6
CVEs
2
Critical
1
High
0
KEV
0
PoC
3
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
1
MEDIUM
3
LOW
0
Monthly CVE Trend
Affected Products (10)
Wordpress Plugin
15
PHP
5
Fundengine
4
Getgenie Ai Content Writer With Keyword Research Seo Tracking Tools
2
Fundengine Donation And Crowdfunding Platform
2
Elementskit Elementor Addons Advanced Widgets Templates Addons For Elementor
2
Emailkit Email Customizer For Woocommerce Wp
2
Shopengine Elementor Woocommerce Builder Addon All In One Woocommerce Solution With Ecommerce Templates Woo Widgets
1
Metform Contact Form Survey Quiz Conditional Forms Form Templates Custom Form Builder For Elementor
1
Wp Ultimate Review
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-32470 | Unauthenticated PHP Object Injection in the FundEngine WordPress fundraising/donation plugin (slug wp-fundraising-donation) affects all versions up to and including 1.7.9, letting a remote attacker with no authentication inject a crafted serialized PHP object into an application deserialization sink. Given the CWE-502 root cause and the PR:N/UI:N vector, a successful attack can pivot to remote code execution, data theft, or full site takeover when a suitable POP gadget chain is reachable. Reported by Patchstack and rated CVSS 9.8, with no public exploit identified at time of analysis and no CISA KEV listing. | CRITICAL | 9.8 | 0.4% | 49 |
No patch
|
| CVE-2026-73993 | Unauthenticated PHP object injection in the Roxnor FundEngine (wp-fundraising-donation) WordPress plugin through version 1.7.9 lets remote attackers pass attacker-controlled serialized data into a PHP unserialize() sink without authentication. If a suitable POP gadget chain is present in the plugin, WordPress core, or another installed plugin, this can escalate to arbitrary code execution, file operations, or SQL manipulation. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. | CRITICAL | 9.8 | 0.4% | 49 |
No patch
|
| CVE-2026-75971 | Privilege escalation in ShopEngine (all versions up to and including 4.9.4) allows Shop Manager-level authenticated users to achieve full WordPress site takeover by injecting arbitrary core options through a malicious WXR import file. The plugin's `rum_importer()` function is hooked to the WordPress core `import_start` action without any plugin-owned capability check or allowlist filtering, meaning attacker-controlled `<wp_option>` pairs from a crafted import file flow directly into `update_option()` - enabling manipulation of `users_can_register` and `default_role` to open administrator self-registration. No CISA KEV listing or EPSS score was present in the provided data; exploitation requires an existing Shop Manager account and WooCommerce's grant of the `import` capability to that role, but once those conditions are met the path to full site compromise is straightforward and documented. | HIGH | 7.2 | 0.3% | 36 |
No patch
|
| CVE-2026-18100 | Stored Cross-Site Scripting in MetForm for WordPress (all versions through 4.1.8) allows authenticated contributors to permanently inject arbitrary JavaScript into pages via the 'mf_form_id' Elementor widget setting, exploiting two independent filter bypass paths. The payload evades Elementor's save-time wp_kses_post filter because it contains no HTML tags, and MetForm's own str_replace logic transforms script-tag constructs into executable JavaScript template literals - providing a second delivery route. Any visitor loading an injected page has the script execute in their browser context, enabling session hijacking or credential theft. No public exploit code or CISA KEV listing has been identified at time of analysis. | MEDIUM | 6.4 | 0.2% | 32 |
No patch
|
| CVE-2026-76063 | Stored Cross-Site Scripting in the FundEngine WordPress plugin (versions up to and including 1.8.1) allows any authenticated user with at minimum Subscriber-level access to inject persistent malicious scripts via the `wfp_featured_video_url` parameter. The REST endpoint that processes this input has its `permission_callback` hardcoded to `__return_true`, effectively bypassing WordPress role-based access controls and exposing the vulnerable code path to the lowest-privilege registered user. Injected scripts execute in the browsers of any subsequent visitor to the affected campaign page, enabling session hijacking, credential theft, or further lateral movement. No confirmed active exploitation has been identified (not in CISA KEV) and no public exploit code is referenced at time of analysis. | MEDIUM | 6.4 | 0.2% | 32 |
No patch
|
| CVE-2026-75930 | Authorization bypass in the FundEngine WordPress donation and crowdfunding plugin (all versions through 1.8.1) allows authenticated subscribers to overwrite the title, body, and author field of any post or page on the affected site. The vulnerable handler in apps/content.php accepts an attacker-supplied post_author integer without verifying the caller's rights over the target post, and the wp_rest nonce that nominally gates the endpoint is freely retrievable by any logged-in user from /wp-admin/admin-ajax.php?action=rest-nonce, eliminating it as a meaningful access control. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and minimal authentication requirement elevate real-world risk on sites that permit open subscriber registration. | MEDIUM | 4.3 | 0.2% | 22 |
No patch
|