5
CVEs
0
Critical
0
High
0
KEV
0
PoC
0
Unpatched C/H
0.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
0
MEDIUM
5
LOW
0
Monthly CVE Trend
Affected Products (7)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-85303 | Stored Cross-Site Scripting in Magepeople Inc.'s Booking and Rental Manager WordPress/WooCommerce plugin (all versions through 2.7.7) allows authenticated low-privileged users to inject persistent malicious scripts into pages rendered by the application. When a higher-privileged user such as an administrator subsequently views the affected page, the stored payload executes in their browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. | MEDIUM | 6.5 | 0.1% | 32 |
No patch
|
| CVE-2026-81802 | Unauthenticated IDOR in the WpEvently WordPress plugin (versions ≤ 5.6.0) allows remote attackers with no credentials to supply user-controlled object identifiers that the plugin resolves without authorization checks, yielding partial integrity and availability impact over event-related data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires only standard network access to a public-facing WordPress installation running the affected plugin. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV. | MEDIUM | 6.5 | 0.2% | 32 |
No patch
|
| CVE-2026-81759 | Broken access control in WpEvently WordPress plugin versions 5.5.0 and earlier permits contributor-level authenticated users to perform unauthorized actions beyond their intended role scope. The flaw, reported by Patchstack and classified as CWE-862 (Missing Authorization), allows low-privileged WordPress users to impact site integrity and availability without administrative consent. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis. | MEDIUM | 5.4 | 0.2% | 27 |
No patch
|
| CVE-2026-78258 | Broken access control in MagePeople Inc.'s Booking and Rental Manager WordPress plugin (all versions through 2.7.5) permits unauthenticated remote attackers to invoke restricted plugin functionality and read limited application data without any credentials. Rooted in CWE-862 (Missing Authorization), the flaw arises from absent capability checks on one or more plugin endpoints - a structural weakness common in WooCommerce extensions that register AJAX handlers or REST routes without verifying caller permissions. No active exploitation has been confirmed via CISA KEV, and no public exploit code has been identified at the time of analysis. | MEDIUM | 5.3 | 0.2% | 26 |
No patch
|
| CVE-2026-81761 | Broken access control in WpEvently WordPress plugin versions 5.5.0 and earlier permits authenticated subscribers to invoke functionality or access data restricted to higher-privileged roles. The flaw is rooted in CWE-862 (Missing Authorization), meaning the plugin fails to enforce proper capability checks on one or more actions accessible to low-privilege users. No public exploit has been identified at time of analysis, and the absence of a KEV listing combined with the PR:L requirement limits opportunistic mass exploitation, though sites with open user registration face meaningful risk. | MEDIUM | 4.3 | 0.2% | 22 |
No patch
|