CVEs published September 19, 2026
103 CVEs were published on September 19, 2026: 8 critical, 23 high.
- Published
- 103
- Critical
- 8
- High
- 23
- Medium
- 65
- Low
- 7
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 37
Most affected products
- Exim
- 4
- Openpanel-dev openpanel
- 4
- Hydra Booking — Appointment Scheduling & Booking Calendar
- 3
- Red Hat Build of Keycloak · Red Hat Single Sign-On
- 3
- themeum Tutor LMS – eLearning and online course solution
- 3
- davidanderson Redux Framework
- 2
- grimmory-tools grimmory
- 2
- mischiefmarmot Create
- 2
- rclone
- 2
- shahrukhlinkgraph Search Atlas SEO – OTTO AI SEO Automation…
- 2
Critical 8
- CVE-2026-93985OpenPanel js-runtime through 2.3.0 JavaScript Template Sandbox Escape RCEOpenpanel-dev openpanel
- CVE-2026-78030DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBMDBI
- CVE-2026-93742Totolink A3002MU formWsc command injectionTotolink A3002MU
- CVE-2026-86591Botiga Pro < 1.6.5 - Unauthenticated Arbitrary Blog Options Update via Templates Builder REST RouteBotiga Pro
- CVE-2026-93741Totolink A3002MU formWlWds buffer overflowTotolink A3002MU
- CVE-2026-89274WP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Contentbrechtvds WP Recipe Maker
- CVE-2026-92229Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameterwpmudev Forminator Forms – Contact Form, Payment Form & Cus…
- CVE-2026-84434Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload FieldGravity Forms
High 23
- CVE-2026-93993Mistral Vibe before 2.25.5 Remote Code Execution via git post-checkoutmistralai mistral-vibe
- CVE-2026-93992Gopeed through 2.0.0-beta.3 Arbitrary File Write via Path TraversalGopeedLab gopeed
- CVE-2026-93991Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selectorargoproj argo-workflows
- CVE-2026-93990Expat before 2.8.5 Malformed UTF-16 Acceptance via Unchecked Surrogatelibexpat
- CVE-2026-93988QloApps through 1.7.0 Arbitrary File Read via getEmailHTMLwebkul qloapps
- CVE-2026-94056Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data fromExim
- CVE-2026-94054Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.Exim
- CVE-2026-82560Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output widthpodlators · perl
- CVE-2026-1255YS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 - Unauthenticated Information Disclosure in 'ysleadgen_get_captured_data' AJAX Actionysinnovations YS LeadGen – Popup Builder, Popup Maker & For…
- CVE-2026-85658Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Field (Entity-Encoded Shortcode Bracket)properfraction Paid Membership Plugin, Ecommerce, User Regi…
- CVE-2026-4327The Welcomizer <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'twiz_custom_logic' Parametersebwordpress The Welcomizer
- CVE-2026-15664Quill Forms | Conversational Multi Step Forms, Surveys & quizzes <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting via Multiple Choice 'Other' Valuemdmag Quill Forms | Conversational Multi Step Forms, Survey…
- CVE-2026-92404MgoSync 2.1.5 - 2.1.6 - Unauthenticated WooCommerce API Credential DisclosureMgoSync
- CVE-2026-88926VikRentItems Flexible Rental Management System < 1.2.4 - Unauthenticated SQLiVikRentItems Flexible Rental Management System
- CVE-2026-88824Master Blocks 1.4.1 - 1.4.1.4 - Unauthenticated Stored XSS via White Label SettingsMaster Blocks
- CVE-2026-86814UsersWP - Social Login < 1.5.10 - Unauthenticated Account Takeover via Unverified Provider EmailUsersWP
- CVE-2026-85680Ultimate Member < 2.13.1 - Unauthenticated Stored XSS via Profile Page TitleUltimate Member
- CVE-2026-85574Unbounce Landing Pages 1.1.1 - 1.1.4 - Subscriber+ Reverse-Proxy Target Hijack via set_unbounce_domainsUnbounce Landing Pages
- CVE-2026-76790Estatik < 4.3.5 - Reflected XSS via get_listings hash ParameterEstatik Real Estate Plugin
- CVE-2026-76554WP Import Export Lite < 3.9.35 - Authenticated Privilege Escalation via User ImportWP Import Export Lite
- CVE-2026-92807Save as PDF Plugin by PDFCrowd <= 4.6.1 - Authenticated (Contributor+) Arbitrary Function Invocation / Code Injection via 'pdf_created_callback' Shortcode AttributeSave as PDF Plugin by PDFCrowd
- CVE-2026-87909WP Photo Album Plus <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injectionopajaap WP Photo Album Plus
- CVE-2026-13354Asset CleanUp: Page Speed Booster <= 1.4.0.5 - Unauthenticated Stored Cross-Site Scripting via Comment Contentgabelivan Asset CleanUp: Page Speed Booster
Medium, low and unrated 72
- CVE-2026-93956olivier-ls PHP-FTS Search SearchEngine.php buildHighlights cross site scriptingolivier-ls PHP-FTS
- CVE-2026-93989vLLM through 0.29.0 Cross-Request Logits Corruption via bad_wordsvllm-project vllm · vllm
- CVE-2026-94057Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted dataExim
- CVE-2026-94055Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free.Exim
- CVE-2026-93955grimmory-tools grimmory Download Endpoint KoboController.java streamFileToResponse authorizationgrimmory-tools grimmory
- CVE-2026-93954grimmory-tools grimmory Settings API Endpoint AppSettingController.java AppSettingController.getAppSettings authorizationgrimmory-tools grimmory
- CVE-2026-82672Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connectionselixir-mint mint
- CVE-2026-94001Keycloak-services: keycloak-services: admin credential delete bypasses denied reset-password permissionRed Hat Build of Keycloak · Red Hat Single Sign-On
- CVE-2026-94000Keycloak-services: keycloak-services: delegated admin with manage-users can escalate to realm-admin via group membershipRed Hat Build of Keycloak · Red Hat Single Sign-On
- CVE-2026-93999Keycloak-services: keycloak-services: token refresh continues issuing tokens for disabled audience clientsRed Hat Build of Keycloak · Red Hat Single Sign-On
- CVE-2026-93987rclone serve docker Path Traversal via Volume Namerclone
- CVE-2026-93986rclone before 1.75.1 Path Traversal via Directory Listing Namesrclone
- CVE-2026-93984OpenPanel API through 2.3.0 Authentication Bypass via Unverified Client SecretOpenpanel-dev openpanel
- CVE-2026-93983OpenPanel through 2.3.0 SQL Injection via ClickHouse Property Key FilterOpenpanel-dev openpanel
- CVE-2026-93982OpenPanel through 2.3.0 MCP Authentication Token in Query Parameter Logged PlaintextOpenpanel-dev openpanel
- CVE-2026-93981hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Stringshonojs hono · hono
- CVE-2026-9858Partial Shipment for Woocommerce <= 3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Modification via wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX Actionswpexpertshub Partial Shipment for WooCommerce
- CVE-2026-9613Datalogics Ecommerce Delivery <= 2.6.65 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actions (datalogics_create_shipping / datalogics_cancel_shipping)Datalogics Ecommerce Delivery – Datalogics
- CVE-2026-76579LiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via ESI 'esi' Parameterlitespeedtech LiteSpeed Cache
- CVE-2026-1256YS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via User Inputysinnovations YS LeadGen – Popup Builder, Popup Maker & For…
- CVE-2026-9766Empik for Woocommerce <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Product Meta Update via empik_csv_process_emp_log_classes AJAX ActionEmpik for Woocommerce
- CVE-2026-9289WordLift <= 3.54.10 - Unauthenticated Sensitive Information Exposure in JSON-LD REST API EndpointsWordLift – AI powered SEO – Schema
- CVE-2026-18346TikTok <= 1.4.1 - Missing Authorization to Unauthenticated TikTok Integration Takeover via 'auth_code' Parametertiktokbusinessplugin TikTok
- CVE-2026-8354Gum Addon for Elementor <= 1.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pop_tag' Widget Settingcelomitan Gum Addon for Elementor
- CVE-2026-5410Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Spinner Field Inputdavidanderson Redux Framework
- CVE-2026-15098Real 3D Flipbook <= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightboxtext' Shortcode Attributecreativeinteractivemedia Real3D Flipbook – 3D FlipBook, PDF…
- CVE-2026-87917MC4WP: Mailchimp for WordPress <= 4.14.0 - Reflected Cross-Site Scripting via 'data' Dynamic Content Tagdvankooten MC4WP: Mailchimp for WordPress
- CVE-2026-1984Ibtana – Ecommerce Product Addons <= 0.4.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'iepa_use_gt_editor' AJAX Actionvowelweb Ibtana – Ecommerce Product Addons
- CVE-2026-9855Custom Field Template <= 2.7.8 - Authenticated (Contributor+) SQL Injection via 'post_ID' Parameterhiroaki-miyashita Custom Field Template
- CVE-2026-5400Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Cross-Site Scripting via User Inputdavidanderson Redux Framework
- CVE-2026-7527WP Ghost (Hide My WP Ghost) <= 7.0.02 - Unauthenticated Open Redirect via 'redirect_to' Parameterjohndarrel Hide My WP Ghost – Security & Firewall
- CVE-2026-12402OTP Login & Register Woocommerce <= 2.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'fb-config' Settingxootix OTP Login & Register Woocommerce
- CVE-2026-75959GoPay for WooCommerce <= 1.0.36 - Authenticated (Shop Manager+) SQL Injection via 'log_table_filter' Parametergopayplugins GoPay for WooCommerce
- CVE-2026-13200Create <= 2.5.3 - Authenticated (Author+) SQL Injection via 'order' Parametermischiefmarmot Create
- CVE-2026-1641Wow Elements Addons for Elementor <= 1.11.2 - Authenticated (Contributor+) Server-Side Request Forgery via Changelog File Settingwowelements Wow Elements Addons for Elementor
- CVE-2026-2422WP Composer <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pbwp_raw_shortcode' Shortcodeghozylab WP Composer – The Easiest Page Builder
- CVE-2026-9232Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX Actioneasyappointments Easy Appointments
- CVE-2026-15463SSL Zen <= 4.7.42 - Reflected Cross-Site Scripting via 'uri' and 'host' Parameterssslzen SSL Zen — SSL Certificate Installer & HTTPS Redirects
- CVE-2026-15946Search Atlas SEO <= 2.6.23 - Missing Authorization to Authenticated (Subscriber+) Whitelabel Password Modification via handle_whitelabel_password_early Functionshahrukhlinkgraph Search Atlas SEO – OTTO AI SEO Automation…
- CVE-2026-6295WP Optimizer <= 2.5.0 - Authenticated (Administrator+) SQL Injection via 's' Parametersh1zen WP Optimizer – PageSpeed, Cache, Minify & Core Web V…
- CVE-2026-13191Create <= 2.5.3 - Authenticated (Author+) SQL Injection via 'order_by' Parametermischiefmarmot Create
- CVE-2026-13770AppMySite <= 3.15.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via save_ams_license_key AJAX HandlerAppMySite – WordPress & WooCommerce Mobile App Builder
- CVE-2026-1242BlockSpare - Gutenberg Site Builder Blocks & Starter Sites <= 4.2.6 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post CreationBlockSpare – Gutenberg Blocks for News, Magazine, Blog & Bu…
- CVE-2026-9832Payment Gateway of Stripe for WooCommerce <= 5.0.8 - Unauthenticated Improper Verification of Cryptographic Signature via woocommerce_api_wt_stripe Webhook Endpointthemehigh Payment Gateway of Stripe for WooCommerce
- CVE-2026-2278VW Writer Blog <= 1.3.8 - Missing Authorization to Authenticated (Subscriber+) Theme Settings Resetvowelweb VW Writer Blog
- CVE-2026-4792Bread <= 2.9.12 - Missing Authorization to Unauthenticated Information Exposureradius314 Bread
- CVE-2026-15947Search Atlas SEO <= 2.6.23 - Missing Authorization to Authenticated (Subscriber+) Site-Wide Option Modification via 'metasync_post_types' Parametershahrukhlinkgraph Search Atlas SEO – OTTO AI SEO Automation…
- CVE-2026-11899PDF Builder for WooCommerce. Create invoices,packing slips and more <= 2.0.11 - Missing Authorization to Authenticated (Subscriber+) Sensitive Invoice Data Disclosure via GetInvoiceDetail AJAX Handleredgarrojas PDF Builder for WooCommerce. Create invoices,pac…
- CVE-2026-11608WP Customer Reviews <= 3.7.8 - Reflected Cross-Site Scripting via 'wpcr3_fname' Parameterbompus WP Customer Reviews
- CVE-2026-9615Flex Import <= 3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'license_activate_fleximp' and 'license_deactivate_fleximp' AJAX Actionsflextheme Flex Import
- CVE-2026-92435Mailchimp for WooCommerce < 6.1.1 - Unauthenticated Broken Access Control in REST APIMailchimp for WooCommerce
- CVE-2026-92430Rede Itaú for WooCommerce < 5.4.7 - Unauthenticated Order Status Manipulation via PIX WebhookRede Itaú for WooCommerce — Payment PIX, Credit Card and De…
- CVE-2026-92425Hydra Booking < 1.2.4 - Hydra Host+ Cross-Host Account Modification and Deletion via IDORHydra Booking — Appointment Scheduling & Booking Calendar
- CVE-2026-92421Hydra Booking 1.1.0 - < 1.2.3 - Hydra Host+ Host Profile Takeover via IDORHydra Booking — Appointment Scheduling & Booking Calendar
- CVE-2026-92420Hydra Booking < 1.2.2 - Hydra Host+ Cross-Host Booking Deletion and Modification via IDORHydra Booking — Appointment Scheduling & Booking Calendar
- CVE-2026-92403Secure Custom Fields < 6.9.4 - Unauthenticated Post Modification via Front-End Form ID SubstitutionSecure Custom Fields
- CVE-2026-92099WPGraphQL Smart Cache < 2.3.2 - Unauthenticated Persisted Query Registration and Alias SquattingWPGraphQL Smart Cache
- CVE-2026-91847Bookly < 28.2 - Unauthenticated AI Assistant Conversation Disclosure and Message Injection via IDOROnline Scheduling and Appointment Booking System
- CVE-2026-84750Ultimate Addons for Contact Form 7 3.2.4 - 3.5.50 - Unauthenticated Arbitrary File Upload via Signature FieldUltra Addons for Contact Form
- CVE-2026-19860JetFormBuilder 3.5.6.2 - 3.6.5.2 - Admin+ Arbitrary File Deletion via Server-Side Validation CallbackJetFormBuilder — Dynamic Blocks Form Builder
- CVE-2025-15698Business Name Generator <= 1.3 - Admin+ Stored XSS via Button Color SettingBusiness Name Generator
- CVE-2026-16557Nimble Builder <= 3.3.8 - Subscriber+ Non-Public Content Disclosure via sek_get_nimble_content_for_seo_pluginsNimble Page Builder
- CVE-2026-12042WP2Social Auto Publish <= 2.4.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'pages' Parameterf1logic WP2Social Auto Publish
- CVE-2026-92967Pochipp <= 1.20.2 - Reflected Cross-Site Scripting via 'keyword' Parameterwppochipp Pochipp
- CVE-2026-89093Better Messages <= 2.15.33 - Unauthenticated Information Exposure Spoofing via 'X-Real-IP' Header via /guests/registerwordplus Better Messages – Chat Rooms, Group Chat, Private…
- CVE-2026-89081Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parametersthemeum Tutor LMS – eLearning and online course solution
- CVE-2026-89334Better Messages <= 2.15.33 - Missing Authorization to Authenticated (Custom+) Chat-Room Transcript Disclosure via '/thread/<id>' REST Endpointwordplus Better Messages – Chat Rooms, Group Chat, Private…
- CVE-2026-88944Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameterthemeum Tutor LMS – eLearning and online course solution
- CVE-2026-15760Divi Essentials <= 5.8.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via dnxte_get_database_data AJAX ActionDivi Essentials
- CVE-2026-15660SEO Booster <= 7.4.7 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Modification via handle_oauth_callback()cleverplugins SEO Booster
- CVE-2026-89333Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameterthemeum Tutor LMS – eLearning and online course solution
- CVE-2026-77820WPComplete <= 2.9.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'empty' Shortcode Attributestellarwp WPComplete