By publication date

Exploited and new serious CVEs: October 2026

8,751 records · 22 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 21 of 88

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2026-62054No exploit	WordPress Yacht Rental theme <= 2.6 - PHP Object Injection vulnerabilitythemerex · yacht rental · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.3%	Oct 10, 2026
28Monitor	CVE-2026-62064No exploit	WordPress Ambed theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilitybracketweb · ambed · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 10, 2026
32Monitor	CVE-2026-62065No exploit	WordPress Cardea theme <= 2.3 - Local File Inclusion vulnerabilitycocobasic · cardea · CWE-98 Pre-auth	High8.1	—	0.3%	Oct 10, 2026
32Monitor	CVE-2026-62066No exploit	WordPress Volos theme <= 1.2 - Local File Inclusion vulnerabilitycocobasic · volos · CWE-98 Pre-auth	High8.1	—	0.3%	Oct 10, 2026
32Monitor	CVE-2026-62067No exploit	WordPress Kaven theme <= 1.2 - Local File Inclusion vulnerabilitycocobasic · kaven · CWE-98 Pre-auth	High8.1	—	0.3%	Oct 10, 2026
32Monitor	CVE-2026-62068No exploit	WordPress Teoro theme <= 1.1 - Local File Inclusion vulnerabilitycocobasic · teoro · CWE-98 Pre-auth	High8.1	—	0.3%	Oct 10, 2026
32Monitor	CVE-2026-62069No exploit	WordPress Fabius theme <= 1.0 - Local File Inclusion vulnerabilitycocobasic · fabius · CWE-98 Pre-auth	High8.1	—	0.3%	Oct 10, 2026
32Monitor	CVE-2026-62070No exploit	WordPress Flipmart theme <= 2.8 - Local File Inclusion vulnerabilityckthemes · flipmart · CWE-98 Pre-auth	High8.1	—	0.3%	Oct 10, 2026
32Monitor	CVE-2026-62074No exploit	WordPress Ozeum theme <= 1.3.0 - Local File Inclusion vulnerabilitythemerex · ozeum · CWE-98 Pre-auth	High8.1	—	0.3%	Oct 10, 2026
32Monitor	CVE-2026-62075No exploit	WordPress Backhoe theme <= 2.0 - Local File Inclusion vulnerabilitymymoun · backhoe · CWE-98 Pre-auth	High8.1	—	0.3%	Oct 10, 2026
39Monitor	CVE-2026-62076No exploit	WordPress Kalles theme <= 1.1.7.1 - PHP Object Injection vulnerabilitythe4 · kalles · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.3%	Oct 10, 2026
39Monitor	CVE-2026-62077No exploit	WordPress Avala theme <= 1.1.4 - PHP Object Injection vulnerabilityboldthemes · avala · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.3%	Oct 10, 2026
28Monitor	CVE-2026-62082No exploit	WordPress Pin WP theme <= 7.0 - Reflected Cross Site Scripting (XSS) vulnerabilityan-themes · pin wp · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 10, 2026
39Monitor	CVE-2026-62086No exploit	WordPress Juno theme <= 2.25 - PHP Object Injection vulnerabilitythemerex · juno · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.3%	Oct 10, 2026
39Monitor	CVE-2026-62087No exploit	WordPress Equadio theme <= 1.1.4 - PHP Object Injection vulnerabilitythemerex · equadio · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.3%	Oct 10, 2026
39Monitor	CVE-2026-62090No exploit	WordPress WineShop theme <= 3.20 - PHP Object Injection vulnerabilitythemerex · wineshop · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.3%	Oct 10, 2026
28Monitor	CVE-2026-62091No exploit	WordPress Armania theme <= 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerabilitykutethemes · armania · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 10, 2026
32Monitor	CVE-2026-62092No exploit	WordPress Armania theme <= 1.4.8 - Local File Inclusion vulnerabilitykutethemes · armania · CWE-98 Pre-auth	High8.1	—	0.2%	Oct 10, 2026
28Monitor	CVE-2026-62093No exploit	WordPress TechOne theme <= 3.0.3 - Reflected Cross Site Scripting (XSS) vulnerabilitykutethemes · techone · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 10, 2026
32Monitor	CVE-2026-62094No exploit	WordPress TechOne theme <= 3.0.3 - Local File Inclusion vulnerabilitykutethemes · techone · CWE-98 Pre-auth	High8.1	—	0.2%	Oct 10, 2026
28Monitor	CVE-2026-62095No exploit	WordPress Biolife theme <= 3.2.3 - Reflected Cross Site Scripting (XSS) vulnerabilitykutethemes · biolife · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 10, 2026
32Monitor	CVE-2026-62096No exploit	WordPress Biolife theme <= 3.2.3 - Local File Inclusion vulnerabilitykutethemes · biolife · CWE-98 Pre-auth	High8.1	—	0.2%	Oct 10, 2026
32Monitor	CVE-2026-62099No exploit	WordPress Boutique theme <= 2.3.3 - Local File Inclusion vulnerabilitykutethemes · boutique · CWE-98 Pre-auth	High8.1	—	0.2%	Oct 10, 2026
28Monitor	CVE-2026-62100No exploit	WordPress KuteShop theme <= 4.2.9 - Reflected Cross Site Scripting (XSS) vulnerabilitykutethemes · kuteshop · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 10, 2026
32Monitor	CVE-2026-62115No exploit	WordPress KuteShop theme <= 4.2.9 - Local File Inclusion vulnerabilitykutethemes · kuteshop · CWE-98 Pre-auth	High8.1	—	0.2%	Oct 10, 2026
28Monitor	CVE-2026-62116No exploit	WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerabilitydmitry v. · barcode scanner with inventory & order manager · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 10, 2026
34Monitor	CVE-2026-62117No exploit	WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - SQL Injection vulnerabilitydmitry v. · barcode scanner with inventory & order manager · CWE-89 SQL injection	High8.5	—	0.2%	Oct 10, 2026
29Monitor	CVE-2026-62118No exploit	WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - Broken Access Control vulnerabilitydmitry v. · barcode scanner with inventory & order manager · CWE-862 Pre-auth Broken access control (IDOR)	High7.3	—	0.2%	Oct 10, 2026
39Monitor	CVE-2026-62120No exploit	WordPress Law Office theme <= 3.20 - PHP Object Injection vulnerabilitythemerex · law office · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.3%	Oct 10, 2026
39Monitor	CVE-2026-62123No exploit	WordPress Invetex theme <= 2.18 - PHP Object Injection vulnerabilitythemerex · invetex · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.3%	Oct 10, 2026
39Monitor	CVE-2026-62124No exploit	WordPress N7 \| Golf Club Sports & Events theme <= 2.21 - PHP Object Injection vulnerabilitythemerex · n7 \| golf club sports & events · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.3%	Oct 10, 2026
39Monitor	CVE-2026-62125No exploit	WordPress Asia Garden theme <= 1.3.1 - PHP Object Injection vulnerabilitythemerex · asia garden · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.3%	Oct 10, 2026
39Monitor	CVE-2026-62129No exploit	WordPress Creator LMS plugin <= 1.2.21 - Arbitrary File Upload vulnerabilitywpfunnels · creator lms · CWE-434 File upload	Critical9.9	—	0.2%	Oct 10, 2026
28Monitor	CVE-2026-62130No exploit	WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.5.8 - PHP Object Injection vulnerabilityamir helzer · woocommerce multilingual & multicurrency · CWE-502 Deserialization	High7.2	—	0.2%	Oct 10, 2026
30Monitor	CVE-2026-65459No exploit	WordPress Forminator plugin <= 1.57.3 - Arbitrary Content Deletion vulnerabilitywpmu dev · forminator · CWE-862 Pre-auth Broken access control (IDOR) Denial of service	High7.5	—	0.2%	Oct 10, 2026
39Monitor	CVE-2026-66482No exploit	WordPress Drone Media theme <= 2.2.0 - PHP Object Injection vulnerabilityancorathemes · drone media · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.3%	Oct 10, 2026
39Monitor	CVE-2026-66483No exploit	WordPress Education Center theme <= 3.6.12 - PHP Object Injection vulnerabilitythemerex · education center · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.3%	Oct 10, 2026
39Monitor	CVE-2026-66563No exploit	WordPress Windsor theme <= 2.10 - PHP Object Injection vulnerabilitythemerex · windsor · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.3%	Oct 10, 2026
39Monitor	CVE-2026-66564No exploit	WordPress ShiftCV theme <= 3.0.14 - PHP Object Injection vulnerabilitythemerex · shiftcv · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.3%	Oct 10, 2026
39Monitor	CVE-2026-66565No exploit	WordPress FC United theme <= 1.1.1 - PHP Object Injection vulnerabilityaxiomthemes · fc united · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.3%	Oct 10, 2026
32Monitor	CVE-2026-66566No exploit	WordPress Ambient theme <= 1.7 - Local File Inclusion vulnerabilityelated-themes · ambient · CWE-98 Pre-auth	High8.1	—	0.2%	Oct 10, 2026
39Monitor	CVE-2026-66567No exploit	WordPress Anesta theme <= 1.5.3 - PHP Object Injection vulnerabilityancorathemes · anesta · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.3%	Oct 10, 2026
39Monitor	CVE-2026-66568No exploit	WordPress Original theme <= 1.9.0 - PHP Object Injection vulnerabilityaxiomthemes · original · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.3%	Oct 10, 2026
39Monitor	CVE-2026-66569No exploit	WordPress Kicker theme <= 2.2.1 - PHP Object Injection vulnerabilityaxiomthemes · kicker · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.3%	Oct 10, 2026
39Monitor	CVE-2026-78529No exploit	WordPress Alliance theme <= 3.11 - PHP Object Injection vulnerabilitythemerex · alliance · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.3%	Oct 10, 2026
30Monitor	CVE-2026-78530No exploit	WordPress FoodBakery theme <= 4.6 - Arbitrary File Deletion vulnerabilitychimpstudio · foodbakery · CWE-22 Path traversal Denial of service	High7.7	—	0.3%	Oct 10, 2026
39Monitor	CVE-2026-78531No exploit	WordPress Jacqueline theme <= 2.22 - PHP Object Injection vulnerabilitythemerex · jacqueline · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.3%	Oct 10, 2026
28Monitor	CVE-2026-78532No exploit	WordPress LMS theme <= 8.3 - Cross Site Scripting (XSS) vulnerabilitydesignthemes · lms · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 10, 2026
39Monitor	CVE-2026-78533No exploit	WordPress Qwery theme <= 3.6.1 - PHP Object Injection vulnerabilityancorathemes · qwery · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.3%	Oct 10, 2026
28Monitor	CVE-2026-78534No exploit	WordPress Educavo theme <= 3.4.2 - Cross Site Scripting (XSS) vulnerabilitykeen it solutions · educavo · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 10, 2026
39Monitor	CVE-2026-78535No exploit	WordPress Photolia theme <= 1.0.3 - PHP Object Injection vulnerabilitythemerex · photolia · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.3%	Oct 10, 2026
39Monitor	CVE-2026-81797No exploit	WordPress Buzz Stone \| Magazine & Viral Blog WordPress Theme theme <= 1.0.2 - PHP Object Injection vulnerabilitythemerex · buzz stone \| magazine & viral blog wordpress theme · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.3%	Oct 10, 2026
28Monitor	CVE-2026-108623No exploit	JeecgBoot through 3.9.5 Missing Authorization via /sys/log/deleteBatchjeecgboot · jeecgboot · CWE-862 Broken access control (IDOR)	High7.1	—	0.3%	Oct 10, 2026
34Monitor	CVE-2026-108628No exploit	JeecgBoot through 3.9.5 Missing Authorization via saveDeptRolePermission Endpointjeecgboot · jeecgboot · CWE-862 Broken access control (IDOR)	High8.6	—	0.2%	Oct 10, 2026
28Monitor	CVE-2026-108648No exploit	JeecgBoot through 3.9.5 Missing Authorization via getDynamicDbSourceByCode Endpointjeecgboot · jeecgboot · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 10, 2026
34Monitor	CVE-2026-108657No exploit	JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/passApplyjeecgboot · jeecgboot · CWE-862 Broken access control (IDOR)	High8.6	—	0.2%	Oct 10, 2026
28Monitor	CVE-2026-108661No exploit	JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/changeOwenUserTenantjeecgboot · jeecgboot · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 10, 2026
28Monitor	CVE-2026-108671No exploit	JeecgBoot through 3.9.5 Missing Authorization via /airag/airagMcp/queryByIdjeecgboot · jeecgboot · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 10, 2026
28Monitor	CVE-2026-108677No exploit	JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserByNamejeecgboot · jeecgboot · CWE-862 Hard-coded credentials Broken access control (IDOR)	High7.1	—	0.2%	Oct 10, 2026
28Monitor	CVE-2026-108692No exploit	1Panel-dev CordysCRM 1.9.0 before 1.9.2 Missing Authorization via /field/source Endpoints1panel-dev · cordyscrm · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 11, 2026
29Monitor	CVE-2026-108693No exploit	ImageMagick through 7.1.2-33 and 6.9.13-58 Uncontrolled Search Path via Ghostscript Delegateimagemagick · imagemagick · CWE-427 Local privilege escalation	High7.3	—	0.2%	Oct 11, 2026
28Monitor	CVE-2026-108694No exploit	ConvertX through 0.19.0 Arbitrary File Read via Pandoc Converterc4illin · convertx · CWE-73 Path traversal	High7.1	—	0.2%	Oct 11, 2026
28Monitor	CVE-2026-108695No exploit	MultiVendorX through 5.0.19 Incorrect Authorization via Settings REST Endpointmultivendorx · multivendorx · CWE-863 Broken access control (IDOR)	High7.1	—	0.3%	Oct 11, 2026
28Monitor	CVE-2026-108700No exploit	1Panel-dev CordysCRM before 1.9.2 Missing Authorization via /field/source/business-title1panel-dev · cordyscrm · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 11, 2026
37Monitor	CVE-2026-108707No exploit	Wukong_HRM through commit 186115e Authentication Bypass via ParamAspectwukongopensource · wukong_hrm · CWE-287 Pre-auth Auth bypass	Critical9.3	—	0.5%	Oct 11, 2026
34Monitor	CVE-2026-108708No exploit	Wukong_HRM through commit 186115e Missing Authorization via EmployeeAspect and EmployeeUtilwukongopensource · wukong_hrm · CWE-862 Broken access control (IDOR)	High8.7	—	0.2%	Oct 11, 2026
35Monitor	CVE-2026-103305No exploit	Prenotazioni <= 1.7.5 - Unauthenticated Stored XSS via Settings Updateunknown · prenotazioni · CWE-79 Pre-auth XSS CSRF	High8.8	—	0.1%	Oct 11, 2026
35Monitor	CVE-2026-103694No exploit	Mobile builder <= 1.4.2 - Subscriber+ Privilege Escalation to Adminunknown · mobile builder · CWE-269	High8.8	—	0.2%	Oct 11, 2026
34Monitor	CVE-2026-103695No exploit	Mobile Builder <= 1.4.2 - Unauthenticated SQLi via 'vendor_id' Parameterunknown · mobile builder · CWE-89 Pre-auth SQL injection	High8.6	—	0.3%	Oct 11, 2026
39Monitor	CVE-2026-104028No exploit	Anton Extensions <= 1.2.2 - Unauthenticated Arbitrary File Upload to RCEunknown · anton extensions · CWE-434 pre-auth RCE File upload	Critical9.8	—	0.5%	Oct 11, 2026
28Monitor	CVE-2026-104680No exploit	Envira Gallery < 1.16.2 - Multisite Subsite Admin+ Arbitrary Plugin Installation via Onboarding Wizardunknown · envira gallery · CWE-269	High7.2	—	0.3%	Oct 11, 2026
30Monitor	CVE-2026-106029No exploit	WeddingCity Lite <= 1.0.4 - Unauthenticated Arbitrary Post and Attachment Deletionunknown · weddingcity lite · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.2%	Oct 11, 2026
35Monitor	CVE-2026-108540No exploit	OpenSpug File Transfer transfer os command injectionopenspug · spug · CWE-77 RCE Command injection	High8.6	—	1.7%	Oct 11, 2026
30Monitor	CVE-2026-14854No exploit	WooCommerce Bookings < 3.11.0 - Unauthenticated Denial of Serviceunknown · woocommerce bookings · CWE-400 Pre-auth Denial of service	High7.5	—	0.3%	Oct 11, 2026
34Monitor	CVE-2026-81420No exploit	Tcard WP <= 1.8.0 - Unauthenticated SQLi via group_id Parameterunknown · tcard wp · CWE-89 Pre-auth SQL injection	High8.6	—	0.3%	Oct 11, 2026
36Monitor	CVE-2026-81649No exploit	Fundiin <= 3.4.0 - Unauthenticated Payment Gateway Settings Update and Credential Disclosureunknown · fundiin cho woocommerce · CWE-863 Pre-auth Broken access control (IDOR) XSS	Critical9.1	—	0.2%	Oct 11, 2026
39Monitor	CVE-2026-84251No exploit	click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Arbitrary Options Updateunknown · click5 crm add-on to ninja forms · CWE-862 Pre-auth Broken access control (IDOR) CSRF	Critical9.8	—	0.1%	Oct 11, 2026
39Monitor	CVE-2026-84252No exploit	click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Arbitrary Options Updateunknown · click5 crm add-on to wpforms · CWE-862 Pre-auth Broken access control (IDOR) CSRF	Critical9.8	—	0.1%	Oct 11, 2026
39Monitor	CVE-2026-84253No exploit	click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Arbitrary Options Updateunknown · click5 crm add-on to gravity forms · CWE-862 Pre-auth Broken access control (IDOR) CSRF	Critical9.8	—	0.1%	Oct 11, 2026
39Monitor	CVE-2026-84254No exploit	click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Arbitrary Options Updateunknown · click5 crm add-on to contact form 7 · CWE-862 Pre-auth Broken access control (IDOR) CSRF	Critical9.8	—	0.1%	Oct 11, 2026
35Monitor	CVE-2026-84258No exploit	click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Stored XSS via post_notificationsunknown · click5 crm add-on to ninja forms · CWE-79 Pre-auth XSS	High8.8	—	0.2%	Oct 11, 2026
35Monitor	CVE-2026-84259No exploit	click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Stored XSS via post_notificationsunknown · click5 crm add-on to wpforms · CWE-79 Pre-auth XSS	High8.8	—	0.2%	Oct 11, 2026
35Monitor	CVE-2026-84260No exploit	click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Stored XSS via post_notificationsunknown · click5 crm add-on to gravity forms · CWE-79 Pre-auth XSS	High8.8	—	0.2%	Oct 11, 2026
35Monitor	CVE-2026-84261No exploit	click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Stored XSS via post_notificationsunknown · click5 crm add-on to contact form 7 · CWE-79 Pre-auth XSS	High8.8	—	0.2%	Oct 11, 2026
39Monitor	CVE-2026-84734No exploit	Mindstien Quick Login <= 1.0 - Unauthenticated Administrator Account Takeover via 'mql_pass' Parameterunknown · mindstien quick login · CWE-287 Pre-auth Auth bypass	Critical9.8	—	0.3%	Oct 11, 2026
39Monitor	CVE-2026-84737No exploit	Freeton WP <= 1.0.0 - Unauthenticated Account Takeover via 'secod' Parameterunknown · freeton wp · CWE-287 Pre-auth Auth bypass	Critical9.8	—	0.3%	Oct 11, 2026
39Monitor	CVE-2026-85118No exploit	AI Content Generator Marketing <= 1.0.0 - Unauthenticated Privilege Escalation via Arbitrary Option Update and Deletionunknown · ai content generator marketing · CWE-269 Pre-auth	Critical9.8	—	0.3%	Oct 11, 2026
36Monitor	CVE-2026-85121No exploit	Insurify <= 1.0 - Unauthenticated Arbitrary Option Creation and Overwrite via saveemailtemplatedesignunknown · insurify · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.3%	Oct 11, 2026
28Monitor	CVE-2026-85126No exploit	Crowdfundly <= 2.2.2 - Crowdfundly Manager+ Privilege Escalationunknown · crowdfundly · CWE-269	High7.2	—	0.3%	Oct 11, 2026
36Monitor	CVE-2026-86706No exploit	Quick quotes <= 1.0.0 - Unauthenticated Integer-Value Option Updateunknown · quick quotes · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.3%	Oct 11, 2026
36Monitor	CVE-2026-86717No exploit	Insurify <= 1.0 - Unauthenticated Arbitrary Option Deletion via removeimg_popupunknown · insurify · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.3%	Oct 11, 2026
35Monitor	CVE-2026-86798No exploit	HootBoard <= 3.1.4 - Unauthenticated Stored XSS via Board Configuration REST Endpointunknown · hootboard · CWE-79 Pre-auth XSS	High8.8	—	0.3%	Oct 11, 2026
35Monitor	CVE-2026-87760No exploit	Web Vitals Tracking <= 5.4.2 - Unauthenticated Stored XSS via Tracking Beacon Metric Nameunknown · web vitals tracking · CWE-79 Pre-auth XSS	High8.8	—	0.3%	Oct 11, 2026
32Monitor	CVE-2026-87761No exploit	Adwised Web Push Notification <= 2.5.7 - Subscriber+ Stored XSS via Pop-up Settingsunknown · adwised web push notification · CWE-79 XSS	High8.0	—	0.2%	Oct 11, 2026
35Monitor	CVE-2026-87762No exploit	Adwised Web Push Notification <= 2.5.7 - Unauthenticated Stored XSS via Secret Key Type Jugglingunknown · adwised web push notification · CWE-79 Pre-auth XSS	High8.8	—	0.3%	Oct 11, 2026
35Monitor	CVE-2026-87764No exploit	BuddyPress Instant Chat <= 1.6 - Unauthenticated Stored XSS via Chat Messageunknown · buddypress instant chat · CWE-79 Pre-auth XSS	High8.8	—	0.2%	Oct 11, 2026
35Monitor	CVE-2026-88826No exploit	SmugMug Embed <= 3.13 - Unauthenticated Stored XSS via saveSelectedAlbumsunknown · smugmug embed · CWE-79 Pre-auth XSS CSRF	High8.8	—	0.1%	Oct 11, 2026
35Monitor	CVE-2026-88827No exploit	Disable Users <= 1.0.5 - Disabled Account Authentication Bypass via XML-RPC and Application Passwordsunknown · disable users · CWE-287 Auth bypass	High8.8	—	0.2%	Oct 11, 2026
35Monitor	CVE-2026-88903No exploit	Topcontent <= 1.2.1 - Unauthenticated Stored XSS via Content Webhookunknown · topcontent · CWE-79 Pre-auth XSS	High8.8	—	0.2%	Oct 11, 2026
35Monitor	CVE-2026-88905No exploit	KeyWord Collector <= 1.4 - Unauthenticated Stored XSS and Settings Update via WPKeyWordSettingsunknown · keyword collector · CWE-79 Pre-auth XSS	High8.8	—	0.2%	Oct 11, 2026

CVE-2026-62054
39Monitor
WordPress Yacht Rental theme <= 2.6 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
themerex · yacht rentalOct 10, 2026
CVE-2026-62064
28Monitor
WordPress Ambed theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
bracketweb · ambedOct 10, 2026
CVE-2026-62065
32Monitor
WordPress Cardea theme <= 2.3 - Local File Inclusion vulnerability
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
cocobasic · cardeaOct 10, 2026
CVE-2026-62066
32Monitor
WordPress Volos theme <= 1.2 - Local File Inclusion vulnerability
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
cocobasic · volosOct 10, 2026
CVE-2026-62067
32Monitor
WordPress Kaven theme <= 1.2 - Local File Inclusion vulnerability
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
cocobasic · kavenOct 10, 2026
CVE-2026-62068
32Monitor
WordPress Teoro theme <= 1.1 - Local File Inclusion vulnerability
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
cocobasic · teoroOct 10, 2026
CVE-2026-62069
32Monitor
WordPress Fabius theme <= 1.0 - Local File Inclusion vulnerability
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
cocobasic · fabiusOct 10, 2026
CVE-2026-62070
32Monitor
WordPress Flipmart theme <= 2.8 - Local File Inclusion vulnerability
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
ckthemes · flipmartOct 10, 2026
CVE-2026-62074
32Monitor
WordPress Ozeum theme <= 1.3.0 - Local File Inclusion vulnerability
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
themerex · ozeumOct 10, 2026
CVE-2026-62075
32Monitor
WordPress Backhoe theme <= 2.0 - Local File Inclusion vulnerability
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
mymoun · backhoeOct 10, 2026
CVE-2026-62076
39Monitor
WordPress Kalles theme <= 1.1.7.1 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
the4 · kallesOct 10, 2026
CVE-2026-62077
39Monitor
WordPress Avala theme <= 1.1.4 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
boldthemes · avalaOct 10, 2026
CVE-2026-62082
28Monitor
WordPress Pin WP theme <= 7.0 - Reflected Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
an-themes · pin wpOct 10, 2026
CVE-2026-62086
39Monitor
WordPress Juno theme <= 2.25 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
themerex · junoOct 10, 2026
CVE-2026-62087
39Monitor
WordPress Equadio theme <= 1.1.4 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
themerex · equadioOct 10, 2026
CVE-2026-62090
39Monitor
WordPress WineShop theme <= 3.20 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
themerex · wineshopOct 10, 2026
CVE-2026-62091
28Monitor
WordPress Armania theme <= 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
kutethemes · armaniaOct 10, 2026
CVE-2026-62092
32Monitor
WordPress Armania theme <= 1.4.8 - Local File Inclusion vulnerability
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
kutethemes · armaniaOct 10, 2026
CVE-2026-62093
28Monitor
WordPress TechOne theme <= 3.0.3 - Reflected Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
kutethemes · techoneOct 10, 2026
CVE-2026-62094
32Monitor
WordPress TechOne theme <= 3.0.3 - Local File Inclusion vulnerability
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
kutethemes · techoneOct 10, 2026
CVE-2026-62095
28Monitor
WordPress Biolife theme <= 3.2.3 - Reflected Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
kutethemes · biolifeOct 10, 2026
CVE-2026-62096
32Monitor
WordPress Biolife theme <= 3.2.3 - Local File Inclusion vulnerability
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
kutethemes · biolifeOct 10, 2026
CVE-2026-62099
32Monitor
WordPress Boutique theme <= 2.3.3 - Local File Inclusion vulnerability
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
kutethemes · boutiqueOct 10, 2026
CVE-2026-62100
28Monitor
WordPress KuteShop theme <= 4.2.9 - Reflected Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
kutethemes · kuteshopOct 10, 2026
CVE-2026-62115
32Monitor
WordPress KuteShop theme <= 4.2.9 - Local File Inclusion vulnerability
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
kutethemes · kuteshopOct 10, 2026
CVE-2026-62116
28Monitor
WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
dmitry v. · barcode scanner with inventory & order managerOct 10, 2026
CVE-2026-62117
34Monitor
WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - SQL Injection vulnerability
HighCVSS 8.5No exploitEPSS 0%
- SQL injection
dmitry v. · barcode scanner with inventory & order managerOct 10, 2026
CVE-2026-62118
29Monitor
WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - Broken Access Control vulnerability
HighCVSS 7.3No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
dmitry v. · barcode scanner with inventory & order managerOct 10, 2026
CVE-2026-62120
39Monitor
WordPress Law Office theme <= 3.20 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
themerex · law officeOct 10, 2026
CVE-2026-62123
39Monitor
WordPress Invetex theme <= 2.18 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
themerex · invetexOct 10, 2026
CVE-2026-62124
39Monitor
WordPress N7 | Golf Club Sports & Events theme <= 2.21 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
themerex · n7 | golf club sports & eventsOct 10, 2026
CVE-2026-62125
39Monitor
WordPress Asia Garden theme <= 1.3.1 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
themerex · asia gardenOct 10, 2026
CVE-2026-62129
39Monitor
WordPress Creator LMS plugin <= 1.2.21 - Arbitrary File Upload vulnerability
CriticalCVSS 9.9No exploitEPSS 0%
- File upload
wpfunnels · creator lmsOct 10, 2026
CVE-2026-62130
28Monitor
WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.5.8 - PHP Object Injection vulnerability
HighCVSS 7.2No exploitEPSS 0%
- Deserialization
amir helzer · woocommerce multilingual & multicurrencyOct 10, 2026
CVE-2026-65459
30Monitor
WordPress Forminator plugin <= 1.57.3 - Arbitrary Content Deletion vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
- Denial of service
wpmu dev · forminatorOct 10, 2026
CVE-2026-66482
39Monitor
WordPress Drone Media theme <= 2.2.0 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
ancorathemes · drone mediaOct 10, 2026
CVE-2026-66483
39Monitor
WordPress Education Center theme <= 3.6.12 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
themerex · education centerOct 10, 2026
CVE-2026-66563
39Monitor
WordPress Windsor theme <= 2.10 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
themerex · windsorOct 10, 2026
CVE-2026-66564
39Monitor
WordPress ShiftCV theme <= 3.0.14 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
themerex · shiftcvOct 10, 2026
CVE-2026-66565
39Monitor
WordPress FC United theme <= 1.1.1 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
axiomthemes · fc unitedOct 10, 2026
CVE-2026-66566
32Monitor
WordPress Ambient theme <= 1.7 - Local File Inclusion vulnerability
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
elated-themes · ambientOct 10, 2026
CVE-2026-66567
39Monitor
WordPress Anesta theme <= 1.5.3 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
ancorathemes · anestaOct 10, 2026
CVE-2026-66568
39Monitor
WordPress Original theme <= 1.9.0 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
axiomthemes · originalOct 10, 2026
CVE-2026-66569
39Monitor
WordPress Kicker theme <= 2.2.1 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
axiomthemes · kickerOct 10, 2026
CVE-2026-78529
39Monitor
WordPress Alliance theme <= 3.11 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
themerex · allianceOct 10, 2026
CVE-2026-78530
30Monitor
WordPress FoodBakery theme <= 4.6 - Arbitrary File Deletion vulnerability
HighCVSS 7.7No exploitEPSS 0%
- Path traversal
- Denial of service
chimpstudio · foodbakeryOct 10, 2026
CVE-2026-78531
39Monitor
WordPress Jacqueline theme <= 2.22 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
themerex · jacquelineOct 10, 2026
CVE-2026-78532
28Monitor
WordPress LMS theme <= 8.3 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
designthemes · lmsOct 10, 2026
CVE-2026-78533
39Monitor
WordPress Qwery theme <= 3.6.1 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
ancorathemes · qweryOct 10, 2026
CVE-2026-78534
28Monitor
WordPress Educavo theme <= 3.4.2 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
keen it solutions · educavoOct 10, 2026
CVE-2026-78535
39Monitor
WordPress Photolia theme <= 1.0.3 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
themerex · photoliaOct 10, 2026
CVE-2026-81797
39Monitor
WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme theme <= 1.0.2 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
themerex · buzz stone | magazine & viral blog wordpress themeOct 10, 2026
CVE-2026-108623
28Monitor
JeecgBoot through 3.9.5 Missing Authorization via /sys/log/deleteBatch
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
jeecgboot · jeecgbootOct 10, 2026
CVE-2026-108628
34Monitor
JeecgBoot through 3.9.5 Missing Authorization via saveDeptRolePermission Endpoint
HighCVSS 8.6No exploitEPSS 0%
- Broken access control (IDOR)
jeecgboot · jeecgbootOct 10, 2026
CVE-2026-108648
28Monitor
JeecgBoot through 3.9.5 Missing Authorization via getDynamicDbSourceByCode Endpoint
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
jeecgboot · jeecgbootOct 10, 2026
CVE-2026-108657
34Monitor
JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/passApply
HighCVSS 8.6No exploitEPSS 0%
- Broken access control (IDOR)
jeecgboot · jeecgbootOct 10, 2026
CVE-2026-108661
28Monitor
JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/changeOwenUserTenant
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
jeecgboot · jeecgbootOct 10, 2026
CVE-2026-108671
28Monitor
JeecgBoot through 3.9.5 Missing Authorization via /airag/airagMcp/queryById
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
jeecgboot · jeecgbootOct 10, 2026
CVE-2026-108677
28Monitor
JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserByName
HighCVSS 7.1No exploitEPSS 0%
- Hard-coded credentials
- Broken access control (IDOR)
jeecgboot · jeecgbootOct 10, 2026
CVE-2026-108692
28Monitor
1Panel-dev CordysCRM 1.9.0 before 1.9.2 Missing Authorization via /field/source Endpoints
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
1panel-dev · cordyscrmOct 11, 2026
CVE-2026-108693
29Monitor
ImageMagick through 7.1.2-33 and 6.9.13-58 Uncontrolled Search Path via Ghostscript Delegate
HighCVSS 7.3No exploitEPSS 0%
- Local privilege escalation
imagemagick · imagemagickOct 11, 2026
CVE-2026-108694
28Monitor
ConvertX through 0.19.0 Arbitrary File Read via Pandoc Converter
HighCVSS 7.1No exploitEPSS 0%
- Path traversal
c4illin · convertxOct 11, 2026
CVE-2026-108695
28Monitor
MultiVendorX through 5.0.19 Incorrect Authorization via Settings REST Endpoint
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
multivendorx · multivendorxOct 11, 2026
CVE-2026-108700
28Monitor
1Panel-dev CordysCRM before 1.9.2 Missing Authorization via /field/source/business-title
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
1panel-dev · cordyscrmOct 11, 2026
CVE-2026-108707
37Monitor
Wukong_HRM through commit 186115e Authentication Bypass via ParamAspect
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
wukongopensource · wukong_hrmOct 11, 2026
CVE-2026-108708
34Monitor
Wukong_HRM through commit 186115e Missing Authorization via EmployeeAspect and EmployeeUtil
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
wukongopensource · wukong_hrmOct 11, 2026
CVE-2026-103305
35Monitor
Prenotazioni <= 1.7.5 - Unauthenticated Stored XSS via Settings Update
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- XSS
- CSRF
unknown · prenotazioniOct 11, 2026
CVE-2026-103694
35Monitor
Mobile builder <= 1.4.2 - Subscriber+ Privilege Escalation to Admin
HighCVSS 8.8No exploitEPSS 0%
unknown · mobile builderOct 11, 2026
CVE-2026-103695
34Monitor
Mobile Builder <= 1.4.2 - Unauthenticated SQLi via 'vendor_id' Parameter
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- SQL injection
unknown · mobile builderOct 11, 2026
CVE-2026-104028
39Monitor
Anton Extensions <= 1.2.2 - Unauthenticated Arbitrary File Upload to RCE
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- File upload
unknown · anton extensionsOct 11, 2026
CVE-2026-104680
28Monitor
Envira Gallery < 1.16.2 - Multisite Subsite Admin+ Arbitrary Plugin Installation via Onboarding Wizard
HighCVSS 7.2No exploitEPSS 0%
unknown · envira galleryOct 11, 2026
CVE-2026-106029
30Monitor
WeddingCity Lite <= 1.0.4 - Unauthenticated Arbitrary Post and Attachment Deletion
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
unknown · weddingcity liteOct 11, 2026
CVE-2026-108540
35Monitor
OpenSpug File Transfer transfer os command injection
HighCVSS 8.6No exploitEPSS 1%
- RCE
- Command injection
openspug · spugOct 11, 2026
CVE-2026-14854
30Monitor
WooCommerce Bookings < 3.11.0 - Unauthenticated Denial of Service
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
unknown · woocommerce bookingsOct 11, 2026
CVE-2026-81420
34Monitor
Tcard WP <= 1.8.0 - Unauthenticated SQLi via group_id Parameter
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- SQL injection
unknown · tcard wpOct 11, 2026
CVE-2026-81649
36Monitor
Fundiin <= 3.4.0 - Unauthenticated Payment Gateway Settings Update and Credential Disclosure
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
- XSS
unknown · fundiin cho woocommerceOct 11, 2026
CVE-2026-84251
39Monitor
click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Arbitrary Options Update
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
- CSRF
unknown · click5 crm add-on to ninja formsOct 11, 2026
CVE-2026-84252
39Monitor
click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Arbitrary Options Update
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
- CSRF
unknown · click5 crm add-on to wpformsOct 11, 2026
CVE-2026-84253
39Monitor
click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Arbitrary Options Update
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
- CSRF
unknown · click5 crm add-on to gravity formsOct 11, 2026
CVE-2026-84254
39Monitor
click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Arbitrary Options Update
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
- CSRF
unknown · click5 crm add-on to contact form 7Oct 11, 2026
CVE-2026-84258
35Monitor
click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Stored XSS via post_notifications
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- XSS
unknown · click5 crm add-on to ninja formsOct 11, 2026
CVE-2026-84259
35Monitor
click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Stored XSS via post_notifications
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- XSS
unknown · click5 crm add-on to wpformsOct 11, 2026
CVE-2026-84260
35Monitor
click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Stored XSS via post_notifications
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- XSS
unknown · click5 crm add-on to gravity formsOct 11, 2026
CVE-2026-84261
35Monitor
click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Stored XSS via post_notifications
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- XSS
unknown · click5 crm add-on to contact form 7Oct 11, 2026
CVE-2026-84734
39Monitor
Mindstien Quick Login <= 1.0 - Unauthenticated Administrator Account Takeover via 'mql_pass' Parameter
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
unknown · mindstien quick loginOct 11, 2026
CVE-2026-84737
39Monitor
Freeton WP <= 1.0.0 - Unauthenticated Account Takeover via 'secod' Parameter
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
unknown · freeton wpOct 11, 2026
CVE-2026-85118
39Monitor
AI Content Generator Marketing <= 1.0.0 - Unauthenticated Privilege Escalation via Arbitrary Option Update and Deletion
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
unknown · ai content generator marketingOct 11, 2026
CVE-2026-85121
36Monitor
Insurify <= 1.0 - Unauthenticated Arbitrary Option Creation and Overwrite via saveemailtemplatedesign
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
unknown · insurifyOct 11, 2026
CVE-2026-85126
28Monitor
Crowdfundly <= 2.2.2 - Crowdfundly Manager+ Privilege Escalation
HighCVSS 7.2No exploitEPSS 0%
unknown · crowdfundlyOct 11, 2026
CVE-2026-86706
36Monitor
Quick quotes <= 1.0.0 - Unauthenticated Integer-Value Option Update
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
unknown · quick quotesOct 11, 2026
CVE-2026-86717
36Monitor
Insurify <= 1.0 - Unauthenticated Arbitrary Option Deletion via removeimg_popup
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
unknown · insurifyOct 11, 2026
CVE-2026-86798
35Monitor
HootBoard <= 3.1.4 - Unauthenticated Stored XSS via Board Configuration REST Endpoint
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- XSS
unknown · hootboardOct 11, 2026
CVE-2026-87760
35Monitor
Web Vitals Tracking <= 5.4.2 - Unauthenticated Stored XSS via Tracking Beacon Metric Name
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- XSS
unknown · web vitals trackingOct 11, 2026
CVE-2026-87761
32Monitor
Adwised Web Push Notification <= 2.5.7 - Subscriber+ Stored XSS via Pop-up Settings
HighCVSS 8.0No exploitEPSS 0%
- XSS
unknown · adwised web push notificationOct 11, 2026
CVE-2026-87762
35Monitor
Adwised Web Push Notification <= 2.5.7 - Unauthenticated Stored XSS via Secret Key Type Juggling
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- XSS
unknown · adwised web push notificationOct 11, 2026
CVE-2026-87764
35Monitor
BuddyPress Instant Chat <= 1.6 - Unauthenticated Stored XSS via Chat Message
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- XSS
unknown · buddypress instant chatOct 11, 2026
CVE-2026-88826
35Monitor
SmugMug Embed <= 3.13 - Unauthenticated Stored XSS via saveSelectedAlbums
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- XSS
- CSRF
unknown · smugmug embedOct 11, 2026
CVE-2026-88827
35Monitor
Disable Users <= 1.0.5 - Disabled Account Authentication Bypass via XML-RPC and Application Passwords
HighCVSS 8.8No exploitEPSS 0%
- Auth bypass
unknown · disable usersOct 11, 2026
CVE-2026-88903
35Monitor
Topcontent <= 1.2.1 - Unauthenticated Stored XSS via Content Webhook
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- XSS
unknown · topcontentOct 11, 2026
CVE-2026-88905
35Monitor
KeyWord Collector <= 1.4 - Unauthenticated Stored XSS and Settings Update via WPKeyWordSettings
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- XSS
unknown · keyword collectorOct 11, 2026