20
CVEs
4
Critical
8
High
0
KEV
2
PoC
11
Unpatched C/H
5.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
4
HIGH
8
MEDIUM
8
LOW
0
Monthly CVE Trend
Affected Products (8)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-82222 | Unauthenticated PHP object injection in the GiveWP WordPress donation plugin (all versions through 4.16.7.1) lets remote attackers reach a deserialization sink and chain it into remote code execution on the hosting server. The flaw is network-reachable with no authentication or user interaction and carries a maximum CVSS of 10.0; Patchstack's public write-up details the full object-injection-to-RCE chain, though no in-the-wild exploitation has been confirmed. Because GiveWP handles donation and payment workflows, a successful attack fully compromises the site and any donor data it processes. | CRITICAL | 10.0 | 0.4% | 70 |
PoC
No patch
|
| CVE-2026-49772 | Blind SQL injection in The Events Calendar WordPress plugin (versions 6.15.12 through 6.16.2) by Liquid Web / StellarWP allows remote attackers to inject malicious SQL via unsanitized input handled by the plugin. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) indicates a network-reachable, unauthenticated, low-complexity issue with a scope change and high confidentiality impact, putting it at 9.3 critical. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; EPSS data was not provided in the input. | CRITICAL | 9.3 | 0.4% | 67 |
PoC
No patch
|
| CVE-2026-97283 | Object injection in the WordPress plugin Advanced Post Manager (all releases through version 4.5.5) lets remote attackers push attacker-controlled serialized data into PHP's unserialize() routine, potentially instantiating arbitrary objects and, where a usable POP gadget chain exists, achieving code execution with full confidentiality, integrity and availability impact. The NVD vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) treats the flaw as unauthenticated and network-reachable, whereas our independent assessment raises attack complexity to High because real-world impact hinges on a reachable gadget chain in the plugin, WordPress core or another active plugin; no public exploit identified at time of analysis and there is no CISA KEV entry for this CVE. | CRITICAL | 9.8 | 0.4% | 49 |
No patch
|
| CVE-2026-95606 | PHP object injection in The Events Calendar WordPress plugin (all versions through 6.17.4, published by Liquid Web / StellarWP) allows an attacker to pass crafted serialized data into a deserialization code path and instantiate arbitrary PHP objects, which can escalate to code execution, data theft or full site compromise if a usable POP gadget chain exists in the plugin, WordPress core or any other installed theme/plugin. The supplied CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes a remote, unauthenticated, no-interaction attack, but the advisory does not name the vulnerable endpoint, and comparable Patchstack object-injection findings frequently require at least a low-privilege authenticated session; our independent assessment therefore keeps the same impact ratings while treating exploitability as high-complexity (AC:H). There is no CISA KEV listing and no public exploit identified at time of analysis, so the practical risk is driven by whether a reachable gadget chain is present on a given WordPress installation rather than by confirmed active exploitation. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-40780 | Authentication bypass in Liquid Web / StellarWP BookIt WordPress plugin versions before 2.5.4.1 allows remote unauthenticated attackers to abuse the password recovery channel to take over accounts. The flaw maps to CWE-288 (alternate path/channel) and carries a CVSS 7.5 (high) integrity impact; no public exploit identified at time of analysis, though Patchstack has catalogued the issue for the WordPress ecosystem. | HIGH | 7.5 | 0.0% | 38 |
|
| CVE-2026-96333 | Payment bypass in GiveWP WordPress plugin through 4.16.8.1 allows unauthenticated remote attackers to have donations accepted without a legitimately cleared payment. This CWE-290 spoofing flaw has a CVSS score of 7.5, but impact is limited to donation/transaction integrity; it does not grant WordPress authentication, admin access, or server control. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, and EPSS data is not provided. | HIGH | 7.5 | 0.3% | 38 |
No patch
|
| CVE-2026-34900 | Unauthenticated reflected cross-site scripting in the GiveWP WordPress donation plugin (versions ≤4.14.2) allows remote attackers to execute arbitrary JavaScript in a victim's browser when the user clicks a crafted link. The flaw was disclosed via Patchstack and tracked as EUVD-2026-36921; no public exploit identified at time of analysis, and the CVSS scope-change rating of 7.1 reflects potential session hijacking or administrative action abuse against logged-in WordPress users including site administrators. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-66599 | Unauthenticated cross-site scripting in the WPComplete WordPress plugin (versions up to and including 2.9.5.6) allows remote attackers to inject and execute arbitrary JavaScript in the context of another user's browser session, with scope change indicating the payload crosses the plugin's security boundary to affect authenticated users such as site administrators. The CVSS vector (PR:N/UI:R/S:C) is consistent with a stored or reflected XSS pattern where an unauthenticated attacker plants a payload that is later triggered when a privileged user visits an affected page. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog. | HIGH | 7.1 | 0.1% | 36 |
No patch
|
| CVE-2026-103354 | Stored cross-site scripting in the Kadence Blocks WordPress plugin (Gutenberg Blocks by Kadence Blocks, versions from n/a through 3.7.11.1) allows a low-privileged content author to persist malicious script inside a Kadence/Gutenberg block, which then executes in the browser of any user who views the affected page or post - including an administrator. Patchstack rates it CVSS 7.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L; the independent assessment refines this to AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, because reaching the vulnerable editing surface realistically requires an account with post/page authoring capability, and no public exploit code has been identified at time of analysis. Impact is bounded to script execution in the victim's browser (session theft, admin-side actions via the victim's session, defacement) rather than direct server compromise, and it depends on the plugin being installed and active. | HIGH | 7.1 | 0.1% | 36 |
No patch
|
| CVE-2026-42678 | DOM-based cross-site scripting in the GiveWP WordPress donation plugin (versions up to and including 4.14.5) allows remote attackers to execute arbitrary JavaScript in a victim's browser session after the victim interacts with an attacker-supplied link or page element. The flaw carries a CVSS 7.1 score driven by changed scope (S:C), meaning impact extends beyond the vulnerable component into the surrounding WordPress site context. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. | HIGH | 7.1 | 0.0% | 36 |
No patch
|
| CVE-2026-66479 | Stored cross-site scripting can be planted on WordPress sites running the WPComplete plugin through version 2.9.5.6, because a WPComplete write action is performed without adequate CSRF nonce validation (CWE-352) and the stored value is later rendered without sufficient output encoding. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) the attacker needs no credentials of their own, but exploitation requires tricking a logged-in, privileged WordPress user into visiting an attacker-controlled page or link while their session is active, which is the primary limiting factor. No public exploit code or confirmed active exploitation was identified at time of analysis, and the net effect is a moderate-priority risk: injected script executes in the site context (scope changed) and can affect other users, but impact to confidentiality, integrity, and availability is each rated Low. | HIGH | 7.1 | 0.1% | 36 |
No patch
|
| CVE-2026-111396 | Missing authorization checks in the Advanced Post Manager WordPress plugin through version 4.5.6 let an authenticated user invoke functionality that should be reserved for higher-privileged roles, weakening the site's access-control boundary. Exploitation requires a valid low-privileged session (CVSS PR:L), so realistic exposure exists mainly on sites with open registration or attacker-controlled accounts, and no public exploit code has been identified at time of analysis. The demonstrated impact is limited to integrity and availability (C:N/I:L/A:L per our assessment), which is why this reads as a moderate-priority issue rather than a top-tier emergency. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-42662 | Unauthenticated authentication bypass in the Event Tickets WordPress plugin (versions ≤ 5.27.5 by Liquid Web / StellarWP) allows remote attackers to circumvent access controls without any credentials, affecting the integrity and availability of ticketing functionality. Classified under CWE-290 (Authentication Bypass by Spoofing), the CVSS vector confirms PR:N and AV:N - meaning any network-accessible attacker can attempt exploitation with low complexity and no user interaction required. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog, indicating no confirmed active exploitation. | MEDIUM | 6.5 | 0.4% | 33 |
No patch
|
| CVE-2026-104404 | Stored cross-site scripting in the GiveWP WordPress donation plugin (versions through 4.17.0) lets an authenticated user with only low-level privileges persist a script payload that executes in the browser of any user who later views the affected page. Because the injected code runs in the origin of the WordPress site (CVSS scope change: S:C), an attacker who convinces an administrator to open the poisoned screen can steal session cookies, harvest nonces, or perform privileged actions as that administrator. A vendor/Patchstack CVSS 3.1 base score of 6.5 (Medium) applies, exploitation requires an authenticated account plus victim interaction, and no public exploit code or confirmed active exploitation was identified at time of analysis. | MEDIUM | 6.5 | 0.2% | 33 |
No patch
|
| CVE-2026-110903 | Stored cross-site scripting in the WordPress plugin The Events Calendar (versions through 6.18.1) lets an authenticated attacker with event-authoring privileges inject persistent JavaScript that executes when another user, such as an administrator, views the affected event page. Exploitation requires a low-privilege WordPress account (PR:L) and victim interaction (UI:R), and the flaw carries a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). No public exploit has been identified at time of analysis, and the issue was reported by Patchstack. | MEDIUM | 6.5 | 0.1% | 32 |
No patch
|