CVEs published in October 2026
17,265 vulnerabilities, 1,627 critical, 21 exploited.
- rextheme product feed managerWordPress Product Feed Manager plugin <= 7.14.1 - PHP Object Injection vulnerability7.2 High
- hakan ozevin wp base bookingWordPress WP BASE Booking plugin <= 6.5.2 - Privilege Escalation vulnerability8.8 High
- acato wp rest cacheWordPress WP REST Cache plugin <= 2026.3.1 - Broken Access Control vulnerability7.5 High
- wpdesk flexible chatWordPress Flexible Chat plugin <= 1.1.0 - Sensitive Data Exposure vulnerability7.5 High
- aguila technologies wp customer areaWordPress WP Customer Area plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- nexcess givewpWordPress GiveWP plugin <= 4.19.0.1 - Broken Access Control vulnerability6.5 Medium
- marketing fire widget optionsWordPress Widget Options plugin <= 4.2.5 - Remote Code Execution (RCE) vulnerability9.1 Critical
- implecode ecommerce product catalogWordPress eCommerce Product Catalog plugin <= 3.6.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- kitae park mang board wpWordPress Mang Board WP plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability7.1 High
- masteriyo - lmsWordPress Masteriyo - LMS plugin <= 3.4.3 - Arbitrary Content Deletion vulnerability6.5 Medium
- e4j s.r.l. vikrentcarWordPress VikRentCar plugin <= 1.4.9 - Cross Site Scripting (XSS) vulnerability7.1 High
- realmag777 huskyWordPress HUSKY plugin <= 1.4.6 - Broken Access Control vulnerability7.5 High
- cozy vision sms alert order notificationsWordPress SMS Alert Order Notifications plugin <= 4.0.2 - Privilege Escalation vulnerability9.8 Critical
- realmag777 huskyWordPress HUSKY plugin <= 1.4.6 - Sensitive Data Exposure vulnerability6.5 Medium
- brainstorm force suredashWordPress SureDash plugin <= 1.12.3 - Arbitrary File Deletion vulnerability5.0 Medium
- multivendorxWordPress MultiVendorX plugin <= 5.0.20 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- yith woocommerce product add-ons, yithemes yith woocommerce product add-ons +1 moreWordPress YITH WooCommerce Product Add-Ons plugin <= 4.34.0 - Bypass Vulnerability vulnerability5.3 Medium
- ad inserter inserter, spacetime ad inserter +1 moreWordPress Ad Inserter plugin <= 2.8.19 - Cross Site Scripting (XSS) vulnerability7.1 High
- saad iqbal all in one loginWordPress All In One Login plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- leadsnapWordPress LeadSnap plugin <= 1.25 - PHP Object Injection vulnerability9.8 Critical
- gs plugins testimonial sliderWordPress GS Testimonial Slider plugin <= 3.3.10 - PHP Object Injection vulnerability8.8 High
- shortpixel enable media replaceWordPress Enable Media Replace plugin <= 4.2.2 - PHP Object Injection vulnerability8.8 High
- cozmoslabs profile builderWordPress Profile Builder plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- cozmoslabs profile builderWordPress Profile Builder plugin <= 4.0.5 - Privilege Escalation vulnerability6.3 Medium
- magepeopleteam booking and rental managerWordPress Booking and Rental Manager plugin <= 2.8.2 - Broken Access Control vulnerability6.5 Medium
- alignak fast velocity minifyWordPress Fast Velocity Minify plugin <= 3.5.7 - Cross Site Scripting (XSS) vulnerability7.1 High
- bookingalgorithms ba book everythingWordPress BA Book Everything plugin <= 1.8.33 - Cross Site Scripting (XSS) vulnerability7.1 High
- aman funnelkit automationsWordPress FunnelKit Automations plugin <= 3.8.6.1 - PHP Object Injection vulnerability9.8 Critical
- saad iqbal wp easypayWordPress WP EasyPay plugin <= 4.5.4 - Path Traversal vulnerability7.5 High
- intinitum form transliteratorWordPress Transliterator plugin <= 2.5.13 - SQL Injection vulnerability9.3 Critical
- e4j s.r.l. vikrentcarWordPress VikRentCar plugin <= 1.4.10 - Cross Site Scripting (XSS) vulnerability7.1 High
- wpeverest user registrationWordPress User Registration plugin <= 5.3.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- themerex royal eventWordPress Royal Event theme <= 2.0 - PHP Object Injection vulnerability9.8 Critical
- cardano-scaling hydraHydra: Deposit Claim omits Head state-token spending requirement8.2 High
- jackh54 voicesentinelVoiceSentinel: Race condition in report buffer cleanup can corrupt transcript data and cause unbounded disk growth8.2 High
- duck-organization questbotQuest Bot: Server Side Request Forgery in the Image to GIF Feature Lets Any Server Member Reach Internal Services2.3 Low
- wp email newsletter team - fluentcrm fluent crmWordPress Fluent CRM plugin <= 3.2.6 - Broken Access Control vulnerability5.3 Medium
- unitecms unlimited elements for elementor (free widgets, addons, templates), unlimited elements for elementor (free widgets, addons, templates) +1 moreWordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Broken Access Control vulnerability4.3 Medium
- liquid web / stellarwp bookitWordPress BookIt plugin <= 2.6.0.6 - Broken Access Control vulnerability4.3 Medium
- arraytics bookticsWordPress Booktics plugin <= 1.0.31 - Broken Access Control vulnerability4.3 Medium
- liquid web / stellarwp event ticketsWordPress Event Tickets plugin <= 5.30.2 - Broken Access Control vulnerability4.3 Medium
- brainstorm force ultimate addons for elementor - liteWordPress Ultimate Addons for Elementor - Lite plugin <= 2.9.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- apache software foundation pinotApache Pinot: Incorrect authorization in the single-stage query engine allows reading unauthorized dimension tables via lookup()6.5 Medium
- ithemelandco giftit – free gifts for woocommerceWordPress GIFTiT – Free Gifts for WooCommerce plugin <= 4.5 - Content Injection vulnerability5.3 Medium
- fahim reza divi contact form 7WordPress Divi Contact Form 7 plugin <= 4.1.0 - Content Injection vulnerability5.3 Medium
- unitecms unlimited elements for elementor (free widgets, addons, templates), unlimited elements for elementor (free widgets, addons, templates) +1 moreWordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Local File Inclusion vulnerability6.5 Medium
- arraytics bookticsWordPress Booktics plugin <= 1.0.31 - Broken Access Control vulnerability5.3 Medium
- aws amazon-kinesis-producerInsertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Java8.2 High
- red hat enterprise linux 10, enterprise linux 10.2 extended update support, enterprise linux 7 +2 more +4 moreGstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: stack buffer overflow in h.266/vvc parser8.8 High
- element labs lm studioLM Studio before 0.4.22+1 Path Traversal via Model Downloader8.7 High
- Show moreLoading…