44
CVEs
4
Critical
10
High
0
KEV
0
PoC
14
Unpatched C/H
2.3%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
4
HIGH
10
MEDIUM
30
LOW
0
Monthly CVE Trend
Affected Products (16)
Wordpress Plugin
77
Tutor Lms
48
Wp Crowdfunding
13
Kirki Freeform Page Builder Website Builder Customizer
12
Tutor Lms Elearning And Online Course Solution
12
Kirki
7
PHP
5
Tutor Lms Elementor Addons
5
Droip
4
Qubely
4
Wp Page Builder
4
Tutor Lms Pro
2
Wordpress Theme
2
Tutor Lms Migration Tool
2
Right Way
1
Skillate
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-8206 | Account takeover in the Kirki Freeform Page Builder WordPress plugin (versions 6.0.0 through 6.0.6) allows unauthenticated remote attackers to hijack any registered account, including administrators, by redirecting password reset links to attacker-controlled email addresses. The flaw stems from the plugin honoring an arbitrary email value supplied alongside a valid username in password reset requests, breaking the trust binding between account and recovery destination. No public exploit identified at time of analysis, but the trivial nature of the bug and Wordfence's published advisory make weaponization straightforward. | CRITICAL | 9.8 | 0.1% | 49 |
No patch
|
| CVE-2026-57724 | Object injection in the Themeum Kirki WordPress customizer framework (all versions through 6.0.12) allows attackers to abuse PHP deserialization of untrusted data (CWE-502), potentially leading to arbitrary object instantiation and, given a suitable POP gadget chain, remote code execution or full site compromise. Reported by Patchstack with a maximum CVSS 9.8 rating; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV. Because Kirki is a developer toolkit bundled into many premium WordPress themes, exposure depends on which theme/plugin code passes attacker-controllable input into its deserialization path. | CRITICAL | 9.8 | 0.6% | 49 |
No patch
|
| CVE-2026-22332 | SQL injection in Tutor LMS Pro (Themeum) versions 3.9.6 and earlier allows remote unauthenticated attackers to inject arbitrary SQL against the underlying WordPress database. The CVSS 9.3 rating reflects a scope change with high confidentiality impact, meaning data accessible to the WordPress backend can be exposed. As of analysis, no public exploit identified at time of analysis, and the issue is tracked via Patchstack. | CRITICAL | 9.3 | 0.3% | 46 |
No patch
|
| CVE-2026-57726 | Blind SQL injection in the Themeum Kirki WordPress customizer framework (all versions up to and including 6.0.12) lets remote attackers inject SQL through improperly neutralized special elements, per the CVSS PR:N vector without authentication, to infer and extract database contents. The scope-changed CVSS 3.1 score of 9.3 reflects impact reaching beyond the plugin's own security boundary into the wider WordPress database. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV. | CRITICAL | 9.3 | 0.4% | 46 |
No patch
|
| CVE-2026-78175 | Remote code execution is achievable in Tutor LMS WordPress plugin (≤4.0.7) via a PHP Object Injection flaw in the withdrawal account AJAX handler that exploits a subtle interaction between `esc_sql()` percent-escaping and PHP serialized string-length declarations. Authenticated attackers with subscriber-level access — or unauthenticated attackers on sites with user registration enabled, the typical eLearning configuration — can inject an arbitrary serialized object stream and trigger the well-documented `GuzzleHttp\Cookie\FileCookieJar` POP chain to write a webshell to an attacker-specified path. No public exploit or KEV listing is confirmed at time of analysis, but a fix changeset is available and the POP chain is reliably reachable due to the plugin's bundled PayPal Composer autoloader. | HIGH | 8.8 | 0.6% | 45 |
No patch
|
| CVE-2026-25406 | Authentication bypass in Tutor LMS Pro WordPress plugin (versions through 3.9.4) allows remote attackers to abuse authentication mechanisms via alternate paths, potentially gaining unauthorized administrative access. CVSS 8.1 reflects high attack complexity (AC:H) requiring specific conditions, yet successful exploitation grants complete system compromise (C:H/I:H/A:H). EPSS probability of 0.02% (6th percentile) indicates low observed exploitation activity. No active exploitation confirmed by CISA KEV. SSVC framework classifies this as non-automatable with total technical impact, making it a priority for organizations running this WordPress LMS plugin despite low real-world exploitation signals. | HIGH | 8.1 | 0.0% | 41 |
No patch
|
| CVE-2026-22330 | Unauthenticated local file inclusion in the Themeum Right Way WordPress theme versions 4.0 and earlier allows remote attackers to include arbitrary local files and likely achieve code execution through PHP file inclusion (CWE-98). The flaw is network-reachable without credentials, though CVSS records high attack complexity (AC:H), and no public exploit has been identified at time of analysis. The advisory is sourced from Patchstack's WordPress vulnerability database. | HIGH | 8.1 | 0.4% | 40 |
No patch
|
| CVE-2026-3360 | Unauthenticated attackers can overwrite billing profile data (name, email, phone, address) for any WordPress user with an incomplete manual order in Tutor LMS plugin versions ≤3.9.7. The pay_incomplete_order() function accepts attacker-controlled order_id parameters without identity verification, writing billing fields directly to the order owner's profile. Exploitation is simplified by predictable Tutor nonce exposure on public pages, enabling targeted profile manipulation via crafted POST requests with enumerated order IDs. No public exploit or active exploitation confirmed at time of analysis. | HIGH | 7.5 | 0.1% | 38 |
No patch
|
| CVE-2026-8073 | Arbitrary file read and deletion in the Kirki - Freeform Page Builder plugin for WordPress (versions through 6.0.6) allows unauthenticated remote attackers to read and delete files within the WordPress uploads base directory by abusing the 'downloadZIP' function. The flaw stems from insufficient path validation and a missing capability check, and was reported by Wordfence; no public exploit identified at time of analysis. | HIGH | 7.5 | 0.1% | 38 |
No patch
|
| CVE-2026-57727 | Broken access control in the Themeum Kirki WordPress customizer framework (versions up to and including 6.0.13) allows remote unauthenticated attackers to reach functionality protected by incorrectly configured access-control levels, resulting in disclosure of sensitive information. The flaw was reported by Patchstack and stems from a missing authorization check (CWE-862); no public exploit has been identified at time of analysis. With a CVSS of 7.5 driven purely by confidentiality impact, the practical risk is unauthorized data exposure rather than site takeover. | HIGH | 7.5 | 0.4% | 38 |
No patch
|
| CVE-2026-17037 | Stored Cross-Site Scripting in the Kirki - Freeform Page Builder, Website Builder & Customizer WordPress plugin (all versions through 6.2.0) allows unauthenticated attackers to permanently embed malicious JavaScript into pages via the unsanitized 'comment' parameter. Injected payloads persist in the database and execute in every subsequent visitor's browser session, enabling session hijacking, credential theft, or privilege escalation against logged-in administrators who view the affected pages. No public exploit or CISA KEV listing has been identified at time of analysis, but the unauthenticated write vector makes mass-exploitation trivially automatable across unpatched WordPress installations. | HIGH | 7.2 | 0.3% | 36 |
No patch
|
| CVE-2026-66629 | Unauthenticated cross-site scripting (XSS) in the Kirki WordPress customizer plugin (all versions up to and including 6.2.3) allows remote, unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser when the victim is socially engineered into visiting a crafted URL or page. The CVSS scope change (S:C) indicates injected script execution escapes the plugin's own context, enabling session hijacking, credential theft, or unauthorized admin actions against authenticated WordPress users. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the zero-privilege-required, low-complexity attack path makes this accessible to unsophisticated attackers targeting WordPress sites. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-22329 | Reflected cross-site scripting in the Skillate WordPress theme versions 1.2.10 and below allows remote unauthenticated attackers to inject arbitrary JavaScript that executes in a victim's browser when they interact with a crafted link. The flaw carries a CVSS 3.1 score of 7.1 with scope change (S:C), reflecting that the injected script runs in the WordPress site context and can pivot against authenticated users including administrators. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-57725 | Stored cross-site scripting in the Themeum Kirki WordPress customizer framework (versions through 6.0.11) lets an attacker persist malicious script that executes in the browsers of users who later view the affected page or admin screen. Because the CVSS scope is marked changed (S:C), a successful payload can act beyond the vulnerable component's boundary, affecting whoever renders the stored input. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV. | HIGH | 7.1 | 0.3% | 36 |
No patch
|
| CVE-2026-65436 | We need to produce a JSON object with specified fields. Let's gather the data: CVE-2026-65436, description: Editor Arbitrary File Deletion in Kirki <= 6.0.13 versions. No KEV mentioned, so not actively exploited. No EPSS data provided (must state missing). No POC info. CVSS: 6.8, vector: AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H. CWE-22 Path Traversal. Multi-source: Patchstack reported, CPE: cpe:2.3:a:themeum:kirki:*:*:*:*:*:*:*:*, Tags: Path Traversal, Kirki. EUVD ID, affected versions: n/a ≤6.0.13. References: Patchstack advisory. Now, product name: "Kirki" (WordPress plugin). So product_name: "Kirki". Summary: Need to synthesize original. Not copy description. Start with impact verb, product. Remote arbitrary file deletion in Kirki WordPress plugin up to 6.0.13, requiring high privileges (editor role). Attackers can delete arbitrary files on the server, causing availability impact (file loss). No evidence of active exploitation or public exploit. EPSS not provided. Technical context: Underlying technology: WordPress plugin for customizing themes. CWE-22 path traversal means improper limitation of a pathname to a restricted directory. Likely insufficient sanitization of user input that gets passed to file deletion functions. The affected product is Kirki plugin by Themeum (cpe:2.3:a:themeum:kirki:* up to 6.0.13). Root cause: path traversal in file deletion functionality accessible to high-privilege users (editor role). CVSS shows network vector, low complexity, high privileges, no user interaction, changed scope, confidentiality none, integrity none, availability high. Risk assessment: CVSS 6.8 medium, but scope changed? Actually 6.8 is medium, but vector includes S:C, and availability impact high, so affecting another component? The vector says scope changed (S:C), meaning the vulnerable component's scope changes, and the impact is on a subsequent component (C:N/I:N/A:H). But that's odd for file deletion within the same system. Possibly the plugin's file deletion i | MEDIUM | 6.8 | 0.3% | 34 |
No patch
|