Skip to content
OpenAdvisories

Archive

September 2026

Vulnerabilities first published in this month (UTC), newest first.

← August 2026 2026 / September October 2026 →
  1. 1480
  2. 2326
  3. 3349
  4. 4564
  5. 5133
  6. 692
  7. 7254
  8. 81568
  9. 9660
  10. 10387
  11. 11700
  12. 1295
  13. 13133
  14. 14782
  15. 151427
  16. 16873
  17. 171035
  18. 18512
  19. 19104
  20. 20107
  21. 21289
  22. 22457
  23. 23475
  24. 24556
  25. 25683
  26. 26245
  27. 27152
  28. 28316
  29. 29616
  30. 30642
All Critical High Medium Low Exploited only Public exploit

6,264 results · Clear filters · Feed

  • High 7.1
    CVE-2026-96836

    WordPress Parsi Date plugin <= 6.3 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Parsi Date <= 6.3 versions.

    Morteza Geransayeh Parsi Date
  • High 7.2
    CVE-2026-96833

    WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.51 - PHP Object Injection vulnerability

    Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions.

    themefic Ultimate Addons for Contact Form 7
  • High 7.2
    CVE-2026-96832

    WordPress Content Egg plugin <= 6.3.1 - PHP Object Injection vulnerability

    Shop manager PHP Object Injection in Content Egg <= 6.3.1 versions.

    keywordrush Content Egg
  • High 8.8
    CVE-2026-96831

    WordPress Themify Builder plugin <= 7.8.1 - PHP Object Injection vulnerability

    Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions.

    themifyme Themify Builder
  • High 7.1
    CVE-2026-96830

    WordPress GiveWP plugin <= 4.16.9 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions.

    Nexcess GiveWP
  • High 7.6
    CVE-2026-96828

    WordPress Category Discount Woocommerce plugin <= 5.18 - SQL Injection vulnerability

    Administrator SQL Injection in Category Discount Woocommerce <= 5.18 versions.

    Vidish Category Discount Woocommerce Web / CMS
  • High 7.6
    CVE-2026-96827

    WordPress Admin Notices Manager plugin <= 1.6.0 - SQL Injection vulnerability

    Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions.

    melapress Admin Notices Manager
  • High 7.5
    CVE-2026-96823

    WordPress Customer Reviews for WooCommerce plugin <= 5.120.0 - Arbitrary Content Deletion vulnerability

    Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce <= 5.120.0 versions.

    CusRev Customer Reviews for WooCommerce Web / CMS
  • High 7.1
    CVE-2026-96820

    WordPress Awesome Support plugin <= 6.3.9 - Cross Site Scripting (XSS) vulnerability

    Subscriber Cross Site Scripting (XSS) in Awesome Support <= 6.3.9 versions.

    Awesome Support Awesome Support
  • High 7.1
    CVE-2026-96819

    WordPress oik plugin <= 4.15.4 - Cross Site Scripting (XSS) vulnerability

    Subscriber Cross Site Scripting (XSS) in oik <= 4.15.4 versions.

    bobbingwide oik
  • High 7.5
    CVE-2026-96818

    WordPress WP Express Checkout (Accept PayPal Payments) plugin <= 2.4.9 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in WP Express Checkout (Accept PayPal Payments) <= 2.4.9 versions.

    mra13 / Team Tips and Tricks HQ WP Express Checkout (Accept PayPal Payments)
  • High 8.2
    CVE-2026-96817

    WordPress MakeCommerce for WooCommerce plugin <= 4.1.0 - Broken Access Control vulnerability

    Subscriber Broken Access Control in MakeCommerce for WooCommerce <= 4.1.0 versions.

    MakeCommerce.net MakeCommerce for WooCommerce Web / CMS
  • High 7.1
    CVE-2026-96816

    WordPress Trusted Shops Easy Integration for WooCommerce plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Trusted Shops Easy Integration for WooCommerce <= 2.0.6 versions.

    vendidero Trusted Shops Easy Integration for WooCommerce Web / CMS
  • High 7.2
    CVE-2026-96815

    WordPress Vitepos plugin <= 3.5.0 - Privilege Escalation vulnerability

    Custom role Privilege Escalation in Vitepos <= 3.5.0 versions.

    Appsbd Vitepos
  • High 7.1
    CVE-2026-96814

    WordPress WooCommerce Product Table Lite plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 5.6.7 versions.

    WP Titan Labs WooCommerce Product Table Lite Web / CMS
  • High 7.1
    CVE-2026-96352

    WordPress YITH WooCommerce Ajax Search plugin <= 2.28.0 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in YITH WooCommerce Ajax Search <= 2.28.0 versions.

    YITHEMES YITH WooCommerce Ajax Search Web / CMS
  • High 7.1
    CVE-2026-96351

    WordPress Classified Listing plugin <= 6.1.3 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 6.1.3 versions.

    RadiusTheme Classified Listing
  • High 7.5
    CVE-2026-96348

    WordPress Bookly plugin <= 28.2 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Bookly <= 28.2 versions.

    Bookly Bookly
  • High 7.6
    CVE-2026-96346

    WordPress WP ERP plugin <= 1.17.9 - SQL Injection vulnerability

    Author SQL Injection in WP ERP <= 1.17.9 versions.

    wedevs WP ERP
  • High 7.6
    CVE-2026-96345

    WordPress Estatik plugin <= 4.3.5 - SQL Injection vulnerability

    Administrator SQL Injection in Estatik <= 4.3.5 versions.

    Estatik Estatik
  • High 7.2
    CVE-2026-96344

    WordPress eCommerce Product Catalog plugin <= 3.6.0 - PHP Object Injection vulnerability

    Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.

    impleCode eCommerce Product Catalog
  • High 7.2
    CVE-2026-96343

    WordPress WP ERP plugin <= 1.17.9 - PHP Object Injection vulnerability

    Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.

    wedevs WP ERP
  • High 7.5
    CVE-2026-95587

    WordPress Hostinger Migrator plugin <= 1.0 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions.

    hostinger Hostinger Migrator
  • High 8.8
    CVE-2026-95531

    WordPress Conversational Forms for ChatBot plugin <= 1.5.0 - PHP Object Injection vulnerability

    Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions.

    Quantum Cloud Conversational Forms for ChatBot
  • High 8.8
    CVE-2026-94683

    WordPress DesignSetGo plugin <= 2.8.0 - PHP Object Injection vulnerability

    Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions.

    Justin Nealey DesignSetGo
  • High 7.2
    CVE-2026-94677

    WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19.1 - PHP Object Injection vulnerability

    Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.

    Nexcess Kadence WooCommerce Email Designer Web / CMS
  • High 8.8
    CVE-2026-94678

    WordPress Go Live Update Urls plugin <= 7.0.8 - PHP Object Injection vulnerability

    Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions.

    Mat Lipe Go Live Update Urls
  • High 7.1
    CVE-2026-94499

    WordPress FormGent plugin <= 1.12.2 - Broken Access Control vulnerability

    Subscriber Broken Access Control in FormGent <= 1.12.2 versions.

    wpWax FormGent
  • High 7.5
    CVE-2026-94178

    WordPress Import and export users and customers plugin <= 2.5.2 - Privilege Escalation vulnerability

    Subscriber Privilege Escalation in Import and export users and customers <= 2.5.2 versions.

    Javier Carazo Import and export users and customers
  • High 8.5
    CVE-2026-94177

    WordPress GamiPress plugin <= 8.0.2 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue affects GamiPress: from n/a through 8.0.2.

    Ruben Garcia GamiPress
  • High 7.5
    CVE-2026-94123

    WordPress NextGEN Gallery plugin <= 4.5.0 - Arbitrary File Download vulnerability

    Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.

    Syed Balkhi NextGEN Gallery
  • High 7.2
    CVE-2026-94122

    WordPress Responsive Slider Gallery plugin <= 1.5.5 - PHP Object Injection vulnerability

    Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions.

    A WP Life Responsive Slider Gallery
  • High 8.8
    CVE-2026-94121

    WordPress 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin <= 2.33.6 - PHP Object Injection vulnerability

    Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions.

    10web 10Web Booster – Website speed optimization, Cache & Page Speed optimizer
  • High 8.5
    CVE-2026-94115

    WordPress Easy Pricing Tables plugin <= 4.1.2 - SQL Injection vulnerability

    Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions.

    Fatcat Apps Easy Pricing Tables
  • High 7.5
    CVE-2026-94120

    WordPress GravityExport Lite for Gravity Forms plugin <= 2.7.2 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <= 2.7.2 versions.

    GravityKit GravityExport Lite for Gravity Forms
  • High 7.6
    CVE-2026-94082

    WordPress Quiz Cat plugin <= 3.1.1 - SQL Injection vulnerability

    Author SQL Injection in Quiz Cat <= 3.1.1 versions.

    Fatcat Apps Quiz Cat
  • High 7.1
    CVE-2026-94081

    WordPress WordPress Persistent Login plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in WordPress Persistent Login <= 3.1.3 versions.

    lukeseager WordPress Persistent Login Web / CMS
  • High 7.1
    CVE-2026-94078

    WordPress Site Reviews plugin <= 8.3.1 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.3.1 versions.

    Gemini Labs Site Reviews
  • High 8.8
    CVE-2026-94076

    WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.5 - PHP Object Injection vulnerability

    Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions.

    SEO Squirrly SEO Plugin by Squirrly SEO
  • High 7.2
    CVE-2026-93771

    WordPress Cost of Goods for WooCommerce plugin <= 3.5.2 - PHP Object Injection vulnerability

    Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions.

    WPFactory Cost of Goods for WooCommerce Web / CMS