16
CVEs
2
Critical
7
High
0
KEV
3
PoC
9
Unpatched C/H
6.2%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
7
MEDIUM
6
LOW
1
Monthly CVE Trend
Affected Products (13)
Wordpress Plugin
34
Profile Builder
18
Membership Content Restriction Paid Member Subscriptions
7
Translatepress Translate Multilingual Sites With Ai Translation
6
PHP
5
User Profile Builder Beautiful User Registration Forms User Profiles User Role Editor
4
Translatepress
4
User Profile Picture
4
Paid Member Subscriptions
3
Profile Builder Pro
3
Profile Builder Plugin
1
Paid Membership Subscriptions
1
Client Portal
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-19632 | Unauthenticated administrator account takeover affects the TranslatePress - Translate Multilingual sites with AI Translation plugin for WordPress in all versions through 3.3.1, where the 'trp_get_translations_regular' AJAX action returns raw translation-dictionary entries without access control. Because an administrator's password-reset URL can be persisted into the secondary-language dictionary as a translatable string, an unauthenticated attacker can read the plaintext reset key and login parameters and seize the admin account. Reported by Wordfence; no public exploit identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 9.8 | 0.8% | 70 |
PoC
No patch
|
| CVE-2026-17505 | Reflected XSS in the TranslatePress WordPress plugin (versions ≤ 3.2.5) allows unauthenticated attackers to inject and execute arbitrary JavaScript in victim browsers by abusing the plugin's internal `#!trpst#`/`#!trpen#` token-to-angle-bracket substitution, which runs after WordPress has already sanitized and escaped the search query parameter. Exploitation requires tricking an authenticated user into clicking a crafted search URL - no server-side authentication is required from the attacker (PR:N per CVSS vector). No confirmed active exploitation (not in CISA KEV) and no public POC have been identified at time of analysis, though the unauthenticated, low-complexity path and large WordPress plugin install base make this a meaningful exposure for unpatched sites. | MEDIUM | 6.1 | 0.4% | 51 |
PoC
No patch
|
| CVE-2026-78267 | Unauthenticated privilege escalation in the TranslatePress multilingual plugin for WordPress (all versions up to and including 3.3.2) allows a remote, unauthenticated attacker to gain elevated privileges within the site, per a Patchstack advisory. The flaw is classified as incorrect privilege assignment (CWE-266) and carries a CVSS 9.8, implying an attacker can escalate to a high-impact role without authentication or user interaction. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-82607 | Unrestricted file upload in Cozmoslabs Profile Builder Plugin for WordPress (versions through 3.16.1) is exploitable without authentication via the wppb_ajax_simple_avatar function exposed on the /wp-admin/admin-ajax.php endpoint. The CVSS 4.0 vector (PR:N, AV:N, AC:L) confirms unauthenticated remote access with no prerequisites beyond reaching the endpoint, and a proof-of-concept exploit has been publicly released, substantially lowering the barrier to opportunistic mass exploitation. Vendor-released patch version 3.16.2 is available and should be applied immediately on all affected WordPress installations. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
|
| CVE-2026-59539 | Unauthenticated modification of subscriber data in the Paid Member Subscriptions plugin for WordPress up to version 3.0.7 allows attackers to alter other users' membership or profile information by exploiting insecure direct object references. No authentication is required, and the attack can be performed remotely without user interaction, resulting in a high integrity impact. At the time of analysis, no public exploit or active exploitation has been identified. | HIGH | 7.5 | 0.3% | 38 |
No patch
|
| CVE-2026-76053 | Stored Cross-Site Scripting in the TranslatePress WordPress plugin (all versions through 3.3.3) allows unauthenticated attackers to permanently inject arbitrary JavaScript into translated pages visible to all site visitors. The attack exploits a bypass of WordPress's native comment sanitization (KSES): a crafted payload using anchor and code tags is permitted by the allowlist, stored verbatim in the database, and later executed when the plugin's bundled simple_html_dom parser processes comments during page translation rendering. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog. | HIGH | 7.2 | 0.3% | 36 |
No patch
|
| CVE-2026-75981 | Stored Cross-Site Scripting in the TranslatePress WordPress plugin (versions up to and including 3.2.5) allows unauthenticated attackers to inject executable HTML into pages viewed in secondary languages by exploiting the plugin's internal translation marker system. Plain-text markers (#!trpst# / #!trpen#) pass through WordPress's wp_kses sanitizer undetected at comment submission, are stored in the database, and are unconditionally converted to angle brackets during page rendering - materializing attacker-controlled text as live HTML tags such as <img onerror=...>. No public exploit has been identified at time of analysis and the vulnerability does not appear in CISA's Known Exploited Vulnerabilities catalog, but the zero-privilege stored nature of the flaw and the plugin's broad WordPress deployment make it a credible priority for any multilingual site with public commenting enabled. | HIGH | 7.2 | 0.2% | 36 |
No patch
|
| CVE-2026-18510 | Stored XSS in the TranslatePress WordPress plugin (all versions ≤3.2.6) enables unauthenticated attackers to inject persistent malicious scripts via comment content containing URL-encoded gettext markers. The bypass technique is noteworthy: the payload exclusively uses WordPress-permitted HTML tags and attributes with percent-encoded characters, causing it to pass the platform's built-in wp_kses sanitization untouched before TranslatePress's translation rendering engine processes and outputs it unescaped. The injected script executes in every visitor's browser on any page displaying the poisoned comment. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; vendor-released patch is version 3.3. | HIGH | 7.2 | 0.2% | 36 |
No patch
|
| CVE-2026-6431 | Stored cross-site scripting in the User Profile Builder WordPress plugin (Cozmoslabs, versions ≤3.15.7) permits unauthenticated attackers to inject persistent JavaScript payloads via the 'Biographical Info' registration field, which execute in any visitor's browser upon viewing the affected profile page. The vulnerability is rooted in missing input sanitization and output escaping in class-formbuilder.php and class-email-confirmation.php, enabling session hijacking, credential theft, or malicious redirects targeting administrators and other authenticated users. A patch is confirmed via WordPress.org SVN changeset 3511465; no public exploit code or active exploitation has been identified at time of analysis. | HIGH | 7.2 | 0.2% | 36 |
No patch
|
| CVE-2026-57348 | Server-Side Request Forgery in the Paid Member Subscriptions WordPress plugin (versions 3.0.4 and earlier by Cozmoslabs) lets remote unauthenticated attackers coerce the WordPress server into issuing arbitrary outbound HTTP requests. Per the CVSS vector (PR:N, S:C) the flaw is reachable without authentication and crosses a security boundary, enabling attackers to reach internal-only services, cloud metadata endpoints, or other back-end systems the WordPress host can talk to. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; EPSS was not provided. | HIGH | 7.2 | 0.2% | 36 |
No patch
|
| CVE-2026-66582 | Unauthenticated XSS in the TranslatePress WordPress plugin versions 3.3.2 and earlier allows remote, unauthenticated attackers to inject malicious JavaScript that executes in the browsers of visiting users. The CVSS 7.1 High rating reflects a scope change (S:C), meaning the injected script crosses the plugin's security boundary into the victim's authenticated WordPress session, enabling session hijacking or unauthorized actions on behalf of the victim. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-18512 | Stored Cross-Site Scripting in TranslatePress (WordPress plugin by cozmoslabs) versions through 3.2.6 allows authenticated attackers with subscriber-level access to inject persistent JavaScript via approved comment body content rendered in the Translation Editor's Strings Dropdown. The payload executes in the browser of any user - typically an administrator or editor - who subsequently opens the affected translation editor interface, creating a reliable subscriber-to-admin privilege escalation path through session hijacking or unauthorized administrative action. No confirmed active exploitation or public POC is identified at time of analysis; a vendor-released patch exists as version 3.3. | MEDIUM | 6.4 | 0.2% | 32 |
No patch
|
| CVE-2026-75965 | Stored Cross-Site Scripting in the User Profile Builder WordPress plugin (versions up to and including 4.0.0) allows authenticated attackers with contributor-level access to inject persistent JavaScript payloads via the 'date' shortcode attribute, executing in victims' browsers whenever they visit an affected page. The vulnerability stems from insufficient input sanitization and output escaping in the format-date shortcode handler (format-date.php), identified in the plugin Trac source at lines 7 and 16. No active exploitation has been confirmed at time of analysis, and a fix appears committed upstream per changeset 3666521 on the WordPress plugin repository. | MEDIUM | 6.4 | 0.2% | 32 |
No patch
|
| CVE-2026-75964 | Stored XSS in the User Profile Builder WordPress plugin (all versions through 4.0.0) allows unauthenticated attackers to inject malicious JavaScript via the email parameter submitted during user registration. The payload persists in the unconfirmed email addresses database and executes in the browser of any administrator with manage_options capability who visits the Users > Unconfirmed Email Addresses list table and interacts with row-action links, because the row_actions() function renders the stored email value verbatim as a javascript: href. No public exploit has been identified at time of analysis, and an upstream fix is available via SVN changeset 3666521. | MEDIUM | 6.1 | 0.2% | 31 |
No patch
|
| CVE-2026-66701 | Unauthenticated broken access control in the Profile Builder WordPress plugin (versions up to and including 3.16.5) allows remote, unauthenticated attackers to perform unauthorized write operations against plugin functionality - bypassing intended access restrictions without any credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms full network exploitability with no prerequisites, though impact is limited to low-severity integrity modifications with no confidentiality or availability consequences. No public exploit code or active exploitation has been identified at time of analysis. | MEDIUM | 5.3 | 0.2% | 27 |
No patch
|