# CVEs published 2026-09-19

103 CVEs were published on September 19, 2026: 8 critical, 23 high. Days are UTC.

- [CVE-2026-93956](https://cve.now/CVE-2026-93956.md): olivier-ls PHP-FTS Search SearchEngine.php buildHighlights cross site scripting (CVSS 5.1, olivier-ls PHP-FTS)
- [CVE-2026-93993](https://cve.now/CVE-2026-93993.md): Mistral Vibe before 2.25.5 Remote Code Execution via git post-checkout (CVSS 8.6, mistralai mistral-vibe)
- [CVE-2026-93992](https://cve.now/CVE-2026-93992.md): Gopeed through 2.0.0-beta.3 Arbitrary File Write via Path Traversal (CVSS 7.0, GopeedLab gopeed)
- [CVE-2026-93991](https://cve.now/CVE-2026-93991.md): Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector (CVSS 8.3, argoproj argo-workflows)
- [CVE-2026-93990](https://cve.now/CVE-2026-93990.md): Expat before 2.8.5 Malformed UTF-16 Acceptance via Unchecked Surrogate (CVSS 8.7, libexpat)
- [CVE-2026-93989](https://cve.now/CVE-2026-93989.md): vLLM through 0.29.0 Cross-Request Logits Corruption via bad\_words (CVSS 2.3, vllm-project vllm · vllm)
- [CVE-2026-93988](https://cve.now/CVE-2026-93988.md): QloApps through 1.7.0 Arbitrary File Read via getEmailHTML (CVSS 7.1, webkul qloapps)
- [CVE-2026-94057](https://cve.now/CVE-2026-94057.md): Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data (CVSS 4.0, Exim)
- [CVE-2026-94056](https://cve.now/CVE-2026-94056.md): Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from (CVSS 7.5, Exim)
- [CVE-2026-94055](https://cve.now/CVE-2026-94055.md): Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free. (CVSS 3.7, Exim)
- [CVE-2026-94054](https://cve.now/CVE-2026-94054.md): Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write. (CVSS 7.0, Exim)
- [CVE-2026-93955](https://cve.now/CVE-2026-93955.md): grimmory-tools grimmory Download Endpoint KoboController.java streamFileToResponse authorization (CVSS 5.3, grimmory-tools grimmory)
- [CVE-2026-93954](https://cve.now/CVE-2026-93954.md): grimmory-tools grimmory Settings API Endpoint AppSettingController.java AppSettingController.getAppSettings authorization (CVSS 5.3, grimmory-tools grimmory)
- [CVE-2026-82672](https://cve.now/CVE-2026-82672.md): Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connections (CVSS 6.3, elixir-mint mint)
- [CVE-2026-82560](https://cve.now/CVE-2026-82560.md): Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width (CVSS 7.5, podlators · perl)
- [CVE-2026-94001](https://cve.now/CVE-2026-94001.md): Keycloak-services: keycloak-services: admin credential delete bypasses denied reset-password permission (CVSS 6.5, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-94000](https://cve.now/CVE-2026-94000.md): Keycloak-services: keycloak-services: delegated admin with manage-users can escalate to realm-admin via group membership (CVSS 6.6, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-93999](https://cve.now/CVE-2026-93999.md): Keycloak-services: keycloak-services: token refresh continues issuing tokens for disabled audience clients (CVSS 4.2, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-93987](https://cve.now/CVE-2026-93987.md): rclone serve docker Path Traversal via Volume Name (CVSS 4.6, rclone)
- [CVE-2026-93986](https://cve.now/CVE-2026-93986.md): rclone before 1.75.1 Path Traversal via Directory Listing Names (CVSS 2.3, rclone)
- [CVE-2026-93985](https://cve.now/CVE-2026-93985.md): OpenPanel js-runtime through 2.3.0 JavaScript Template Sandbox Escape RCE (CVSS 9.4, Openpanel-dev openpanel)
- [CVE-2026-93984](https://cve.now/CVE-2026-93984.md): OpenPanel API through 2.3.0 Authentication Bypass via Unverified Client Secret (CVSS 6.9, Openpanel-dev openpanel)
- [CVE-2026-93983](https://cve.now/CVE-2026-93983.md): OpenPanel through 2.3.0 SQL Injection via ClickHouse Property Key Filter (CVSS 5.3, Openpanel-dev openpanel)
- [CVE-2026-93982](https://cve.now/CVE-2026-93982.md): OpenPanel through 2.3.0 MCP Authentication Token in Query Parameter Logged Plaintext (CVSS 4.8, Openpanel-dev openpanel)
- [CVE-2026-93981](https://cve.now/CVE-2026-93981.md): hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings (CVSS 2.3, honojs hono · hono)
- [CVE-2026-78030](https://cve.now/CVE-2026-78030.md): DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm\_type and dbm\_mldbm attributes in DBD::DBM (CVSS 9.8, DBI)
- [CVE-2026-93742](https://cve.now/CVE-2026-93742.md): Totolink A3002MU formWsc command injection (CVSS 9.4, Totolink A3002MU)
- [CVE-2026-9858](https://cve.now/CVE-2026-9858.md): Partial Shipment for Woocommerce \<= 3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Modification via wxp\_order\_shipment, wxp\_order\_item\_shipment, and wxp\_order\_set\_shipped AJAX Actions (CVSS 4.3, wpexpertshub Partial Shipment for WooCommerce)
- [CVE-2026-9613](https://cve.now/CVE-2026-9613.md): Datalogics Ecommerce Delivery \<= 2.6.65 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actions (datalogics\_create\_shipping / datalogics\_cancel\_shipping) (CVSS 4.3, Datalogics Ecommerce Delivery – Datalogics)
- [CVE-2026-76579](https://cve.now/CVE-2026-76579.md): LiteSpeed Cache \<= 7.9 - Reflected Cross-Site Scripting via ESI 'esi' Parameter (CVSS 4.7, litespeedtech LiteSpeed Cache)
- [CVE-2026-1256](https://cve.now/CVE-2026-1256.md): YS LeadGen – Popups, Opt-ins & Lead Capture \<= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via User Input (CVSS 6.4, ysinnovations YS LeadGen – Popup Builder, Popup Maker & For…)
- [CVE-2026-9766](https://cve.now/CVE-2026-9766.md): Empik for Woocommerce \<= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Product Meta Update via empik\_csv\_process\_emp\_log\_classes AJAX Action (CVSS 4.3, Empik for Woocommerce)
- [CVE-2026-9289](https://cve.now/CVE-2026-9289.md): WordLift \<= 3.54.10 - Unauthenticated Sensitive Information Exposure in JSON-LD REST API Endpoints (CVSS 5.3, WordLift – AI powered SEO – Schema)
- [CVE-2026-1255](https://cve.now/CVE-2026-1255.md): YS LeadGen – Popups, Opt-ins & Lead Capture \<= 2.1.4 - Unauthenticated Information Disclosure in 'ysleadgen\_get\_captured\_data' AJAX Action (CVSS 7.5, ysinnovations YS LeadGen – Popup Builder, Popup Maker & For…)
- [CVE-2026-18346](https://cve.now/CVE-2026-18346.md): TikTok \<= 1.4.1 - Missing Authorization to Unauthenticated TikTok Integration Takeover via 'auth\_code' Parameter (CVSS 5.3, tiktokbusinessplugin TikTok)
- [CVE-2026-8354](https://cve.now/CVE-2026-8354.md): Gum Addon for Elementor \<= 1.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pop\_tag' Widget Setting (CVSS 6.4, celomitan Gum Addon for Elementor)
- [CVE-2026-5410](https://cve.now/CVE-2026-5410.md): Redux Framework \<= 4.5.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Spinner Field Input (CVSS 6.4, davidanderson Redux Framework)
- [CVE-2026-15098](https://cve.now/CVE-2026-15098.md): Real 3D Flipbook \<= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightboxtext' Shortcode Attribute (CVSS 6.4, creativeinteractivemedia Real3D Flipbook – 3D FlipBook, PDF…)
- [CVE-2026-87917](https://cve.now/CVE-2026-87917.md): MC4WP: Mailchimp for WordPress \<= 4.14.0 - Reflected Cross-Site Scripting via 'data' Dynamic Content Tag (CVSS 6.1, dvankooten MC4WP: Mailchimp for WordPress)
- [CVE-2026-1984](https://cve.now/CVE-2026-1984.md): Ibtana – Ecommerce Product Addons \<= 0.4.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'iepa\_use\_gt\_editor' AJAX Action (CVSS 5.3, vowelweb Ibtana – Ecommerce Product Addons)
- [CVE-2026-9855](https://cve.now/CVE-2026-9855.md): Custom Field Template \<= 2.7.8 - Authenticated (Contributor+) SQL Injection via 'post\_ID' Parameter (CVSS 6.5, hiroaki-miyashita Custom Field Template)
- [CVE-2026-5400](https://cve.now/CVE-2026-5400.md): Redux Framework \<= 4.5.13 - Authenticated (Subscriber+) Cross-Site Scripting via User Input (CVSS 6.4, davidanderson Redux Framework)
- [CVE-2026-7527](https://cve.now/CVE-2026-7527.md): WP Ghost (Hide My WP Ghost) \<= 7.0.02 - Unauthenticated Open Redirect via 'redirect\_to' Parameter (CVSS 4.7, johndarrel Hide My WP Ghost – Security & Firewall)
- [CVE-2026-85658](https://cve.now/CVE-2026-85658.md): Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content \<= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup\_bio' Biography Field (Entity-Encoded Shortcode Bracket) (CVSS 8.1, properfraction Paid Membership Plugin, Ecommerce, User Regi…)
- [CVE-2026-12402](https://cve.now/CVE-2026-12402.md): OTP Login & Register Woocommerce \<= 2.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'fb-config' Setting (CVSS 4.4, xootix OTP Login & Register Woocommerce)
- [CVE-2026-75959](https://cve.now/CVE-2026-75959.md): GoPay for WooCommerce \<= 1.0.36 - Authenticated (Shop Manager+) SQL Injection via 'log\_table\_filter' Parameter (CVSS 4.9, gopayplugins GoPay for WooCommerce)
- [CVE-2026-13200](https://cve.now/CVE-2026-13200.md): Create \<= 2.5.3 - Authenticated (Author+) SQL Injection via 'order' Parameter (CVSS 6.5, mischiefmarmot Create)
- [CVE-2026-1641](https://cve.now/CVE-2026-1641.md): Wow Elements Addons for Elementor \<= 1.11.2 - Authenticated (Contributor+) Server-Side Request Forgery via Changelog File Setting (CVSS 6.5, wowelements Wow Elements Addons for Elementor)
- [CVE-2026-2422](https://cve.now/CVE-2026-2422.md): WP Composer \<= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pbwp\_raw\_shortcode' Shortcode (CVSS 6.4, ghozylab WP Composer – The Easiest Page Builder)
- [CVE-2026-4327](https://cve.now/CVE-2026-4327.md): The Welcomizer \<= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'twiz\_custom\_logic' Parameter (CVSS 8.8, sebwordpress The Welcomizer)
- [CVE-2026-9232](https://cve.now/CVE-2026-9232.md): Easy Appointments \<= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea\_get\_customers\_ajax AJAX Action (CVSS 6.5, easyappointments Easy Appointments)
- [CVE-2026-15463](https://cve.now/CVE-2026-15463.md): SSL Zen \<= 4.7.42 - Reflected Cross-Site Scripting via 'uri' and 'host' Parameters (CVSS 6.1, sslzen SSL Zen — SSL Certificate Installer & HTTPS Redirects)
- [CVE-2026-15946](https://cve.now/CVE-2026-15946.md): Search Atlas SEO \<= 2.6.23 - Missing Authorization to Authenticated (Subscriber+) Whitelabel Password Modification via handle\_whitelabel\_password\_early Function (CVSS 4.3, shahrukhlinkgraph Search Atlas SEO – OTTO AI SEO Automation…)
- [CVE-2026-6295](https://cve.now/CVE-2026-6295.md): WP Optimizer \<= 2.5.0 - Authenticated (Administrator+) SQL Injection via 's' Parameter (CVSS 4.9, sh1zen WP Optimizer – PageSpeed, Cache, Minify & Core Web V…)
- [CVE-2026-13191](https://cve.now/CVE-2026-13191.md): Create \<= 2.5.3 - Authenticated (Author+) SQL Injection via 'order\_by' Parameter (CVSS 6.5, mischiefmarmot Create)
- [CVE-2026-13770](https://cve.now/CVE-2026-13770.md): AppMySite \<= 3.15.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via save\_ams\_license\_key AJAX Handler (CVSS 6.4, AppMySite – WordPress & WooCommerce Mobile App Builder)
- [CVE-2026-1242](https://cve.now/CVE-2026-1242.md): BlockSpare - Gutenberg Site Builder Blocks & Starter Sites \<= 4.2.6 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Creation (CVSS 4.3, BlockSpare – Gutenberg Blocks for News, Magazine, Blog & Bu…)
- [CVE-2026-9832](https://cve.now/CVE-2026-9832.md): Payment Gateway of Stripe for WooCommerce \<= 5.0.8 - Unauthenticated Improper Verification of Cryptographic Signature via woocommerce\_api\_wt\_stripe Webhook Endpoint (CVSS 5.3, themehigh Payment Gateway of Stripe for WooCommerce)
- [CVE-2026-2278](https://cve.now/CVE-2026-2278.md): VW Writer Blog \<= 1.3.8 - Missing Authorization to Authenticated (Subscriber+) Theme Settings Reset (CVSS 4.3, vowelweb VW Writer Blog)
- [CVE-2026-4792](https://cve.now/CVE-2026-4792.md): Bread \<= 2.9.12 - Missing Authorization to Unauthenticated Information Exposure (CVSS 5.3, radius314 Bread)
- [CVE-2026-15947](https://cve.now/CVE-2026-15947.md): Search Atlas SEO \<= 2.6.23 - Missing Authorization to Authenticated (Subscriber+) Site-Wide Option Modification via 'metasync\_post\_types' Parameter (CVSS 4.3, shahrukhlinkgraph Search Atlas SEO – OTTO AI SEO Automation…)
- [CVE-2026-11899](https://cve.now/CVE-2026-11899.md): PDF Builder for WooCommerce. Create invoices,packing slips and more \<= 2.0.11 - Missing Authorization to Authenticated (Subscriber+) Sensitive Invoice Data Disclosure via GetInvoiceDetail AJAX Handler (CVSS 4.3, edgarrojas PDF Builder for WooCommerce. Create invoices,pac…)
- [CVE-2026-15664](https://cve.now/CVE-2026-15664.md): Quill Forms | Conversational Multi Step Forms, Surveys & quizzes \<= 5.7.1 - Unauthenticated Stored Cross-Site Scripting via Multiple Choice 'Other' Value (CVSS 7.2, mdmag Quill Forms | Conversational Multi Step Forms, Survey…)
- [CVE-2026-11608](https://cve.now/CVE-2026-11608.md): WP Customer Reviews \<= 3.7.8 - Reflected Cross-Site Scripting via 'wpcr3\_fname' Parameter (CVSS 6.1, bompus WP Customer Reviews)
- [CVE-2026-9615](https://cve.now/CVE-2026-9615.md): Flex Import \<= 3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'license\_activate\_fleximp' and 'license\_deactivate\_fleximp' AJAX Actions (CVSS 4.3, flextheme Flex Import)
- [CVE-2026-92435](https://cve.now/CVE-2026-92435.md): Mailchimp for WooCommerce \< 6.1.1 - Unauthenticated Broken Access Control in REST API (CVSS 5.3, Mailchimp for WooCommerce)
- [CVE-2026-92430](https://cve.now/CVE-2026-92430.md): Rede Itaú for WooCommerce \< 5.4.7 - Unauthenticated Order Status Manipulation via PIX Webhook (CVSS 5.3, Rede Itaú for WooCommerce — Payment PIX, Credit Card and De…)
- [CVE-2026-92425](https://cve.now/CVE-2026-92425.md): Hydra Booking \< 1.2.4 - Hydra Host+ Cross-Host Account Modification and Deletion via IDOR (CVSS 5.5, Hydra Booking — Appointment Scheduling & Booking Calendar)
- [CVE-2026-92421](https://cve.now/CVE-2026-92421.md): Hydra Booking 1.1.0 - \< 1.2.3 - Hydra Host+ Host Profile Takeover via IDOR (CVSS 4.7, Hydra Booking — Appointment Scheduling & Booking Calendar)
- [CVE-2026-92420](https://cve.now/CVE-2026-92420.md): Hydra Booking \< 1.2.2 - Hydra Host+ Cross-Host Booking Deletion and Modification via IDOR (CVSS 3.8, Hydra Booking — Appointment Scheduling & Booking Calendar)
- [CVE-2026-92404](https://cve.now/CVE-2026-92404.md): MgoSync 2.1.5 - 2.1.6 - Unauthenticated WooCommerce API Credential Disclosure (CVSS 7.5, MgoSync)
- [CVE-2026-92403](https://cve.now/CVE-2026-92403.md): Secure Custom Fields \< 6.9.4 - Unauthenticated Post Modification via Front-End Form ID Substitution (CVSS 3.7, Secure Custom Fields)
- [CVE-2026-92099](https://cve.now/CVE-2026-92099.md): WPGraphQL Smart Cache \< 2.3.2 - Unauthenticated Persisted Query Registration and Alias Squatting (CVSS 6.5, WPGraphQL Smart Cache)
- [CVE-2026-91847](https://cve.now/CVE-2026-91847.md): Bookly \< 28.2 - Unauthenticated AI Assistant Conversation Disclosure and Message Injection via IDOR (CVSS 4.8, Online Scheduling and Appointment Booking System)
- [CVE-2026-88926](https://cve.now/CVE-2026-88926.md): VikRentItems Flexible Rental Management System \< 1.2.4 - Unauthenticated SQLi (CVSS 8.6, VikRentItems Flexible Rental Management System)
- [CVE-2026-88824](https://cve.now/CVE-2026-88824.md): Master Blocks 1.4.1 - 1.4.1.4 - Unauthenticated Stored XSS via White Label Settings (CVSS 8.8, Master Blocks)
- [CVE-2026-86814](https://cve.now/CVE-2026-86814.md): UsersWP - Social Login \< 1.5.10 - Unauthenticated Account Takeover via Unverified Provider Email (CVSS 8.1, UsersWP)
- [CVE-2026-86591](https://cve.now/CVE-2026-86591.md): Botiga Pro \< 1.6.5 - Unauthenticated Arbitrary Blog Options Update via Templates Builder REST Route (CVSS 9.8, Botiga Pro)
- [CVE-2026-85680](https://cve.now/CVE-2026-85680.md): Ultimate Member \< 2.13.1 - Unauthenticated Stored XSS via Profile Page Title (CVSS 8.8, Ultimate Member)
- [CVE-2026-85574](https://cve.now/CVE-2026-85574.md): Unbounce Landing Pages 1.1.1 - 1.1.4 - Subscriber+ Reverse-Proxy Target Hijack via set\_unbounce\_domains (CVSS 8.0, Unbounce Landing Pages)
- [CVE-2026-84750](https://cve.now/CVE-2026-84750.md): Ultimate Addons for Contact Form 7 3.2.4 - 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Field (CVSS 6.5, Ultra Addons for Contact Form)
- [CVE-2026-76790](https://cve.now/CVE-2026-76790.md): Estatik \< 4.3.5 - Reflected XSS via get\_listings hash Parameter (CVSS 7.1, Estatik Real Estate Plugin)
- [CVE-2026-76554](https://cve.now/CVE-2026-76554.md): WP Import Export Lite \< 3.9.35 - Authenticated Privilege Escalation via User Import (CVSS 7.2, WP Import Export Lite)
- [CVE-2026-19860](https://cve.now/CVE-2026-19860.md): JetFormBuilder 3.5.6.2 - 3.6.5.2 - Admin+ Arbitrary File Deletion via Server-Side Validation Callback (CVSS 5.5, JetFormBuilder — Dynamic Blocks Form Builder)
- [CVE-2025-15698](https://cve.now/CVE-2025-15698.md): Business Name Generator \<= 1.3 - Admin+ Stored XSS via Button Color Setting (CVSS 3.5, Business Name Generator)
- [CVE-2026-16557](https://cve.now/CVE-2026-16557.md): Nimble Builder \<= 3.3.8 - Subscriber+ Non-Public Content Disclosure via sek\_get\_nimble\_content\_for\_seo\_plugins (CVSS 4.3, Nimble Page Builder)
- [CVE-2026-93741](https://cve.now/CVE-2026-93741.md): Totolink A3002MU formWlWds buffer overflow (CVSS 10.0, Totolink A3002MU)
- [CVE-2026-92807](https://cve.now/CVE-2026-92807.md): Save as PDF Plugin by PDFCrowd \<= 4.6.1 - Authenticated (Contributor+) Arbitrary Function Invocation / Code Injection via 'pdf\_created\_callback' Shortcode Attribute (CVSS 8.8, Save as PDF Plugin by PDFCrowd)
- [CVE-2026-12042](https://cve.now/CVE-2026-12042.md): WP2Social Auto Publish \<= 2.4.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'pages' Parameter (CVSS 4.4, f1logic WP2Social Auto Publish)
- [CVE-2026-92967](https://cve.now/CVE-2026-92967.md): Pochipp \<= 1.20.2 - Reflected Cross-Site Scripting via 'keyword' Parameter (CVSS 6.1, wppochipp Pochipp)
- [CVE-2026-89093](https://cve.now/CVE-2026-89093.md): Better Messages \<= 2.15.33 - Unauthenticated Information Exposure Spoofing via 'X-Real-IP' Header via /guests/register (CVSS 5.3, wordplus Better Messages – Chat Rooms, Group Chat, Private…)
- [CVE-2026-89081](https://cve.now/CVE-2026-89081.md): Tutor LMS \<= 4.0.8 - Reflected Cross-Site Scripting via 'back\_url' and 'search' Parameters (CVSS 6.1, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2026-89274](https://cve.now/CVE-2026-89274.md): WP Recipe Maker \<= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content (CVSS 9.1, brechtvds WP Recipe Maker)
- [CVE-2026-89334](https://cve.now/CVE-2026-89334.md): Better Messages \<= 2.15.33 - Missing Authorization to Authenticated (Custom+) Chat-Room Transcript Disclosure via '/thread/\<id\>' REST Endpoint (CVSS 6.5, wordplus Better Messages – Chat Rooms, Group Chat, Private…)
- [CVE-2026-88944](https://cve.now/CVE-2026-88944.md): Tutor LMS \<= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson\_id' Parameter (CVSS 4.3, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2026-92229](https://cve.now/CVE-2026-92229.md): Forminator Forms \<= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current\_url' Parameter (CVSS 9.1, wpmudev Forminator Forms – Contact Form, Payment Form & Cus…)
- [CVE-2026-84434](https://cve.now/CVE-2026-84434.md): Gravity Forms \<= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field (CVSS 9.8, Gravity Forms)
- [CVE-2026-87909](https://cve.now/CVE-2026-87909.md): WP Photo Album Plus \<= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection (CVSS 7.5, opajaap WP Photo Album Plus)
- [CVE-2026-15760](https://cve.now/CVE-2026-15760.md): Divi Essentials \<= 5.8.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via dnxte\_get\_database\_data AJAX Action (CVSS 6.5, Divi Essentials)
- [CVE-2026-13354](https://cve.now/CVE-2026-13354.md): Asset CleanUp: Page Speed Booster \<= 1.4.0.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content (CVSS 7.2, gabelivan Asset CleanUp: Page Speed Booster)
- [CVE-2026-15660](https://cve.now/CVE-2026-15660.md): SEO Booster \<= 7.4.7 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Modification via handle\_oauth\_callback() (CVSS 4.3, cleverplugins SEO Booster)
- [CVE-2026-89333](https://cve.now/CVE-2026-89333.md): Tutor LMS \<= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student\_id' Parameter (CVSS 6.5, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2026-77820](https://cve.now/CVE-2026-77820.md): WPComplete \<= 2.9.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'empty' Shortcode Attribute (CVSS 6.4, stellarwp WPComplete)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-09-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.