Explore CVE records

MedPublished 30 Sep 2026, 19:28 WIB

CVE-2026-100513

WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.5 versions.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:37 WIB

Official record

MedPublished 30 Sep 2026, 19:28 WIB

CVE-2026-100508

WordPress Two Factor plugin <= 0.16.0 - Denial of Service Attack vulnerability

Unauthenticated Denial of Service Attack in Two Factor <= 0.16.0 versions.

Excerpt language: en.

CVSS5.3

HighPublished 30 Sep 2026, 19:28 WIB

CVE-2026-100507

WordPress If-So Dynamic Content Personalization plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Content If-So Dynamic Content Personalization if-so allows Reflected XSS.This issue affects If-So Dynamic Content Personalization: from n/a through 1.10.1.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated07 Oct 2026, 14:02 WIB

Official record

MedPublished 30 Sep 2026, 19:28 WIB

CVE-2026-97302

WordPress MPG plugin <= 4.2.3 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:27 WIB

Official record

MedPublished 30 Sep 2026, 19:28 WIB

CVE-2026-97301

WordPress Cool Formkit Lite plugin <= 2.7.8 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:27 WIB

Official record

MedPublished 30 Sep 2026, 19:28 WIB

CVE-2026-97299

WordPress Razorpay Payment Links for WooCommerce plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Razorpay Payment Links for WooCommerce <= 2.1.5 versions.

Excerpt language: en.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:27 WIB

Official record

MedPublished 30 Sep 2026, 19:28 WIB

CVE-2026-97298

WordPress King Addons for Elementor plugin <= 51.1.86 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 versions.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:27 WIB

Official record

HighPublished 30 Sep 2026, 19:28 WIB

CVE-2026-97293

WordPress Media LIbrary Assistant plugin <= 3.41 - SQL Injection vulnerability

Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions.

Excerpt language: en.

CVSS8.5v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:27 WIB

Official record

MedPublished 30 Sep 2026, 19:28 WIB

CVE-2026-97292

WordPress YITH WooCommerce Tab Manager plugin <= 2.15.0 - Cross Site Scripting (XSS) vulnerability

Author Cross Site Scripting (XSS) in YITH WooCommerce Tab Manager <= 2.15.0 versions.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:27 WIB

Official record

HighPublished 30 Sep 2026, 19:28 WIB

CVE-2026-97289

WordPress Quiz And Survey Master plugin <= 11.2.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.6.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated10 Oct 2026, 01:13 WIB

Official record

MedPublished 30 Sep 2026, 19:28 WIB

CVE-2026-97288

WordPress OAuth Server plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versions.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:37 WIB

Official record

HighPublished 30 Sep 2026, 19:28 WIB

CVE-2026-97287

WordPress Event Tickets plugin <= 5.29.5 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL Injection. This issue affects Event Tickets: from n/a through 5.29.5.

Excerpt language: en.

CVSS8.5v3.1KEVNot listedEPSSPresentUpdated15 Oct 2026, 06:27 WIB

Official record

MedPublished 30 Sep 2026, 19:28 WIB

CVE-2026-97286

WordPress Strong Testimonials plugin <= 3.3.11 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.11.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated03 Oct 2026, 00:45 WIB

Official record

MedPublished 30 Sep 2026, 19:28 WIB

CVE-2026-97285

WordPress The Events Calendar plugin <= 6.17.5 - Broken Access Control vulnerability

Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions.

Excerpt language: en.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:37 WIB

Official record

MedPublished 30 Sep 2026, 19:28 WIB

CVE-2026-97282

WordPress Review Schema plugin <= 3.1.0 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References (IDOR) in Review Schema <= 3.1.0 versions.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:37 WIB

Official record

MedPublished 30 Sep 2026, 19:28 WIB

CVE-2026-97279

WordPress Polylang plugin <= 3.8.9 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:37 WIB

Official record

CritPublished 30 Sep 2026, 19:28 WIB

CVE-2026-97274

WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.2 - Bypass vulnerability vulnerability

Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO (OAuth Client) <= 7.1.2 versions.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:37 WIB

Official record

HighPublished 30 Sep 2026, 19:28 WIB

CVE-2026-97272

WordPress Premmerce Permalink Manager for WooCommerce plugin <= 2.3.13 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for WooCommerce <= 2.3.13 versions.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:37 WIB

Official record

HighPublished 30 Sep 2026, 19:28 WIB

CVE-2026-97271

WordPress WPFunnels plugin <= 3.13.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:37 WIB

Official record

MedPublished 30 Sep 2026, 19:28 WIB

CVE-2026-97270

WordPress CMB2 plugin <= 2.13.0 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in CMB2 <= 2.13.0 versions.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:27 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage