19
CVEs
0
Critical
6
High
0
KEV
1
PoC
6
Unpatched C/H
0.0%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
6
MEDIUM
13
LOW
0
Monthly CVE Trend
Affected Products (23)
Wordpress Plugin
46
Poll Maker
20
Quiz Maker
18
Survey Maker
15
Popup Box
9
PHP
5
Secure Copy Content Protection And Content Locking
5
Photo Gallery
5
Popup Like Box
2
Chatgpt Assistant
2
Chartify
2
Image Slider By Ays
2
Easy Form
2
Fox Lms
1
Faq Builder
1
Personal Dictionary
1
Faq Builder Ays
1
Photo Gallery By Ays Responsive Image Gallery
1
Quiz Maker By Ays
1
Poll Maker By Ays Versus Polls Anonymous Polls Image Polls
1
Advanced Related Posts
1
Image Slider
1
Portfolio Responsive Gallery
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-31922 | Fox LMS versions 1.0.6.3 and earlier are vulnerable to blind SQL injection attacks through improper input sanitization, allowing authenticated attackers to execute arbitrary SQL queries and potentially exfiltrate sensitive database information. The vulnerability requires user authentication but can be exploited remotely with no user interaction needed, and carries a high CVSS score of 8.5. No patch is currently available for affected organizations. | HIGH | 8.5 | 0.0% | 43 |
No patch
|
| CVE-2026-65565 | Unauthenticated Cross-Site Scripting in the Survey Maker WordPress plugin (versions <= 5.2.3.3) permits remote attackers without any credentials to inject arbitrary JavaScript that executes in a victim's browser when they interact with an affected survey page. The CVSS Changed scope (S:C) confirms the payload crosses from the plugin context into the victim's browser session, enabling session cookie theft, credential harvesting, or unauthorized actions performed on behalf of the victim. No public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-25346 | A Cross-Site Scripting (XSS) vulnerability exists in AYS Pro FAQ Builder plugin versions up to and including 1.8.2, allowing attackers to inject malicious scripts through improperly neutralized input during web page generation. The vulnerability stems from incorrectly configured access control security levels, enabling unauthenticated or low-privileged attackers to execute arbitrary JavaScript in the context of affected WordPress sites. While CVSS and EPSS scores are not publicly available, the vulnerability was reported by Patchstack and assigned ENISA EUVD ID EUVD-2026-15661, indicating formal recognition across European vulnerability databases. | HIGH | 7.1 | 0.0% | 36 |
No patch
|
| CVE-2026-32494 | A Cross-site Scripting (XSS) vulnerability exists in the Ays Pro Image Slider WordPress plugin (versions up to and including 2.7.1) due to improper input neutralization during web page generation, combined with incorrectly configured access control security levels. Attackers can inject malicious scripts that execute in the context of other users' browsers, potentially stealing session tokens, redirecting users, or performing unauthorized actions on behalf of victims. No CVSS score, EPSS data, or active exploitation signals (KEV status) are currently available, but the vulnerability is confirmed by Patchstack and assigned EUVD-2026-15837. | HIGH | 7.1 | 0.0% | 36 |
No patch
|
| CVE-2026-54192 | Reflected cross-site scripting in the Ays Pro Popup Box WordPress plugin versions 6.2.9 and earlier allows remote unauthenticated attackers to execute arbitrary JavaScript in a victim's browser when the victim clicks a crafted link. The CVSS 7.1 score reflects scope change (S:C) typical of XSS escaping the plugin context into the broader WordPress session. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-57361 | Stored/reflected cross-site scripting in the Survey Maker WordPress plugin (versions 5.2.2.5 and earlier by AYS Pro) lets unauthenticated remote attackers inject JavaScript that executes in a victim's browser after they interact with a crafted page or survey. The CVSS scope-change flag (S:C) indicates the injected script escapes the plugin's context to affect the wider WordPress site, potentially reaching authenticated admin sessions. This is a Patchstack-reported issue with no public exploit identified at time of analysis and no CISA KEV listing. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-6817 | Stored Cross-Site Scripting (XSS) in Quiz Maker by AYS WordPress plugin versions up to 6.7.1.29 allows unauthenticated attackers to inject arbitrary JavaScript through the 'rate_reason' parameter due to insufficient input sanitization and output escaping. Injected scripts execute in the browsers of all users who view affected pages, enabling credential theft, malware distribution, or defacement without requiring authentication or user interaction. | MEDIUM | 5.8 | 0.0% | 29 |
No patch
|
| CVE-2025-58015 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Ays Pro Quiz Maker allows Retrieve Embedded Sensitive Data.7.0.61. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | MEDIUM | 5.3 | 0.1% | 27 |
No patch
|
| CVE-2026-32329 | Advanced Related Posts plugin through version 1.9.1 contains insufficient authorization controls that allow unauthenticated remote attackers to modify plugin settings and data. The vulnerability stems from improperly configured access restrictions in the plugin's functionality, enabling attackers to alter post relationships without proper authentication or permission validation. | MEDIUM | 5.3 | 0.0% | 27 |
No patch
|
| CVE-2026-32332 | Easy Form versions 2.7.9 and earlier are vulnerable to missing authorization controls that allow unauthenticated attackers to modify data through incorrectly configured access restrictions. An attacker can exploit this vulnerability remotely without authentication to perform unauthorized data manipulation operations. No patch is currently available for this vulnerability. | MEDIUM | 5.3 | 0.0% | 27 |
No patch
|
| CVE-2026-32402 | Image Slider By Ays versions 2.7.1 and earlier contain a missing authorization flaw that allows unauthenticated remote attackers to modify content through improper access control validation. The vulnerability affects the plugin's core functionality and could enable unauthorized changes to website content without proper authentication checks. No patch is currently available. | MEDIUM | 5.3 | 0.0% | 27 |
No patch
|
| CVE-2026-32428 | Popup Like Box versions 3.7.7 and earlier contain an authorization bypass vulnerability that allows unauthenticated attackers to modify content through improperly configured access controls. The vulnerability affects the ays-facebook-popup-likebox plugin and requires no user interaction to exploit. While no patch is currently available, the impact is limited to integrity violations without affecting confidentiality or availability. | MEDIUM | 5.3 | 0.0% | 27 |
No patch
|
| CVE-2026-76006 | SQL injection in Photo Gallery by Ays - Responsive Image Gallery (all versions through 6.8.2) allows authenticated administrators to extract arbitrary data from the WordPress database by appending malicious SQL to the 's' search parameter. The vulnerability spans two distinct code paths in the plugin's category list table class - record_count() via $wpdb->get_var() and prepare_items()/get_image_categories() via $wpdb->get_results() - supporting both blind and UNION-based exfiltration techniques. No public exploit has been identified at time of analysis; the high privilege requirement significantly constrains realistic attack scenarios. | MEDIUM | 4.9 | 0.4% | 25 |
No patch
|
| CVE-2026-8995 | Poll Maker WordPress plugin (versions ≤6.3.7) leaks the complete WP_User object - including bcrypt password hashes, email addresses, login names, registration dates, roles, and capabilities - through an AJAX endpoint that performs no nonce verification or capability check beyond confirming the requestor is logged in. Any subscriber-level authenticated user on an affected site can call the `ays_poll_get_user_information` action and retrieve user data that WordPress deliberately withholds from all of its standard interfaces, including the REST API. No public exploit has been identified at time of analysis, but the attack requires only a valid subscriber session and a single POST request, and the recovered bcrypt hash enables offline password-cracking attacks. | MEDIUM | 4.3 | 0.0% | 22 |
No patch
|
| CVE-2025-67595 | Cross-Site Request Forgery in the Quiz Maker WordPress plugin by Ays Pro up to version 6.7.0.82 allows unauthenticated attackers to perform unauthorized actions on behalf of authenticated site administrators. No active exploitation or public exploit code has been identified, and a vendor patch is available via a later version. | MEDIUM | 4.3 | 0.0% | 22 |
No patch
|