7
CVEs
0
Critical
3
High
0
KEV
0
PoC
3
Unpatched C/H
14.3%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
3
MEDIUM
4
LOW
0
Monthly CVE Trend
Affected Products (16)
Wordpress Plugin
77
Tutor Lms
48
Wp Crowdfunding
13
Kirki Freeform Page Builder Website Builder Customizer
12
Tutor Lms Elearning And Online Course Solution
12
Kirki
7
PHP
5
Tutor Lms Elementor Addons
5
Droip
4
Qubely
4
Wp Page Builder
4
Tutor Lms Pro
2
Wordpress Theme
2
Tutor Lms Migration Tool
2
Right Way
1
Skillate
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-78175 | Remote code execution is achievable in Tutor LMS WordPress plugin (≤4.0.7) via a PHP Object Injection flaw in the withdrawal account AJAX handler that exploits a subtle interaction between `esc_sql()` percent-escaping and PHP serialized string-length declarations. Authenticated attackers with subscriber-level access — or unauthenticated attackers on sites with user registration enabled, the typical eLearning configuration — can inject an arbitrary serialized object stream and trigger the well-documented `GuzzleHttp\Cookie\FileCookieJar` POP chain to write a webshell to an attacker-specified path. No public exploit or KEV listing is confirmed at time of analysis, but a fix changeset is available and the POP chain is reliably reachable due to the plugin's bundled PayPal Composer autoloader. | HIGH | 8.8 | 0.6% | 45 |
No patch
|
| CVE-2026-17037 | Stored Cross-Site Scripting in the Kirki - Freeform Page Builder, Website Builder & Customizer WordPress plugin (all versions through 6.2.0) allows unauthenticated attackers to permanently embed malicious JavaScript into pages via the unsanitized 'comment' parameter. Injected payloads persist in the database and execute in every subsequent visitor's browser session, enabling session hijacking, credential theft, or privilege escalation against logged-in administrators who view the affected pages. No public exploit or CISA KEV listing has been identified at time of analysis, but the unauthenticated write vector makes mass-exploitation trivially automatable across unpatched WordPress installations. | HIGH | 7.2 | 0.3% | 36 |
No patch
|
| CVE-2026-66629 | Unauthenticated cross-site scripting (XSS) in the Kirki WordPress customizer plugin (all versions up to and including 6.2.3) allows remote, unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser when the victim is socially engineered into visiting a crafted URL or page. The CVSS scope change (S:C) indicates injected script execution escapes the plugin's own context, enabling session hijacking, credential theft, or unauthorized admin actions against authenticated WordPress users. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the zero-privilege-required, low-complexity attack path makes this accessible to unsophisticated attackers targeting WordPress sites. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-16759 | Unauthenticated remote PHP function invocation in the Tutor LMS WordPress plugin (all versions up to and including 4.0.5) allows any internet-accessible attacker to call arbitrary zero-argument PHP functions server-side via a missing-authorization AJAX handler combined with extract()-based variable injection into a template scope. The most critical demonstrated impact is persistent subscriber-level account creation through WordPress core's edit_user() function, which reads POST parameters directly, enabling unauthenticated user registration on any affected site. No CISA KEV listing has been identified at time of analysis, but Wordfence's detailed technical disclosure with specific file paths and line numbers substantially lowers the barrier for independent exploit development against the 6.5 CVSS-rated but trivially accessible unauthenticated attack surface. | MEDIUM | 6.5 | 0.4% | 33 |
No patch
|
| CVE-2026-73189 | Insecure Direct Object References in WP Crowdfunding (Themeum) versions prior to 2.2.1 allow authenticated subscriber-level users to access campaign objects, donor records, or financial data they are not authorized to view. The vulnerability, discovered and reported by Patchstack, stems from missing authorization checks on direct object references within the plugin, enabling lateral data exposure across campaigns or users. No public exploit or active exploitation has been identified at time of analysis, and a vendor patch is available. | MEDIUM | 6.5 | 0.3% | 33 |
|
| CVE-2026-19945 | Stored Cross-Site Scripting in the WP Crowdfunding WordPress plugin (≤2.2.1, by Themeum) allows authenticated subscribers to inject persistent JavaScript via the `first_name` parameter in the plugin's user profile dashboard. When an administrator views the attacker's user profile via the `?show_user_id=` URL parameter, the payload executes in the admin's browser session, enabling cross-privilege script execution from a subscriber-level account to an administrative context. No public exploit code has been identified and the CVE is absent from CISA KEV, though a patch commit exists in the plugin SVN repository. | MEDIUM | 6.4 | 0.2% | 32 |
No patch
|
| CVE-2026-19944 | Second-order SQL injection in the WP Crowdfunding WordPress plugin by Themeum (versions ≤2.2.1) enables authenticated shop managers to exfiltrate arbitrary database contents. The attack is split across two phases: the attacker writes a malicious payload once to the `wpneo_reward` post meta via the WooCommerce REST API, and the unsanitized value is then injected into a live SQL query on every subsequent public page view that renders the campaign rewards sidebar - making the extraction persistent and silent. No public exploit or KEV listing is identified at time of analysis, but the high confidentiality impact (C:H) and persistent execution model elevate practical risk beyond the CVSS 4.9 base score. | MEDIUM | 4.9 | 0.3% | 25 |
No patch
|