6
CVEs
1
Critical
4
High
0
KEV
0
PoC
5
Unpatched C/H
0.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
4
MEDIUM
1
LOW
0
Monthly CVE Trend
Affected Products (13)
Wordpress Plugin
18
Active Products Tables For Woocommerce
3
Bear Bulk Editor And Products Manager Professional For Woocommerce By Pluginus Net
2
Fox Currency Switcher Professional For Woocommerce
2
Fox
2
Tableon Wordpress Posts Table Filterable
2
Bear
2
Inpost Gallery
1
PHP
1
Wolf
1
Wpcs
1
Mdtf
1
Husky Products Filter For Woocommerce Professional
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-66436 | SQL injection in the realmag777 'Active Products Tables for WooCommerce' WordPress plugin (versions up to and including 1.1.1) lets remote attackers inject arbitrary SQL against the site database without authentication. Reported by Patchstack and rated CVSS 9.3 (CWE-89), the flaw exposes back-end WooCommerce/WordPress data to disclosure. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV. | CRITICAL | 9.3 | 0.3% | 47 |
No patch
|
| CVE-2026-18881 | Blind SQL injection in the TableOn - WordPress Posts Table Filterable plugin (versions ≤ 1.0.5.1) exposes WordPress user credentials to unauthenticated remote attackers via a public AJAX endpoint. The `filter_data[comment_count]` parameter is split on a colon delimiter and both halves are interpolated directly into a `posts_where` SQL clause without `intval()` casting or `$wpdb->prepare()` sanitization, enabling blind query appending. A researcher confirmed extraction of database metadata, all WordPress usernames, and password hashes; the fix is available in version 1.0.6, and no public exploit code has been identified at time of analysis. | HIGH | 7.5 | 0.4% | 38 |
No patch
|
| CVE-2026-84816 | Unauthenticated cross-site scripting in the WPCS WordPress currency switcher plugin (versions ≤ 1.3.2) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in victims' browsers without any server-side privileges. The CVSS Scope:Changed metric confirms the injected payload escapes the plugin's own security context, enabling session theft, credential harvesting, or admin-level action execution on behalf of a tricked user. No public exploit or CISA KEV listing has been identified at time of analysis, though the unauthenticated nature lowers the bar for exploitation significantly. | HIGH | 7.1 | 0.1% | 36 |
No patch
|
| CVE-2026-57320 | Reflected/stored cross-site scripting in the WordPress plugin BEAR (realmag777's WooCommerce Bulk Editor and Products Manager, woo-bulk-editor) version 1.1.8 and earlier allows an unauthenticated remote attacker to inject malicious script that executes in a victim's browser when the victim is lured to interact with a crafted request. The CVSS:3.1 vector (AV:N/PR:N/UI:R/S:C) indicates network-reachable, no-authentication exploitation that requires user interaction and crosses a security scope boundary. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was reported by Patchstack. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-57409 | DOM-based cross-site scripting affects the RealMag777 "Active Products Tables for WooCommerce" WordPress plugin (slug profit-products-tables-for-woocommerce) in all versions through 1.1.0, letting a remote attacker deliver crafted input that is unsafely written into the DOM and executed as script in a victim's browser. Because the CVSS scope is changed (S:C) and no authentication is required (PR:N), successful exploitation can affect resources beyond the vulnerable component, though it requires the victim to interact with an attacker-influenced page or link (UI:R). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS score was supplied. | HIGH | 7.1 | 0.3% | 36 |
No patch
|
| CVE-2026-18562 | Reflected cross-site scripting in HUSKY - Products Filter Professional for WooCommerce (WordPress plugin, versions ≤1.4.3) allows unauthenticated attackers to inject arbitrary JavaScript into page responses by embedding malicious payloads inside SEO-friendly permalink URL filter path segments. The root cause is in wp_load_js(), which calls parse_url_query() to extract filter values from the URL path and serializes them with PHP's json_encode() into an inline script block without escaping single quotes, enabling string-context escape and script injection. Exploitation requires social engineering - the victim must click a crafted link - but a successful attack against a store administrator can lead to session hijacking or full WooCommerce backend compromise. No public exploit identified at time of analysis. | MEDIUM | 6.1 | 0.2% | 31 |
No patch
|