CVEs published October 3, 2026
114 CVEs were published on October 3, 2026: 5 critical, 45 high.
- Published
- 114
- Critical
- 5
- High
- 45
- Medium
- 58
- Low
- 6
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 55
Most affected products
- OpenIdentityPlatform OpenAM
- 9
- laradashboard
- 6
- Legion of the Bouncy Castle BC-JAVA
- 6
- WP Ultimate Review
- 4
- Legion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1
- 3
- Unlimited Elements for Elementor
- 3
- arraytics WPCafe – Restaurant Menu, Online Food Ordering &…
- 2
- beaverbuilder Beaver Builder Page Builder – Drag and Drop W…
- 2
- Kubio AI Page Builder
- 2
- Legion of the Bouncy Castle BC-JAVA · Legion of the Bouncy…
- 2
Critical 5
- CVE-2026-105105Unauthenticated ZeroMQ command/telemetry bus in AIT-Core allows remote spacecraft command injection and telemetry exfiltrationNASA-AMMOS AIT-Core
- CVE-2026-71885MLS X.509 credential not bound to the LeafNode signature keyLegion of the Bouncy Castle BC-JAVA
- CVE-2026-92084Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Outputbeaverbuilder Beaver Builder Page Builder – Drag and Drop W…
- CVE-2026-87115VikAppointments Services Booking Calendar <= 1.2.21 - Unauthenticated Arbitrary File Deletion via 'old_vapcfN' Parametere4jvikwp VikAppointments Services Booking Calendar
- CVE-2026-105080In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from CaliC4illin ConvertX
High 45
- CVE-2026-105129LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings APIlaradashboard
- CVE-2026-105126LaraDashboard before 1.4.8 Privilege Escalation via Superadmin Role Tamperinglaradashboard
- CVE-2026-105123W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload APIvincent-peugnet wcms
- CVE-2026-96451WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerabilityUltimate Member
- CVE-2026-103342WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Cross Site Scripting (XSS) vulnerabilityUnlimited Elements For Elementor
- CVE-2026-103065WordPress Kirki plugin <= 6.3.1 - Arbitrary Code Execution vulnerabilityThemeum Kirki
- CVE-2026-105119OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid FlowsOpenIdentityPlatform OpenAM
- CVE-2026-105115OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC InterfaceOpenIdentityPlatform OpenAM
- CVE-2026-105113Nezha 1.8.0 before 2.3.13 Denial of Service via Notification Mutex Deadlocknezhahq nezha
- CVE-2026-71890MLS external commit can remove an arbitrary group memberLegion of the Bouncy Castle BC-JAVA
- CVE-2026-71891BLS12-381 key validation accepts a public key built on a foreign curveLegion of the Bouncy Castle BC-JAVA
- CVE-2026-71886OpenPGP certification accepted from a subkey without certification authorityLegion of the Bouncy Castle BC-JAVA
- CVE-2026-71887OpenPGP data signature accepted from a signing subkey without cross-certificationLegion of the Bouncy Castle BC-JAVA
- CVE-2026-71883Native AES packet cipher returns the raw AES key on an aliasLegion of the Bouncy Castle BC-LTS-JAVA
- CVE-2026-71888CMS AuthenticatedData exposes attacker-inserted authAttrs when digestAlgorithm is absentLegion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1
- CVE-2026-71889PKIXCertPathReviewer does not apply X.509 name constraints to the target certificateLegion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1
- CVE-2026-85515OpenPGP message truncation not reported, bypassing the SEIPDv1 integrity checkLegion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1
- CVE-2026-18443Smart Manager <= 8.97.0 - Authenticated (Subscriber+) SQL Injection to Privilege Escalation via 'access_privileges' Parameterstoreapps Smart Manager – WooCommerce Bulk Edit: Products,…
- CVE-2026-94505Nelio Content <= 4.5.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Reusable Message Deletion via 'id' ParameterNelio Content – Editorial Calendar & Social Media Auto-Post…
- CVE-2026-96267WP Visitor Statistics (Real Time Traffic) <= 8.7 - Unauthenticated SQL Injection via 'fullRef' Parameterosamaesh WP Visitor Statistics
- CVE-2026-93889Mail logging <= 2.1.12 - Unauthenticated Stored Cross-Site Scripting via PHPMailer 'wp_mail_failed' Error Messagewardee Mail logging & Catcher
- CVE-2026-75028WPCafe <= 3.0.18 - Authenticated (Contributor+) Local File Inclusion via 'food_menu_style' Elementor Widget Settingarraytics WPCafe – Restaurant Menu, Online Food Ordering &…
- CVE-2026-97660WPC Product Options for WooCommerce <= 4.0.5 - Unauthenticated Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Namewpclever WPC Product Options for WooCommerce
- CVE-2026-91078TillKit < 1.0.5 - Unauthenticated POS Takeover via Hard-Coded Default Manager PINTillKit
- CVE-2026-89236SaveTo Wishlist Lite < 1.1.5 - Unauthenticated SQLi via 'sort_column' and 'sort_order' ParametersSaveTo Wishlist Lite
- CVE-2026-88783Kubio AI Page Builder < 2.9.3 - Unauthenticated Stored XSS via Comment ContentKubio AI Page Builder
- CVE-2026-103514WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via TOTP Code ReplayWP 2FA
- CVE-2026-101161WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Unset Display Settings in wp-reviews ShortcodeWP Ultimate Review
- CVE-2026-101160WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Non-Numeric Review RatingWP Ultimate Review
- CVE-2026-101159WP Ultimate Review < 2.4.4 - Unauthenticated Stored XSS via Review SubmissionWP Ultimate Review
- CVE-2026-96575Transliterator <= 2.5.8 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable {rstr_keep} Placeholderivijanstefan Transliterator – Multilingual and Multi-script…
- CVE-2026-87091Welcart e-Commerce <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parametersuscnanbu Welcart e-Commerce
- CVE-2026-101923Photo Reviews for WooCommerce <= 1.2.30 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'wcpr_image_upload_id' Parametervillatheme Photo Reviews for WooCommerce
- CVE-2026-97337Simple Membership <= 4.8.3 - Missing Authorization to Unauthenticated Account Takeover and Sensitive Information Disclosure via 'email' Parameter on Activation Endpointswpinsider-1 Simple Membership
- CVE-2026-101928Magic Tooltips For Contact Form 7 <= 1.0.34 - Unauthenticated Stored Cross-Site Scripting via 'esc_html' Filter Override via Comment Authormagicplugins Magic Tooltips For Contact Form
- CVE-2026-96564SEOPress <= 10.2 - Unauthenticated Stored Cross-Site Scripting via Author Display Namerainbowgeek SEOPress – AI SEO Plugin & On-site SEO
- CVE-2026-96650Strong Testimonials <= 3.3.11 - Unauthenticated Stored Cross-Site Scripting via 'platform_user_photo' Custom Fieldwpchill Strong Testimonials
- CVE-2026-93430GD Rating System <= 3.7.1 - Unauthenticated Stored Cross-Site Scripting via 'title' and 'url' Render Args in gdrts_live_handler AJAXgdragon GD Rating System
- CVE-2026-103913GeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listingpaoltaia GeoDirectory – WP Business Directory Plugin and Cl…
- CVE-2026-97341Visitor Traffic Real Time Statistics <= 8.16 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Headerwp-buy Visitor Traffic Real Time Statistics
- CVE-2026-97644Groundhogg <= 4.9 - Authenticated (Sales Person+) Privilege Escalation via Contact Identity Rebinding leading to Administrator Account Takeover to 'user_id' Parameter (v3 /contacts) chained with v4 /emails/testtrainingbusinesspros Groundhogg — CRM, Newsletters, and Mar…
- CVE-2026-92977Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via Commentdevowl Real Cookie Banner: GDPR & ePrivacy Cookie Consent
- CVE-2026-92536Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Authenticated (Subscriber+) Sensitive Information Exposure via Shortcode Injection via Nickname and Biographical Info Profile Fieldsproperfraction Paid Membership Plugin, Ecommerce, User Regi…
- CVE-2026-93428Ultimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypassultimatemember Ultimate Member – User Profile, Registration…
- CVE-2026-96270Ultimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameterultimatemember Ultimate Member – User Profile, Registration…
Medium, low and unrated 64
- CVE-2026-105130LaraDashboard 1.4.0 before 1.4.8 Race Condition Bypasses Per-IP Registration Limitlaradashboard
- CVE-2026-105128LaraDashboard before 1.4.8 Open Redirect via Email Template Builder redirect_urllaradashboard
- CVE-2026-105127LaraDashboard 1.4.2 before 1.4.8 Resource Exhaustion via Password Recovery Endpointslaradashboard
- CVE-2026-105125LaraDashboard before 1.4.8 Path Traversal via /api/translations/{lang} Endpointlaradashboard
- CVE-2026-105124W (wcms) through 3.18.0 Unauthenticated Stored XSS via Login Username and Commentsvincent-peugnet wcms
- CVE-2026-105122OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uriOpenIdentityPlatform OpenAM
- CVE-2026-105121OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm ScopingOpenIdentityPlatform OpenAM
- CVE-2026-105120OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST EndpointOpenIdentityPlatform OpenAM
- CVE-2026-105118OpenAM before 16.1.3 Open Redirect via Unverified id_token_hint in endSessionOpenIdentityPlatform OpenAM
- CVE-2026-105117OpenAM before 16.1.3 Email Content Injection via Users REST Self-Service ActionsOpenIdentityPlatform OpenAM
- CVE-2026-105116OpenAM before 16.1.3 Latent XSS in SAML Load-Balancer Cookie Bounce PageOpenIdentityPlatform OpenAM
- CVE-2026-105114OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error PageOpenIdentityPlatform OpenAM
- CVE-2026-105112Nezha 1.8.0 before 2.3.13 Deadlock DoS via notification-group endpointsnezhahq nezha
- CVE-2026-104983Linux Mint Xreader PDF Attachment Saving ev-window.c g_file_get_child path traversalLinux Mint Xreader
- CVE-2026-18040HQC leaks private key information through secret-indexed GF(2^8) tables and a secret-dependent fixed-weight samplerLegion of the Bouncy Castle BC-JAVA
- CVE-2026-71892CMS key-transport recipient key-size validation never runs for RFC 9709 HKDF-derived keysLegion of the Bouncy Castle BC-JAVA · Legion of the Bouncy…
- CVE-2026-97873Legacy PBES1 and PKCS#12 PBE iteration count honoured unbounded in the raw JCA providerLegion of the Bouncy Castle BC-JAVA · Legion of the Bouncy…
- CVE-2026-104982Linux Mint Xreader EPUB File epub-document.c g_strdup_printf path traversalLinux Mint Xreader
- CVE-2026-92767Twenty20 Image Before-After <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'offset' Shortcode Attributezayedbaloch Twenty20 Image Before-After
- CVE-2026-100157WP Ultimate Review <= 2.4.3 - Unauthenticated Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter (Split-Shortcode / Late-Registered Shortcode)roxnor WP Ultimate Review
- CVE-2026-11601WPCafe <= 3.0.19 - Missing Authorization to Unauthenticated Arbitrary Email Notification Flow Read/Create/Update/Deletearraytics WPCafe – Restaurant Menu, Online Food Ordering &…
- CVE-2026-104313WPC Estimated Delivery Date for WooCommerce <= 4.0.1 - Reflected Cross-Site Scripting via 'rule_data' Parameterwpclever WPC Estimated Delivery Date for WooCommerce
- CVE-2026-103519WP Ultimate Review <= 2.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameterroxnor WP Ultimate Review
- CVE-2026-93896WPFront Notification Bar <= 3.5.1 - Reflected Cross-Site Scripting via REQUEST_URIsyammohanm WPFront Notification Bar
- CVE-2026-92974Photo Gallery by 10Web <= 1.8.46 - Reflected Cross-Site Scripting via 'thumb_url' ParameterPhoto Gallery by 10Web – Mobile-Friendly Image Gallery
- CVE-2026-15795Responsive Plus <= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributescyberchimps Responsive Starter Templates – Elementor Templa…
- CVE-2026-103421WPMobile.App <= 11.84 - Unauthenticated Stored Cross-Site Scripting via '/android_json/search/<value>/0' Path Segmentamauric WPMobile.App – Android and iOS App Builder
- CVE-2026-97343Burst Statistics <= 3.7.1 - Improper Authentication to Account Persistence via Share-Link Authentication Bypass via 'burst_share_token'burstbv Burst Statistics – Simple WordPress Analytics
- CVE-2026-96962Pie Register < 3.8.4.14 - Unauthenticated User Email Disclosure via Invitation CodePie Register
- CVE-2026-94239Loco Translate < 2.8.9 - Translator+ Stored XSS via Bundle ConfigurationLoco Translate
- CVE-2026-94238Loco Translate < 2.8.9 - Translator+ Limited File Read via 'path' ParameterLoco Translate
- CVE-2026-92923Unlimited Elements For Elementor 1.5.142 - 2.0.20 - Subscriber+ SQLi via get_addon_output_dataUnlimited Elements for Elementor
- CVE-2026-92437Mailchimp for WooCommerce < 6.3 - Unauthenticated Abandoned Cart Modification and DeletionMailchimp for WooCommerce
- CVE-2026-88782Kubio AI Page Builder < 2.9.3 - Contributor+ Stored XSS via Image Gallery Item URL AttributeKubio AI Page Builder
- CVE-2026-86834MetForm 2.2.1 - 4.3.0 - Unauthenticated Debug File Disclosure via HubSpot Forms IntegrationMetForm
- CVE-2026-86832MetForm < 4.3.1 - Unauthenticated Form Entry Data Disclosure via REST APIMetForm
- CVE-2026-85568Unlimited Elements For Elementor 1.5.139 - 2.0.20 - Unauthenticated SQLi via 'ucs' ParameterUnlimited Elements for Elementor
- CVE-2026-85015Unlimited Elements For Elementor < 2.0.21 - Authenticated Arbitrary File Write via Path TraversalUnlimited Elements for Elementor
- CVE-2026-80518WP Ultimate CSV Importer < 9.2 - Unauthenticated Imported Data Disclosure via Predictable Log PathWP Ultimate CSV Importer
- CVE-2026-80517WP Ultimate CSV Importer 7.17 - 9.1 - Admin+ Stored XSS via ZIP Import SVG UploadWP Ultimate CSV Importer
- CVE-2026-103293MPG < 4.2.3 - Editor+ Arbitrary File Read via Project ImportMPG
- CVE-2026-101162WP Ultimate Review < 2.4.4 - Author+ Stored XSS via Review Overview SettingsWP Ultimate Review
- CVE-2026-103888WPC Smart Quick View for WooCommerce <= 4.4.0 - Reflected Cross-Site Scripting via 'woosq-redirect' Parameterwpclever WPC Smart Quick View for WooCommerce
- CVE-2026-103909Calculated Fields Form <= 5.5.1.5 - Reflected DOM-Based Cross-Site Scripting via URL Parameter Substitution in Calculated Field Equationcodepeople Calculated Fields Form – AI Form Builder for Wor…
- CVE-2026-100148Rich Showcase for Google Reviews <= 7.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Google Review Text (imported via Places API)widgetpack Rich Showcase for Google Reviews
- CVE-2026-101357SEOPress <= 10.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'seopress_google_analytics_matomo_id' Parameterrainbowgeek SEOPress – AI SEO Plugin & On-site SEO
- CVE-2026-100149WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons <= 4.7.3 - Unauthenticated Sensitive Information Disclosure via HMAC Signature Collision (Missing Domain Separation) in HMAC Signature Domain-Separation Flaw in `/yamidoo/v1/customer`…WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Shar…
- CVE-2025-12828Ultra Addons Lite for Elementor <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Type Out Widgetultrapressorg Ultra Addons Lite for Elementor
- CVE-2026-100152All in One SEO <= 5.0.2 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Query Parametersmub All in One SEO – AI SEO Plugin to Boost SEO Rankings &…
- CVE-2026-97344Wp Social Login and Register Social Counter <= 3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Writeroxnor Wp Social Login and Register Social Counter
- CVE-2026-91108Alt Text AI <= 1.10.41 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Content Modification via atai_enrich_post_content AJAX Actionalttextai Alt Text AI – Automatically generate image alt te…
- CVE-2026-11399Helpdesk Support Ticket System for WooCommerce <= 2.1.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Ticket Response Deletion via 'id' Parameterwpcodefactory Helpdesk Support Ticket System for WooCommerce
- CVE-2026-92727EmbedPress <= 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slidesShow' Block Attributewpdevteam EmbedPress – PDF Embedder, 3D PDF FlipBook, Googl…
- CVE-2026-92538LearnPress <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameterthimpress LearnPress – WordPress LMS Plugin for Create and…
- CVE-2026-92826EWWW Image Optimizer <= 8.7.7 - Reflected Cross-Site Scripting via REQUEST_URI Parameter Keynosilver4u EWWW Image Optimizer
- CVE-2026-92551Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Reflected Cross-Site Scripting via ppress_billing_address Filename Parameterproperfraction Paid Membership Plugin, Ecommerce, User Regi…
- CVE-2026-92243Ivory Search <= 5.5.18 - Reflected DOM-Based Cross-Site Scripting via 's' Parametervinod-dalvi Ivory Search – WordPress Search Plugin
- CVE-2026-94539SupportCandy <= 3.5.3 - Authenticated (Custom+) SQL Injection via 'sort_by' Parameterpsmplugins SupportCandy – AI Customer Support Ticket System…
- CVE-2026-94378SupportCandy <= 3.5.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'name' Parameterpsmplugins SupportCandy – AI Customer Support Ticket System…
- CVE-2026-100180Jeg Kit for Elementor <= 3.2.19 - Unauthenticated Stored Cross-Site Scripting via Commentjegtheme Jeg Kit for Elementor – Powerful Addons for Elemen…
- CVE-2026-95865Beaver Builder Page Builder <= 2.11.0.5 - Authenticated (Contributor+) SQL Injection via 'fields[][value]' Parameterbeaverbuilder Beaver Builder Page Builder – Drag and Drop W…
- CVE-2026-105090Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS.Formbricks
- CVE-2026-105083ImageMagick before 7.1.2-32 and 6.9.13-57 Security Policy Bypass via policy.xml DOCTYPEImageMagick
- CVE-2026-79113OpenAPV before 1.1.1.0 has a read_bitstream heap-based buffer overflow.aswf OpenAPV