Skip to content
OpenAdvisories

Archive

September 2026

Vulnerabilities first published in this month (UTC), newest first.

← August 2026 2026 / September October 2026 →
  1. 1480
  2. 2326
  3. 3349
  4. 4564
  5. 5133
  6. 692
  7. 7254
  8. 81568
  9. 9660
  10. 10387
  11. 11700
  12. 1295
  13. 13133
  14. 14782
  15. 151427
  16. 16873
  17. 171035
  18. 18512
  19. 19104
  20. 20107
  21. 21289
  22. 22457
  23. 23475
  24. 24556
  25. 25683
  26. 26245
  27. 27152
  28. 28316
  29. 29616
  30. 30642
All Critical High Medium Low Exploited only Public exploit

15,012 results · Feed

  • High 7.1
    CVE-2026-96830

    WordPress GiveWP plugin <= 4.16.9 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions.

    Nexcess GiveWP
  • Medium 6.5
    CVE-2026-96829

    WordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.5.1 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in The Plus Addons for Elementor Page Builder Lite <= 6.5.1 versions.

    POSIMYTH The Plus Addons for Elementor Page Builder Lite
  • High 7.6
    CVE-2026-96828

    WordPress Category Discount Woocommerce plugin <= 5.18 - SQL Injection vulnerability

    Administrator SQL Injection in Category Discount Woocommerce <= 5.18 versions.

    Vidish Category Discount Woocommerce Web / CMS
  • Medium 4.2
    CVE-2026-96825

    WordPress All In One WP Security & Firewall plugin <= 5.4.8 - Bypass Vulnerability vulnerability

    Subscriber Bypass Vulnerability in All In One WP Security & Firewall <= 5.4.8 versions.

    David Anderson / Team Updraft All In One WP Security & Firewall
  • High 7.6
    CVE-2026-96827

    WordPress Admin Notices Manager plugin <= 1.6.0 - SQL Injection vulnerability

    Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions.

    melapress Admin Notices Manager
  • Medium 6.8
    CVE-2026-96824

    WordPress Template Kit – Import plugin <= 1.0.16 - Arbitrary File Deletion vulnerability

    Editor Arbitrary File Deletion in Template Kit – Import <= 1.0.16 versions.

    envato Template Kit – Import
  • High 7.5
    CVE-2026-96823

    WordPress Customer Reviews for WooCommerce plugin <= 5.120.0 - Arbitrary Content Deletion vulnerability

    Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce <= 5.120.0 versions.

    CusRev Customer Reviews for WooCommerce Web / CMS
  • Critical 9.3
    CVE-2026-96822

    WordPress Books Gallery plugin <= 4.8.3 - SQL Injection vulnerability

    Unauthenticated SQL Injection in Books Gallery <= 4.8.3 versions.

    Hossni Mubarak Books Gallery
  • Medium 6.3
    CVE-2026-96821

    WordPress FluentBoards plugin <= 2.0.12 - Privilege Escalation vulnerability

    Subscriber Privilege Escalation in FluentBoards <= 2.0.12 versions.

    Mahmudul Hasan Arif FluentBoards
  • High 7.1
    CVE-2026-96820

    WordPress Awesome Support plugin <= 6.3.9 - Cross Site Scripting (XSS) vulnerability

    Subscriber Cross Site Scripting (XSS) in Awesome Support <= 6.3.9 versions.

    Awesome Support Awesome Support
  • High 7.1
    CVE-2026-96819

    WordPress oik plugin <= 4.15.4 - Cross Site Scripting (XSS) vulnerability

    Subscriber Cross Site Scripting (XSS) in oik <= 4.15.4 versions.

    bobbingwide oik
  • High 7.5
    CVE-2026-96818

    WordPress WP Express Checkout (Accept PayPal Payments) plugin <= 2.4.9 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in WP Express Checkout (Accept PayPal Payments) <= 2.4.9 versions.

    mra13 / Team Tips and Tricks HQ WP Express Checkout (Accept PayPal Payments)
  • High 8.2
    CVE-2026-96817

    WordPress MakeCommerce for WooCommerce plugin <= 4.1.0 - Broken Access Control vulnerability

    Subscriber Broken Access Control in MakeCommerce for WooCommerce <= 4.1.0 versions.

    MakeCommerce.net MakeCommerce for WooCommerce Web / CMS
  • High 7.1
    CVE-2026-96816

    WordPress Trusted Shops Easy Integration for WooCommerce plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Trusted Shops Easy Integration for WooCommerce <= 2.0.6 versions.

    vendidero Trusted Shops Easy Integration for WooCommerce Web / CMS
  • High 7.2
    CVE-2026-96815

    WordPress Vitepos plugin <= 3.5.0 - Privilege Escalation vulnerability

    Custom role Privilege Escalation in Vitepos <= 3.5.0 versions.

    Appsbd Vitepos
  • High 7.1
    CVE-2026-96814

    WordPress WooCommerce Product Table Lite plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 5.6.7 versions.

    WP Titan Labs WooCommerce Product Table Lite Web / CMS
  • Medium 5.4
    CVE-2026-96450

    WordPress pixfort Core plugin < 4.3.3 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in pixfort Core < 4.3.3 versions.

    pixfort pixfort Core
  • High 7.1
    CVE-2026-96352

    WordPress YITH WooCommerce Ajax Search plugin <= 2.28.0 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in YITH WooCommerce Ajax Search <= 2.28.0 versions.

    YITHEMES YITH WooCommerce Ajax Search Web / CMS
  • High 7.1
    CVE-2026-96351

    WordPress Classified Listing plugin <= 6.1.3 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 6.1.3 versions.

    RadiusTheme Classified Listing
  • Critical 9.8
    CVE-2026-96350

    WordPress Estatik plugin <= 4.3.5 - Privilege Escalation vulnerability

    Subscriber Privilege Escalation in Estatik <= 4.3.5 versions.

    Estatik Estatik
  • Critical 10.0
    CVE-2026-96349 Public exploit

    WordPress SiteSkite plugin <= 2.1.8 - Remote Code Execution (RCE) vulnerability

    Unauthenticated Remote Code Execution (RCE) in SiteSkite <= 2.1.8 versions.

    SiteSkite SiteSkite
  • High 7.5
    CVE-2026-96348

    WordPress Bookly plugin <= 28.2 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Bookly <= 28.2 versions.

    Bookly Bookly
  • Medium 6.5
    CVE-2026-96347

    WordPress Bookly plugin <= 28.2 - Insecure Direct Object References (IDOR) vulnerability

    Subscriber Insecure Direct Object References (IDOR) in Bookly <= 28.2 versions.

    Bookly Bookly
  • High 7.6
    CVE-2026-96346

    WordPress WP ERP plugin <= 1.17.9 - SQL Injection vulnerability

    Author SQL Injection in WP ERP <= 1.17.9 versions.

    wedevs WP ERP
  • High 7.6
    CVE-2026-96345

    WordPress Estatik plugin <= 4.3.5 - SQL Injection vulnerability

    Administrator SQL Injection in Estatik <= 4.3.5 versions.

    Estatik Estatik
  • High 7.2
    CVE-2026-96344

    WordPress eCommerce Product Catalog plugin <= 3.6.0 - PHP Object Injection vulnerability

    Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.

    impleCode eCommerce Product Catalog
  • High 7.2
    CVE-2026-96343

    WordPress WP ERP plugin <= 1.17.9 - PHP Object Injection vulnerability

    Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.

    wedevs WP ERP
  • High 7.5
    CVE-2026-95587

    WordPress Hostinger Migrator plugin <= 1.0 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions.

    hostinger Hostinger Migrator
  • Medium 6.5
    CVE-2026-96338

    WordPress Profile Builder plugin <= 4.0.2 - Cross Site Scripting (XSS) vulnerability

    Subscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.2 versions.

    Cozmoslabs Profile Builder
  • High 8.8
    CVE-2026-95531

    WordPress Conversational Forms for ChatBot plugin <= 1.5.0 - PHP Object Injection vulnerability

    Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions.

    Quantum Cloud Conversational Forms for ChatBot
  • High 8.8
    CVE-2026-94683

    WordPress DesignSetGo plugin <= 2.8.0 - PHP Object Injection vulnerability

    Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions.

    Justin Nealey DesignSetGo
  • Medium 5.9
    CVE-2026-94681

    WordPress WP Store Locator plugin < 3.0.0 - Denial of Service Attack vulnerability

    Unauthenticated Denial of Service Attack in WP Store Locator < 3.0.0 versions.

    Tijmen Smit WP Store Locator
  • High 7.2
    CVE-2026-94677

    WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19.1 - PHP Object Injection vulnerability

    Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.

    Nexcess Kadence WooCommerce Email Designer Web / CMS
  • High 8.8
    CVE-2026-94678

    WordPress Go Live Update Urls plugin <= 7.0.8 - PHP Object Injection vulnerability

    Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions.

    Mat Lipe Go Live Update Urls
  • Medium 6.5
    CVE-2026-94674

    WordPress Pixel Manager for WooCommerce plugin <= 1.69.0 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Pixel Manager for WooCommerce <= 1.69.0 versions.

    SweetCode Pixel Manager for WooCommerce Web / CMS
  • Medium 5.3
    CVE-2026-94673

    WordPress Simply Schedule Appointments plugin <= 1.6.12.31 - Insecure Direct Object References (IDOR) vulnerability

    Unauthenticated Insecure Direct Object References (IDOR) in Simply Schedule Appointments <= 1.6.12.31 versions.

    N Squared Simply Schedule Appointments
  • Medium 4.3
    CVE-2026-94672

    WordPress Safe SVG plugin <= 2.5.0 - Insecure Direct Object References (IDOR) vulnerability

    Contributor Insecure Direct Object References (IDOR) in Safe SVG <= 2.5.0 versions.

    10up Safe SVG
  • High 7.1
    CVE-2026-94499

    WordPress FormGent plugin <= 1.12.2 - Broken Access Control vulnerability

    Subscriber Broken Access Control in FormGent <= 1.12.2 versions.

    wpWax FormGent
  • High 7.5
    CVE-2026-94178

    WordPress Import and export users and customers plugin <= 2.5.2 - Privilege Escalation vulnerability

    Subscriber Privilege Escalation in Import and export users and customers <= 2.5.2 versions.

    Javier Carazo Import and export users and customers
  • Critical 9.0
    CVE-2026-94389

    WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Remote Code Execution (RCE) vulnerability

    Unauthenticated Remote Code Execution (RCE) in AcyMailing SMTP Newsletter <= 11.0.5 versions.

    AcyMailing Newsletter Team AcyMailing SMTP Newsletter