6
CVEs
4
Critical
2
High
0
KEV
0
PoC
6
Unpatched C/H
0.0%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
4
HIGH
2
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (6)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-14282 | Unauthenticated arbitrary file upload in the rtCamp GoDAM WordPress plugin (versions ≤ 1.12.2) allows remote attackers to plant executable files and likely achieve remote code execution. The flaw lives in the plugin's WPForms video-field integration, which bypasses WordPress's built-in upload sanitization by trusting the client-supplied Content-Type header and moving raw uploads into a web-served directory. No public exploit code has been identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network vector make this a critical-priority patch for any exposed site. | CRITICAL | 9.8 | 1.3% | 50 |
No patch
|
| CVE-2026-28185 | Authentication bypass in the rtCamp "Log in with Google" WordPress plugin (versions <= 1.4.2) lets unauthenticated remote attackers assume the identity of legitimate users because the plugin insufficiently verifies the authenticity of the Google OAuth login response. Rated CVSS 9.8, the flaw permits full account takeover without credentials or user interaction; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the Patchstack advisory confirms the vulnerability class. | CRITICAL | 9.8 | 0.2% | 49 |
No patch
|
| CVE-2026-59549 | Unauthenticated SQL injection in rtMedia for WordPress, BuddyPress and bbPress versions ≤4.7. | CRITICAL | 9.3 | 0.2% | 46 |
No patch
|
| CVE-2026-66592 | SQL injection in the rtMedia for WordPress, BuddyPress and bbPress plugin (versions 4.7.11 and earlier) lets remote unauthenticated attackers inject crafted SQL into a backend query, per a Patchstack-reported advisory. With CVSS 9.3 and a scope-changed vector, successful exploitation exposes sensitive database contents (WordPress user records, session/auth data, private media metadata) without any login. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-reachable nature makes it high-priority for any site running the plugin. | CRITICAL | 9.3 | 0.3% | 46 |
No patch
|
| CVE-2026-59551 | SQL injection in the rtMedia WordPress plugin (versions ≤ 4.7.10) allows authenticated subscriber-level users to extract highly sensitive information from the site's database. The vulnerability, disclosed by Patchstack, has no known active exploitation or public exploit code. With a CVSS score of 8.5, it poses a high data exposure risk for any site using the plugin with open subscriber registration. | HIGH | 8.5 | 0.3% | 42 |
No patch
|
| CVE-2026-16482 | Time-based blind SQL injection in rtMedia for WordPress, BuddyPress and bbPress (all versions through 4.7.11) enables unauthenticated remote attackers to exfiltrate arbitrary data from the WordPress database. The flaw stems from RTMediaQuery::query() merging raw $_REQUEST input into internal query parameters while only validating top-level array keys, allowing the nested 'compare' subvalue to bypass input validation and reach an unparameterized SQL sink. Exploitation requires only that a public-facing page exist with an rtMedia shortcode present - no authentication, interaction, or special server configuration is needed. No public exploit code or CISA KEV listing was identified at time of analysis. | HIGH | 7.5 | 0.3% | 38 |
No patch
|