12
CVEs
3
Critical
6
High
0
KEV
0
PoC
9
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
3
HIGH
6
MEDIUM
3
LOW
0
Monthly CVE Trend
Affected Products (11)
Wordpress Plugin
69
Registrationmagic
36
Profilegrid
35
Eventprime
27
PHP
10
Profilegrid User Profiles Groups And Communities
5
Download Plugin
3
Registrationmagic Custom Registration Forms User Registration Payment And User Login
2
Eventprime Events Calendar Bookings And Tickets
1
Themeflection Numbers
1
Memberships And User Profiles For Woocommerce Profilegrid Woocommerce Integration
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-73341 | Unauthenticated PHP Object Injection in the RegistrationMagic WordPress plugin (versions <= 6.0.9.7) allows remote attackers to inject crafted serialized PHP objects that are deserialized by the application without validation. Depending on the POP gadget chains available in the plugin, WordPress core, or other installed plugins, this can escalate to arbitrary file operations, SQL injection, or remote code execution. Reported by Patchstack with a CVSS 9.8; no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is not confirmed in the wild. | CRITICAL | 9.8 | 0.4% | 49 |
No patch
|
| CVE-2026-12073 | Account takeover in the ProfileGrid - User Profiles, Groups and Communities WordPress plugin (all versions through 5.9.9.5) lets unauthenticated remote attackers hijack the site administrator account. The plugin fails to validate a `user_login` value on registration forms lacking that parameter and mishandles the resulting error messages, allowing an attacker to overwrite the email address of the user with ID=1 (typically the admin) and then trigger a password reset to seize full control. Reported by Wordfence with a 9.8 CVSS; no public exploit identified at time of analysis. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-49764 | Authentication bypass in the RegistrationMagic WordPress plugin (versions up to and including 6.0.8.6) allows unauthenticated remote attackers to circumvent intended authentication controls and gain access to protected resources. The flaw, tracked as CWE-288 and reported by Patchstack, carries a critical 9.8 CVSS score because exploitation requires no privileges, no user interaction, and is reachable over the network. There is no public exploit identified at time of analysis and the issue is not currently listed in CISA KEV. | CRITICAL | 9.8 | 0.4% | 49 |
No patch
|
| CVE-2026-12158 | Privilege escalation via Cross-Site Request Forgery in the RegistrationMagic WordPress plugin (all versions through 6.0.9.1) lets a remote attacker promote an arbitrary form submitter to administrator by forging a request to the process_request function, which lacks proper nonce validation. The attack plants a malicious Chronos automation task that later runs through WordPress cron, and it succeeds when a logged-in administrator is tricked into clicking an attacker-supplied link. No public exploit identified at time of analysis, and it is not listed in CISA KEV; risk is driven by the plugin's install base and the low technical bar of CSRF. | HIGH | 8.8 | 0.2% | 44 |
No patch
|
| CVE-2026-57759 | Cross-site request forgery in the ProfileGrid - User Profiles, Groups and Communities WordPress plugin (versions 5.9.9.7 and earlier) allows a remote unauthenticated attacker to force a logged-in victim into performing unintended state-changing actions, chaining to full account takeover. Because a successful CSRF against an administrator can hijack a privileged account, impact is rated high across confidentiality, integrity, and availability (CVSS 8.8). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. | HIGH | 8.8 | 0.1% | 44 |
No patch
|
| CVE-2026-57697 | Authentication bypass in the Metagauss ProfileGrid WordPress plugin (versions up to and including 5.9.9.6) lets remote unauthenticated attackers abuse the password recovery flow as an alternate channel to hijack arbitrary user accounts, including administrators. Because the flaw is exploitable over the network with no privileges and no user interaction (CVSS 7.5, I:H), it enables full account takeover on affected WordPress sites. No public exploit is identified at time of analysis and it is not in CISA KEV, but the low attack complexity makes it an attractive target once details circulate. | HIGH | 7.5 | 0.5% | 38 |
No patch
|
| CVE-2026-82225 | Broken authentication in RegistrationMagic WordPress plugin versions up to and including 6.0.9.8 allows unauthenticated network attackers to bypass authentication controls via an alternate path or channel, achieving high confidentiality and integrity impact without any credentials or user interaction. Classified under CWE-288, the flaw enables unauthorized access to registration and submission management functionality that should be gated behind authentication. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS High severity and dual C:H/I:H impact classify this as a priority remediation for any WordPress deployment running the affected plugin. | HIGH | 7.4 | 0.2% | 37 |
No patch
|
| CVE-2026-13441 | Stored cross-site scripting in the EventPrime events plugin for WordPress (versions through 4.3.4.2, by Metagauss) lets low-privileged or, in one configuration, unauthenticated actors persist arbitrary JavaScript through the 'new_event_type_background_color' field of the event-type creation flow. The injected script runs in the browser of any user who later views the affected page, enabling session/context theft in the WordPress front end and admin context. No public exploit has been identified at time of analysis and it is not listed in CISA KEV; the finding was reported by Wordfence. | HIGH | 7.2 | 0.2% | 36 |
No patch
|
| CVE-2026-82221 | Unauthenticated XSS in RegistrationMagic WordPress plugin versions 6.0.9.8 and below exposes sites to script injection attacks requiring only that a victim visit a crafted URL. The CVSS scope-change metric (S:C) confirms the injected payload executes in the victim's browser security context rather than the server's, enabling session hijacking, credential theft, or administrative action on behalf of the victim. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog. | HIGH | 7.1 | 0.1% | 36 |
No patch
|
| CVE-2026-4610 | Stored Cross-Site Scripting in the ProfileGrid WordPress plugin (all versions through 5.9.9.2) allows authenticated users with Subscriber-level access to inject persistent malicious scripts via the `pm_author_message` parameter in the private messaging function `pm_send_message_to_author`. The injected payload executes in any user's browser upon visiting the affected page, with a changed scope (S:C) meaning impact can extend to the broader WordPress session context - including potential admin account compromise. No public exploit has been identified at time of analysis, and a partial patch in version 5.9.8.5 does not fully remediate the issue, leaving sites running through 5.9.9.2 exposed. | MEDIUM | 6.4 | 0.2% | 32 |
No patch
|
| CVE-2026-9242 | Authentication bypass in the RegistrationMagic WordPress plugin (all versions through 6.0.8.6) permits an unauthenticated attacker with a prior legitimate payment transaction on the target site to obtain real WordPress session cookies for any user account, including administrators. The flaw exploits a fatally inverted processing order in the PayPal IPN callback handler: attacker-controlled POST data including the target user_id is written to the payment log database before PayPal IPN validation is performed, and the database poisoning persists even after validation subsequently rejects the forged notification. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the account-takeover impact makes this a critical priority for any site running the plugin with active PayPal payment integration. | MEDIUM | 5.3 | 0.2% | 27 |
No patch
|
| CVE-2026-11359 | Unauthorized plugin installation affects the Memberships and User Profiles for WooCommerce - ProfileGrid WooCommerce Integration plugin (versions up to and including 3.4), allowing any authenticated WordPress user at Subscriber level or above to force-install and activate the ProfileGrid plugin without administrative approval. The flaw stems from a dual failure - absent capability check and absent nonce validation - on the `pg_install_profilegrid()` AJAX handler, registered via the `wp_ajax_pg_install_profilegrid` hook. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis; however, the low barrier to exploitation (any authenticated user) makes this a meaningful integrity risk on multi-tenant or open-registration WooCommerce stores. | MEDIUM | 4.3 | 0.2% | 22 |
No patch
|