8
CVEs
0
Critical
5
High
0
KEV
0
PoC
5
Unpatched C/H
0.0%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
5
MEDIUM
3
LOW
0
Monthly CVE Trend
Affected Products (23)
Wordpress Plugin
46
Poll Maker
20
Quiz Maker
18
Survey Maker
15
Popup Box
9
PHP
5
Secure Copy Content Protection And Content Locking
5
Photo Gallery
5
Popup Like Box
2
Chatgpt Assistant
2
Chartify
2
Image Slider By Ays
2
Easy Form
2
Fox Lms
1
Faq Builder
1
Personal Dictionary
1
Faq Builder Ays
1
Photo Gallery By Ays Responsive Image Gallery
1
Quiz Maker By Ays
1
Poll Maker By Ays Versus Polls Anonymous Polls Image Polls
1
Advanced Related Posts
1
Image Slider
1
Portfolio Responsive Gallery
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-65565 | Unauthenticated Cross-Site Scripting in the Survey Maker WordPress plugin (versions <= 5.2.3.3) permits remote attackers without any credentials to inject arbitrary JavaScript that executes in a victim's browser when they interact with an affected survey page. The CVSS Changed scope (S:C) confirms the payload crosses from the plugin context into the victim's browser session, enabling session cookie theft, credential harvesting, or unauthorized actions performed on behalf of the victim. No public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-25346 | A Cross-Site Scripting (XSS) vulnerability exists in AYS Pro FAQ Builder plugin versions up to and including 1.8.2, allowing attackers to inject malicious scripts through improperly neutralized input during web page generation. The vulnerability stems from incorrectly configured access control security levels, enabling unauthenticated or low-privileged attackers to execute arbitrary JavaScript in the context of affected WordPress sites. While CVSS and EPSS scores are not publicly available, the vulnerability was reported by Patchstack and assigned ENISA EUVD ID EUVD-2026-15661, indicating formal recognition across European vulnerability databases. | HIGH | 7.1 | 0.0% | 36 |
No patch
|
| CVE-2026-32494 | A Cross-site Scripting (XSS) vulnerability exists in the Ays Pro Image Slider WordPress plugin (versions up to and including 2.7.1) due to improper input neutralization during web page generation, combined with incorrectly configured access control security levels. Attackers can inject malicious scripts that execute in the context of other users' browsers, potentially stealing session tokens, redirecting users, or performing unauthorized actions on behalf of victims. No CVSS score, EPSS data, or active exploitation signals (KEV status) are currently available, but the vulnerability is confirmed by Patchstack and assigned EUVD-2026-15837. | HIGH | 7.1 | 0.0% | 36 |
No patch
|
| CVE-2026-54192 | Reflected cross-site scripting in the Ays Pro Popup Box WordPress plugin versions 6.2.9 and earlier allows remote unauthenticated attackers to execute arbitrary JavaScript in a victim's browser when the victim clicks a crafted link. The CVSS 7.1 score reflects scope change (S:C) typical of XSS escaping the plugin context into the broader WordPress session. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-57361 | Stored/reflected cross-site scripting in the Survey Maker WordPress plugin (versions 5.2.2.5 and earlier by AYS Pro) lets unauthenticated remote attackers inject JavaScript that executes in a victim's browser after they interact with a crafted page or survey. The CVSS scope-change flag (S:C) indicates the injected script escapes the plugin's context to affect the wider WordPress site, potentially reaching authenticated admin sessions. This is a Patchstack-reported issue with no public exploit identified at time of analysis and no CISA KEV listing. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-6817 | Stored Cross-Site Scripting (XSS) in Quiz Maker by AYS WordPress plugin versions up to 6.7.1.29 allows unauthenticated attackers to inject arbitrary JavaScript through the 'rate_reason' parameter due to insufficient input sanitization and output escaping. Injected scripts execute in the browsers of all users who view affected pages, enabling credential theft, malware distribution, or defacement without requiring authentication or user interaction. | MEDIUM | 5.8 | 0.0% | 29 |
No patch
|
| CVE-2026-76006 | SQL injection in Photo Gallery by Ays - Responsive Image Gallery (all versions through 6.8.2) allows authenticated administrators to extract arbitrary data from the WordPress database by appending malicious SQL to the 's' search parameter. The vulnerability spans two distinct code paths in the plugin's category list table class - record_count() via $wpdb->get_var() and prepare_items()/get_image_categories() via $wpdb->get_results() - supporting both blind and UNION-based exfiltration techniques. No public exploit has been identified at time of analysis; the high privilege requirement significantly constrains realistic attack scenarios. | MEDIUM | 4.9 | 0.4% | 25 |
No patch
|
| CVE-2026-8995 | Poll Maker WordPress plugin (versions ≤6.3.7) leaks the complete WP_User object - including bcrypt password hashes, email addresses, login names, registration dates, roles, and capabilities - through an AJAX endpoint that performs no nonce verification or capability check beyond confirming the requestor is logged in. Any subscriber-level authenticated user on an affected site can call the `ays_poll_get_user_information` action and retrieve user data that WordPress deliberately withholds from all of its standard interfaces, including the REST API. No public exploit has been identified at time of analysis, but the attack requires only a valid subscriber session and a single POST request, and the recovered bcrypt hash enables offline password-cracking attacks. | MEDIUM | 4.3 | 0.0% | 22 |
No patch
|