6
CVEs
1
Critical
2
High
0
KEV
0
PoC
3
Unpatched C/H
0.0%
Patch Rate
0.0%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
2
MEDIUM
2
LOW
0
Monthly CVE Trend
Affected Products (10)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-32303 | WPCHURCH WordPress plugin (through 2.7.0) has blind SQL injection with scope change, enabling unauthenticated extraction of the full WordPress database. | CRITICAL | 9.3 | 0.0% | 47 |
No patch
|
| CVE-2026-21625 | Arbitrary file upload in Joomla's Easy Discuss component allows authenticated attackers to bypass file validation by spoofing extensions, since the component relies solely on extension checks without verifying MIME types. An attacker with user privileges can upload malicious files to achieve remote code execution on affected systems. No patch is currently available. | HIGH | 8.8 | 0.0% | 44 |
No patch
|
| CVE-2025-32304 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mojoomla WPCHURCH allows PHP Local File Inclusion.This issue affects WPCHURCH: from n/a through 2.7.0. [CVSS 8.1 HIGH] | HIGH | 8.1 | 0.1% | 41 |
No patch
|
| CVE-2026-21623 | Stored cross-site scripting in Joomla's Easy Discuss component allows authenticated users to inject malicious scripts into forum posts due to insufficient input validation. An attacker with login credentials can execute arbitrary JavaScript in the browsers of other users viewing affected posts, potentially leading to session hijacking or credential theft. No patch is currently available for this vulnerability. | MEDIUM | 5.4 | 0.0% | 27 |
No patch
|
| CVE-2026-21624 | Insufficient input validation in the Easy Discuss component for Joomla allows authenticated users to inject persistent cross-site scripting (XSS) payloads through user avatar text fields. An attacker with valid credentials can exploit this to execute malicious scripts in the browsers of other users viewing affected content. The vulnerability affects Joomla installations using the vulnerable Easy Discuss component, with no patch currently available. | MEDIUM | 5.4 | 0.0% | 27 |
No patch
|
| CVE-2026-21627 | The vulnerability was rooted in how the Tassos Framework plugin handled specific AJAX requests through Joomla’s com_ajax entry point. Under certain conditions, internal framework functionality could be invoked without proper restriction. | – | 0.0% | 0 |
No patch
|