Katalog CVE (hal. 989)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 267.603 (Critical 36.783 · High 106.969 · KEV 1.767 · sejak 2020) · Pembaruan terakhir: 4 Nov 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 49.401–49.450 dari 267.603 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-56303 Capgo before 12.128.2 contains an information disclosure vulnerability in the find_apikey_by_value PostgreSQL function marked SECURITY DEFINER and executable by the anon...	7.5 High	—	0,46%	11 Jul 2026
CVE-2026-56296 Cap-go before 12.128.2 contains an information disclosure vulnerability in the public.transfer_app RPC function that returns distinct error messages for existing versus n...	5.3 Medium	—	0,31%	11 Jul 2026
CVE-2026-56240 Capgo before 12.128.12 contains a billing authorization bypass vulnerability in the plan_valid calculation that allows organizations with exhausted or expired usage credi...	4.3 Medium	—	0,23%	11 Jul 2026
CVE-2026-57828 phoca download Joomla Extension - phoca.cz - Authenticated file upload in Phoca Downloads component < 6.1.3 - The Joomla extension Phoca Downloads is vulnerable to an authenticated arbi...	8.8 High	—	0,54%	11 Jul 2026
CVE-2026-57827 rsjoomla rsfiles! Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12 - The Joomla extension RSFiles is vulnerable to an unauthenticated arbitrary...	9.8 Critical	—	2,3%	11 Jul 2026
CVE-2026-1359 The Genolve – AI image AI video generation plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the genolve_setOpt...	8.8 High	—	0,44%	11 Jul 2026
CVE-2026-9282 The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.4 via the setupSources function. This makes it poss...	7.5 High	—	2,9%	11 Jul 2026
CVE-2026-9017 The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.2.2. This is due to...	5.3 Medium	—	0,47%	11 Jul 2026
CVE-2026-6939 The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'approval_code' parameter in all versions up to, and i...	7.2 High	—	0,56%	11 Jul 2026
CVE-2026-6801 The Context Blog theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.5 via the context_blog_modal_popup. This ma...	5.3 Medium	—	0,36%	11 Jul 2026
CVE-2026-4661 The WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'fildname' parameter in all ve...	7.5 High	—	0,51%	11 Jul 2026
CVE-2026-15155 The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Authenticated Account Takeover via Email Header Injection...	8.8 High	—	0,67%	11 Jul 2026
CVE-2026-15010 The bbp Style Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 6.4.5 via the Topic Form Additional Fields feature....	6.4 Medium	—	0,33%	11 Jul 2026
CVE-2026-1382 The fresh Podcaster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'freshpodcaster' shortcode in all versions up to, and including, 1.0.7 due t...	6.4 Medium	—	0,33%	11 Jul 2026
CVE-2026-12994 The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.7.27. This is due to the pl...	5.3 Medium	—	0,56%	11 Jul 2026
CVE-2026-12738 The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0. Thi...	4.3 Medium	—	0,37%	11 Jul 2026
CVE-2026-12126 The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment 'post_title' in all versio...	6.4 Medium	—	0,36%	11 Jul 2026
CVE-2026-12103 The Wallet for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.6.4. This is due to the plugin not properly...	4.3 Medium	—	0,49%	11 Jul 2026
CVE-2026-11901 The WP Hotel Booking plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 2.3.1. This is due to the...	5.3 Medium	—	0,26%	11 Jul 2026
CVE-2026-11898 The White Label CMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.7.12 due to insufficient...	4.4 Medium	—	0,40%	11 Jul 2026
CVE-2026-11591 The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 13.3 due to insu...	4.4 Medium	—	0,40%	11 Jul 2026
CVE-2026-10865 The Cost Calculator Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.11 via the (template body). Thi...	5.3 Medium	—	0,58%	11 Jul 2026
CVE-2026-10041 The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.27 via the wc...	4.3 Medium	—	0,43%	11 Jul 2026
CVE-2025-6784 The Code Engine plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.3.5 via the 'code-engine' shortcode. This is due to th...	8.8 High	—	0,85%	11 Jul 2026
CVE-2025-5017 The Catalyst Connect Zoho CRM Client Portal plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uid’ parameter in all versions up to, and including, 2...	4.9 Medium	—	0,32%	11 Jul 2026
CVE-2026-7655 The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 4.2.3. This is due to the plugin not proper...	8.1 High	—	0,47%	11 Jul 2026
CVE-2026-13378 The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form 7 Form Field in all versions up to, and inc...	7.2 High	—	0,41%	11 Jul 2026
CVE-2026-9738 The Print, PDF, Email by PrintFriendly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content_position_css' parameter in all versions up to, a...	4.4 Medium	—	0,34%	11 Jul 2026
CVE-2026-7620 The Notification for Telegram plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.1. This is due to the plugin not proper...	4.3 Medium	—	0,47%	11 Jul 2026
CVE-2026-7559 The Affilia – Affiliate Program & Referral Tracking for WordPress plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 3.3.3. T...	4.3 Medium	—	0,54%	11 Jul 2026
CVE-2026-6804 The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.12. This is due to the p...	5.3 Medium	—	0,56%	11 Jul 2026
CVE-2026-6803 The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.4.12. This is due to miss...	5.3 Medium	—	0,52%	11 Jul 2026
CVE-2026-3576 The Planyo Online Reservation System plugin for WordPress is vulnerable to Server-Side Request Forgery leading to Local File Inclusion in all versions up to, and includin...	7.2 High	—	8,8%	11 Jul 2026
CVE-2026-3552 The SurfLink - Ultimate Link Manager plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the ajax_import_410() funct...	4.3 Medium	—	0,37%	11 Jul 2026
CVE-2026-2354 The Swiss Toolkit For WP plugin for WordPress is vulnerable to arbitrary file upload due to a flawed file type validation bypass in the `upload_extension_files()` functio...	8.8 High	—	1,00%	11 Jul 2026
CVE-2026-1832 The ThriveDesk – Live Chat, AI Chatbot, Helpdesk & Knowledge Base plugin for WordPress is vulnerable to unauthorized cache deletion due to a missing capability check on t...	4.3 Medium	—	0,35%	11 Jul 2026
CVE-2026-15335 The Booking Package plugin for WordPress is vulnerable to generic SQL Injection via 'email' Form Parameter (form<N>) in all versions up to, and including, 1.7.20 due to i...	7.5 High	—	0,76%	11 Jul 2026
CVE-2026-15097 The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'height_slider' Slider Module Field in all versions up to, and including, 7.7.6...	6.4 Medium	—	0,35%	11 Jul 2026
CVE-2026-15096 The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Map Module 'b_width_map' Field in all versions up to, and including, 7.7.6 due t...	6.4 Medium	—	0,33%	11 Jul 2026
CVE-2026-14262 The Simple JWT Login – Allows you to use JWT on REST endpoints. plugin for WordPress is vulnerable to Authentication Bypass to Privilege Escalation in all versions up to,...	8.8 High	—	0,74%	11 Jul 2026
CVE-2026-13250 The Solace Extra plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.3. This is due to the plugin not properly verifying...	5.3 Medium	—	0,47%	11 Jul 2026
CVE-2026-13116 The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.14.0 via t...	4.3 Medium	—	0,44%	11 Jul 2026
CVE-2026-12141 The Premium Addons for Elementor – Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'premium_tooltip_text'...	4.9 Medium	—	0,29%	11 Jul 2026
CVE-2025-13968 The Starboard Suite Reservation Calendars plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode attributes in the [starboard-suite-lightbox] sho...	6.4 Medium	—	0,35%	11 Jul 2026
CVE-2026-8678 The MyParcel plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.25.1. This is due to the plugin not properly verifying tha...	4.3 Medium	—	0,40%	11 Jul 2026
CVE-2026-7544 The Mux Video Uploader plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.4 via the muxvideo_enqueue_settings_...	4.3 Medium	—	0,41%	11 Jul 2026
CVE-2026-5743 The SimpLy Gallery Block & Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via block attributes in all versions up to, and including, 3.3.3.2....	6.4 Medium	—	0,45%	11 Jul 2026
CVE-2026-3367 The Lockme OAuth2 calendars integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'App ID' setting in all versions up to, and including, 2...	4.4 Medium	—	0,41%	11 Jul 2026
CVE-2026-15338 The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.1 via the get_type_template f...	7.5 High	—	0,96%	11 Jul 2026
CVE-2026-15073 The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and...	6.5 Medium	—	0,41%	11 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.