AIMF Security · Platform intelligence
WordPress & Plugin Vulnerability Feed
Track published CVE records affecting WordPress core, plugins and themes. Review affected versions and remediation guidance in the linked source before deciding whether a record applies to your installation.
CISA KEV identifies vulnerabilities with evidence of exploitation. NVD provides published CVE details and severity where available. Inclusion in NVD alone does not establish active exploitation.
Severity Distribution
Top Vendors
0 vulnerabilities shown
| Source | CVE ID | Severity | Vendor / Product | Description | Date | Flags |
|---|---|---|---|---|---|---|
| KEV | CVE-2026-102764 | N/A | BeyondTrust / Remote Support | BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability | 2026-10-16 | |
| KEV | CVE-2025-61624 | N/A | Fortinet / Multiple Products | Fortinet Multiple Products Path Traversal Vulnerability | 2026-10-16 | |
| KEV | CVE-2026-21589 | N/A | Atlassian / Multiple Products | Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability | 2026-10-15 | |
| KEV | CVE-2026-105134 | N/A | Ahsay / AhsayCBS | Ahsay AhsayCBS Command Injection Vulnerability | 2026-10-14 | |
| KEV | CVE-2026-76519 | N/A | Cisco / Secure Email Gateway | Cisco Secure Email Gateway Relative Path Traversal Vulnerability | 2026-10-14 | |
| KEV | CVE-2026-105133 | N/A | Ahsay / AhsayCBS | Ahsay AhsayCBS Improper Authentication Vulnerability | 2026-10-14 | |
| KEV | CVE-2026-0322 | N/A | Palo Alto Networks / PAN-OS | Palo Alto Networks PAN-OS Code Injection Vulnerability | 2026-10-14 | |
| KEV | CVE-2026-104935 | N/A | Ivanti / Connect Secure | Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability | 2026-10-13 | |
| KEV | CVE-2026-96951 | N/A | Microsoft / Windows | Microsoft Windows Command Injection Vulnerability | 2026-10-13 | |
| KEV | CVE-2015-5477 | N/A | ISC / BIND | ISC BIND Data Processing Errors Vulnerability | 2026-10-08 | |
| KEV | CVE-2016-3081 | N/A | Apache / Struts | Apache Struts Command Injection Vulnerability | 2026-10-08 | |
| KEV | CVE-2023-22894 | N/A | Strapi / Strapi | Strapi Cleartext Storage of Sensitive Information Vulnerability | 2026-10-08 | |
| KEV | CVE-2021-3199 | N/A | ONLYOFFICE / Docs | ONLYOFFICE Docs Server Path Traversal Vulnerability | 2026-10-08 | |
| KEV | CVE-2015-3306 | N/A | ProFTPD / ProFTPD | ProFTPD Improper Access Control Vulnerability | 2026-10-08 | |
| KEV | CVE-2026-88779 | N/A | Citrix / NetScaler | Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability | 2026-10-04 | |
| KEV | CVE-2026-102490 | N/A | Zammad GmbH / Zammad | Zammad GmbH Zammad Improper Privilege Management Vulnerability | 2026-10-02 | |
| KEV | CVE-2026-102489 | N/A | Zammad GmbH / Zammad | Zammad GmbH Zammad Session Fixation Vulnerability | 2026-10-02 | |
| KEV | CVE-2026-104286 | N/A | Fortinet / FortiMail | Fortinet FortiMail Path Traversal Vulnerability | 2026-10-01 | |
| KEV | CVE-2026-76504 | N/A | Cisco / Catalyst SD-WAN Manager | Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability | 2026-09-30 | |
| KEV | CVE-2026-86950 | N/A | Apple / Multiple Products | Apple Multiple Products Out-of-Bounds Write Vulnerability | 2026-09-29 | |
| KEV | CVE-2026-88772 | N/A | Citrix / NetScaler | Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability | 2026-09-27 | |
| KEV | CVE-2026-88771 | N/A | Citrix / NetScaler | Citrix NetScaler Improper Input Validation Vulnerability | 2026-09-27 | |
| KEV | CVE-2026-67279 | N/A | MikroTik / RouterOS | Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability | 2026-09-25 | |
| KEV | CVE-2026-65660 | N/A | Microsoft / SharePoint | Microsoft SharePoint Code Injection Vulnerability | 2026-09-25 | |
| KEV | CVE-2026-87902 | N/A | WordPress / Core | WordPress Core Remote File Inclusion Vulnerability | 2026-09-25 | |
| KEV | CVE-2026-5430 | N/A | WSO2 / Multiple Products | WSO2 Multiple Products Path Traversal Vulnerability | 2026-09-24 | |
| KEV | CVE-2026-71362 | N/A | Adobe / Commerce and Magento | Adobe Commerce and Magento Incorrect Authorization Vulnerability | 2026-09-24 | |
| KEV | CVE-2026-93952 | N/A | Arista / VeloCloud Orchestrator | Arista VeloCloud Orchestrator Improper Input Validation Vulnerability | 2026-09-22 | |
| KEV | CVE-2026-94127 | N/A | F5 / BIG-IP APM | F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability | 2026-09-22 | |
| KEV | CVE-2026-93616 | N/A | Check Point / Multiple Products | Check Point Multiple Products Path Traversal Vulnerability | 2026-09-22 | |
| KEV | CVE-2026-85102 | N/A | Check Point / Multiple Products | Check Point Multiple Products Improper Certificate Validation Vulnerability | 2026-09-22 | |
| KEV | CVE-2026-7273 | N/A | Zyxel / GS1900 Series Switches | Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability | 2026-09-21 | |
| KEV | CVE-2025-39964 | N/A | Linux / Kernel | Linux Kernel Race Condition Vulnerability | 2026-09-18 | |
| KEV | CVE-2026-53266 | N/A | Linux / Kernel | Linux Kernel Out-of-Bounds Write Vulnerability | 2026-09-18 | |
| KEV | CVE-2025-39682 | N/A | Linux / Kernel | Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability | 2026-09-18 | |
| KEV | CVE-2026-58704 | N/A | Google / Pixel | Google Pixel Improper Authorization Vulnerability | 2026-09-16 | |
| KEV | CVE-2026-76460 | N/A | Cisco / Identity Services Engine | Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability | 2026-09-16 | |
| KEV | CVE-2026-87886 | N/A | Acronis / Backup | Acronis Backup Incorrect Default Permissions Vulnerability | 2026-09-16 | |
| KEV | CVE-2026-76461 | N/A | Cisco / Secure Email Gateway | Cisco Secure Email Gateway SQL Injection Vulnerability | 2026-09-14 | |
| KEV | CVE-2026-84869 | N/A | ConnectWise / ScreenConnect | ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability | 2026-09-11 | |
| KEV | CVE-2026-42016 | N/A | JFrog / Artifactory | JFrog Artifactory Incorrect Authorization Vulnerability | 2026-09-11 | |
| KEV | CVE-2026-42018 | N/A | JFrog / Artifactory | JFrog Artifactory Improper Authentication Vulnerability | 2026-09-11 | |
| KEV | CVE-2026-85706 | N/A | GitLab / Community Edition and Enterprise Edition | GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability | 2026-09-11 | |
| KEV | CVE-2026-86060 | N/A | MikroTik / RouterOS | MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability | 2026-09-10 | |
| KEV | CVE-2026-67277 | N/A | MikroTik / RouterOS | MikroTik RouterOS Missing Authentication for Critical Function Vulnerability | 2026-09-10 | |
| KEV | CVE-2026-87491 | N/A | Google / Chromium V8 | Google Chromium V8 Out of Bounds Write Vulnerability | 2026-09-09 | |
| KEV | CVE-2026-20079 | N/A | Cisco / Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability | 2026-09-09 | |
| KEV | CVE-2026-19490 | N/A | Citrix / NetScaler | Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability | 2026-09-09 | |
| KEV | CVE-2025-25249 | N/A | Fortinet / Multiple Products | Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability | 2026-09-09 | |
| KEV | CVE-2026-75650 | N/A | Adobe / Commerce and Magento | Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability | 2026-09-08 | |
| NVD | CVE-2026-103376 | Medium 5.3 | The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)... | Oct 17, 2026 | ||
| NVD | CVE-2026-104122 | Medium 6.8 | The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before... | Oct 17, 2026 | ||
| NVD | CVE-2026-104246 | Medium 5.9 | The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature... | Oct 17, 2026 | ||
| NVD | CVE-2026-106470 | Medium 5.0 | The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks... | Oct 17, 2026 | ||
| NVD | CVE-2026-110527 | Medium 5.3 | The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account... | Oct 17, 2026 | ||
| NVD | CVE-2026-81343 | Medium 5.3 | The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability... | Oct 17, 2026 | ||
| NVD | CVE-2026-81344 | Medium 6.6 | The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP... | Oct 17, 2026 | ||
| NVD | CVE-2026-91074 | Medium 6.8 | The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a... | Oct 17, 2026 | ||
| NVD | CVE-2026-92431 | Low 3.7 | The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of... | Oct 17, 2026 | ||
| NVD | CVE-2026-92432 | Medium 4.3 | The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting,... | Oct 17, 2026 | ||
| NVD | CVE-2026-92433 | Medium 6.5 | The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site... | Oct 17, 2026 | ||
| NVD | CVE-2026-97314 | Medium 6.5 | The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the... | Oct 17, 2026 | ||
| NVD | CVE-2026-110384 | High 7.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Fancy... | Oct 17, 2026 | ||
| NVD | CVE-2026-100316 | High 7.2 | The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site... | Oct 17, 2026 | ||
| NVD | CVE-2026-109983 | Medium 6.4 | The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the... | Oct 17, 2026 | ||
| NVD | CVE-2026-110253 | Medium 5.4 | The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress... | Oct 17, 2026 | ||
| NVD | CVE-2026-111110 | High 7.2 | The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is... | Oct 17, 2026 | ||
| NVD | CVE-2026-110889 | High 7.5 | Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows... | Oct 17, 2026 | ||
| NVD | CVE-2026-109701 | High 7.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PAYCOMET PAYCOMET for... | Oct 17, 2026 | ||
| NVD | CVE-2024-58398 | Medium 4.3 | Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect... | Oct 17, 2026 | ||
| NVD | CVE-2026-103899 | High 7.2 | The EU VAT Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting... | Oct 17, 2026 | ||
| NVD | CVE-2026-104736 | Critical 9.8 | The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to,... | Oct 17, 2026 | ||
| NVD | CVE-2026-107744 | Medium 6.5 | The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress... | Oct 17, 2026 | ||
| NVD | CVE-2026-107752 | Medium 4.9 | The Welcart e-Commerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wp_usces_order_old... | Oct 17, 2026 | ||
| NVD | CVE-2026-108123 | High 7.5 | The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass... | Oct 17, 2026 | ||
| NVD | CVE-2026-109368 | Medium 6.5 | The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Sensitive Information... | Oct 17, 2026 | ||
| NVD | CVE-2026-109369 | Medium 6.8 | The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass... | Oct 17, 2026 | ||
| NVD | CVE-2026-109985 | Medium 6.4 | The xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN plugin for WordPress is... | Oct 17, 2026 | ||
| NVD | CVE-2026-109989 | Medium 6.4 | The Themify Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'popup_width_unit'... | Oct 17, 2026 | ||
| NVD | CVE-2026-110268 | Medium 4.9 | The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in... | Oct 17, 2026 | ||
| NVD | CVE-2026-111726 | Medium 6.4 | The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode... | Oct 17, 2026 | ||
| NVD | CVE-2026-92715 | Medium 4.3 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to... | Oct 17, 2026 | ||
| NVD | CVE-2026-92798 | High 8.1 | The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in... | Oct 17, 2026 | ||
| NVD | CVE-2026-92978 | Medium 4.3 | The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile,... | Oct 17, 2026 | ||
| NVD | CVE-2026-96660 | High 7.2 | The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile,... | Oct 17, 2026 | ||
| NVD | CVE-2026-104734 | High 7.2 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable... | Oct 17, 2026 | ||
| NVD | CVE-2026-107762 | High 7.5 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable... | Oct 17, 2026 | ||
| NVD | CVE-2026-107763 | Medium 4.3 | The Fastcache by Host.it plugin for WordPress is vulnerable to authorization bypass in all versions... | Oct 17, 2026 | ||
| NVD | CVE-2026-109208 | High 7.2 | The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress... | Oct 17, 2026 | ||
| NVD | CVE-2026-110653 | Critical 9.1 | The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress... | Oct 17, 2026 | ||
| NVD | CVE-2026-111601 | Medium 6.1 | The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting... | Oct 17, 2026 | ||
| NVD | CVE-2026-111602 | Low 3.7 | The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress... | Oct 17, 2026 | ||
| NVD | CVE-2026-111823 | Critical 9.8 | Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown... | Oct 17, 2026 | ||
| NVD | CVE-2026-111853 | High 8.8 | An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command... | Oct 17, 2026 | ||
| NVD | CVE-2026-111854 | High 8.1 | An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal... | Oct 17, 2026 | ||
| NVD | CVE-2026-111855 | High 7.5 | An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal... | Oct 17, 2026 | ||
| NVD | CVE-2026-106549 | Unknown | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | Oct 16, 2026 | ||
| NVD | CVE-2026-107346 | Unknown | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | Oct 16, 2026 | ||
| NVD | CVE-2026-110752 | Unknown | Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index... | Oct 16, 2026 | ||
| NVD | CVE-2026-110753 | Unknown | Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when... | Oct 16, 2026 |
This product uses data from the NVD API but is not endorsed or certified by the NVD.
CISA KEV data is a U.S. government work in the public domain. Mobile CVE data sourced from cve.tools.
Use the feed as a triage aid
- Match the affected plugin, theme or core component against your inventory.
- Confirm vulnerable versions, prerequisites and the vendor's remediation guidance.
- Prioritize known-exploited records, then consider severity and exposure.
- Back up, test the fix and verify the deployed version.
This feed is a source sample, not a scan of your site or a complete vulnerability inventory. Older records without enough retained classification evidence may be excluded. Feed timestamps indicate source refreshes, not a guarantee that every advisory has been indexed.
Page prepared for review: .