9
CVEs
2
Critical
1
High
0
KEV
0
PoC
3
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
1
MEDIUM
6
LOW
0
Monthly CVE Trend
Affected Products (10)
Wordpress Plugin
16
PHP
5
Fundengine
4
Emailkit Email Customizer For Woocommerce Wp
2
Getgenie Ai Content Writer With Keyword Research Seo Tracking Tools
2
Fundengine Donation And Crowdfunding Platform
2
Elementskit Elementor Addons Advanced Widgets Templates Addons For Elementor
2
Shopengine Elementor Woocommerce Builder Addon All In One Woocommerce Solution With Ecommerce Templates Woo Widgets
2
Wp Ultimate Review
1
Metform Contact Form Survey Quiz Conditional Forms Form Templates Custom Form Builder For Elementor
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-32470 | Unauthenticated PHP Object Injection in the FundEngine WordPress fundraising/donation plugin (slug wp-fundraising-donation) affects all versions up to and including 1.7.9, letting a remote attacker with no authentication inject a crafted serialized PHP object into an application deserialization sink. Given the CWE-502 root cause and the PR:N/UI:N vector, a successful attack can pivot to remote code execution, data theft, or full site takeover when a suitable POP gadget chain is reachable. Reported by Patchstack and rated CVSS 9.8, with no public exploit identified at time of analysis and no CISA KEV listing. | CRITICAL | 9.8 | 0.4% | 49 |
No patch
|
| CVE-2026-73993 | Unauthenticated PHP object injection in the Roxnor FundEngine (wp-fundraising-donation) WordPress plugin through version 1.7.9 lets remote attackers pass attacker-controlled serialized data into a PHP unserialize() sink without authentication. If a suitable POP gadget chain is present in the plugin, WordPress core, or another installed plugin, this can escalate to arbitrary code execution, file operations, or SQL manipulation. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. | CRITICAL | 9.8 | 0.4% | 49 |
No patch
|
| CVE-2026-75971 | Privilege escalation in ShopEngine (all versions up to and including 4.9.4) allows Shop Manager-level authenticated users to achieve full WordPress site takeover by injecting arbitrary core options through a malicious WXR import file. The plugin's `rum_importer()` function is hooked to the WordPress core `import_start` action without any plugin-owned capability check or allowlist filtering, meaning attacker-controlled `<wp_option>` pairs from a crafted import file flow directly into `update_option()` - enabling manipulation of `users_can_register` and `default_role` to open administrator self-registration. No CISA KEV listing or EPSS score was present in the provided data; exploitation requires an existing Shop Manager account and WooCommerce's grant of the `import` capability to that role, but once those conditions are met the path to full site compromise is straightforward and documented. | HIGH | 7.2 | 0.3% | 36 |
No patch
|
| CVE-2026-57406 | Missing authorization in the FundEngine WordPress fundraising plugin (versions through 1.7.6) permits unauthenticated remote attackers to exploit incorrectly configured access control, resulting in partial data integrity and availability impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms low-complexity, unauthenticated network exploitation with no user interaction required. No active exploitation is confirmed in the CISA KEV catalog, and no public exploit code has been identified at the time of this analysis. | MEDIUM | 6.5 | 0.3% | 32 |
No patch
|
| CVE-2026-59560 | We need to parse the input and produce a JSON. Let's extract all provided data: CVE ID: CVE-2026-59560 Description: "Subscriber Broken Access Control in FundEngine <= 1.7.8 versions." That's all. Very sparse. CVSS Score: 6.5 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CWE: CWE-862 (Missing Authorization) Multi-source intelligence: Reported by: Patchstack CPE: cpe:2.3:a:roxnor:fundengine:*:*:*:*:*:*:*:* (implies version <=1.7.8 from affected versions) Tags: Authentication Bypass, Fundengine (tags from probably Patchstack) ENISA EUVD ID: EUVD-2026-49227 Affected versions (EUVD): ["FundEngine n/a ≤1.7.8"] - note the "n/a" maybe they say version up to 1.7.8. References: [cveorg] (None) but URL: https://patchstack.com/database/wordpress/plugin/wp-fundraising-donation/vulnerability/wordpress-fundengine-plugin-1-7-8-broken-access-control-vulnerability?_s_id=cve We have no EPSS, no KEV status, no POC availability explicitly in the data. So we'll assume none provided. However, we must synthesize. The vulnerability is "Subscriber Broken Access Control", CWE-862 Missing Authorization. CVSS: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H -> high availability impact, no confidentiality/integrity. So an authenticated subscriber (low privilege) can cause a denial of service. The product is FundEngine, a WordPress plugin for fundraising/donation. So likely a WordPress plugin. Vendor: roxnor. The reference leads to Patchstack database. Patchstack often lists these. We need to infer from the URL: "wordpress-fundengine-plugin-1-7-8-broken-access-control-vulnerability". So it's in the wp-fundraising-donation plugin. The product name: FundEngine. So product_name: "FundEngine" (WordPress plugin). The description is "Subscriber Broken Access Control in FundEngine <= 1.7.8 versions." We need to write summary: original synthesis, not paraphrasing description. So what can a low-privileged subscriber do? They can cause a denial of service (from CVSS A:H). The description says broken | MEDIUM | 6.5 | 0.4% | 32 |
No patch
|
| CVE-2026-18100 | Stored Cross-Site Scripting in MetForm for WordPress (all versions through 4.1.8) allows authenticated contributors to permanently inject arbitrary JavaScript into pages via the 'mf_form_id' Elementor widget setting, exploiting two independent filter bypass paths. The payload evades Elementor's save-time wp_kses_post filter because it contains no HTML tags, and MetForm's own str_replace logic transforms script-tag constructs into executable JavaScript template literals - providing a second delivery route. Any visitor loading an injected page has the script execute in their browser context, enabling session hijacking or credential theft. No public exploit code or CISA KEV listing has been identified at time of analysis. | MEDIUM | 6.4 | 0.2% | 32 |
No patch
|
| CVE-2026-76063 | Stored Cross-Site Scripting in the FundEngine WordPress plugin (versions up to and including 1.8.1) allows any authenticated user with at minimum Subscriber-level access to inject persistent malicious scripts via the `wfp_featured_video_url` parameter. The REST endpoint that processes this input has its `permission_callback` hardcoded to `__return_true`, effectively bypassing WordPress role-based access controls and exposing the vulnerable code path to the lowest-privilege registered user. Injected scripts execute in the browsers of any subsequent visitor to the affected campaign page, enabling session hijacking, credential theft, or further lateral movement. No confirmed active exploitation has been identified (not in CISA KEV) and no public exploit code is referenced at time of analysis. | MEDIUM | 6.4 | 0.2% | 32 |
No patch
|
| CVE-2026-85575 | Stored Cross-Site Scripting in the ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress (versions up to and including 4.9.5) allows authenticated attackers with Author-level access or higher to persistently inject arbitrary JavaScript via the `shopengine_product_title_header_size` parameter. The injected payload executes in any site visitor's browser upon loading an affected page, enabling session hijacking, credential theft, or malicious redirects. No public exploit code has been identified at time of analysis, and it is not listed in the CISA KEV catalog. | MEDIUM | 6.4 | 0.2% | 32 |
No patch
|
| CVE-2026-75930 | Authorization bypass in the FundEngine WordPress donation and crowdfunding plugin (all versions through 1.8.1) allows authenticated subscribers to overwrite the title, body, and author field of any post or page on the affected site. The vulnerable handler in apps/content.php accepts an attacker-supplied post_author integer without verifying the caller's rights over the target post, and the wp_rest nonce that nominally gates the endpoint is freely retrievable by any logged-in user from /wp-admin/admin-ajax.php?action=rest-nonce, eliminating it as a meaningful access control. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and minimal authentication requirement elevate real-world risk on sites that permit open subscriber registration. | MEDIUM | 4.3 | 0.2% | 22 |
No patch
|