3
CVEs
0
Critical
2
High
0
KEV
0
PoC
2
Unpatched C/H
0.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
2
MEDIUM
1
LOW
0
Monthly CVE Trend
Affected Products (23)
Wordpress Plugin
46
Poll Maker
20
Quiz Maker
18
Survey Maker
15
Popup Box
9
PHP
5
Secure Copy Content Protection And Content Locking
5
Photo Gallery
5
Popup Like Box
2
Chatgpt Assistant
2
Chartify
2
Image Slider By Ays
2
Easy Form
2
Fox Lms
1
Faq Builder
1
Personal Dictionary
1
Faq Builder Ays
1
Photo Gallery By Ays Responsive Image Gallery
1
Quiz Maker By Ays
1
Poll Maker By Ays Versus Polls Anonymous Polls Image Polls
1
Advanced Related Posts
1
Image Slider
1
Portfolio Responsive Gallery
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-65565 | Unauthenticated Cross-Site Scripting in the Survey Maker WordPress plugin (versions <= 5.2.3.3) permits remote attackers without any credentials to inject arbitrary JavaScript that executes in a victim's browser when they interact with an affected survey page. The CVSS Changed scope (S:C) confirms the payload crosses from the plugin context into the victim's browser session, enabling session cookie theft, credential harvesting, or unauthorized actions performed on behalf of the victim. No public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-57361 | Stored/reflected cross-site scripting in the Survey Maker WordPress plugin (versions 5.2.2.5 and earlier by AYS Pro) lets unauthenticated remote attackers inject JavaScript that executes in a victim's browser after they interact with a crafted page or survey. The CVSS scope-change flag (S:C) indicates the injected script escapes the plugin's context to affect the wider WordPress site, potentially reaching authenticated admin sessions. This is a Patchstack-reported issue with no public exploit identified at time of analysis and no CISA KEV listing. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-76006 | SQL injection in Photo Gallery by Ays - Responsive Image Gallery (all versions through 6.8.2) allows authenticated administrators to extract arbitrary data from the WordPress database by appending malicious SQL to the 's' search parameter. The vulnerability spans two distinct code paths in the plugin's category list table class - record_count() via $wpdb->get_var() and prepare_items()/get_image_categories() via $wpdb->get_results() - supporting both blind and UNION-based exfiltration techniques. No public exploit has been identified at time of analysis; the high privilege requirement significantly constrains realistic attack scenarios. | MEDIUM | 4.9 | 0.4% | 25 |
No patch
|