# CVEs published 2026-10-31

111 CVEs were published on October 31, 2026: 10 critical, 41 high. 9 early warnings were posted. Days are UTC.
## Early warnings

- [SZB-2884815801](https://cve.now/SZB-2884815801): Japan Airlines says Amadeus passenger system breach exposed about 92,000 customers
- [SZB-d172816815](https://cve.now/SZB-d172816815): Polymarket suspends trading after reported third-party compromise, per BleepingComputer
- [SZB-a4df36c045](https://cve.now/SZB-a4df36c045): Northflank warns breach led to unauthorized use of customers' AI API keys
- [SZB-34aa303ce5](https://cve.now/SZB-34aa303ce5): BleepingComputer reports public exploit for patched Android flaw CVE-2026-58882
- [SZB-7d756337c8](https://cve.now/SZB-7d756337c8): Chainalysis confirms intrusion exposing non-sensitive customer data
- [SZB-244b3755f3](https://cve.now/SZB-244b3755f3): Malicious Claude Code VS Code extension was distributed via Cursor marketplace, per BleepingComputer
- [SZB-8c692d7c3c](https://cve.now/SZB-8c692d7c3c): Binance reports breach; North Korea blamed for reported $6.3B theft
- [SZB-31aa1da420](https://cve.now/SZB-31aa1da420): CISA adds two Ivanti Connect Secure flaws to KEV after active exploitation
- [SZB-58cc390643](https://cve.now/SZB-58cc390643): CISA orders federal patching of Linux kernel flaw exploited alongside PHP2Shell

## CVEs

- [CVE-2026-115946](https://cve.now/CVE-2026-115946.md): XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder (no CVSS, XS-libbrotli)
- [CVE-2026-120185](https://cve.now/CVE-2026-120185.md): ken678 YznCMS Auth Group Group.php Backend privileges management (CVSS 5.1, ken678 YznCMS)
- [CVE-2026-120135](https://cve.now/CVE-2026-120135.md): Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by default (CVSS 8.2, Apache Software Foundation Apache Thrift)
- [CVE-2026-118636](https://cve.now/CVE-2026-118636.md): Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder (CVSS 9.8, Apache Software Foundation Apache MINA)
- [CVE-2026-118147](https://cve.now/CVE-2026-118147.md): Visual Studio Spoofing Vulnerability (CVSS 7.4, Microsoft Visual Studio)
- [CVE-2026-120210](https://cve.now/CVE-2026-120210.md): FFmpeg 5.0 through 9.0.2 Path Traversal via IMF Demuxer ASSETMAP Path (CVSS 5.3, FFmpeg)
- [CVE-2026-120209](https://cve.now/CVE-2026-120209.md): AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token (CVSS 9.3, anji-plus AJ-Report)
- [CVE-2026-120208](https://cve.now/CVE-2026-120208.md): libheif 1.18.0 before 1.23.3 Heap Buffer Overflow via unci Mixed-Interleave Decoder (CVSS 7.7, strukturag libheif)
- [CVE-2026-120207](https://cve.now/CVE-2026-120207.md): Thelia Page Module before 2.0.4 CSRF via Page Tag, Document and Image Delete Routes (CVSS 7.0, Thelia Page Module)
- [CVE-2026-120206](https://cve.now/CVE-2026-120206.md): Thelia before 3.2.0 Back-Office CSRF via URL Token and Unprotected Actions (CVSS 5.9, Thelia)
- [CVE-2026-120205](https://cve.now/CVE-2026-120205.md): Thelia before 3.1.0 Stored XSS via Coupon Condition Customer Name (CVSS 7.4, Thelia)
- [CVE-2026-120204](https://cve.now/CVE-2026-120204.md): DeepInfer through 0.1.0 Path Traversal via /profile output\_dir Parameter (CVSS 6.3, deepseek-ai DeepInfer)
- [CVE-2026-120203](https://cve.now/CVE-2026-120203.md): ShowDoc 2.8.14 before 3.9.6 Code Injection via Mock Templates (CVSS 8.7, ShowDoc)
- [CVE-2026-120202](https://cve.now/CVE-2026-120202.md): Highflame ramparts 0.8.1 through 0.8.10 Skill Bundle Scan Bypass via Nested .pyc (CVSS 7.1, highflame-ai ramparts)
- [CVE-2026-120201](https://cve.now/CVE-2026-120201.md): Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header (CVSS 9.3, dromara Jpom)
- [CVE-2026-120200](https://cve.now/CVE-2026-120200.md): Nexterm through 1.2.2-BETA Missing Authorization in Server Session Lifecycle Routes (CVSS 5.3, gnmyt Nexterm)
- [CVE-2026-120199](https://cve.now/CVE-2026-120199.md): LearnHouse before 1.1.1 Missing Authorization via Assignment Submissions API (CVSS 5.3, learnhouse)
- [CVE-2026-102212](https://cve.now/CVE-2026-102212.md): Pre-Auth Heap Buffer Overflow in the Multipart Request (CVSS 8.4, Opengear IM7200 · Opengear CM7100 +1)
- [CVE-2026-78192](https://cve.now/CVE-2026-78192.md): WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer in the default… (no CVSS, WebDyne)
- [CVE-2026-78191](https://cve.now/CVE-2026-78191.md): WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages (no CVSS, WebDyne)
- [CVE-2026-78190](https://cve.now/CVE-2026-78190.md): WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing cross-site scripting (no CVSS, WebDyne)
- [CVE-2026-78189](https://cve.now/CVE-2026-78189.md): WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route… (no CVSS, WebDyne)
- [CVE-2026-78188](https://cve.now/CVE-2026-78188.md): WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes (no CVSS, WebDyne)
- [CVE-2026-15272](https://cve.now/CVE-2026-15272.md): Web 2.0 Directory \<= 2.10.12 - Unauthenticated SQL Injection via 'w2dc\_level\_filter' Parameter (CVSS 6.5, Shamalli Web 2.0 Directory plugin for WordPress)
- [CVE-2026-120194](https://cve.now/CVE-2026-120194.md): Json-glib: json-glib: infinite loop in json\_path\_query() with negative jsonpath slice step (CVSS 7.5, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-118599](https://cve.now/CVE-2026-118599.md): epiphany: TAR-based .xpi with hard links can overwrite user files during WebExtension install (CVSS 5.5, GNOME Epiphany)
- [CVE-2026-118598](https://cve.now/CVE-2026-118598.md): epiphany: clipboard/website-data permission prompt incorrectly grants camera and microphone access (CVSS 6.5, GNOME Epiphany)
- [CVE-2026-104926](https://cve.now/CVE-2026-104926.md): WooCommerce Extra Product Options Pro \<= 3.3.2 - Reflected Cross-Site Scripting via '\<fieldname\>\_start' / '\<fieldname\>\_end' Parameter (CVSS 6.1, ThemeHigh WooCommerce Extra Product Options Pro)
- [CVE-2026-109231](https://cve.now/CVE-2026-109231.md): Germanized for WooCommerce \<= 4.1.4 - Authenticated (Subscriber+) Unauthorized Access of Private Data via Activation Token Reuse via… (CVSS 4.3, vendidero Germanized for WooCommerce)
- [CVE-2026-107711](https://cve.now/CVE-2026-107711.md): FlexStock \<= 3.17.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post\_content' Parameter via REST update endpoint (CVSS 6.4, wppool FlexStock – Product Stock Sync with Google Sheets fo…)
- [CVE-2026-120114](https://cve.now/CVE-2026-120114.md): Debug Log Manager \<= 2.5.2 - Unauthenticated Stored Cross-Site Scripting via 'log\_js\_errors' AJAX Endpoint (CVSS 7.2, qriouslad Debug Log Manager – Conveniently Monitor and Insp…)
- [CVE-2026-100151](https://cve.now/CVE-2026-100151.md): Ninja Forms \<= 3.15.5 - Reflected DOM-Based Cross-Site Scripting via 'querystring:\<key\>' URL Parameter (CVSS 6.1, kstover Ninja Forms – Contact Form Builder with Calculators…)
- [CVE-2026-109197](https://cve.now/CVE-2026-109197.md): WP Directory Kit \<= 1.6.0 - Unauthenticated SQL Injection via 'idfield' Parameter (CVSS 7.5, wpdirectorykit WP Directory Kit)
- [CVE-2026-96554](https://cve.now/CVE-2026-96554.md): BuddyBoss Platform \<= 3.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Group Name (CVSS 6.4, Boss Media BuddyBoss Platform)
- [CVE-2026-76010](https://cve.now/CVE-2026-76010.md): Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery \<= 4.4.1 - Authenticated (Custom+) Remote Code Execution via XML-RPC… (CVSS 8.8, smub Photo Gallery, Sliders, Proofing and Themes – NextGEN…)
- [CVE-2026-116752](https://cve.now/CVE-2026-116752.md): GeoDirectory \<= 2.8.197 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post\_images' Image Title Delimiter Injection (CVSS 6.4, paoltaia GeoDirectory – WP Business Directory Plugin and Cl…)
- [CVE-2026-117681](https://cve.now/CVE-2026-117681.md): Konflux-ci: ui proxy skips backend tls verification on non-openshift clusters, leaking a token that can impersonate anyone (CVSS 8.0, konflux-ci)
- [CVE-2026-116964](https://cve.now/CVE-2026-116964.md): Konflux-ci: remote code execution via eval() in manifest scripts (CVSS 8.4, konflux-ci)
- [CVE-2026-116086](https://cve.now/CVE-2026-116086.md): Konflux-ci: jq filter injection in github workflow issue management (CVSS 8.8, konflux-ci)
- [CVE-2026-114217](https://cve.now/CVE-2026-114217.md): Konflux-ci: github token plaintext exposure in ci/cd scripts (CVSS 8.6, konflux-ci)
- [CVE-2026-101325](https://cve.now/CVE-2026-101325.md): Newsletters \<= 4.18.1 - Authenticated (Subscriber+) SQL Injection via 'id' Parameter (CVSS 5.3, contrid Newsletters)
- [CVE-2026-110530](https://cve.now/CVE-2026-110530.md): FeedWordPress \<= 2026.0517 - Unauthenticated Stored Cross-Site Scripting via Syndicated Feed Content (CVSS 7.2, radgeek FeedWordPress)
- [CVE-2026-120075](https://cve.now/CVE-2026-120075.md): WP Activity Log \<= 5.6.1 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, melapress WP Activity Log)
- [CVE-2026-103882](https://cve.now/CVE-2026-103882.md): Acadlix LMS \<= 1.1.9 - Unauthenticated Arbitrary File Deletion via 'delete\_file\_data.file\_path' Parameter (CVSS 9.1, Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin fo…)
- [CVE-2026-119160](https://cve.now/CVE-2026-119160.md): Smart Post \<= 4.0.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User display\_name via Author Filter block (CVSS 6.4, shapedplugin Smart Post – Post Grid, Post Carousel, Post Sl…)
- [CVE-2026-109367](https://cve.now/CVE-2026-109367.md): All in One SEO \<= 5.0.3 - Unauthenticated Sensitive Information Disclosure in 's' Search Query Parameter (CVSS 5.3, smub All in One SEO – AI SEO Plugin to Boost SEO Rankings &…)
- [CVE-2026-118235](https://cve.now/CVE-2026-118235.md): SimpleForm \<= 3.10.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename via Unknown File Key in simpleform\_get\_submit\_data (CVSS 9.8, wpazleen SimpleForm – Form Maker to Chat Apps with Quiz, Po…)
- [CVE-2026-103915](https://cve.now/CVE-2026-103915.md): Booking for Appointments and Events Calendar \<= 2.4.12 - Unauthenticated Sensitive Information Exposure in 'page' Parameter (CVSS 5.3, melograno Booking for Appointments and Events Calendar – Am…)
- [CVE-2026-120070](https://cve.now/CVE-2026-120070.md): User Frontend \<= 4.3.13 - Authenticated (Subscriber+) Privilege Escalation via post\_content Parameter (CVSS 8.8, wedevs User Frontend – Membership, User Registration, User…)
- [CVE-2026-103898](https://cve.now/CVE-2026-103898.md): Wp Social Login and Register Social Counter \<= 3.2.2 - Unauthenticated Authentication Bypass via Insufficient Email Verification in Social… (CVSS 8.1, roxnor Wp Social Login and Register Social Counter)
- [CVE-2026-111070](https://cve.now/CVE-2026-111070.md): Content Pilot \<= 2.2.4 - Unauthenticated Stored Cross-Site Scripting via RSS-linked article \`\<meta name="description"\>\` (CVSS 5.4, pluginever Content Pilot – Autoblogging & Affiliate Marketi…)
- [CVE-2026-107759](https://cve.now/CVE-2026-107759.md): WPO365 | MICROSOFT 365 GRAPH MAILER \<= 6.2 - Unauthenticated Stored Cross-Site Scripting via Email Subject via wp\_mail (CVSS 7.2, WPO365 | MICROSOFT 365 GRAPH MAILER)
- [CVE-2026-116512](https://cve.now/CVE-2026-116512.md): Project Manager \<= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection (CVSS 9.8, wedevs Project Manager – AI Powered Project Management, Tas…)
- [CVE-2026-103997](https://cve.now/CVE-2026-103997.md): Redux Framework \<= 4.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via… (CVSS 6.5, davidanderson Redux Framework)
- [CVE-2025-11455](https://cve.now/CVE-2025-11455.md): Perfect Images \<= 7.2.0 - Missing Authorization to Authenticated (Author+) Image Replacement (CVSS 4.3, tigroumeow Perfect Images: Regenerate Thumbnails, Image Siz…)
- [CVE-2025-9462](https://cve.now/CVE-2025-9462.md): WP2LEADS \<= 3.5.6 - Authenticated (Subscriber+) SQL Injection via order Parameter (CVSS 6.5, tobias\_conrad WP2LEADS | WordPress und KlickTipp einfach v…)
- [CVE-2026-103962](https://cve.now/CVE-2026-103962.md): User Frontend \<= 4.3.13 - Reflected Cross-Site Scripting via 'field\_attr\[required\]' Parameter (CVSS 6.1, wedevs User Frontend – Membership, User Registration, User…)
- [CVE-2026-116535](https://cve.now/CVE-2026-116535.md): SEOPress \<= 10.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display\_name' Profile Field via %%archive\_title%% Template… (CVSS 6.4, rainbowgeek SEOPress – AI SEO Plugin & On-site SEO)
- [CVE-2026-119096](https://cve.now/CVE-2026-119096.md): Uncanny Toolkit for LearnDash \<= 3.8.2 - Unauthenticated Authentication Bypass via 'email' Parameter (CVSS 9.8, uncannyowl Uncanny Toolkit for LearnDash)
- [CVE-2026-118057](https://cve.now/CVE-2026-118057.md): Shield Security \<= 22.3.2 - Unauthenticated Stored Cross-Site Scripting via Request Path (REQUEST\_URI) in Traffic Log (CVSS 7.2, paultgoodchild Shield Security – Smart Bot Blocking, Brute-…)
- [CVE-2026-110023](https://cve.now/CVE-2026-110023.md): WP Data Access \<= 5.5.88 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'rel\_tab' Parameter (CVSS 5.9, peterschulznl WP Data Access – App Builder for Tables, Form…)
- [CVE-2026-111592](https://cve.now/CVE-2026-111592.md): Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors \<= 4.17.0 - Authenticated (Subscriber+) Stored… (CVSS 6.4, Co-Authors, Multiple Authors and Guest Authors in an Author…)
- [CVE-2026-104012](https://cve.now/CVE-2026-104012.md): Rox Appointment Booking \<= 1.3.1 - Unauthenticated Privilege Escalation via Mass Assignment to Mass Assignment via '/public/booking'… (CVSS 8.8, roxnor Rox Appointment Booking – Event, Calendar & Appointm…)
- [CVE-2026-11396](https://cve.now/CVE-2026-11396.md): Product Filter for WooCommerce by WBW \<= 3.4.6 - Missing Authorization to Unauthenticated Information Disclosure via… (CVSS 5.3, woobewoo Product Filter for WooCommerce by WBW)
- [CVE-2026-109386](https://cve.now/CVE-2026-109386.md): Hustle \<= 7.8.14.3 - Missing Authorization to Authenticated (Custom+) ESP Credential Overwrite and Irreversible OAuth Token Deletion via… (CVSS 4.3, wpmudev Hustle – Email Marketing, Lead Generation, Optins,…)
- [CVE-2026-119166](https://cve.now/CVE-2026-119166.md): Welcart e-Commerce \<= 2.12.5 - Account Takeover via Insecure Direct Object Reference to Unauthenticated User Input via 'member\[ID\]'… (CVSS 5.3, uscnanbu Welcart e-Commerce)
- [CVE-2026-119065](https://cve.now/CVE-2026-119065.md): Shipping Zones by Drawing for WooCommerce \<= 3.3.0 - Unauthenticated Stored Cross-Site Scripting via 'szbd-picked' Checkout Parameter (CVSS 7.2, arosoft Shipping Zones by Drawing for WooCommerce)
- [CVE-2026-109217](https://cve.now/CVE-2026-109217.md): PDF Invoices & Packing Slips for WooCommerce \<= 5.16.5 - Unauthenticated Sensitive Information Exposure via Yearly-Reset Invoice… (CVSS 5.3, wpovernight PDF Invoices & Packing Slips for WooCommerce)
- [CVE-2026-116548](https://cve.now/CVE-2026-116548.md): VikRentCar Car Rental Management System \<= 1.4.10 - Unauthenticated Stored Cross-Site Scripting via 'optionals' Parameter (CVSS 7.2, e4jvikwp VikRentCar Car Rental Management System)
- [CVE-2026-110251](https://cve.now/CVE-2026-110251.md): Photo Reviews for WooCommerce \<= 1.2.31 - Unauthenticated File Deletion via 'wcpr\_image\_upload\_id' Parameter (CVSS 5.4, villatheme Revopic – Photo Reviews for WooCommerce)
- [CVE-2026-116557](https://cve.now/CVE-2026-116557.md): WP Booking System \<= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs\_calendar\_remove\_note… (CVSS 9.1, murgroland WP Booking System – Booking Calendar)
- [CVE-2026-118070](https://cve.now/CVE-2026-118070.md): Welcart e-Commerce \<= 2.12.5 - Unauthenticated Stored Cross-Site Scripting via 'gid' Parameter (CVSS 7.2, uscnanbu Welcart e-Commerce)
- [CVE-2026-115840](https://cve.now/CVE-2026-115840.md): VikRentCar Car Rental Management System \<= 1.4.9 - Unauthenticated Stored Cross-Site Scripting via 'poplink' Parameter (CVSS 7.2, e4jvikwp VikRentCar Car Rental Management System)
- [CVE-2026-107750](https://cve.now/CVE-2026-107750.md): PDF Invoices & Packing Slips for WooCommerce \<= 5.16.4 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name /… (CVSS 7.2, wpovernight PDF Invoices & Packing Slips for WooCommerce)
- [CVE-2026-88942](https://cve.now/CVE-2026-88942.md): Product Filter for WooCommerce by WBW \<= 3.4.6 - Reflected Cross-Site Scripting via 'wpf\_fid' JSON Parameter (CVSS 6.1, woobewoo Product Filter for WooCommerce by WBW)
- [CVE-2026-119980](https://cve.now/CVE-2026-119980.md): UsersWP \<= 1.2.78 - Unauthenticated Account Access via Predictable Dummy User Password Disclosed through Registration Form Hash (CVSS 6.5, stiofansisland UsersWP – Front-end login form, User Registr…)
- [CVE-2026-90960](https://cve.now/CVE-2026-90960.md): Seraphinite Accelerator \<= 2.29.24 - Unauthenticated Sensitive Information Exposure in Object Cache Directory (CVSS 5.3, seraphinitesoft Seraphinite Accelerator)
- [CVE-2026-119162](https://cve.now/CVE-2026-119162.md): User Submitted Posts \<= 20260916 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user-submitted-content' Parameter via… (CVSS 7.2, specialk User Submitted Posts – Enable Users to Submit Post…)
- [CVE-2026-107765](https://cve.now/CVE-2026-107765.md): Discussion Board \<= 2.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Profile Website (user\_url) Field (CVSS 6.4, marketingfire Discussion Board – WordPress Forum Plugin)
- [CVE-2026-120040](https://cve.now/CVE-2026-120040.md): Mail logging & Catcher \<= 2.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure to Privilege Escalation to Mail Log Viewer /… (CVSS 7.5, wardee Mail logging & Catcher)
- [CVE-2026-116546](https://cve.now/CVE-2026-116546.md): WP Job Portal \<= 2.7.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'degreetitle' Parameter (CVSS 6.4, wpjobportal WP Job Portal – AI-Powered Recruitment System f…)
- [CVE-2026-116522](https://cve.now/CVE-2026-116522.md): Relevanssi \<= 4.28.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Late Entity Decode (CVSS 7.2, comesio Relevanssi – A Better Search)
- [CVE-2026-119089](https://cve.now/CVE-2026-119089.md): ThirstyAffiliates \<= 3.12.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via \<ta\> Tag (CVSS 7.2, supercleanse ThirstyAffiliates – Affiliate Links, Link Bran…)
- [CVE-2026-120019](https://cve.now/CVE-2026-120019.md): W3 Total Cache \<= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable Minify Placeholder (CVSS 5.4, boldgrid W3 Total Cache)
- [CVE-2026-107653](https://cve.now/CVE-2026-107653.md): SureCart \<= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via 'manual-payment-instructions' Attribute of… (CVSS 7.2, SureCart – Ecommerce Made Easy For Selling Physical Product…)
- [CVE-2026-119163](https://cve.now/CVE-2026-119163.md): FunnelKit Automations \<= 3.8.5.2 - Unauthenticated SQL Injection via 'bwfan\_cart\_id' Parameter (CVSS 7.5, teamfunnelkit FunnelKit Automations – Email Marketing Autom…)
- [CVE-2026-109220](https://cve.now/CVE-2026-109220.md): PDF Invoice for WooCommerce + Drag and Drop Template Builder \<= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution via… (CVSS 9.8, addonsorg PDF Invoice for WooCommerce + Drag and Drop Templ…)
- [CVE-2026-89270](https://cve.now/CVE-2026-89270.md): Popup Builder \<= 4.4.5 - Missing Authorization to Unauthenticated Arbitrary Popup Post Trashing via 'post\_type' and 'sg\_popup\_preview\_id'… (CVSS 9.1, popupbuilder Popup Builder – Create highly converting, mobi…)
- [CVE-2026-111109](https://cve.now/CVE-2026-111109.md): Webmention \<= 5.10.1 - Unauthenticated Stored Cross-Site Scripting via Open Graph og:title Meta Tag (CVSS 6.1, pfefferle Webmention)
- [CVE-2026-111254](https://cve.now/CVE-2026-111254.md): W3 Total Cache \<= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content Cached as HTML after License Expiry (CVSS 7.2, boldgrid W3 Total Cache)
- [CVE-2026-94361](https://cve.now/CVE-2026-94361.md): PAYable IPG \< 1.3.1 - Unauthenticated Order Payment Forgery via Unsigned Callback (no CVSS, Payable Payment Gateway for WooCommerce)
- [CVE-2026-82214](https://cve.now/CVE-2026-82214.md): Quick Event Manager 8.4.6 - 9.18 - Unauthenticated Private and Draft Content Disclosure via ICS Download (no CVSS, Quick Event Manager)
- [CVE-2026-118638](https://cve.now/CVE-2026-118638.md): Mapster WP Maps \< 2.0.6 - Unauthenticated Arbitrary Post Modification via save-mapmaker REST Route (no CVSS, Mapster WP Maps)
- [CVE-2026-118629](https://cve.now/CVE-2026-118629.md): All-in-One Video Gallery \< 5.0.0 - Unauthenticated Private and Draft Video Disclosure (no CVSS, All-in-One Video Gallery)
- [CVE-2026-118438](https://cve.now/CVE-2026-118438.md): Firelight Lightbox \< 2.3.24 - Contributor+ Stored XSS via Image 'src' Attribute (no CVSS, Firelight Lightbox)
- [CVE-2026-118437](https://cve.now/CVE-2026-118437.md): BuddyForms 2.8.8 - 2.10.0 - Unauthenticated Guest Attachment Deletion (no CVSS, BuddyForms)
- [CVE-2026-118185](https://cve.now/CVE-2026-118185.md): Security Optimizer \< 1.6.9 - 2FA Bypass via Missing Rate Limiting (no CVSS, Security Optimizer)
- [CVE-2026-118184](https://cve.now/CVE-2026-118184.md): Premium Packages \< 7.2.2 - Unauthenticated Order Total Manipulation (no CVSS, Premium Packages)
- [CVE-2026-118043](https://cve.now/CVE-2026-118043.md): Bulk Media Register \< 2.01 - Author+ Arbitrary File Move via Path Traversal (no CVSS, Bulk Media Register)
- [CVE-2026-110808](https://cve.now/CVE-2026-110808.md): Essential Addons for Elementor 6.6.0 - 6.8.7 - Author+ Privilege Escalation via register\_user\_role (no CVSS, Essential Addons for Elementor)
- [CVE-2026-110042](https://cve.now/CVE-2026-110042.md): Payment Forms for Paystack \< 4.0.6 - Contributor+ Sensitive Information Disclosure via Settings Page (no CVSS, Payment Forms for Paystack)
- [CVE-2026-116520](https://cve.now/CVE-2026-116520.md): PPWP \<= 1.9.26 - Unauthenticated Stored Cross-Site Scripting via '\[ppwp\]' Shortcode 'desc\_below\_form' Attribute via Placeholder Marker… (CVSS 7.2, buildwps PPWP – Password Protect Pages)
- [CVE-2026-100155](https://cve.now/CVE-2026-100155.md): Ninja Forms \<= 3.15.5 - Unauthenticated Arbitrary Shortcode Execution via 'formData' Field Value via Success Message Merge Tag (CVSS 6.5, kstover Ninja Forms – Contact Form Builder with Calculators…)
- [CVE-2026-92294](https://cve.now/CVE-2026-92294.md): Spectra Gutenberg Blocks \<= 2.20.4 - Missing Authorization to Unauthenticated Limited Theme File Deletion and Modification via 'page'… (CVSS 6.5, brainstormforce Spectra Legacy – Gutenberg Blocks)
- [CVE-2026-109997](https://cve.now/CVE-2026-109997.md): Ninja Forms \<= 3.15.5 - Unauthenticated Stored Cross-Site Scripting via 'extra' Parameter via Metadata Key Normalization (CVSS 7.2, kstover Ninja Forms – Contact Form Builder with Calculators…)
- [CVE-2026-119977](https://cve.now/CVE-2026-119977.md): WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution (CVSS 8.1, WordPress Foundation WordPress)
- [CVE-2026-109234](https://cve.now/CVE-2026-109234.md): Meow Lightbox \<= 5.6.4 - Unauthenticated Stored Cross-Site Scripting via HTML Parser Quote-Metadata Desynchronization (CVSS 7.2, tigroumeow Meow Lightbox)
- [CVE-2026-116563](https://cve.now/CVE-2026-116563.md): Photo Gallery, Sliders, Proofing and Themes \<= 4.5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment \`title\` Attribute… (CVSS 5.4, smub Photo Gallery, Sliders, Proofing and Themes – NextGEN…)
- [CVE-2026-101326](https://cve.now/CVE-2026-101326.md): Ninja Forms \<= 3.15.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via '{wp:user\_display\_name}' Merge Tag via display\_name (CVSS 5.4, kstover Ninja Forms – Contact Form Builder with Calculators…)
- [CVE-2026-116755](https://cve.now/CVE-2026-116755.md): SoftIron HyperCloud: OS Command Injection in Orchestrator via Virtual Machine Template Fields (CVSS 7.4, SoftIron HyperCloud)
- [CVE-2026-110176](https://cve.now/CVE-2026-110176.md): File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers (CVSS 8.7, Drupal File Force Download)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-10-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.