Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-104759
The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Authentication Bypass via OIDC Nonce Replay in all versions...
|
8.1 High | — | 0,52% | 10 Okt 2026 |
|
CVE-2026-104728
The AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to...
|
4.3 Medium | — | 0,29% | 10 Okt 2026 |
|
CVE-2026-103478
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'checkout[billing][phone] (and state / tax...
|
6.4 Medium | — | 0,31% | 10 Okt 2026 |
|
CVE-2026-102774
The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Po...
|
6.4 Medium | — | 0,27% | 10 Okt 2026 |
|
CVE-2026-102291
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including,...
|
5.4 Medium | — | 0,30% | 10 Okt 2026 |
|
CVE-2026-101921
The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting...
|
4.7 Medium | — | 0,25% | 10 Okt 2026 |
|
CVE-2026-101920
The Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comm...
|
7.2 High | — | 0,30% | 10 Okt 2026 |
|
CVE-2026-100178
The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'adverts_location' parameter in all versions up to, and inclu...
|
7.2 High | — | 0,37% | 10 Okt 2026 |
|
CVE-2026-100147
The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shipping_first_name' parameter in all v...
|
7.2 High | — | 0,30% | 10 Okt 2026 |
|
CVE-2026-97348
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.74.3 via the get_instance_css function. Th...
|
6.5 Medium | — | 0,73% | 10 Okt 2026 |
|
CVE-2026-96840
The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via display_name User Field in all versions up to, and including,...
|
7.2 High | — | 0,24% | 10 Okt 2026 |
|
CVE-2026-96574
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to...
|
6.4 Medium | — | 0,22% | 10 Okt 2026 |
|
CVE-2026-96572
The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and includ...
|
7.2 High | — | 0,24% | 10 Okt 2026 |
|
CVE-2026-96558
The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'qsm_hidden_questions' pa...
|
7.2 High | — | 0,24% | 10 Okt 2026 |
|
CVE-2026-95684
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'attachments[name]' Parameter in all versions up to, and i...
|
7.2 High | — | 0,24% | 10 Okt 2026 |
|
CVE-2026-94538
The WP File Download plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.3.9. This is due to the plugin not properly verify...
|
8.1 High | — | 0,25% | 10 Okt 2026 |
|
CVE-2026-89100
The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '#response' URL Fragment in all versions up to, and in...
|
6.1 Medium | — | 0,22% | 10 Okt 2026 |
|
CVE-2026-6243
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up to, and including, 3....
|
6.4 Medium | — | 0,17% | 10 Okt 2026 |
|
CVE-2026-5725
The Favicon Rotator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'fvrt_' prefixed request parameters in all versions up to, and including,...
|
6.1 Medium | — | 0,17% | 10 Okt 2026 |
|
CVE-2026-3717
The CV Builder – Professional Resume Builder SaaS plugin for WordPress is vulnerable to unauthorized arbitrary file upload due to a missing capability check on the 'wp_sa...
|
5.3 Medium | — | 0,19% | 10 Okt 2026 |
|
CVE-2026-15178
The Fluent Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.2.5. This is due to the plugin not properly verifying...
|
5.4 Medium | — | 0,16% | 10 Okt 2026 |
|
CVE-2026-12626
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 28.2 via de...
|
7.2 High | — | 0,32% | 10 Okt 2026 |
|
CVE-2026-108503
ZTE Z80 Ultra has an interface permission validation vulnerability. The callable functions provided by the system lack sufficient access control. An attacker can leverage...
|
3.3 Low | — | 0,13% | 10 Okt 2026 |
|
CVE-2026-108502
ZTE Z80 Ultra contains an information disclosure vulnerability, through which third-party applications can read relevant information by hooking system APIs.
|
3.3 Low | — | 0,13% | 10 Okt 2026 |
|
CVE-2026-107742
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter...
|
7.2 High | — | 0,24% | 10 Okt 2026 |
|
CVE-2026-107712
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'current_month' parameter in all versions up to, and inclu...
|
6.5 Medium | — | 0,27% | 10 Okt 2026 |
|
CVE-2026-104801
The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the re...
|
9.1 Critical | — | 0,76% | 10 Okt 2026 |
|
CVE-2026-104006
The SpeedyCache – Cache, Optimization, Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2 via th...
|
3.7 Low | — | 0,26% | 10 Okt 2026 |
|
CVE-2026-103897
The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.7....
|
4.4 Medium | — | 0,21% | 10 Okt 2026 |
|
CVE-2026-103427
The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'country' parameter in all versions up to, and including, 4.8.4 due to ins...
|
6.4 Medium | — | 0,21% | 10 Okt 2026 |
|
CVE-2026-102402
The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ttp_filter_taxonomy (meta of the attacker-chosen post)'...
|
6.4 Medium | — | 0,19% | 10 Okt 2026 |
|
CVE-2026-100196
The LazyLoad Plugin – Lazy Load Images, Videos, and Iframes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment_content (rendered inline in...
|
7.2 High | — | 0,29% | 10 Okt 2026 |
|
CVE-2026-100161
The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'wcpr_image_upload_id' parameter in all versions up...
|
7.2 High | — | 0,26% | 10 Okt 2026 |
|
CVE-2026-97643
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `givewp_campaign_grid` shortcode...
|
6.4 Medium | — | 0,21% | 10 Okt 2026 |
|
CVE-2026-96682
The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via <presto-player> Tag in all versions up to, and including, 4.5....
|
7.2 High | — | 0,24% | 10 Okt 2026 |
|
CVE-2026-96667
The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all ve...
|
7.2 High | — | 0,29% | 10 Okt 2026 |
|
CVE-2026-94421
The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 5.1.2 due to insufficie...
|
6.4 Medium | — | 0,16% | 10 Okt 2026 |
|
CVE-2026-94257
The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose password is being changed to the phone number that was actually verified during its OTP passw...
|
8.1 High | — | 0,23% | 10 Okt 2026 |
|
CVE-2026-94256
The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs to, allowing unauthenticated a...
|
8.1 High | — | 0,23% | 10 Okt 2026 |
|
CVE-2026-94375
The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8 via the g...
|
5.3 Medium | — | 0,29% | 10 Okt 2026 |
|
CVE-2026-93775
The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Auphonic Webhook in all versions up to, and including, 4.5.6 due to in...
|
7.2 High | — | 0,25% | 10 Okt 2026 |
|
CVE-2026-92975
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.3 via the...
|
8.1 High | — | 0,35% | 10 Okt 2026 |
|
CVE-2026-91862
The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-image-points' parameter in all versions up to, and including...
|
6.4 Medium | — | 0,16% | 10 Okt 2026 |
|
CVE-2026-87781
The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable...
|
8.6 High | — | 0,26% | 10 Okt 2026 |
|
CVE-2026-87780
The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape values submitted through an unauthenticated endpoint before storing them and outputtin...
|
8.8 High | — | 0,25% | 10 Okt 2026 |
|
CVE-2026-85571
The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering requests belong to a course the requester manages, allowi...
|
6.5 Medium | — | 0,23% | 10 Okt 2026 |
|
CVE-2026-91050
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference / Missing Authoriz...
|
4.3 Medium | — | 0,21% | 10 Okt 2026 |
|
CVE-2026-83526
The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.1.7 via the check_mimetype function. This is due to in...
|
8.8 High | — | 0,64% | 10 Okt 2026 |
|
CVE-2026-78068
The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Cell Content in all versions up to, and including, 1.3....
|
6.4 Medium | — | 0,16% | 10 Okt 2026 |
|
CVE-2026-77183
The FooSales – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1...
|
8.8 High | — | 0,29% | 10 Okt 2026 |