CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- wedevs wp erpWordPress WP ERP plugin <= 1.17.9 - PHP Object Injection vulnerability7.2 High
- cozmoslabs profile builderWordPress Profile Builder plugin <= 4.0.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- hostinger migratorWordPress Hostinger Migrator plugin <= 1.0 - Broken Access Control vulnerability7.5 High
- chatbot for wordpress - wpbot conversational forms for chatbotWordPress Conversational Forms for ChatBot plugin <= 1.5.0 - PHP Object Injection vulnerability8.8 High
- justin nealey designsetgoWordPress DesignSetGo plugin <= 2.8.0 - PHP Object Injection vulnerability8.8 High
- tijmen smit wp store locatorWordPress WP Store Locator plugin < 3.0.0 - Denial of Service Attack vulnerability5.9 Medium
- mat lipe go live update urlsWordPress Go Live Update Urls plugin <= 7.0.8 - PHP Object Injection vulnerability8.8 High
- nexcess kadence woocommerce email designerWordPress Kadence WooCommerce Email Designer plugin <= 1.5.19.1 - PHP Object Injection vulnerability7.2 High
- alekv pixel manager for woocommerceWordPress Pixel Manager for WooCommerce plugin <= 1.69.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- nsquared simply schedule appointmentsWordPress Simply Schedule Appointments plugin <= 1.6.12.31 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- 10up safe svgWordPress Safe SVG plugin <= 2.5.0 - Insecure Direct Object References (IDOR) vulnerability4.3 Medium
- wpwax formgentWordPress FormGent plugin <= 1.12.2 - Broken Access Control vulnerability7.1 High
- acymailing newsletter team smtp newsletterWordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Remote Code Execution (RCE) vulnerability9.0 Critical
- carazo import and export users and customersWordPress Import and export users and customers plugin <= 2.5.2 - Privilege Escalation vulnerability7.5 High
- ruben garcia gamipressWordPress GamiPress plugin <= 8.0.2 - SQL Injection vulnerability8.5 High
- strategy11 team business directoryWordPress Business Directory plugin <= 6.4.27 - Insecure Direct Object References (IDOR) vulnerability5.4 Medium
- imagely nextgen galleryWordPress NextGEN Gallery plugin <= 4.5.0 - Arbitrary File Download vulnerability7.5 High
- a wp life responsive slider galleryWordPress Responsive Slider Gallery plugin <= 1.5.5 - PHP Object Injection vulnerability7.2 High
- 10web booster – website speed optimization, cache & page speed optimizerWordPress 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin <= 2.33.6 - PHP Object Injection vulnerability8.8 High
- gravitykit gravityexport lite for gravity formsWordPress GravityExport Lite for Gravity Forms plugin <= 2.7.2 - Broken Access Control vulnerability7.5 High
- fatcatapps easy pricing tablesWordPress Easy Pricing Tables plugin <= 4.1.2 - SQL Injection vulnerability8.5 High
- fatcatapps quiz catWordPress Quiz Cat plugin <= 3.1.1 - SQL Injection vulnerability7.6 High
- lukeseager wordpress persistent loginWordPress WordPress Persistent Login plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- gemini labs site reviewsWordPress Site Reviews plugin <= 8.3.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- 10up safe svgWordPress Safe SVG plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- seo squirrly plugin by squirrly seoWordPress SEO Plugin by Squirrly SEO plugin <= 14.2.5 - PHP Object Injection vulnerability8.8 High
- nsquared simply schedule appointmentsWordPress Simply Schedule Appointments plugin <= 1.6.12.29 - Broken Access Control vulnerability6.5 Medium
- wpfactory cost of goods for woocommerceWordPress Cost of Goods for WooCommerce plugin <= 3.5.2 - PHP Object Injection vulnerability7.2 High
- veronalabs wp statisticsWordPress WP Statistics plugin <= 14.16.13 - Cross Site Scripting (XSS) vulnerability7.1 High
- dotstore minimum and maximum quantity for woocommerceWordPress Minimum and Maximum Quantity for WooCommerce plugin <= 2.1.2 - PHP Object Injection vulnerability7.2 High
- codepeople music player for woocommerceWordPress Music Player for WooCommerce plugin <= 1.9.1 - PHP Object Injection vulnerability7.2 High
- passionate programmer peter wp data accessWordPress WP Data Access plugin <= 5.5.84 - SQL Injection vulnerability8.2 High
- rainafarai notification for telegramWordPress Notification for Telegram plugin <= 3.5.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- ilghera jw player for wordpressWordPress JW Player for WordPress plugin <= 2.3.11 - Cross Site Scripting (XSS) vulnerability7.1 High
- melapress wp activity logWordPress WP Activity Log plugin <= 5.6.6 - SQL Injection vulnerability7.6 High
- wpfunnels creator lmsWordPress Creator LMS plugin <= 1.2.19 - Other vulnerability Type vulnerability5.4 Medium
- wp desk flexible pdf couponsWordPress Flexible PDF Coupons plugin <= 1.14.11 - Insecure Direct Object References (IDOR) vulnerability5.4 Medium
- leevio happy addons for elementorWordPress Happy Addons for Elementor plugin <= 3.23.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- qode qi addons for elementorWordPress Qi Addons For Elementor plugin <= 1.11 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- leap13 premium addons for elementorWordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wpfunnelsWordPress WPFunnels plugin <= 3.13.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- brainstorm force astra wordpress themeWordPress Astra WordPress theme theme <= 4.13.12 - Content Injection vulnerability2.7 Low
- apache wss4jApache WSS4J: Unauthenticated denial of service via integer overflow in DER parsing of X.509 certificate extensions7.5 High
- mispMISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image8.3 High
- os4ed opensis-classicOS4ED openSIS-Classic Student Search CustomFieldsFnc.php sql injection5.3 Medium
- apache wss4jApache WSS4J: UsernameToken replay protection bypassed by re-encoding the Nonce4.8 Medium
- yunohost-apps sogo yhnAuthentication Bypass in sogo_yhn9.2 Critical
- yunohost-apps sogo yhnAuthentication Bypass in sogo_yhn9.3 Critical
- apache wss4jApache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform reference7.5 High
quinn-protocrates.ioLong Retry token can panic or exhaust memory in a QUIC clientNo score- Show moreLoading…