20
CVEs
3
Critical
3
High
0
KEV
1
PoC
6
Unpatched C/H
0.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
3
HIGH
3
MEDIUM
14
LOW
0
Monthly CVE Trend
Affected Products (11)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-78006 | Remote code execution in The Events Calendar plugin for WordPress (StellarWP) affects all versions up to and including 6.17.4, allowing unauthenticated attackers to run arbitrary PHP on the server via unsafe deserialization. The is_safe_widget_instance guard is bypassed because PHP fires magic methods during pre-parse and enable_rendering_widget_copied() forges a valid wp_hash integrity attribute before unserialize() executes; the malicious block markup reaches the sink through the V2 single-event template running do_blocks() over buffered comment HTML. Reported by Wordfence with a CVSS of 9.8; no public exploit identified at time of analysis, though the vulnerability is well-documented with pinpointed source-line references. | CRITICAL | 9.8 | 0.8% | 70 |
PoC
No patch
|
| CVE-2026-78159 | Remote code execution in The Events Calendar WordPress plugin (StellarWP) through version 6.17.3 lets unauthenticated attackers run arbitrary PHP on the server by abusing Element_Classes::parse_array(). A plain-array widget 'classes' payload evades the is_safe_widget_instance() object check and reaches a callable-invocation sink; the chain fires when do_blocks() renders a single-event page whose comment area contains a crafted wp:legacy-widget block. Reported by Wordfence with a 9.8 CVSS; no public exploit identified at time of analysis, and the flaw is only reachable on sites that enable comments on tribe_events posts. | CRITICAL | 9.8 | 0.8% | 50 |
No patch
|
| CVE-2026-9273 | Account takeover in the Membership Plugin - Kadence Memberships (formerly Restrict Content) for WordPress affects all versions through 4.0.0 via password-reset link poisoning. The legacy lost-password handler trusts an attacker-controlled rc_redirect POST value, so an unauthenticated attacker can trigger a reset email for any account (including administrators) whose reset link points at an attacker-controlled host carrying a valid key/login; when the victim clicks it, the reset key leaks and can be replayed to seize the account. No public exploit identified at time of analysis, and the flaw is not in CISA KEV, but Wordfence-confirmed root cause and a straightforward primitive make this a high-priority patch (CVSS 9.3). | CRITICAL | 9.3 | 0.3% | 47 |
No patch
|
| CVE-2026-12483 | Unrestricted file upload in the LearnDash LMS WordPress plugin (versions ≤5.1.5) allows authenticated subscribers enrolled in courses with assignment uploads enabled to bypass file-type validation by submitting a multi-file array, where only the first file is validated and subsequent files - including PHP webshells - are silently accepted and written to wp-content/uploads/learndash/assignments/. Remote code execution is contingent on non-default server configurations that permit PHP execution within the uploads directory. No public exploit or CISA KEV listing has been identified at time of analysis. | HIGH | 7.5 | 0.4% | 38 |
No patch
|
| CVE-2026-3174 | Unauthenticated payment credential hijacking in the Event Tickets and Registration WordPress plugin (StellarWP, all versions ≤5.27.4) allows any remote attacker to silently replace the site's Stripe merchant account credentials - access tokens, publishable keys, and account ID - via a missing capability check on the plugin's Stripe OAuth return endpoint. Once the attacker's own Stripe credentials are stored, all subsequent ticket purchases by legitimate customers are processed into the attacker's account with no visible indication to the buyer or site administrator. No public exploit has been identified at time of analysis, but the fully unauthenticated AV:N/AC:L/PR:N attack surface makes opportunistic mass exploitation straightforward. | HIGH | 7.5 | 0.3% | 38 |
No patch
|
| CVE-2026-32546 | StellarWP Restrict Content plugin versions 3.2.22 and earlier contain an authorization bypass that allows unauthenticated attackers to modify access control settings through improper validation of security levels. An attacker can leverage this vulnerability to escalate privileges or grant unauthorized content access to restricted resources. No patch is currently available. | HIGH | 7.5 | 0.0% | 38 |
No patch
|
| CVE-2026-3079 | The LearnDash LMS plugin for WordPress contains a blind time-based SQL injection vulnerability in the 'filters[orderby_order]' parameter of the 'learndash_propanel_template' AJAX action, affecting all versions up to and including 5.0.3. Authenticated attackers with Contributor-level access or higher can exploit insufficient input escaping and lack of prepared statements to extract sensitive database information through time-based SQL injection techniques. While the CVSS score of 6.5 reflects medium severity with high confidentiality impact, the requirement for authentication and low network complexity means this poses a real but contained risk, particularly in multi-user WordPress environments where contributor accounts are common. | MEDIUM | 6.5 | 0.0% | 33 |
No patch
|
| CVE-2026-13246 | Stored Cross-Site Scripting in GiveWP versions up to and including 4.16.0 allows authenticated attackers with author-level WordPress access to inject persistent JavaScript payloads via the 'block_id' attribute of the 'givewp_campaign_comments' shortcode. The flaw originates in two code paths - CampaignCommentsShortcode::parseAttributes() and BlockRenderController::render() - where the blockId value is interpolated directly into a single-quoted HTML attribute without WordPress's esc_attr() sanitization function. Any visitor loading an injected page will have the malicious script execute in their browser context. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis. | MEDIUM | 6.4 | 0.2% | 32 |
No patch
|
| CVE-2026-14987 | Stored XSS in GiveWP's Sequoia donation template allows authenticated attackers with give worker-level access to inject persistent JavaScript payloads via the 'twitter_message' template setting, affecting all WordPress installations running plugin versions through 4.16.3. The injected payload is not sanitized before being embedded inside a JavaScript template literal in the Sequoia confirmation view's social-sharing component, and executes in the donor's browser specifically when they click the 'Share on Twitter' button after completing a donation. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the Wordfence disclosure includes direct source code references confirming the unsanitized evaluation path. | MEDIUM | 6.4 | 0.2% | 32 |
No patch
|
| CVE-2026-18062 | Stored Cross-Site Scripting in the Kadence Blocks WordPress plugin (all versions through 3.7.8.1) lets authenticated contributors permanently embed malicious scripts into WordPress pages via the Identity Block's inner image content, with those scripts executing in the browsers of any subsequent visitor. The vulnerable code path inside build_html() is only reachable when the Identity Block's urlTransparent attribute is explicitly set to a non-empty value, narrowing exposure to sites where contributors actively configure this specific block attribute. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified, though the CVSS Scope:Changed rating reflects that injected payloads execute in victim browser contexts rather than being confined to the server side. | MEDIUM | 6.4 | 0.2% | 32 |
No patch
|
| CVE-2026-18435 | Stored Cross-Site Scripting in the Kadence Blocks WordPress plugin (all versions through 3.7.8) allows authenticated contributors to inject persistent JavaScript payloads via the 'toggleIcon' block attribute, which execute in the browsers of any user who subsequently visits the poisoned page. The scope change (S:C in CVSS) means impact crosses from the plugin into victim browser sessions, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing is identified at time of analysis, but the low barrier to exploitation-contributor-level access is readily obtained on multi-author WordPress sites-elevates practical risk above the moderate CVSS score might suggest. | MEDIUM | 6.4 | 0.2% | 32 |
No patch
|
| CVE-2026-5510 | Stored Cross-Site Scripting in GiveWP (WordPress donation plugin by StellarWP, versions through 4.14.4) allows authenticated Contributor-level users to inject persistent JavaScript payloads into donation form pages via the give_form shortcode. The flaw arises because the continue_button_title and display_style shortcode attributes are sanitized with sanitize_text_field() - which strips HTML tags but does not encode special characters - and then written unescaped into HTML data attributes, leaving a standard XSS sink unguarded. No public exploit has been identified and active exploitation has not been confirmed by CISA KEV at time of analysis. | MEDIUM | 6.4 | 0.3% | 32 |
No patch
|
| CVE-2026-42643 | Stored XSS in StellarWP's Image Widget WordPress plugin (all versions through 4.4.11) allows a high-privileged attacker to plant persistent malicious JavaScript into widget configuration fields, which then executes in the browsers of any visitor loading pages that render the widget. The CVSS scope-change indicator (S:C) confirms the payload crosses from the admin backend into the victim's browser context. No public exploit code or active exploitation has been observed; EPSS at 0.03% (9th percentile) and SSVC exploitation status of 'none' indicate negligible current threat activity. | MEDIUM | 5.9 | 0.0% | 30 |
No patch
|
| CVE-2026-12843 | Authorization bypass in the LearnDash LMS WordPress plugin (versions 4.25.0-5.1.6) allows attackers to enroll arbitrary users in paid courses without completing payment, systematically circumventing the plugin's entire payment verification workflow. The root cause is CWE-862 (Missing Authorization): enrollment action handlers fail to verify that the requesting party has the appropriate permission or has satisfied payment conditions. A patched release (5.1.6.1) is available, and no public exploit has been identified at time of analysis. | MEDIUM | 5.4 | 0.2% | 27 |
No patch
|
| CVE-2026-42642 | Missing authorization in GiveWP (StellarWP's WordPress donation plugin) versions through 4.14.5 permits unauthenticated remote attackers to access restricted functionality due to incorrectly configured access control levels, resulting in partial information disclosure. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special conditions are required, and the SSVC framework rates the attack as automatable - meaning mass scanning is trivially feasible if a public exploit emerges. No public exploit or active exploitation has been identified at time of analysis; EPSS places exploitation probability at just 0.03% (8th percentile), indicating low current real-world risk despite the accessible attack surface. | MEDIUM | 5.3 | 0.0% | 27 |
No patch
|