6
CVEs
2
Critical
2
High
0
KEV
1
PoC
4
Unpatched C/H
0.0%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
2
MEDIUM
2
LOW
0
Monthly CVE Trend
Affected Products (11)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-78006 | Remote code execution in The Events Calendar plugin for WordPress (StellarWP) affects all versions up to and including 6.17.4, allowing unauthenticated attackers to run arbitrary PHP on the server via unsafe deserialization. The is_safe_widget_instance guard is bypassed because PHP fires magic methods during pre-parse and enable_rendering_widget_copied() forges a valid wp_hash integrity attribute before unserialize() executes; the malicious block markup reaches the sink through the V2 single-event template running do_blocks() over buffered comment HTML. Reported by Wordfence with a CVSS of 9.8; no public exploit identified at time of analysis, though the vulnerability is well-documented with pinpointed source-line references. | CRITICAL | 9.8 | 0.8% | 70 |
PoC
No patch
|
| CVE-2026-78159 | Remote code execution in The Events Calendar WordPress plugin (StellarWP) through version 6.17.3 lets unauthenticated attackers run arbitrary PHP on the server by abusing Element_Classes::parse_array(). A plain-array widget 'classes' payload evades the is_safe_widget_instance() object check and reaches a callable-invocation sink; the chain fires when do_blocks() renders a single-event page whose comment area contains a crafted wp:legacy-widget block. Reported by Wordfence with a 9.8 CVSS; no public exploit identified at time of analysis, and the flaw is only reachable on sites that enable comments on tribe_events posts. | CRITICAL | 9.8 | 0.8% | 50 |
No patch
|
| CVE-2026-12483 | Unrestricted file upload in the LearnDash LMS WordPress plugin (versions ≤5.1.5) allows authenticated subscribers enrolled in courses with assignment uploads enabled to bypass file-type validation by submitting a multi-file array, where only the first file is validated and subsequent files - including PHP webshells - are silently accepted and written to wp-content/uploads/learndash/assignments/. Remote code execution is contingent on non-default server configurations that permit PHP execution within the uploads directory. No public exploit or CISA KEV listing has been identified at time of analysis. | HIGH | 7.5 | 0.4% | 38 |
No patch
|
| CVE-2026-3174 | Unauthenticated payment credential hijacking in the Event Tickets and Registration WordPress plugin (StellarWP, all versions ≤5.27.4) allows any remote attacker to silently replace the site's Stripe merchant account credentials - access tokens, publishable keys, and account ID - via a missing capability check on the plugin's Stripe OAuth return endpoint. Once the attacker's own Stripe credentials are stored, all subsequent ticket purchases by legitimate customers are processed into the attacker's account with no visible indication to the buyer or site administrator. No public exploit has been identified at time of analysis, but the fully unauthenticated AV:N/AC:L/PR:N attack surface makes opportunistic mass exploitation straightforward. | HIGH | 7.5 | 0.3% | 38 |
No patch
|
| CVE-2026-5510 | Stored Cross-Site Scripting in GiveWP (WordPress donation plugin by StellarWP, versions through 4.14.4) allows authenticated Contributor-level users to inject persistent JavaScript payloads into donation form pages via the give_form shortcode. The flaw arises because the continue_button_title and display_style shortcode attributes are sanitized with sanitize_text_field() - which strips HTML tags but does not encode special characters - and then written unescaped into HTML data attributes, leaving a standard XSS sink unguarded. No public exploit has been identified and active exploitation has not been confirmed by CISA KEV at time of analysis. | MEDIUM | 6.4 | 0.3% | 32 |
No patch
|
| CVE-2026-12843 | Authorization bypass in the LearnDash LMS WordPress plugin (versions 4.25.0-5.1.6) allows attackers to enroll arbitrary users in paid courses without completing payment, systematically circumventing the plugin's entire payment verification workflow. The root cause is CWE-862 (Missing Authorization): enrollment action handlers fail to verify that the requesting party has the appropriate permission or has satisfied payment conditions. A patched release (5.1.6.1) is available, and no public exploit has been identified at time of analysis. | MEDIUM | 5.4 | 0.2% | 27 |
No patch
|