Unknown To Do List Member vulnerabilities

2 CVEs affecting Unknown To Do List Member, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-86802, published 2026-09-21.

More from Unknown.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-86801, published 2026-09-17. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication, capability or nonce check of any kind,…
• CVE-2026-86802, published 2026-09-21. Low severity, CVSS 3.7. EPSS: 0.2% chance of exploitation in the next 30 days. The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetches the imported data from, allowing…