UpHeron
All posts

Daily summary

Vulnerabilities of 27 October 2026: 8 new, 1 critical, 2 newly exploited

8 vulnerabilities added on 27 October 2026, 1 critical and 4 high: Cross-site request forgery in WordPress plugins, Cross-site scripting in WordPress plugins and more. 2 vulnerabilities newly listed as exploited by CISA.

  • 1 critical
  • 4 high
  • 2 medium
  • 1 low
  • 2 newly exploited

Newly listed as exploited

Added to CISA's Known Exploited Vulnerabilities catalog: attackers use them.

  1. 9.2PHPRCE via stale global stateExploitedFixed in 8.4.27, 8.5.12CVE-2026-109619
  2. 9.2PHPRCE via OOM corruptionExploitedFixed in 8.4.27, 8.5.12CVE-2026-109618

Cross-site request forgery in WordPress plugins

1 vulnerability

  1. 9.6NewslettersUp to 4.18.2CVE-2026-116863

Cross-site scripting in WordPress plugins

3 vulnerabilities

  1. 7.2Advanced ViewsUnauthenticated Stored Cross-Site Scripting via Comment ContentUp to 3.9.6CVE-2026-109995
  2. 7.2Analytics InsightsUnauthenticated Stored Cross-Site Scripting via GA4 Realtime Page TitleUp to 6.3.12CVE-2026-111820
  3. 6.4Jupiter X CoreAuthenticated (Contributor+) Stored Cross-Site Scripting via 'forget_password_link' ParameterUp to 4.61.0CVE-2026-10511

Other vulnerabilities in WordPress plugins

3 vulnerabilities

  1. 8.8KirkiAuthenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX EndpointUp to 6.2.5CVE-2026-75891
  2. 8.7MembershipWorksInformation Disclosure via WordPress REST APIFixed in 6.17CVE-2026-112355
  3. 4.8Advanced Custom Fields: ExtendedMissing Authorization to Unauthenticated Arbitrary Attachment Deletion via Email Action Dynamic File FieldUp to 0.9.2.6CVE-2026-10752

Servers and applications

1 vulnerability

  1. 2.0PythonLenient parsing of integers for response body and chunk framingFixed in 3.16.0CVE-2026-103995

From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.