# CVEs published 2026-10-03

114 CVEs were published on October 3, 2026: 5 critical, 45 high. Days are UTC.

- [CVE-2026-105130](https://cve.now/CVE-2026-105130.md): LaraDashboard 1.4.0 before 1.4.8 Race Condition Bypasses Per-IP Registration Limit (CVSS 6.3, laradashboard)
- [CVE-2026-105129](https://cve.now/CVE-2026-105129.md): LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings API (CVSS 7.1, laradashboard)
- [CVE-2026-105128](https://cve.now/CVE-2026-105128.md): LaraDashboard before 1.4.8 Open Redirect via Email Template Builder redirect\_url (CVSS 5.3, laradashboard)
- [CVE-2026-105127](https://cve.now/CVE-2026-105127.md): LaraDashboard 1.4.2 before 1.4.8 Resource Exhaustion via Password Recovery Endpoints (CVSS 6.9, laradashboard)
- [CVE-2026-105126](https://cve.now/CVE-2026-105126.md): LaraDashboard before 1.4.8 Privilege Escalation via Superadmin Role Tampering (CVSS 8.6, laradashboard)
- [CVE-2026-105125](https://cve.now/CVE-2026-105125.md): LaraDashboard before 1.4.8 Path Traversal via /api/translations/{lang} Endpoint (CVSS 6.3, laradashboard)
- [CVE-2026-105124](https://cve.now/CVE-2026-105124.md): W (wcms) through 3.18.0 Unauthenticated Stored XSS via Login Username and Comments (CVSS 5.3, vincent-peugnet wcms)
- [CVE-2026-105123](https://cve.now/CVE-2026-105123.md): W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API (CVSS 8.7, vincent-peugnet wcms)
- [CVE-2026-96451](https://cve.now/CVE-2026-96451.md): WordPress Ultimate Member plugin \<= 2.13.1 - Privilege Escalation vulnerability (CVSS 8.8, Ultimate Member)
- [CVE-2026-103342](https://cve.now/CVE-2026-103342.md): WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin \<= 2.0.20 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Unlimited Elements For Elementor)
- [CVE-2026-103065](https://cve.now/CVE-2026-103065.md): WordPress Kirki plugin \<= 6.3.1 - Arbitrary Code Execution vulnerability (CVSS 8.2, Themeum Kirki)
- [CVE-2026-105122](https://cve.now/CVE-2026-105122.md): OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks\_uri (CVSS 5.3, OpenIdentityPlatform OpenAM)
- [CVE-2026-105121](https://cve.now/CVE-2026-105121.md): OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm Scoping (CVSS 6.9, OpenIdentityPlatform OpenAM)
- [CVE-2026-105120](https://cve.now/CVE-2026-105120.md): OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST Endpoint (CVSS 6.9, OpenIdentityPlatform OpenAM)
- [CVE-2026-105119](https://cve.now/CVE-2026-105119.md): OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows (CVSS 7.6, OpenIdentityPlatform OpenAM)
- [CVE-2026-105118](https://cve.now/CVE-2026-105118.md): OpenAM before 16.1.3 Open Redirect via Unverified id\_token\_hint in endSession (CVSS 2.3, OpenIdentityPlatform OpenAM)
- [CVE-2026-105117](https://cve.now/CVE-2026-105117.md): OpenAM before 16.1.3 Email Content Injection via Users REST Self-Service Actions (CVSS 5.3, OpenIdentityPlatform OpenAM)
- [CVE-2026-105116](https://cve.now/CVE-2026-105116.md): OpenAM before 16.1.3 Latent XSS in SAML Load-Balancer Cookie Bounce Page (CVSS 5.1, OpenIdentityPlatform OpenAM)
- [CVE-2026-105115](https://cve.now/CVE-2026-105115.md): OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface (CVSS 8.8, OpenIdentityPlatform OpenAM)
- [CVE-2026-105114](https://cve.now/CVE-2026-105114.md): OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page (CVSS 5.3, OpenIdentityPlatform OpenAM)
- [CVE-2026-105113](https://cve.now/CVE-2026-105113.md): Nezha 1.8.0 before 2.3.13 Denial of Service via Notification Mutex Deadlock (CVSS 7.1, nezhahq nezha)
- [CVE-2026-105112](https://cve.now/CVE-2026-105112.md): Nezha 1.8.0 before 2.3.13 Deadlock DoS via notification-group endpoints (CVSS 6.0, nezhahq nezha)
- [CVE-2026-105105](https://cve.now/CVE-2026-105105.md): Unauthenticated ZeroMQ command/telemetry bus in AIT-Core allows remote spacecraft command injection and telemetry exfiltration (CVSS 9.8, NASA-AMMOS AIT-Core)
- [CVE-2026-104983](https://cve.now/CVE-2026-104983.md): Linux Mint Xreader PDF Attachment Saving ev-window.c g\_file\_get\_child path traversal (CVSS 5.3, Linux Mint Xreader)
- [CVE-2026-71890](https://cve.now/CVE-2026-71890.md): MLS external commit can remove an arbitrary group member (CVSS 8.7, Legion of the Bouncy Castle BC-JAVA)
- [CVE-2026-71891](https://cve.now/CVE-2026-71891.md): BLS12-381 key validation accepts a public key built on a foreign curve (CVSS 7.1, Legion of the Bouncy Castle BC-JAVA)
- [CVE-2026-18040](https://cve.now/CVE-2026-18040.md): HQC leaks private key information through secret-indexed GF(2^8) tables and a secret-dependent fixed-weight sampler (CVSS 5.9, Legion of the Bouncy Castle BC-JAVA)
- [CVE-2026-71885](https://cve.now/CVE-2026-71885.md): MLS X.509 credential not bound to the LeafNode signature key (CVSS 9.2, Legion of the Bouncy Castle BC-JAVA)
- [CVE-2026-71886](https://cve.now/CVE-2026-71886.md): OpenPGP certification accepted from a subkey without certification authority (CVSS 8.2, Legion of the Bouncy Castle BC-JAVA)
- [CVE-2026-71887](https://cve.now/CVE-2026-71887.md): OpenPGP data signature accepted from a signing subkey without cross-certification (CVSS 8.2, Legion of the Bouncy Castle BC-JAVA)
- [CVE-2026-71883](https://cve.now/CVE-2026-71883.md): Native AES packet cipher returns the raw AES key on an alias (CVSS 8.2, Legion of the Bouncy Castle BC-LTS-JAVA)
- [CVE-2026-71888](https://cve.now/CVE-2026-71888.md): CMS AuthenticatedData exposes attacker-inserted authAttrs when digestAlgorithm is absent (CVSS 8.7, Legion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1)
- [CVE-2026-71889](https://cve.now/CVE-2026-71889.md): PKIXCertPathReviewer does not apply X.509 name constraints to the target certificate (CVSS 8.7, Legion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1)
- [CVE-2026-71892](https://cve.now/CVE-2026-71892.md): CMS key-transport recipient key-size validation never runs for RFC 9709 HKDF-derived keys (CVSS 6.9, Legion of the Bouncy Castle BC-JAVA · Legion of the Bouncy…)
- [CVE-2026-85515](https://cve.now/CVE-2026-85515.md): OpenPGP message truncation not reported, bypassing the SEIPDv1 integrity check (CVSS 8.2, Legion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1)
- [CVE-2026-97873](https://cve.now/CVE-2026-97873.md): Legacy PBES1 and PKCS#12 PBE iteration count honoured unbounded in the raw JCA provider (CVSS 5.3, Legion of the Bouncy Castle BC-JAVA · Legion of the Bouncy…)
- [CVE-2026-104982](https://cve.now/CVE-2026-104982.md): Linux Mint Xreader EPUB File epub-document.c g\_strdup\_printf path traversal (CVSS 5.3, Linux Mint Xreader)
- [CVE-2026-92767](https://cve.now/CVE-2026-92767.md): Twenty20 Image Before-After \<= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'offset' Shortcode Attribute (CVSS 6.4, zayedbaloch Twenty20 Image Before-After)
- [CVE-2026-92084](https://cve.now/CVE-2026-92084.md): Beaver Builder Page Builder \<= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output (CVSS 9.1, beaverbuilder Beaver Builder Page Builder – Drag and Drop W…)
- [CVE-2026-100157](https://cve.now/CVE-2026-100157.md): WP Ultimate Review \<= 2.4.3 - Unauthenticated Arbitrary Shortcode Execution via 'xs\_reviw\_summery' Parameter (Split-Shortcode / Late-Registered Shortcode) (CVSS 6.5, roxnor WP Ultimate Review)
- [CVE-2026-11601](https://cve.now/CVE-2026-11601.md): WPCafe \<= 3.0.19 - Missing Authorization to Unauthenticated Arbitrary Email Notification Flow Read/Create/Update/Delete (CVSS 5.3, arraytics WPCafe – Restaurant Menu, Online Food Ordering &…)
- [CVE-2026-18443](https://cve.now/CVE-2026-18443.md): Smart Manager \<= 8.97.0 - Authenticated (Subscriber+) SQL Injection to Privilege Escalation via 'access\_privileges' Parameter (CVSS 8.8, storeapps Smart Manager – WooCommerce Bulk Edit: Products,…)
- [CVE-2026-104313](https://cve.now/CVE-2026-104313.md): WPC Estimated Delivery Date for WooCommerce \<= 4.0.1 - Reflected Cross-Site Scripting via 'rule\_data' Parameter (CVSS 6.1, wpclever WPC Estimated Delivery Date for WooCommerce)
- [CVE-2026-94505](https://cve.now/CVE-2026-94505.md): Nelio Content \<= 4.5.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Reusable Message Deletion via 'id' Parameter (CVSS 8.1, Nelio Content – Editorial Calendar & Social Media Auto-Post…)
- [CVE-2026-96267](https://cve.now/CVE-2026-96267.md): WP Visitor Statistics (Real Time Traffic) \<= 8.7 - Unauthenticated SQL Injection via 'fullRef' Parameter (CVSS 7.5, osamaesh WP Visitor Statistics)
- [CVE-2026-103519](https://cve.now/CVE-2026-103519.md): WP Ultimate Review \<= 2.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs\_reviw\_summery' Parameter (CVSS 5.4, roxnor WP Ultimate Review)
- [CVE-2026-87115](https://cve.now/CVE-2026-87115.md): VikAppointments Services Booking Calendar \<= 1.2.21 - Unauthenticated Arbitrary File Deletion via 'old\_vapcfN' Parameter (CVSS 9.1, e4jvikwp VikAppointments Services Booking Calendar)
- [CVE-2026-93889](https://cve.now/CVE-2026-93889.md): Mail logging \<= 2.1.12 - Unauthenticated Stored Cross-Site Scripting via PHPMailer 'wp\_mail\_failed' Error Message (CVSS 7.2, wardee Mail logging & Catcher)
- [CVE-2026-93896](https://cve.now/CVE-2026-93896.md): WPFront Notification Bar \<= 3.5.1 - Reflected Cross-Site Scripting via REQUEST\_URI (CVSS 6.1, syammohanm WPFront Notification Bar)
- [CVE-2026-75028](https://cve.now/CVE-2026-75028.md): WPCafe \<= 3.0.18 - Authenticated (Contributor+) Local File Inclusion via 'food\_menu\_style' Elementor Widget Setting (CVSS 7.5, arraytics WPCafe – Restaurant Menu, Online Food Ordering &…)
- [CVE-2026-92974](https://cve.now/CVE-2026-92974.md): Photo Gallery by 10Web \<= 1.8.46 - Reflected Cross-Site Scripting via 'thumb\_url' Parameter (CVSS 6.1, Photo Gallery by 10Web – Mobile-Friendly Image Gallery)
- [CVE-2026-15795](https://cve.now/CVE-2026-15795.md): Responsive Plus \<= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, cyberchimps Responsive Starter Templates – Elementor Templa…)
- [CVE-2026-97660](https://cve.now/CVE-2026-97660.md): WPC Product Options for WooCommerce \<= 4.0.5 - Unauthenticated Stored Cross-Site Scripting via wpcpo-\* Array Key via Multipart Field Name (CVSS 7.2, wpclever WPC Product Options for WooCommerce)
- [CVE-2026-103421](https://cve.now/CVE-2026-103421.md): WPMobile.App \<= 11.84 - Unauthenticated Stored Cross-Site Scripting via '/android\_json/search/\<value\>/0' Path Segment (CVSS 5.4, amauric WPMobile.App – Android and iOS App Builder)
- [CVE-2026-97343](https://cve.now/CVE-2026-97343.md): Burst Statistics \<= 3.7.1 - Improper Authentication to Account Persistence via Share-Link Authentication Bypass via 'burst\_share\_token' (CVSS 4.3, burstbv Burst Statistics – Simple WordPress Analytics)
- [CVE-2026-96962](https://cve.now/CVE-2026-96962.md): Pie Register \< 3.8.4.14 - Unauthenticated User Email Disclosure via Invitation Code (CVSS 3.7, Pie Register)
- [CVE-2026-94239](https://cve.now/CVE-2026-94239.md): Loco Translate \< 2.8.9 - Translator+ Stored XSS via Bundle Configuration (CVSS 6.8, Loco Translate)
- [CVE-2026-94238](https://cve.now/CVE-2026-94238.md): Loco Translate \< 2.8.9 - Translator+ Limited File Read via 'path' Parameter (CVSS 6.8, Loco Translate)
- [CVE-2026-92923](https://cve.now/CVE-2026-92923.md): Unlimited Elements For Elementor 1.5.142 - 2.0.20 - Subscriber+ SQLi via get\_addon\_output\_data (CVSS 6.3, Unlimited Elements for Elementor)
- [CVE-2026-92437](https://cve.now/CVE-2026-92437.md): Mailchimp for WooCommerce \< 6.3 - Unauthenticated Abandoned Cart Modification and Deletion (CVSS 5.3, Mailchimp for WooCommerce)
- [CVE-2026-91078](https://cve.now/CVE-2026-91078.md): TillKit \< 1.0.5 - Unauthenticated POS Takeover via Hard-Coded Default Manager PIN (CVSS 8.2, TillKit)
- [CVE-2026-89236](https://cve.now/CVE-2026-89236.md): SaveTo Wishlist Lite \< 1.1.5 - Unauthenticated SQLi via 'sort\_column' and 'sort\_order' Parameters (CVSS 8.6, SaveTo Wishlist Lite)
- [CVE-2026-88783](https://cve.now/CVE-2026-88783.md): Kubio AI Page Builder \< 2.9.3 - Unauthenticated Stored XSS via Comment Content (CVSS 8.8, Kubio AI Page Builder)
- [CVE-2026-88782](https://cve.now/CVE-2026-88782.md): Kubio AI Page Builder \< 2.9.3 - Contributor+ Stored XSS via Image Gallery Item URL Attribute (CVSS 6.8, Kubio AI Page Builder)
- [CVE-2026-86834](https://cve.now/CVE-2026-86834.md): MetForm 2.2.1 - 4.3.0 - Unauthenticated Debug File Disclosure via HubSpot Forms Integration (CVSS 3.7, MetForm)
- [CVE-2026-86832](https://cve.now/CVE-2026-86832.md): MetForm \< 4.3.1 - Unauthenticated Form Entry Data Disclosure via REST API (CVSS 5.3, MetForm)
- [CVE-2026-85568](https://cve.now/CVE-2026-85568.md): Unlimited Elements For Elementor 1.5.139 - 2.0.20 - Unauthenticated SQLi via 'ucs' Parameter (CVSS 6.8, Unlimited Elements for Elementor)
- [CVE-2026-85015](https://cve.now/CVE-2026-85015.md): Unlimited Elements For Elementor \< 2.0.21 - Authenticated Arbitrary File Write via Path Traversal (CVSS 6.6, Unlimited Elements for Elementor)
- [CVE-2026-80518](https://cve.now/CVE-2026-80518.md): WP Ultimate CSV Importer \< 9.2 - Unauthenticated Imported Data Disclosure via Predictable Log Path (CVSS 3.7, WP Ultimate CSV Importer)
- [CVE-2026-80517](https://cve.now/CVE-2026-80517.md): WP Ultimate CSV Importer 7.17 - 9.1 - Admin+ Stored XSS via ZIP Import SVG Upload (CVSS 3.5, WP Ultimate CSV Importer)
- [CVE-2026-103514](https://cve.now/CVE-2026-103514.md): WP 2FA \< 4.1.0 - Two-Factor Authentication Bypass via TOTP Code Replay (CVSS 7.5, WP 2FA)
- [CVE-2026-103293](https://cve.now/CVE-2026-103293.md): MPG \< 4.2.3 - Editor+ Arbitrary File Read via Project Import (CVSS 6.8, MPG)
- [CVE-2026-101162](https://cve.now/CVE-2026-101162.md): WP Ultimate Review \< 2.4.4 - Author+ Stored XSS via Review Overview Settings (CVSS 6.4, WP Ultimate Review)
- [CVE-2026-101161](https://cve.now/CVE-2026-101161.md): WP Ultimate Review \< 2.4.4 - Unauthenticated DoS via Unset Display Settings in wp-reviews Shortcode (CVSS 7.5, WP Ultimate Review)
- [CVE-2026-101160](https://cve.now/CVE-2026-101160.md): WP Ultimate Review \< 2.4.4 - Unauthenticated DoS via Non-Numeric Review Rating (CVSS 7.5, WP Ultimate Review)
- [CVE-2026-101159](https://cve.now/CVE-2026-101159.md): WP Ultimate Review \< 2.4.4 - Unauthenticated Stored XSS via Review Submission (CVSS 7.5, WP Ultimate Review)
- [CVE-2026-103888](https://cve.now/CVE-2026-103888.md): WPC Smart Quick View for WooCommerce \<= 4.4.0 - Reflected Cross-Site Scripting via 'woosq-redirect' Parameter (CVSS 6.1, wpclever WPC Smart Quick View for WooCommerce)
- [CVE-2026-103909](https://cve.now/CVE-2026-103909.md): Calculated Fields Form \<= 5.5.1.5 - Reflected DOM-Based Cross-Site Scripting via URL Parameter Substitution in Calculated Field Equation (CVSS 6.1, codepeople Calculated Fields Form – AI Form Builder for Wor…)
- [CVE-2026-96575](https://cve.now/CVE-2026-96575.md): Transliterator \<= 2.5.8 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable {rstr\_keep} Placeholder (CVSS 7.2, ivijanstefan Transliterator – Multilingual and Multi-script…)
- [CVE-2026-100148](https://cve.now/CVE-2026-100148.md): Rich Showcase for Google Reviews \<= 7.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Google Review Text (imported via Places API) (CVSS 6.4, widgetpack Rich Showcase for Google Reviews)
- [CVE-2026-101357](https://cve.now/CVE-2026-101357.md): SEOPress \<= 10.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'seopress\_google\_analytics\_matomo\_id' Parameter (CVSS 4.9, rainbowgeek SEOPress – AI SEO Plugin & On-site SEO)
- [CVE-2026-100149](https://cve.now/CVE-2026-100149.md): WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons \<= 4.7.3 - Unauthenticated Sensitive Information Disclosure via HMAC Signature Collision (Missing Domain Separation) in HMAC Signature Domain-Separation Flaw in \`/yamidoo/v1/customer\`… (CVSS 5.3, WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Shar…)
- [CVE-2026-87091](https://cve.now/CVE-2026-87091.md): Welcart e-Commerce \<= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parameters (CVSS 7.2, uscnanbu Welcart e-Commerce)
- [CVE-2026-101923](https://cve.now/CVE-2026-101923.md): Photo Reviews for WooCommerce \<= 1.2.30 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'wcpr\_image\_upload\_id' Parameter (CVSS 8.1, villatheme Photo Reviews for WooCommerce)
- [CVE-2026-97337](https://cve.now/CVE-2026-97337.md): Simple Membership \<= 4.8.3 - Missing Authorization to Unauthenticated Account Takeover and Sensitive Information Disclosure via 'email' Parameter on Activation Endpoints (CVSS 7.5, wpinsider-1 Simple Membership)
- [CVE-2025-12828](https://cve.now/CVE-2025-12828.md): Ultra Addons Lite for Elementor \<= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Type Out Widget (CVSS 6.4, ultrapressorg Ultra Addons Lite for Elementor)
- [CVE-2026-100152](https://cve.now/CVE-2026-100152.md): All in One SEO \<= 5.0.2 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Query Parameter (CVSS 6.5, smub All in One SEO – AI SEO Plugin to Boost SEO Rankings &…)
- [CVE-2026-101928](https://cve.now/CVE-2026-101928.md): Magic Tooltips For Contact Form 7 \<= 1.0.34 - Unauthenticated Stored Cross-Site Scripting via 'esc\_html' Filter Override via Comment Author (CVSS 7.2, magicplugins Magic Tooltips For Contact Form)
- [CVE-2026-96564](https://cve.now/CVE-2026-96564.md): SEOPress \<= 10.2 - Unauthenticated Stored Cross-Site Scripting via Author Display Name (CVSS 7.2, rainbowgeek SEOPress – AI SEO Plugin & On-site SEO)
- [CVE-2026-96650](https://cve.now/CVE-2026-96650.md): Strong Testimonials \<= 3.3.11 - Unauthenticated Stored Cross-Site Scripting via 'platform\_user\_photo' Custom Field (CVSS 7.2, wpchill Strong Testimonials)
- [CVE-2026-93430](https://cve.now/CVE-2026-93430.md): GD Rating System \<= 3.7.1 - Unauthenticated Stored Cross-Site Scripting via 'title' and 'url' Render Args in gdrts\_live\_handler AJAX (CVSS 7.2, gdragon GD Rating System)
- [CVE-2026-103913](https://cve.now/CVE-2026-103913.md): GeoDirectory \<= 2.8.186 - Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listing (CVSS 7.5, paoltaia GeoDirectory – WP Business Directory Plugin and Cl…)
- [CVE-2026-97341](https://cve.now/CVE-2026-97341.md): Visitor Traffic Real Time Statistics \<= 8.16 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header (CVSS 7.2, wp-buy Visitor Traffic Real Time Statistics)
- [CVE-2026-97344](https://cve.now/CVE-2026-97344.md): Wp Social Login and Register Social Counter \<= 3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write (CVSS 6.4, roxnor Wp Social Login and Register Social Counter)
- [CVE-2026-91108](https://cve.now/CVE-2026-91108.md): Alt Text AI \<= 1.10.41 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Content Modification via atai\_enrich\_post\_content AJAX Action (CVSS 4.3, alttextai Alt Text AI – Automatically generate image alt te…)
- [CVE-2026-11399](https://cve.now/CVE-2026-11399.md): Helpdesk Support Ticket System for WooCommerce \<= 2.1.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Ticket Response Deletion via 'id' Parameter (CVSS 4.3, wpcodefactory Helpdesk Support Ticket System for WooCommerce)
- [CVE-2026-92727](https://cve.now/CVE-2026-92727.md): EmbedPress \<= 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slidesShow' Block Attribute (CVSS 6.4, wpdevteam EmbedPress – PDF Embedder, 3D PDF FlipBook, Googl…)
- [CVE-2026-92538](https://cve.now/CVE-2026-92538.md): LearnPress \<= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter (CVSS 6.1, thimpress LearnPress – WordPress LMS Plugin for Create and…)
- [CVE-2026-92826](https://cve.now/CVE-2026-92826.md): EWWW Image Optimizer \<= 8.7.7 - Reflected Cross-Site Scripting via REQUEST\_URI Parameter Key (CVSS 6.1, nosilver4u EWWW Image Optimizer)
- [CVE-2026-97644](https://cve.now/CVE-2026-97644.md): Groundhogg \<= 4.9 - Authenticated (Sales Person+) Privilege Escalation via Contact Identity Rebinding leading to Administrator Account Takeover to 'user\_id' Parameter (v3 /contacts) chained with v4 /emails/test (CVSS 8.8, trainingbusinesspros Groundhogg — CRM, Newsletters, and Mar…)
- [CVE-2026-92977](https://cve.now/CVE-2026-92977.md): Real Cookie Banner: GDPR & ePrivacy Cookie Consent \<= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via Comment (CVSS 7.2, devowl Real Cookie Banner: GDPR & ePrivacy Cookie Consent)
- [CVE-2026-92551](https://cve.now/CVE-2026-92551.md): Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content \<= 4.17.4 - Reflected Cross-Site Scripting via ppress\_billing\_address Filename Parameter (CVSS 6.1, properfraction Paid Membership Plugin, Ecommerce, User Regi…)
- [CVE-2026-92536](https://cve.now/CVE-2026-92536.md): Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content \<= 4.17.4 - Authenticated (Subscriber+) Sensitive Information Exposure via Shortcode Injection via Nickname and Biographical Info Profile Fields (CVSS 8.8, properfraction Paid Membership Plugin, Ecommerce, User Regi…)
- [CVE-2026-93428](https://cve.now/CVE-2026-93428.md): Ultimate Member \<= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass (CVSS 7.5, ultimatemember Ultimate Member – User Profile, Registration…)
- [CVE-2026-92243](https://cve.now/CVE-2026-92243.md): Ivory Search \<= 5.5.18 - Reflected DOM-Based Cross-Site Scripting via 's' Parameter (CVSS 6.1, vinod-dalvi Ivory Search – WordPress Search Plugin)
- [CVE-2026-94539](https://cve.now/CVE-2026-94539.md): SupportCandy \<= 3.5.3 - Authenticated (Custom+) SQL Injection via 'sort\_by' Parameter (CVSS 6.5, psmplugins SupportCandy – AI Customer Support Ticket System…)
- [CVE-2026-94378](https://cve.now/CVE-2026-94378.md): SupportCandy \<= 3.5.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'name' Parameter (CVSS 6.4, psmplugins SupportCandy – AI Customer Support Ticket System…)
- [CVE-2026-100180](https://cve.now/CVE-2026-100180.md): Jeg Kit for Elementor \<= 3.2.19 - Unauthenticated Stored Cross-Site Scripting via Comment (CVSS 5.4, jegtheme Jeg Kit for Elementor – Powerful Addons for Elemen…)
- [CVE-2026-96270](https://cve.now/CVE-2026-96270.md): Ultimate Member \<= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form\_id' Parameter (CVSS 7.2, ultimatemember Ultimate Member – User Profile, Registration…)
- [CVE-2026-95865](https://cve.now/CVE-2026-95865.md): Beaver Builder Page Builder \<= 2.11.0.5 - Authenticated (Contributor+) SQL Injection via 'fields\[\]\[value\]' Parameter (CVSS 6.5, beaverbuilder Beaver Builder Page Builder – Drag and Drop W…)
- [CVE-2026-105090](https://cve.now/CVE-2026-105090.md): Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. (CVSS 5.1, Formbricks)
- [CVE-2026-105083](https://cve.now/CVE-2026-105083.md): ImageMagick before 7.1.2-32 and 6.9.13-57 Security Policy Bypass via policy.xml DOCTYPE (CVSS 1.8, ImageMagick)
- [CVE-2026-79113](https://cve.now/CVE-2026-79113.md): OpenAPV before 1.1.1.0 has a read\_bitstream heap-based buffer overflow. (CVSS 5.1, aswf OpenAPV)
- [CVE-2026-105080](https://cve.now/CVE-2026-105080.md): In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Cali (CVSS 9.4, C4illin ConvertX)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-10-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.