2
CVEs
0
Critical
1
High
0
KEV
0
PoC
1
Unpatched C/H
0.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
1
MEDIUM
1
LOW
0
Monthly CVE Trend
Affected Products (13)
Wordpress Plugin
18
Active Products Tables For Woocommerce
3
Bear Bulk Editor And Products Manager Professional For Woocommerce By Pluginus Net
2
Fox Currency Switcher Professional For Woocommerce
2
Fox
2
Tableon Wordpress Posts Table Filterable
2
Bear
2
Inpost Gallery
1
PHP
1
Wolf
1
Wpcs
1
Mdtf
1
Husky Products Filter For Woocommerce Professional
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-84816 | Unauthenticated cross-site scripting in the WPCS WordPress currency switcher plugin (versions ≤ 1.3.2) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in victims' browsers without any server-side privileges. The CVSS Scope:Changed metric confirms the injected payload escapes the plugin's own security context, enabling session theft, credential harvesting, or admin-level action execution on behalf of a tricked user. No public exploit or CISA KEV listing has been identified at time of analysis, though the unauthenticated nature lowers the bar for exploitation significantly. | HIGH | 7.1 | 0.1% | 36 |
No patch
|
| CVE-2026-18562 | Reflected cross-site scripting in HUSKY - Products Filter Professional for WooCommerce (WordPress plugin, versions ≤1.4.3) allows unauthenticated attackers to inject arbitrary JavaScript into page responses by embedding malicious payloads inside SEO-friendly permalink URL filter path segments. The root cause is in wp_load_js(), which calls parse_url_query() to extract filter values from the URL path and serializes them with PHP's json_encode() into an inline script block without escaping single quotes, enabling string-context escape and script injection. Exploitation requires social engineering - the victim must click a crafted link - but a successful attack against a store administrator can lead to session hijacking or full WooCommerce backend compromise. No public exploit identified at time of analysis. | MEDIUM | 6.1 | 0.2% | 31 |
No patch
|