3
CVEs
1
Critical
2
High
0
KEV
0
PoC
3
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
2
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (11)
Wordpress Plugin
69
Registrationmagic
36
Profilegrid
35
Eventprime
27
PHP
10
Profilegrid User Profiles Groups And Communities
5
Download Plugin
3
Registrationmagic Custom Registration Forms User Registration Payment And User Login
2
Eventprime Events Calendar Bookings And Tickets
1
Themeflection Numbers
1
Memberships And User Profiles For Woocommerce Profilegrid Woocommerce Integration
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-73341 | Unauthenticated PHP Object Injection in the RegistrationMagic WordPress plugin (versions <= 6.0.9.7) allows remote attackers to inject crafted serialized PHP objects that are deserialized by the application without validation. Depending on the POP gadget chains available in the plugin, WordPress core, or other installed plugins, this can escalate to arbitrary file operations, SQL injection, or remote code execution. Reported by Patchstack with a CVSS 9.8; no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is not confirmed in the wild. | CRITICAL | 9.8 | 0.4% | 49 |
No patch
|
| CVE-2026-82225 | Broken authentication in RegistrationMagic WordPress plugin versions up to and including 6.0.9.8 allows unauthenticated network attackers to bypass authentication controls via an alternate path or channel, achieving high confidentiality and integrity impact without any credentials or user interaction. Classified under CWE-288, the flaw enables unauthorized access to registration and submission management functionality that should be gated behind authentication. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS High severity and dual C:H/I:H impact classify this as a priority remediation for any WordPress deployment running the affected plugin. | HIGH | 7.4 | 0.2% | 37 |
No patch
|
| CVE-2026-82221 | Unauthenticated XSS in RegistrationMagic WordPress plugin versions 6.0.9.8 and below exposes sites to script injection attacks requiring only that a victim visit a crafted URL. The CVSS scope-change metric (S:C) confirms the injected payload executes in the victim's browser security context rather than the server's, enabling session hijacking, credential theft, or administrative action on behalf of the victim. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog. | HIGH | 7.1 | 0.1% | 36 |
No patch
|