2
CVEs
1
Critical
1
High
0
KEV
0
PoC
2
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
1
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (6)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-66592 | SQL injection in the rtMedia for WordPress, BuddyPress and bbPress plugin (versions 4.7.11 and earlier) lets remote unauthenticated attackers inject crafted SQL into a backend query, per a Patchstack-reported advisory. With CVSS 9.3 and a scope-changed vector, successful exploitation exposes sensitive database contents (WordPress user records, session/auth data, private media metadata) without any login. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-reachable nature makes it high-priority for any site running the plugin. | CRITICAL | 9.3 | 0.3% | 46 |
No patch
|
| CVE-2026-16482 | Time-based blind SQL injection in rtMedia for WordPress, BuddyPress and bbPress (all versions through 4.7.11) enables unauthenticated remote attackers to exfiltrate arbitrary data from the WordPress database. The flaw stems from RTMediaQuery::query() merging raw $_REQUEST input into internal query parameters while only validating top-level array keys, allowing the nested 'compare' subvalue to bypass input validation and reach an unparameterized SQL sink. Exploitation requires only that a public-facing page exist with an rtMedia shortcode present - no authentication, interaction, or special server configuration is needed. No public exploit code or CISA KEV listing was identified at time of analysis. | HIGH | 7.5 | 0.3% | 38 |
No patch
|