8
CVEs
3
Critical
0
High
0
KEV
0
PoC
3
Unpatched C/H
0.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
3
HIGH
0
MEDIUM
5
LOW
0
Monthly CVE Trend
Affected Products (9)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-81780 | Unauthenticated arbitrary file upload in the Hash Form WordPress plugin (HashThemes) affects all versions up to and including 1.4.2, allowing a remote attacker with no authentication to upload files of arbitrary type to the server. Because the plugin fails to validate uploaded file types (CWE-434), an attacker can plant an executable PHP payload and achieve full site compromise. Rated CVSS 10.0 with a scope-change vector; no public exploit identified at time of analysis and it is not listed in CISA KEV, though the class of bug is trivially weaponizable. | CRITICAL | 10.0 | 0.3% | 50 |
No patch
|
| CVE-2026-78292 | PHP Object Injection in the Hash Form WordPress plugin (versions 1.4.1 and earlier) lets remote, unauthenticated attackers inject crafted serialized objects that are deserialized by the plugin, enabling code execution, data tampering, or site compromise depending on available gadget chains. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates it 9.8 Critical with no authentication required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.8 | 0.5% | 50 |
No patch
|
| CVE-2026-28164 | Cross-Site Request Forgery in HashThemes Easy Elementor Addons (WordPress plugin) affects all versions up to and including 2.3.7, letting a remote attacker forge state-changing requests that are executed with a victim administrator's privileges when the victim is lured into interacting with attacker-controlled content. Reported by Patchstack (CVE-2026-28164 / EUVD-2026-63327) with a vendor-assigned CVSS of 9.6; no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation hinges on tricking an authenticated user into triggering the forged request, since the plugin fails to validate request authenticity (CWE-352). | CRITICAL | 9.6 | 0.1% | 48 |
No patch
|
| CVE-2026-6370 | Stored cross-site scripting (XSS) in Mini Ajax Cart for WooCommerce up to version 1.3.4 allows authenticated administrators to inject malicious scripts into pages. When other users view these pages, the scripts execute, potentially leading to session theft or defacement. No active exploitation reported (CISA KEV not listed, SSVC exploitation none); EPSS score very low (0.03%). | MEDIUM | 5.9 | 0.0% | 30 |
No patch
|
| CVE-2026-65483 | Cross-site scripting in the HashThemes Demo Importer WordPress plugin (versions up to and including 1.4.2) allows a high-privileged attacker to inject malicious scripts into author-related fields that execute in other users' browsers when the affected content is viewed. The vulnerability carries a scope change (S:C), meaning a compromised author context can impact administrative sessions, potentially enabling session hijacking or unauthorized actions on behalf of a victim admin. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog. | MEDIUM | 5.9 | 0.2% | 30 |
No patch
|
| CVE-2026-5077 | Stored Cross-Site Scripting in Total WordPress theme versions up to 2.2.1 allows authenticated contributors and above to inject arbitrary JavaScript via post titles in the home blog section. The vulnerability stems from insufficient output escaping when rendering post titles in HTML attribute context. Exploitation requires the malicious post to be published and displayed with a featured image on the home page, where the injected script will execute in the browsers of all users viewing the page. No public exploit code has been identified, and active exploitation has not been confirmed. | MEDIUM | 5.4 | 0.0% | 27 |
No patch
|
| CVE-2026-24618 | Sensitive system information exposure in the Hash Elements WordPress plugin (all versions through 1.5.4) enables authenticated low-privilege users to retrieve embedded sensitive data from the plugin's output or internal responses. Classified under CWE-497, the plugin surfaces system-level information - potentially including API keys, server paths, or configuration values - to parties who should not have access to it. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the low authentication barrier (subscriber-level or equivalent WordPress account) broadens the pool of potential abusers on multi-user WordPress installations. | MEDIUM | 4.3 | 0.0% | 22 |
No patch
|
| CVE-2026-78280 | Cross-Site Request Forgery (CSRF) in the Hash Form WordPress plugin versions 1.4.0 and below enables unauthenticated remote attackers to trigger unauthorized state-changing actions on behalf of authenticated WordPress users who visit a malicious page. The vulnerability stems from missing or insufficient CSRF token (nonce) validation in the plugin's request handling, classified under CWE-352. With no public exploit identified at time of analysis and an integrity-only impact (CVSS 4.3), this is a medium-severity finding requiring user interaction to exploit. | MEDIUM | 4.3 | 0.1% | 22 |
No patch
|