3
CVEs
1
Critical
1
High
0
KEV
0
PoC
2
Unpatched C/H
0.0%
Patch Rate
0.5%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
1
MEDIUM
1
LOW
0
Monthly CVE Trend
Affected Products (3)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-75816 | Unauthenticated account takeover in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.12) lets remote attackers overwrite any user's email address - including an administrator's - and then hijack the account via WordPress's built-in password-reset flow. The flaw stems from a missing capability check in pre_update_value combined with an authorization gate that is silently bypassed when a non-numeric post identifier (e.g. 'user_1') is supplied. Reported by Wordfence; no public exploit code or CISA KEV listing was identified at time of analysis, but the trivial, unauthenticated nature makes this a high-priority patch. | CRITICAL | 9.8 | 0.5% | 50 |
No patch
|
| CVE-2026-19952 | Unauthenticated arbitrary file deletion in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.12) allows remote attackers to remove any server-accessible file via path traversal in the move_folders function. Deleting critical files such as wp-config.php triggers WordPress's reinstallation routine, cascading directly to full remote code execution and site takeover. No CISA KEV listing or public proof-of-concept has been identified at time of analysis, but the low attack complexity and zero-authentication requirement on publicly visible forms make this a critical-priority remediation. | HIGH | 7.5 | 0.8% | 38 |
No patch
|
| CVE-2026-12747 | Stored Cross-Site Scripting in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.11) allows authenticated contributors to inject persistent malicious scripts via the 'tag' shortcode attribute, executing in the browser of any user who subsequently visits the compromised page. The scope change (S:C in CVSS) reflects the cross-context impact: scripts run under victims' browser sessions, enabling session hijacking, credential harvesting, or unauthorized actions on behalf of administrators. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV. | MEDIUM | 6.4 | 0.2% | 32 |
No patch
|