Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

695772 source statements · aliases may refer to the same vulnerability

CVE-2026-93942Published

WordPress Dwell theme <= 1.16.0 - PHP Object Injection vulnerability

cve-program ·

https://themeforest.net: dwell

CVSS 3.1 9.8Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-93943Published

WordPress Convex theme <= 1.16.0 - PHP Object Injection vulnerability

cve-program ·

https://themeforest.net: convex

CVSS 3.1 9.8Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-62046Published

WordPress Gutentype theme <= 2.1.12 - PHP Object Injection vulnerability

cve-program ·

https://themeforest.net: gutentype

CVSS 3.1 9.8Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-62045Published

WordPress Booklovers theme <= 2.13.0 - PHP Object Injection vulnerability

cve-program ·

https://themeforest.net: booklovers

CVSS 3.1 9.8Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-105885Published

WordPress Slider by 10Web plugin <= 1.2.62 - PHP Object Injection vulnerability

cve-program ·

https://wordpress.org/plugins: slider-wd

CVSS 3.1 8.8Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-94676Published

WordPress Tainacan plugin <= 1.3.0 - PHP Object Injection vulnerability

cve-program ·

https://wordpress.org/plugins: tainacan

CVSS 3.1 7.2Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-66435Published

WordPress WP Rollback plugin <= 3.1.2 - Sensitive Data Exposure vulnerability

cve-program ·

https://wordpress.org/plugins: wp-rollback

CVSS 3.1 5.9Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-62044Published

WordPress Super Video Player plugin <= 1.8.13 - PHP Object Injection vulnerability

cve-program ·

https://wordpress.org/plugins: super-video-player

CVSS 3.1 7.2Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-106609Published

WordPress Bayarcash WooCommerce plugin <= 4.4.2 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: bayarcash-wc

CVSS 3.1 7.5Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-106608Published

WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerability

cve-program ·

https://wordpress.org/plugins: woocommerce

CVSS 3.1 7.2Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-103357Published

WordPress GIFT4U plugin <= 1.1.3 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: gift4u-gift-cards-all-in-one-for-woo

CVSS 4.0 6.9Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-103071Published

WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.3 - Content Injection vulnerability

cve-program ·

https://wordpress.org/plugins: woo-thank-you-page-customizer

CVSS 3.1 7.5Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-106610Published

WordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerability

cve-program ·

https://wordpress.org/plugins: miniorange-otp-verification

CVSS 3.1 9.8Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-94590Published

WordPress Sell Downloads plugin <= 1.2.3 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: sell-downloads

CVSS 3.1 6.5Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-39801Published

WordPress AIWU plugin <= 1.5.9 - Privilege Escalation vulnerability

cve-program ·

https://wordpress.org/plugins: ai-copilot-content-generator

CVSS 3.1 9.8Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-39802Published

WordPress Everest Backup plugin <= 2.3.13 - Remote Code Execution (RCE) vulnerability

cve-program ·

https://wordpress.org/plugins: everest-backup

CVSS 3.1 8.1Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-40777Published

WordPress WPSection plugin <= 1.5.1 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: wpsection

CVSS 3.1 8.1Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-40801Published

WordPress Wordable plugin <= 8.2.10 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: wordable

CVSS 3.1 8.1Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-40805Published

WordPress PeepSo plugin <= 9.0.5.4 - Arbitrary File Deletion vulnerability

cve-program ·

Vendor product: PeepSo

CVSS 3.1 7.7Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-40808Published

WordPress Jetpack VideoPress plugin <= 3.6 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: jetpack-videopress

CVSS 3.1 6.5Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-42705Published

WordPress Grand News theme <= 3.4 - Broken Access Control vulnerability

cve-program ·

Vendor product: Grand News

CVSS 3.1 7.5Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-42706Published

WordPress DK theme <= 3.2.1 - Broken Access Control vulnerability

cve-program ·

Vendor product: DK

CVSS 3.1 7.5Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-42719Published

WordPress Dynamic User Directory plugin <= 2.4 - PHP Object Injection vulnerability

cve-program ·

https://wordpress.org/plugins: dynamic-user-directory

CVSS 3.1 9.8Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-62021Published

WordPress Angio theme <= 1.1.1 - PHP Object Injection vulnerability

cve-program ·

Vendor product: Angio

CVSS 3.1 8.8Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-62022Published

WordPress Tonda Membership plugin <= 1.0.1 - Privilege Escalation vulnerability

cve-program ·

Vendor product: Tonda Membership

CVSS 3.1 9.8Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-62024Published

WordPress CodeBard Help Desk plugin <= 1.1.2 - Arbitrary File Upload vulnerability

cve-program ·

https://wordpress.org/plugins: codebard-help-desk

CVSS 3.1 9.9Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-62025Published

WordPress Tailored Tools plugin <= 3.0.3 - Arbitrary File Upload vulnerability

cve-program ·

https://wordpress.org/plugins: tailored-tools

CVSS 3.1 9.0Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-62033Published

WordPress uListing plugin <= 2.2.0 - Settings Change vulnerability

cve-program ·

https://wordpress.org/plugins: ulisting

CVSS 3.1 7.6Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-62035Published

WordPress AWS S3 for WordPress Plugin – Upcasted plugin <= 3.1.0 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: upcasted-s3-offload

CVSS 3.1 6.3Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-62038Published

WordPress eRoom plugin <= 1.7.1 - Broken Authentication vulnerability

cve-program ·

https://wordpress.org/plugins: eroom-zoom-meetings-webinar

CVSS 3.1 7.3Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-62098Published

WordPress Boutique theme <= 2.3.3 - Arbitrary Shortcode Execution vulnerability

cve-program ·

Vendor product: Boutique

CVSS 3.1 6.5Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-62118Published

WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: barcode-scanner-lite-pos-to-manage-products-inventory-and-orders

CVSS 3.1 7.3Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-62129Published

WordPress Creator LMS plugin <= 1.2.21 - Arbitrary File Upload vulnerability

cve-program ·

https://wordpress.org/plugins: creatorlms

CVSS 3.1 9.9Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-62130Published

WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.5.8 - PHP Object Injection vulnerability

cve-program ·

https://wordpress.org/plugins: woocommerce-multilingual

CVSS 3.1 7.2Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-65459Published

WordPress Forminator plugin <= 1.57.3 - Arbitrary Content Deletion vulnerability

cve-program ·

https://wordpress.org/plugins: forminator

CVSS 3.1 7.5Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-66481Published

WordPress Presto Player Pro plugin <= 3.0.1 - Arbitrary File Deletion vulnerability

cve-program ·

Vendor product: Presto Player Pro

CVSS 3.1 6.8Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-78530Published

WordPress FoodBakery theme <= 4.6 - Arbitrary File Deletion vulnerability

cve-program ·

Vendor product: FoodBakery

CVSS 3.1 7.7Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-107420Published

WordPress Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway plugin <= 1.7.2 - Bypass Vulnerability vulnerability

cve-program ·

https://wordpress.org/plugins: cryptocurrency-payments-using-metamask-for-woocommerce

CVSS 3.1 5.3Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-107434Published

WordPress MicroPayments plugin <= 3.2.9 - Bypass Vulnerability vulnerability

cve-program ·

https://wordpress.org/plugins: paid-membership

CVSS 3.1 5.4Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-103685Published

WordPress ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin <= 2.2.4 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: woo-alidropship

CVSS 3.1 4.3Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-62043Published

WordPress Contact Form 7 – Dynamic Text Extension plugin <= 5.0.7 - Sensitive Data Exposure vulnerability

cve-program ·

https://wordpress.org/plugins: contact-form-7-dynamic-text-extension

CVSS 3.1 7.5Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-42419Published

WordPress Swish Migrate and Backup plugin <= 1.4.0 - Sensitive Data Exposure vulnerability

cve-program ·

https://wordpress.org/plugins: swish-migrate-and-backup

CVSS 3.1 5.9Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-42630Published

WordPress Web Plura Backup & Restore Manager plugin <= 0.2.25 - Sensitive Data Exposure vulnerability

cve-program ·

https://wordpress.org/plugins: web-plura-backup-restore-manager

CVSS 3.1 7.5Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-96329Published

WordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: td-subscription

CVSS 3.1 8.5Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-96330Published

WordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: td-subscription

CVSS 3.1 9.3Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-96809Published

WordPress EduAdmin Booking plugin < 6.0.0 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: eduadmin-booking

CVSS 3.1 9.3Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-105889Published

WordPress Tickera plugin <= 3.6.0.6 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: tickera-event-ticketing-system

CVSS 3.1 9.3Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-40800Published

WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: elex-bulk-edit-products-prices-attributes-for-woocommerce-basic

CVSS 3.1 9.3Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-42633Published

WordPress Events Manager plugin <= 7.4.6 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: events-manager

CVSS 3.1 8.5Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-42712Published

WordPress Qode Tours plugin <= 3.1.3.2 - SQL Injection vulnerability

cve-program ·

Vendor product: Qode Tours

CVSS 3.1 8.5Source modified 11 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.