillytavernOct 10, 2026

  • CVE-2026-108546
    30Monitor

    Spotweb through 1.5.8 OS Command Injection via Spot Title in Runcommand Integration

    HighCVSS 7.7No exploitEPSS 0%

    spotweb · spotwebOct 10, 2026

  • CVE-2026-108547
    28Monitor

    AstronRPA through 1.1.6 Cross-Tenant Shared Variable Disclosure via get-batch-shared-var

    HighCVSS 7.1No exploitEPSS 0%

    iflytek · astron-rpaOct 10, 2026

  • CVE-2026-108549
    36Monitor

    cc-connect through 1.5.0 Missing Authentication via MAX Webhook Sender Spoofing

    CriticalCVSS 9.2No exploitEPSS 0%

    chenhg5 · cc-connectOct 10, 2026

  • CVE-2026-108550
    34Monitor

    SkillHub before 0.2.22 Account Takeover via Account Merge Flow

    HighCVSS 8.7No exploitEPSS 0%

    iflytek · skillhubOct 10, 2026

  • CVE-2026-108551
    37Monitor

    openapi-typescript-codegen through 0.31.0 Code Injection via Handlebars Templates

    CriticalCVSS 9.3Proof of conceptEPSS 0%

    ferdikoomen · openapi-typescript-codegenOct 10, 2026

  • CVE-2026-108553
    30Monitor

    OpenRefine through 3.10.1 CSRF to RCE via get-rows Command

    HighCVSS 7.7No exploitEPSS 0%

    openrefine · openrefineOct 10, 2026

  • CVE-2026-108581
    28Monitor

    Octop through 1.0.2b6 Missing Authorization Exposes Provider API Keys via /api/providers

    HighCVSS 7.1No exploitEPSS 0%

    tencentcloud · octopOct 10, 2026

  • CVE-2026-103071
    30Monitor

    WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.3 - Content Injection vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    villatheme · thank you page customizer for woocommerceOct 10, 2026

  • CVE-2026-104398
    39Monitor

    WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.10 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    villatheme · affi – affiliate marketing for woocommerceOct 10, 2026

  • CVE-2026-105889
    37Monitor

    WordPress Tickera plugin <= 3.6.0.6 - SQL Injection vulnerability

    CriticalCVSS 9.3No exploitEPSS 0%

    tickera · tickeraOct 10, 2026

  • CVE-2026-106608
    28Monitor

    WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerability

    HighCVSS 7.2No exploitEPSS 0%

    automattic · woocommerceOct 10, 2026

  • CVE-2026-106609
    30Monitor

    WordPress Bayarcash WooCommerce plugin <= 4.4.2 - Broken Access Control vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    web impian · bayarcash woocommerceOct 10, 2026

  • CVE-2026-62044
    28Monitor

    WordPress Super Video Player plugin <= 1.8.13 - PHP Object Injection vulnerability

    HighCVSS 7.2No exploitEPSS 0%

    bplugins · super video playerOct 10, 2026

  • CVE-2026-94160
    28Monitor

    WordPress ThemeStek Extras for LabtechCO Theme plugin <= 8.4 - Reflected Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    themestek · themestek extras for labtechco themeOct 10, 2026

  • CVE-2026-105892
    39Monitor

    WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.13 - Arbitrary File Deletion vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    rtcamp inc. · rtmedia for wordpress, buddypress and bbpressOct 10, 2026

  • CVE-2026-106610
    39Monitor

    WordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    miniorange · miniorange otp verificationOct 10, 2026

  • CVE-2026-108592
    24Monitor

    mini-swe-agent 1.10.0 through 2.4.6 Environment Exposure via BubblewrapEnvironment

    MediumCVSS 6.0Proof of conceptEPSS 0%

    swe-agent · mini-swe-agentOct 10, 2026

  • CVE-2026-108593
    29Monitor

    9router 0.4.1 through 0.5.99 Config Injection RCE via hermes-settings Endpoint

    HighCVSS 7.3No exploitEPSS 0%

    decolua · 9routerOct 10, 2026

  • CVE-2026-108598
    37Monitor

    Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates

    CriticalCVSS 9.3Proof of conceptEPSS 0%

    floci-io · flociOct 10, 2026

  • CVE-2026-57806
    28Monitor

    WordPress Martfury - WooCommerce Marketplace WordPress theme theme <= 3.3.9 - Reflected Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    drfuri · martfury - woocommerce marketplace wordpress themeOct 10, 2026

  • CVE-2026-96341
    32Monitor

    WordPress Forminator plugin <= 1.57.3 - Privilege Escalation vulnerability

    HighCVSS 8.2No exploitEPSS 0%

    wpmu dev · forminatorOct 10, 2026

  • CVE-2026-27350
    28Monitor

    WordPress Builderius plugin <= 1.4-beta - Server Side Request Forgery (SSRF) vulnerability

    HighCVSS 7.2No exploitEPSS 0%

    builderius.io · builderiusOct 10, 2026

  • CVE-2026-39799
    28Monitor

    WordPress WP File Download plugin <= 6.3.6 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    joomunited · wp file downloadOct 10, 2026

  • CVE-2026-39800
    28Monitor

    WordPress Additional Order Filters for WooCommerce plugin <= 1.24 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    anton bond · additional order filters for woocommerceOct 10, 2026

  • CVE-2026-39801
    39Monitor

    WordPress AIWU plugin <= 1.5.9 - Privilege Escalation vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    sergey · aiwuOct 10, 2026

  • CVE-2026-39802
    32Monitor

    WordPress Everest Backup plugin <= 2.3.13 - Remote Code Execution (RCE) vulnerability

    HighCVSS 8.1No exploitEPSS 0%

    everestthemes · everest backupOct 10, 2026

  • CVE-2026-40777
    32Monitor

    WordPress WPSection plugin <= 1.5.1 - Broken Access Control vulnerability

    HighCVSS 8.1No exploitEPSS 0%

    rashid · wpsectionOct 10, 2026

  • CVE-2026-40800
    37Monitor

    WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - SQL Injection vulnerability

    CriticalCVSS 9.3No exploitEPSS 0%

    elextensions · elex woocommerce advanced bulk edit products, prices & attributesOct 10, 2026

  • CVE-2026-40801
    32Monitor

    WordPress Wordable plugin <= 8.2.10 - Broken Access Control vulnerability

    HighCVSS 8.1No exploitEPSS 0%

    wordable · wordableOct 10, 2026

  • CVE-2026-40802
    30Monitor

    WordPress Pubjet | پاب‌جت plugin <= 5.4.8 - Settings Change vulnerability

    HighCVSS 7.6No exploitEPSS 0%

    pubjet · pubjet | پاب‌جتOct 10, 2026

  • CVE-2026-40803
    28Monitor

    WordPress Jotform – AI Chatbot plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    jotform · jotform &#8211; ai chatbotOct 10, 2026

  • CVE-2026-40805
    30Monitor

    WordPress PeepSo plugin <= 9.0.5.4 - Arbitrary File Deletion vulnerability

    HighCVSS 7.7No exploitEPSS 0%

    peepso · peepsoOct 10, 2026

  • CVE-2026-42630
    30Monitor

    WordPress Web Plura Backup & Restore Manager plugin <= 0.2.25 - Sensitive Data Exposure vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    web plura · web plura backup &amp; restore managerOct 10, 2026

  • CVE-2026-42631
    28Monitor

    WordPress Qode Music plugin <= 2.1.8.2 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    qode · qode musicOct 10, 2026

  • CVE-2026-42632
    28Monitor

    WordPress Qode Real Estate plugin <= 1.1.7.3 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    qode · qode real estateOct 10, 2026

  • CVE-2026-42633
    34Monitor

    WordPress Events Manager plugin <= 7.4.6 - SQL Injection vulnerability

    HighCVSS 8.5No exploitEPSS 0%

    marcus · events managerOct 10, 2026

  • CVE-2026-42693
    28Monitor

    WordPress Jannah theme < 7.6.8 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    tielabs · jannahOct 10, 2026

  • CVE-2026-42696
    40Plan

    WordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.18 - Remote Code Execution (RCE) vulnerability

    CriticalCVSS 10.0No exploitEPSS 0%

    royal plugins · sitevault – backup, restore, migration &amp; cloningOct 10, 2026

  • CVE-2026-42697
    28Monitor

    WordPress Social Share Icons & Social Share Buttons plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    inisev · social share icons & social share buttonsOct 10, 2026

  • CVE-2026-42699
    28Monitor

    WordPress FV Player 8 plugin <= 8.1.8 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    foliovision · fv player 8Oct 10, 2026

  • CVE-2026-42702
    28Monitor

    WordPress Tutor LMS plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    themeum · tutor lmsOct 10, 2026

  • CVE-2026-42704
    32Monitor

    WordPress Kids Care theme <= 3.2.4 - Local File Inclusion vulnerability

    HighCVSS 8.1No exploitEPSS 0%

    axiomthemes · kids careOct 10, 2026

  • CVE-2026-42705
    30Monitor

    WordPress Grand News theme <= 3.4 - Broken Access Control vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    themegoods · grand newsOct 10, 2026

  • CVE-2026-42706
    30Monitor

    WordPress DK theme <= 3.2.1 - Broken Access Control vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    themegoods · dkOct 10, 2026

  • CVE-2026-42709
    28Monitor

    WordPress Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin <= 6.0.5 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    radiustheme · food menu – restaurant menu & online ordering for woocommerceOct 10, 2026

  • CVE-2026-42711
    28Monitor

    WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    10web · slider by 10webOct 10, 2026

  • CVE-2026-42712
    34Monitor

    WordPress Qode Tours plugin <= 3.1.3.2 - SQL Injection vulnerability

    HighCVSS 8.5No exploitEPSS 0%

    qode · qode toursOct 10, 2026

  • CVE-2026-42715
    28Monitor

    WordPress Photo Gallery by 10Web plugin <= 1.8.47 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    10web · photo gallery by 10webOct 10, 2026

  • CVE-2026-42716
    39Monitor

    WordPress Payever - WooCommerce Gateway plugin <= 4.8.2 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    payever · payever - woocommerce gatewayOct 10, 2026

  • CVE-2026-42717
    30Monitor

    WordPress Leyka plugin <= 3.32.3 - SQL Injection vulnerability

    HighCVSS 7.6No exploitEPSS 0%

    vaultdweller · leykaOct 10, 2026

  • CVE-2026-42718
    39Monitor

    WordPress Booster for WooCommerce plugin <= 8.4.0 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    pluggabl · booster for woocommerceOct 10, 2026

  • CVE-2026-42719
    39Monitor

    WordPress Dynamic User Directory plugin <= 2.4 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    sarah giles · dynamic user directoryOct 10, 2026

  • CVE-2026-42722
    30Monitor

    WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - SQL Injection vulnerability

    HighCVSS 7.6No exploitEPSS 0%

    shabti kaplan · frontend admin by dynamiappsOct 10, 2026

  • CVE-2026-42723
    39Monitor

    WordPress CleanSkin theme <= 1.5.0 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    ancorathemes · cleanskinOct 10, 2026

  • CVE-2026-42724
    32Monitor

    WordPress CleanSkin theme <= 1.5.0 - Local File Inclusion vulnerability

    HighCVSS 8.1No exploitEPSS 0%

    ancorathemes · cleanskinOct 10, 2026

  • CVE-2026-42777
    32Monitor

    WordPress Aalto theme <= 1.8 - Local File Inclusion vulnerability

    HighCVSS 8.1No exploitEPSS 0%

    edge-themes · aaltoOct 10, 2026

  • CVE-2026-45440
    30Monitor

    WordPress WP Ultimate CSV Importer plugin <= 9.2 - SQL Injection vulnerability

    HighCVSS 7.6No exploitEPSS 0%

    smackcoders inc. · wp ultimate csv importerOct 10, 2026

  • CVE-2026-48193
    32Monitor

    WordPress Uminex theme <= 1.0.9 - Local File Inclusion vulnerability

    HighCVSS 8.1No exploitEPSS 0%

    kutethemes · uminexOct 10, 2026

  • CVE-2026-48194
    32Monitor

    WordPress DukaMarket theme <= 1.3.0 - Local File Inclusion vulnerability

    HighCVSS 8.1No exploitEPSS 0%

    kutethemes · dukamarketOct 10, 2026

  • CVE-2026-57742
    28Monitor

    WordPress Kids Planet theme <= 2.2.14.2 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    themerex group · kids planetOct 10, 2026

  • CVE-2026-62020
    32Monitor

    WordPress TouchUp theme < 1.4 - Local File Inclusion vulnerability

    HighCVSS 8.1No exploitEPSS 0%

    mikado-themes · touchupOct 10, 2026

  • CVE-2026-62021
    35Monitor

    WordPress Angio theme <= 1.1.1 - PHP Object Injection vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    rascals · angioOct 10, 2026

  • CVE-2026-62022
    39Monitor

    WordPress Tonda Membership plugin <= 1.0.1 - Privilege Escalation vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    select-themes · tonda membershipOct 10, 2026

  • CVE-2026-62024
    39Monitor

    WordPress CodeBard Help Desk plugin <= 1.1.2 - Arbitrary File Upload vulnerability

    CriticalCVSS 9.9No exploitEPSS 0%

    codebard · codebard help deskOct 10, 2026

  • CVE-2026-62025
    36Monitor

    WordPress Tailored Tools plugin <= 3.0.3 - Arbitrary File Upload vulnerability

    CriticalCVSS 9.0No exploitEPSS 0%

    tailored media · tailored toolsOct 10, 2026

  • CVE-2026-62027
    28Monitor

    WordPress Team Section Block plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    bplugins · team section blockOct 10, 2026

  • CVE-2026-62030
    28Monitor

    WordPress StreamCast plugin <= 2.4.5 - Server Side Request Forgery (SSRF) vulnerability

    HighCVSS 7.2No exploitEPSS 0%

    bplugins · streamcastOct 10, 2026

  • CVE-2026-62031
    37Monitor

    WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability

    CriticalCVSS 9.3No exploitEPSS 0%

    stylemix · ulistingOct 10, 2026

  • CVE-2026-62032
    39Monitor

    WordPress DirectoryPress plugin <= 3.6.27 - Local File Inclusion vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    designinvento · directorypressOct 10, 2026

  • CVE-2026-62033
    30Monitor

    WordPress uListing plugin <= 2.2.0 - Settings Change vulnerability

    HighCVSS 7.6No exploitEPSS 0%

    stylemix · ulistingOct 10, 2026

  • CVE-2026-62034
    28Monitor

    WordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    bplugins · before after image comparison – image comparison for wpOct 10, 2026

  • CVE-2026-62037
    28Monitor

    WordPress Document Embedder plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    bplugins · document embedderOct 10, 2026

  • CVE-2026-62038
    29Monitor

    WordPress eRoom plugin <= 1.7.1 - Broken Authentication vulnerability

    HighCVSS 7.3No exploitEPSS 0%

    digitalme · eroomOct 10, 2026

  • CVE-2026-62043
    30Monitor

    WordPress Contact Form 7 – Dynamic Text Extension plugin <= 5.0.7 - Sensitive Data Exposure vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    sevenspark · contact form 7 – dynamic text extensionOct 10, 2026

  • CVE-2026-62050
    39Monitor

    WordPress Splendour theme <= 1.23 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    themerex · splendourOct 10, 2026

  • CVE-2026-62051
    39Monitor

    WordPress Stargaze theme <= 1.10 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    themerex · stargazeOct 10, 2026

  • CVE-2026-62052
    39Monitor

    WordPress Tipsy theme <= 1.6 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    themerex · tipsyOct 10, 2026

  • CVE-2026-62053
    39Monitor

    WordPress Wine House theme <= 3.20 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    themerex · wine houseOct 10, 2026