Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-18040
In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF(2^8) arithmetic used lookup tables indexed by field elements, maki...
|
5.9 Medium | — | 0,11% | 3 Okt 2026 |
|
CVE-2026-92767
The Twenty20 Image Before-After plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'offset' Shortcode Attribute in all versions up to, and including, 2...
|
6.4 Medium | — | 0,19% | 3 Okt 2026 |
|
CVE-2026-92084
The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and includi...
|
9.1 Critical | — | 0,53% | 3 Okt 2026 |
|
CVE-2026-104982
A flaw has been found in Linux Mint Xreader up to 4.6.5. This issue affects the function setup_document_content_list/g_strdup_printf of the file backend/epub/epub-documen...
|
4.3 Medium | — | 0,43% | 3 Okt 2026 |
|
CVE-2026-97660
The WPC Product Options for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name in all versions u...
|
7.2 High | — | 0,29% | 3 Okt 2026 |
|
CVE-2026-97343
The Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Improper Authentication leading to Account Persiste...
|
4.3 Medium | — | 0,30% | 3 Okt 2026 |
|
CVE-2026-96267
The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to generic SQL Injection via the 'fullRef' parameter in all versions up to, and including...
|
7.5 High | — | 0,33% | 3 Okt 2026 |
|
CVE-2026-94505
The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0...
|
8.1 High | — | 0,29% | 3 Okt 2026 |
|
CVE-2026-93896
The WPFront Notification Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.5.1. This is due to the debug-log ou...
|
6.1 Medium | — | 0,22% | 3 Okt 2026 |
|
CVE-2026-93889
The Mail logging – WP Mail Catcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PHPMailer 'wp_mail_failed' Error Message in all versions up to, a...
|
7.2 High | — | 0,24% | 3 Okt 2026 |
|
CVE-2026-92974
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'thumb_url' parameter in all versi...
|
6.1 Medium | — | 0,23% | 3 Okt 2026 |
|
CVE-2026-87115
The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract functi...
|
9.1 Critical | — | 0,88% | 3 Okt 2026 |
|
CVE-2026-75028
The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including,...
|
7.5 High | — | 0,70% | 3 Okt 2026 |
|
CVE-2026-18443
The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'access_privileges' paramete...
|
8.8 High | — | 0,37% | 3 Okt 2026 |
|
CVE-2026-15795
The Responsive Plus – Elementor Templates & Starter Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to...
|
6.4 Medium | — | 0,19% | 3 Okt 2026 |
|
CVE-2026-11601
The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including,...
|
5.3 Medium | — | 0,36% | 3 Okt 2026 |
|
CVE-2026-104313
The WPC Estimated Delivery Date for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'rule_data' parameter in all versions up to,...
|
6.1 Medium | — | 0,21% | 3 Okt 2026 |
|
CVE-2026-103519
The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software al...
|
5.4 Medium | — | 0,27% | 3 Okt 2026 |
|
CVE-2026-103421
The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'REQUEST_URI (path segment after /android_json/se...
|
5.4 Medium | — | 0,22% | 3 Okt 2026 |
|
CVE-2026-100157
The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software al...
|
6.5 Medium | — | 0,28% | 3 Okt 2026 |
|
CVE-2026-97344
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write i...
|
6.4 Medium | — | 0,19% | 3 Okt 2026 |
|
CVE-2026-97341
The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header in all versions up to, an...
|
7.2 High | — | 0,27% | 3 Okt 2026 |
|
CVE-2026-97337
The Simple Membership plugin for WordPress is vulnerable to unauthorized modification of data and sensitive information disclosure in versions up to, and including, 4.8.3...
|
7.5 High | — | 0,37% | 3 Okt 2026 |
|
CVE-2026-96962
The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors who know a valid invitation co...
|
3.7 Low | — | 0,17% | 3 Okt 2026 |
|
CVE-2026-96650
The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'platform_user_photo' Custom Field in all versions up to, and including, 3.3...
|
7.2 High | — | 0,26% | 3 Okt 2026 |
|
CVE-2026-96575
The Transliterator – Multilingual and Multi-script Text Conversion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Predictable {...
|
7.2 High | — | 0,24% | 3 Okt 2026 |
|
CVE-2026-96564
The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Author Display Name in all versions up to, and including,...
|
7.2 High | — | 0,24% | 3 Okt 2026 |
|
CVE-2026-94239
The Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape some bundle configuration values before outputting them back in an admin page, allowing user...
|
6.8 Medium | — | 0,24% | 3 Okt 2026 |
|
CVE-2026-94238
The Loco Translate WordPress plugin before 2.8.9 does not restrict which file paths its translation file routes will read, allowing users granted the Loco Translate WordP...
|
6.8 Medium | — | 0,32% | 3 Okt 2026 |
|
CVE-2026-93430
The GD Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'title' and 'url' Render Args in gdrts_live_handler AJAX in all versions up to,...
|
7.2 High | — | 0,27% | 3 Okt 2026 |
|
CVE-2026-92923
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise and escape a parameter before using it in a SQL statement, allowing users with a rol...
|
6.3 Medium | — | 0,18% | 3 Okt 2026 |
|
CVE-2026-92437
The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication, a nonce or an ownership check before it acts on a customer's abandoned-cart rec...
|
5.3 Medium | — | 0,22% | 3 Okt 2026 |
|
CVE-2026-91108
The Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress is vulnerable to authorization bypass in all versions up to, and in...
|
4.3 Medium | — | 0,21% | 3 Okt 2026 |
|
CVE-2026-91078
The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before...
|
8.2 High | — | 0,19% | 3 Okt 2026 |
|
CVE-2026-89236
The SaveTo Wishlist Lite WordPress plugin before 1.1.5 does not sanitise and escape parameters before using them in the ORDER BY clause of a SQL query, allowing unauthen...
|
8.6 High | — | 0,27% | 3 Okt 2026 |
|
CVE-2026-88783
The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when f...
|
8.8 High | — | 0,28% | 3 Okt 2026 |
|
CVE-2026-88782
The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link target, allowing users wi...
|
6.8 Medium | — | 0,24% | 3 Okt 2026 |
|
CVE-2026-87091
The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Settlement Notification Parameters in all versions up to, and including, 2.12...
|
7.2 High | — | 0,31% | 3 Okt 2026 |
|
CVE-2026-86834
The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpot Forms int...
|
3.7 Low | — | 0,18% | 3 Okt 2026 |
|
CVE-2026-86832
The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter information thr...
|
5.3 Medium | — | 0,21% | 3 Okt 2026 |
|
CVE-2026-85568
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not correctly handle a search value before rewriting an already prepared SQL statement, allowing...
|
6.8 Medium | — | 0,22% | 3 Okt 2026 |
|
CVE-2026-85015
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated u...
|
6.6 Medium | — | 0,42% | 3 Okt 2026 |
|
CVE-2026-80518
The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it writes under the up...
|
3.7 Low | — | 0,18% | 3 Okt 2026 |
|
CVE-2026-80517
The WP Ultimate CSV Importer WordPress plugin before 9.2 does not properly validate the file types contained in an uploaded archive nor sanitise their content before sto...
|
3.5 Low | — | 0,14% | 3 Okt 2026 |
|
CVE-2026-11399
The Helpdesk Support Ticket System for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.6 via...
|
4.3 Medium | — | 0,16% | 3 Okt 2026 |
|
CVE-2026-103913
The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the stored latitude/longitude coordinates of a listing in versions up to, and including, 2.8.186....
|
7.5 High | — | 0,38% | 3 Okt 2026 |
|
CVE-2026-103909
The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scr...
|
6.1 Medium | — | 0,27% | 3 Okt 2026 |
|
CVE-2026-103888
The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'woosq-redirect' parameter in all versions up to, an...
|
6.1 Medium | — | 0,31% | 3 Okt 2026 |
|
CVE-2026-103514
The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password a...
|
7.5 High | — | 0,30% | 3 Okt 2026 |
|
CVE-2026-103293
The MPG WordPress plugin before 4.2.3 does not validate that the dataset source supplied when importing a project is a remote URL before treating it as a local filesyste...
|
6.8 Medium | — | 0,35% | 3 Okt 2026 |