Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: October 2026

8,743 records · 21 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 8 of 88

  • CVE-2026-105759
    30Monitor

    vLLM: Unbounded Prometheus label cardinality from attacker-controlled HTTP method tokens in the vLLM Rust frontend metrics middleware (unauthenticated denial of

    HighCVSS 7.5No exploitEPSS 0%

    vllm · vllmOct 5, 2026

  • CVE-2026-105761
    28Monitor

    Dify: IDOR in AppMCPServer PUT Endpoint Allows Modification of Other Apps' MCP Servers

    HighCVSS 7.1No exploitEPSS 0%

    langgenius · difyOct 5, 2026

  • CVE-2026-105762
    33Monitor

    Dify: Unauthenticated Server-Side Request Forgery in /console/api/remote-files/upload endpoint

    HighCVSS 8.3No exploitEPSS 0%

    langgenius · difyOct 6, 2026

  • CVE-2026-105763
    38Monitor

    Twenty: Plaintext IMAP/SMTP/CalDAV password disclosure to any workspace member via /metadata GraphQL

    CriticalCVSS 9.6No exploitEPSS 0%

    twentyhq · twentyOct 6, 2026

  • CVE-2026-105764
    30Monitor

    Immich: Authenticated SVG upload reaches ImageMagick coders and enables RCE

    HighCVSS 7.7No exploitEPSS 0%

    immich-app · immichOct 6, 2026

  • CVE-2026-105782
    30Monitor

    Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware

    HighCVSS 7.5No exploitEPSS 0%

    scrapy · scrapyOct 6, 2026

  • CVE-2026-105783
    32Monitor

    Joplin Web Clipper pairing allows cross-origin theft of a permanent API token

    HighCVSS 8.0No exploitEPSS 0%

    laurent22 · joplinOct 6, 2026

  • CVE-2026-105786
    34Monitor

    Joplin: Unauthenticated account takeover via an attacker-chosen application-authorisation identifier

    HighCVSS 8.5No exploitEPSS 0%

    laurent22 · joplinOct 6, 2026

  • CVE-2026-82988
    30Monitor

    There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unknown allows a remote, unauthenticated atta

    HighCVSS 7.5No exploitEPSS 0%

    viewsonic · vcastOct 6, 2026

  • CVE-2026-82989
    39Monitor

    There is an input injection in vCast exposed network services in ViewSonic ViewBoard that allows a remote, unauthenticated attacker to injec

    CriticalCVSS 9.8No exploitEPSS 0%

    viewsonic · vcastOct 6, 2026

  • CVE-2026-105484
    41Plan

    TOTOLINK X6000R UploadFirmwareFile cstecgi.cgi firmware_check os command injection

    CriticalCVSS 10.0Proof of conceptEPSS 2%

    totolink · x6000rOct 6, 2026

  • CVE-2026-105072
    30Monitor

    WordPress FluentBooking Pro plugin < 2.5.0 - Broken Access Control vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    wp manage ninja · fluentbooking proOct 6, 2026

  • CVE-2026-39723
    30Monitor

    WordPress Morning for WooCommerce plugin <= 2.4.1 - Broken Access Control vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    green invoice · morning for woocommerceOct 6, 2026

  • CVE-2026-39760
    28Monitor

    WordPress Real 3D FlipBook plugin <= 5.5 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    creative interactive media · real 3d flipbookOct 6, 2026

  • CVE-2026-39789
    30Monitor

    WordPress Fluent Affiliate Pro plugin <= 1.6.4 - Broken Access Control vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    wp manage ninja · fluent affiliate proOct 6, 2026

  • CVE-2026-41558
    30Monitor

    WordPress WP Migration Plugin DB & Files – WP Synchro plugin <= 1.16.1 - 2FA Bypass vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    wp synchro · wp migration plugin db & files – wp synchroOct 6, 2026

  • CVE-2026-41563
    30Monitor

    WordPress Sitemovr plugin <= 1.0.1 - Sensitive Data Exposure vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    dawer drew · sitemovrOct 6, 2026

  • CVE-2026-75962
    28Monitor

    Post SMTP <= 4.0.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user_email' Parameter (Multisite Registration → Failed Email Log)

    HighCVSS 7.2No exploitEPSS 0%

    saadiqbal · post smtp – complete email delivery and smtp solution with email logs, alerts, backup smtp & mobile appOct 6, 2026

  • CVE-2026-105701
    35Monitor

    ACPT (Premium) <= 2.0.66 - Authenticated (Subscriber+) Remote Code Execution via REST API Email Template

    HighCVSS 8.8No exploitEPSS 0%

    mauro cassani · acpt (premium)Oct 6, 2026

  • CVE-2026-105778
    34Monitor

    Tenda AC5 Wifi setWifi stack-based overflow

    HighCVSS 8.6No exploitEPSS 0%

    tenda · ac5Oct 6, 2026

  • CVE-2026-25267
    31Monitor

    Missing Authorization in Core

    HighCVSS 7.8No exploitEPSS 0%

    qualcomm · qca6698au firmwareOct 6, 2026

  • CVE-2026-25291
    31Monitor

    Use After Free in Graphics

    HighCVSS 7.8No exploitEPSS 0%

    qualcomm · sar1165p firmwareOct 6, 2026

  • CVE-2026-25302
    28Monitor

    Improper Verification of Cryptographic Signature in Boot

    HighCVSS 7.1No exploitEPSS 0%

    qualcomm · xrv9209 firmwareOct 6, 2026

  • CVE-2026-57537
    31Monitor

    Use After Free in DSP Service

    HighCVSS 7.8No exploitEPSS 0%

    qualcomm · congo firmwareOct 6, 2026

  • CVE-2026-57545
    31Monitor

    Untrusted Pointer Dereference in Graphics

    HighCVSS 7.8No exploitEPSS 0%

    qualcomm · snapdragon g1 gen 2 gaming platform firmwareOct 6, 2026

  • CVE-2026-57546
    30Monitor

    Buffer Over-read in WLAN HAL

    HighCVSS 7.5No exploitEPSS 0%

    qualcomm · congo firmwareOct 6, 2026

  • CVE-2026-57554
    31Monitor

    Use After Free in DSP Service

    HighCVSS 7.8No exploitEPSS 0%

    qualcomm · snapdragon g1 gen 2 gaming platform firmwareOct 6, 2026

  • CVE-2026-57555
    31Monitor

    Use After Free in DSP Service

    HighCVSS 7.8No exploitEPSS 0%

    qualcomm · cologne firmwareOct 6, 2026

  • CVE-2026-57559
    31Monitor

    Use After Free in DSP_Services

    HighCVSS 7.8No exploitEPSS 0%

    qualcomm · cologne firmwareOct 6, 2026

  • CVE-2026-59358
    30Monitor

    UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type

    HighCVSS 7.6Proof of conceptEPSS 0%

    cloud foundry · uaaOct 6, 2026

  • CVE-2026-94293
    37Monitor

    Missing authentication for critical function in the aas-edge-client REST API

    CriticalCVSS 9.3No exploitEPSS 0%

    murrelektronik · software aas edge client all versionsOct 6, 2026

  • CVE-2026-85153
    37Monitor

    Information Disclosure Vulnerability in Schmooze dating mobile Application

    CriticalCVSS 9.3No exploitEPSS 0%

    schmooze · schmooze dating mobile applicationOct 6, 2026

  • CVE-2026-102387
    30Monitor

    WordPress Xserver Migrator plugin <= 1.6.6 - Sensitive Data Exposure vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    xserver · xserver migratorOct 6, 2026

  • CVE-2026-102915
    34Monitor

    WordPress WPO365 plugin <= 44.1 - Broken Access Control vulnerability

    HighCVSS 8.5No exploitEPSS 0%

    marco van wieren · wpo365Oct 6, 2026

  • CVE-2026-103346
    28Monitor

    WordPress Payflex Payment Gateway plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    tomlister · payflex payment gatewayOct 6, 2026

  • CVE-2026-104385
    30Monitor

    WordPress Groundhogg plugin <= 4.8.3 - Sensitive Data Exposure vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    adrian tobey · groundhoggOct 6, 2026

  • CVE-2026-104387
    28Monitor

    WordPress PowerPress Podcasting plugin <= 11.17.9 - Broken Access Control vulnerability

    HighCVSS 7.2No exploitEPSS 0%

    blubrry · powerpress podcastingOct 6, 2026

  • CVE-2026-104394
    28Monitor

    WordPress Charitable plugin <= 1.8.12.3 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    syed balkhi · charitableOct 6, 2026

  • CVE-2026-104395
    28Monitor

    WordPress picu plugin <= 3.10.1 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    picu · picuOct 6, 2026

  • CVE-2026-104405
    32Monitor

    WordPress GiveWP plugin <= 4.17.0 - Privilege Escalation vulnerability

    HighCVSS 8.1No exploitEPSS 0%

    nexcess · givewpOct 6, 2026

  • CVE-2026-104406
    29Monitor

    WordPress picu plugin <= 3.10.1 - Broken Access Control vulnerability

    HighCVSS 7.3No exploitEPSS 0%

    picu · picuOct 6, 2026

  • CVE-2026-104670
    28Monitor

    WordPress LearnPress plugin <= 4.4.9 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    thimpress · learnpressOct 6, 2026

  • CVE-2026-104672
    28Monitor

    WordPress GiveWP plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    nexcess · givewpOct 6, 2026

  • CVE-2026-104747
    32Monitor

    WordPress Haaken theme <= 1.5 - PHP Object Injection vulnerability

    HighCVSS 8.1No exploitEPSS 0%

    edge-themes · haakenOct 6, 2026

  • CVE-2026-104757
    28Monitor

    WordPress Import and export users and customers plugin <= 2.5.5 - Privilege Escalation vulnerability

    HighCVSS 7.2No exploitEPSS 0%

    javier carazo · import and export users and customersOct 6, 2026

  • CVE-2026-104814
    28Monitor

    WordPress Form Block plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    epiphyt · form blockOct 6, 2026

  • CVE-2026-105058
    35Monitor

    WordPress WP User Profiles plugin <= 2.7.3 - Privilege Escalation vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    john james jacoby · wp user profilesOct 6, 2026

  • CVE-2026-105061
    28Monitor

    WordPress WP Mailster plugin <= 1.9.0.0 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    bởi brandtoss · wp mailsterOct 6, 2026

  • CVE-2026-105070
    35Monitor

    WordPress Salon booking system plugin <= 10.31.7 - Privilege Escalation vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    dimitri grassi · salon booking systemOct 6, 2026

  • CVE-2026-105071
    30Monitor

    WordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.17 - Sensitive Data Exposure vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    royal plugins · sitevault – backup, restore, migration &amp; cloningOct 6, 2026

  • CVE-2026-105317
    34Monitor

    WordPress Paid Member Subscriptions plugin <= 3.1.1 - SQL Injection vulnerability

    HighCVSS 8.5No exploitEPSS 0%

    cozmoslabs · paid member subscriptionsOct 6, 2026

  • CVE-2026-25433
    28Monitor

    WordPress WP2LEADS plugin <= 3.5.7 - Broken Access Control vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    tobias @saleswonder.biz · wp2leadsOct 6, 2026

  • CVE-2026-25434
    34Monitor

    WordPress WP2LEADS plugin <= 3.5.7 - SQL Injection vulnerability

    HighCVSS 8.5No exploitEPSS 0%

    tobias @saleswonder.biz · wp2leadsOct 6, 2026

  • CVE-2026-32557
    37Monitor

    WordPress WooCommerce Appointments plugin <= 5.3.2 - SQL Injection vulnerability

    CriticalCVSS 9.3No exploitEPSS 0%

    bot verification bookingwp.com: verifying that you are not a robot... · woocommerce appointmentsOct 6, 2026

  • CVE-2026-32568
    39Monitor

    WordPress WooCommerce Designer Pro plugin <= 1.9.33 - Remote Code Execution (RCE) vulnerability

    CriticalCVSS 9.9No exploitEPSS 0%

    jmaplugins · woocommerce designer proOct 6, 2026

  • CVE-2026-32569
    28Monitor

    WordPress WP Media folder plugin <= 6.2.2 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    joomunited · wp media folderOct 6, 2026

  • CVE-2026-32570
    28Monitor

    WordPress Progressify - Progressive Web App (PWA) plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    daftplug · progressify - progressive web app (pwa)Oct 6, 2026

  • CVE-2026-32572
    28Monitor

    WordPress WP User Frontend Pro plugin <= 4.2.13 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    wedevs · wp user frontend proOct 6, 2026

  • CVE-2026-32574
    28Monitor

    WordPress Smart Forms plugin <= 2.6.104 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    edgarrojas · smart formsOct 6, 2026

  • CVE-2026-32575
    28Monitor

    WordPress SUMO Affiliates Pro plugin <= 11.7.0 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    fantastic plugins · sumo affiliates proOct 6, 2026

  • CVE-2026-32577
    28Monitor

    WordPress Frontend File Manager plugin <= 23.6 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    n-media · frontend file managerOct 6, 2026

  • CVE-2026-32578
    28Monitor

    WordPress ECPay Ecommerce for WooCommerce plugin <= 1.1.2606090 - Broken Access Control vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    techsupport · ecpay ecommerce for woocommerceOct 6, 2026

  • CVE-2026-32579
    40Plan

    WordPress Kognetiks Chatbot for WordPress plugin <= 2.4.9 - Arbitrary File Upload vulnerability

    CriticalCVSS 10.0No exploitEPSS 0%

    kognetiks · kognetiks chatbot for wordpressOct 6, 2026

  • CVE-2026-32580
    30Monitor

    WordPress WooCommerce Lottery plugin <= 2.2.9 - SQL Injection vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    wpgenie · woocommerce lotteryOct 6, 2026

  • CVE-2026-32581
    28Monitor

    WordPress Mooberry Book Manager plugin 4.16.2 - SQL Injection vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    mooberrydreams · mooberry book managerOct 6, 2026

  • CVE-2026-39719
    28Monitor

    WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerability

    HighCVSS 7.2No exploitEPSS 0%

    deknows · pdf smart viewer for elementorOct 6, 2026

  • CVE-2026-39720
    28Monitor

    WordPress Mapster WP Maps plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    mapster · mapster wp mapsOct 6, 2026

  • CVE-2026-39722
    28Monitor

    WordPress WPLMS theme <= 4.972 - Reflected Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    vibethemes · wplmsOct 6, 2026

  • CVE-2026-39724
    28Monitor

    WordPress HTTP Requests Manager plugin <= 1.3.11 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    veppa · http requests managerOct 6, 2026

  • CVE-2026-39726
    28Monitor

    WordPress Lumise Product Designer plugin < 2.1.4.1 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    lumise neo · lumise product designerOct 6, 2026

  • CVE-2026-39728
    28Monitor

    WordPress Instapage Plugin plugin <= 3.7.2 - Server Side Request Forgery (SSRF) vulnerability

    HighCVSS 7.2No exploitEPSS 0%

    instapagedev · instapage pluginOct 6, 2026

  • CVE-2026-39729
    28Monitor

    WordPress Edwiser Bridge plugin <= 4.3.4 - Sensitive Data Exposure vulnerability

    HighCVSS 7.2No exploitEPSS 0%

    wisdmlabs · edwiser bridgeOct 6, 2026

  • CVE-2026-39730
    28Monitor

    WordPress Wise Chat plugin <= 3.4.3 - Broken Access Control vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    marcin · wise chatOct 6, 2026

  • CVE-2026-39731
    28Monitor

    WordPress Database for CF7 plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    code4life · database for cf7Oct 6, 2026

  • CVE-2026-39745
    28Monitor

    WordPress Contact Form to DB by BestWebSoft plugin <= 1.7.6 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    bestweblayout · contact form to db by bestwebsoftOct 6, 2026

  • CVE-2026-39746
    37Monitor

    WordPress Booknetic plugin < 5.10.3 - SQL Injection vulnerability

    CriticalCVSS 9.3No exploitEPSS 0%

    fs-code · bookneticOct 6, 2026

  • CVE-2026-39747
    34Monitor

    WordPress Woffice theme < 5.4.43 - SQL Injection vulnerability

    HighCVSS 8.5No exploitEPSS 0%

    wofficeio · wofficeOct 6, 2026

  • CVE-2026-39748
    28Monitor

    WordPress EduMall theme <= 4.5.3 - Reflected Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    thememove · edumallOct 6, 2026

  • CVE-2026-39750
    28Monitor

    WordPress StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin <= 2.0.6 - Cross Site Scripting (XSS)

    HighCVSS 7.1No exploitEPSS 0%

    wedevs · storegrowth: smart sales booster for woocommerce | bogo, upsells, direct checkout, quick view, side cartOct 6, 2026

  • CVE-2026-39751
    30Monitor

    WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Broken Access Control vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    payplug · payplug for woocommerce (official)Oct 6, 2026

  • CVE-2026-39752
    30Monitor

    WordPress Jobs for WordPress plugin <= 2.8.2 - Arbitrary File Deletion vulnerability

    HighCVSS 7.7No exploitEPSS 0%

    blueglass interactive ag · jobs for wordpressOct 6, 2026

  • CVE-2026-39753
    39Monitor

    WordPress Taskbot plugin <= 6.6 - Privilege Escalation vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    amentotech · taskbotOct 6, 2026

  • CVE-2026-39755
    39Monitor

    WordPress WP Duplicate plugin <= 1.1.11 - Arbitrary File Upload vulnerability

    CriticalCVSS 9.9No exploitEPSS 0%

    revmakx · wp duplicateOct 6, 2026

  • CVE-2026-39757
    39Monitor

    WordPress Taskbot plugin <= 6.6 - Arbitrary File Upload vulnerability

    CriticalCVSS 9.9No exploitEPSS 0%

    amentotech · taskbotOct 6, 2026

  • CVE-2026-39758
    28Monitor

    WordPress Midtrans-WooCommerce plugin <= 2.32.3 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    midtrans · midtrans-woocommerceOct 6, 2026

  • CVE-2026-39759
    39Monitor

    WordPress Workreap Core plugin <= 3.4.5 - Arbitrary File Upload vulnerability

    CriticalCVSS 9.9No exploitEPSS 0%

    amentotech · workreap coreOct 6, 2026

  • CVE-2026-39761
    39Monitor

    WordPress Meta Box AIO plugin <= 3.7.1 - Privilege Escalation vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    elightup · meta box aioOct 6, 2026

  • CVE-2026-39764
    37Monitor

    WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.19 - SQL Injection vulnerability

    CriticalCVSS 9.3No exploitEPSS 0%

    radiustheme · radius booking — booking calendar for appointments &amp; servicesOct 6, 2026

  • CVE-2026-39765
    28Monitor

    WordPress Challan plugin <= 3.7.88 - Privilege Escalation vulnerability

    HighCVSS 7.2No exploitEPSS 0%

    webappick · challanOct 6, 2026

  • CVE-2026-39766
    28Monitor

    WordPress ARForms plugin <= 7.1.2 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    reputeinfosystems · arformsOct 6, 2026

  • CVE-2026-39769
    30Monitor

    WordPress Graphina plugin <= 3.1.12 - Broken Authentication vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    iqonic design · graphinaOct 6, 2026

  • CVE-2026-39770
    40Plan

    WordPress Doctreat theme <= 1.7.0 - Arbitrary File Upload vulnerability

    CriticalCVSS 10.0No exploitEPSS 0%

    amentotech · doctreatOct 6, 2026

  • CVE-2026-39771
    34Monitor

    WordPress Buddyboss Platform plugin <= 3.1.0 - SQL Injection vulnerability

    HighCVSS 8.5No exploitEPSS 0%

    mightynetworks vs buddyboss · buddyboss platformOct 6, 2026

  • CVE-2026-39773
    40Plan

    WordPress Doctreat Core plugin <= 1.7.0 - Privilege Escalation vulnerability

    CriticalCVSS 10.0No exploitEPSS 0%

    amentotech · doctreat coreOct 6, 2026

  • CVE-2026-39774
    35Monitor

    WordPress Tourfic Pro plugin <= 1.17.3 - Privilege Escalation vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    tourfic ai studio · tourfic proOct 6, 2026

  • CVE-2026-39775
    35Monitor

    WordPress JobZilla - Job Board WordPress Theme theme <= 2.2 - Privilege Escalation vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    dexignzone · jobzilla - job board wordpress themeOct 6, 2026

  • CVE-2026-39776
    32Monitor

    WordPress Tabs plugin <= 2.5 - Remote Code Execution (RCE) vulnerability

    HighCVSS 8.0No exploitEPSS 0%

    wpshopmart · tabsOct 6, 2026

  • CVE-2026-39778
    28Monitor

    WordPress Ansar Import – One Click Starter Sites – for Elementor & Themes plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    themeansar · ansar import – one click starter sites – for elementor &amp; themesOct 6, 2026

  • CVE-2026-39780
    28Monitor

    WordPress Youzify plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    youzify · youzifyOct 6, 2026

  • CVE-2026-39781
    28Monitor

    WordPress Document Gallery plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    dan rossiter · document galleryOct 6, 2026