Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-9289
The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.54.10 via the JSON-LD...
|
5.3 Medium | — | 0,62% | 19 Sep 2026 |
|
CVE-2026-8354
The Gum Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pop_tag' parameter in all versions up to, and including, 1.3.15 due...
|
6.4 Medium | — | 0,35% | 19 Sep 2026 |
|
CVE-2026-76579
The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due to insuffic...
|
4.7 Medium | — | 0,38% | 19 Sep 2026 |
|
CVE-2026-5410
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the spinner field in versions up to, and including, 4.5.13 This is due to insuff...
|
6.4 Medium | — | 0,38% | 19 Sep 2026 |
|
CVE-2026-1256
The YS LeadGen plugin for WordPress is vulnerable to authorization bypass and Stored Cross-Site Scripting via multiple AJAX endpoints in all versions up to, and including...
|
6.4 Medium | — | 0,20% | 19 Sep 2026 |
|
CVE-2026-1255
The YS LeadGen plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 due to the 'ysleadgen_get_captured_data' A...
|
7.5 High | — | 0,30% | 19 Sep 2026 |
|
CVE-2026-18346
The TikTok plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.1. This is due to the plugin not properly verifying that a...
|
5.3 Medium | — | 0,26% | 19 Sep 2026 |
|
CVE-2026-9855
The Custom Field Template plugin for WordPress is vulnerable to generic SQL Injection via the 'post_ID' parameter in all versions up to, and including, 2.7.8 due to insuf...
|
6.5 Medium | — | 0,58% | 19 Sep 2026 |
|
CVE-2026-9832
The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to, and including,...
|
5.3 Medium | — | 0,38% | 19 Sep 2026 |
|
CVE-2026-9615
The Flex Import plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0. This is due to the license_activate_fleximp() and l...
|
4.3 Medium | — | 0,43% | 19 Sep 2026 |
|
CVE-2026-9232
The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.27 via the handle_customers_ajax. Th...
|
6.5 Medium | — | 0,48% | 19 Sep 2026 |
|
CVE-2026-87917
The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data' Dynamic Content Tag in all versions up to, and includin...
|
6.1 Medium | — | 0,38% | 19 Sep 2026 |
|
CVE-2026-85658
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary...
|
8.1 High | — | 0,65% | 19 Sep 2026 |
|
CVE-2026-75959
The GoPay for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'log_table_filter' parameter in all versions up to, and including, 1.0.36 du...
|
4.9 Medium | — | 0,44% | 19 Sep 2026 |
|
CVE-2026-7527
The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 7.0.02. This is due to the...
|
4.7 Medium | — | 0,40% | 19 Sep 2026 |
|
CVE-2026-6295
The WP Optimizer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to and including 2.5.0. This is due to an unsafe subquery-de...
|
4.9 Medium | — | 0,51% | 19 Sep 2026 |
|
CVE-2026-5400
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Media field filter values in versions up to, and including, 4.5.13 This is d...
|
6.4 Medium | — | 0,42% | 19 Sep 2026 |
|
CVE-2026-4792
The Bread plugin for WordPress is vulnerable to information exposure in versions up to and including 2.9.12. This is due to the lack of authentication and authorization c...
|
5.3 Medium | — | 0,58% | 19 Sep 2026 |
|
CVE-2026-4327
The The Welcomizer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to and including 2.8.1. This is due to missing authorization checks on t...
|
8.8 High | — | 0,68% | 19 Sep 2026 |
|
CVE-2026-2422
The WP Composer – The Easiest Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pbwp_raw_shortcode' shortcode in all versions up to,...
|
6.4 Medium | — | 0,21% | 19 Sep 2026 |
|
CVE-2026-2278
The VW Writer Blog theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'vw_writer_blog_reset_all_settings' fun...
|
4.3 Medium | — | 0,20% | 19 Sep 2026 |
|
CVE-2026-1984
The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a missing capability check on the 'iepa_use_gt_edit...
|
5.3 Medium | — | 0,23% | 19 Sep 2026 |
|
CVE-2026-1641
The Wow Elements Addons for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.11.2. This is due to the p...
|
6.5 Medium | — | 0,28% | 19 Sep 2026 |
|
CVE-2026-15947
The Metasync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_instant_indexing_settings() function in...
|
4.3 Medium | — | 0,21% | 19 Sep 2026 |
|
CVE-2026-1242
The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to incorrect logic in the permission callback in all versions up to, and including, 4.2.6 du...
|
4.3 Medium | — | 0,18% | 19 Sep 2026 |
|
CVE-2026-15946
The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization plugin for WordPress is vulnerable to authorization bypass in all versi...
|
4.3 Medium | — | 0,23% | 19 Sep 2026 |
|
CVE-2026-15664
The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Multiple Choice 'Other' Value i...
|
7.2 High | — | 0,39% | 19 Sep 2026 |
|
CVE-2026-15463
The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'host' parameter in all versions up...
|
6.1 Medium | — | 0,14% | 19 Sep 2026 |
|
CVE-2026-15098
The Real3D Flipbook Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lightboxtext' shortcode attribute (and other unsanitized attributes ha...
|
6.4 Medium | — | 0,19% | 19 Sep 2026 |
|
CVE-2026-13770
The AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via save_am...
|
6.4 Medium | — | 0,20% | 19 Sep 2026 |
|
CVE-2026-13200
The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping...
|
6.5 Medium | — | 0,25% | 19 Sep 2026 |
|
CVE-2026-13191
The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order_by' parameter in all versions up to, and including, 2.5.3 due to insufficient escapi...
|
6.5 Medium | — | 0,28% | 19 Sep 2026 |
|
CVE-2026-12402
The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fb-config' Setting in all versions up to, and including, 2.7.3...
|
4.4 Medium | — | 0,19% | 19 Sep 2026 |
|
CVE-2026-11899
The PDF Builder for WooCommerce. Create invoices,packing slips and more plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2...
|
4.3 Medium | — | 0,21% | 19 Sep 2026 |
|
CVE-2026-11608
The WP Customer Reviews plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpcr3_fname' parameter in all versions up to, and including, 3.7.8 d...
|
6.1 Medium | — | 0,33% | 19 Sep 2026 |
|
CVE-2026-92435
The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback for several...
|
5.3 Medium | — | 0,30% | 19 Sep 2026 |
|
CVE-2026-92430
The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updati...
|
5.3 Medium | — | 0,33% | 19 Sep 2026 |
|
CVE-2026-92425
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checks on several of its host-mana...
|
5.5 Medium | — | 0,31% | 19 Sep 2026 |
|
CVE-2026-92421
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the user making...
|
4.7 Medium | — | 0,29% | 19 Sep 2026 |
|
CVE-2026-92420
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the requesting user before modifying...
|
3.8 Low | — | 0,32% | 19 Sep 2026 |
|
CVE-2026-92404
The MgoSync WordPress plugin before 2.1.7 does not have authorization controls on one of its REST API endpoints, allowing unauthenticated users to retrieve the stored Wo...
|
7.5 High | — | 0,43% | 19 Sep 2026 |
|
CVE-2026-92403
The Secure Custom Fields WordPress plugin before 6.9.4 does not properly verify that a front-end form submission corresponds to the form that was rendered to the visitor,...
|
3.7 Low | — | 0,27% | 19 Sep 2026 |
|
CVE-2026-92099
The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persisted query fro...
|
6.5 Medium | — | 0,34% | 19 Sep 2026 |
|
CVE-2026-91847
The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester owns the AI booking-assistant conversation named in...
|
4.8 Medium | — | 0,22% | 19 Sep 2026 |
|
CVE-2026-88926
The VikRentItems Flexible Rental Management System WordPress plugin before 1.2.4 does not sanitise and escape some of its parameters before using them in SQL statements,...
|
8.6 High | — | 0,45% | 19 Sep 2026 |
|
CVE-2026-88824
The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST routes, allowing unauthenticated users to update its settings, including a...
|
8.8 High | — | 0,51% | 19 Sep 2026 |
|
CVE-2026-86814
The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existin...
|
8.1 High | — | 0,38% | 19 Sep 2026 |
|
CVE-2026-86591
The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated users to update arbitrary WordP...
|
9.8 Critical | — | 0,54% | 19 Sep 2026 |
|
CVE-2026-85680
The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title, and decodes H...
|
8.8 High | — | 0,51% | 19 Sep 2026 |
|
CVE-2026-85574
The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing...
|
8.0 High | — | 0,34% | 19 Sep 2026 |