277
CVEs
18
Critical
57
High
0
KEV
276
PoC
22
Unpatched C/H
86.6%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
18
HIGH
57
MEDIUM
169
LOW
33
Monthly CVE Trend
Affected Products (30)
PHP
56
User Registration Membership
11
Kirki
11
Eventin
10
Masterstudy Lms Wordpress Plugin
9
Ai Engine
8
Wp Directory Kit
7
Registrationmagic
7
Tutor Lms
7
Profilegrid
7
Rank Math Seo
7
Booking For Appointments And Events Calendar
6
Passster
6
Mstore Api
6
Dokan
6
Royal Addons For Elementor
6
Wp Photo Album Plus
6
Easy Appointments
6
Newsletters
6
Miniorange 2fa
5
User Frontend
5
Bit Form
5
Frontend File Manager Plugin
5
Open Redirect
5
Salon Booking System
5
Wpvivid Backup Migration Staging
5
Js Help Desk
5
Visualizer
4
Stripe Payment Forms By Wp Full Pay
4
Brizy
4
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-4357 | Unrestricted file upload in the Embed HTML5 Game WordPress plugin (versions through 1.3) lets unauthenticated attackers upload arbitrary files - including PHP scripts - because the plugin neither restricts who may upload nor validates file type, enabling planting of PHP backdoors and full remote code execution. WPScan reports the flaw with a publicly available exploit, and the CVSS 10.0 rating reflects unauthenticated network exploitation with complete impact. No CISA KEV listing exists, but the combination of PR:N and a public PoC makes opportunistic scanning likely. | CRITICAL | 10.0 | 0.3% | 70 |
PoC
No patch
|
| CVE-2026-81648 | Missing authorization on an AJAX endpoint in the CryptoPayment Gateway WordPress plugin (versions 1.2.1 through 1.2.2) lets remote unauthenticated attackers invoke administrative operations. An attacker can delete arbitrary files on the server, overwrite the payment gateway configuration, and read stored wallet credentials in cleartext. Publicly available exploit detail exists (reported by WPScan); there is no public evidence of active exploitation at time of analysis, though the CVSS vector (10.0, AV:N/AC:L/PR:N/UI:N/S:C) marks it as trivially exploitable. | CRITICAL | 10.0 | 0.3% | 70 |
PoC
No patch
|
| CVE-2026-14560 | Unauthenticated remote code execution in the Teddy Bear Customize Addon WordPress plugin (all versions through 1.0.5) allows attackers to upload arbitrary PHP files to the server and execute code. The plugin's upload handler trusts the client-supplied MIME/content type and preserves the original attacker-controlled filename, so a request declaring an image content type while carrying a .php payload lands as an executable script in the webroot. Publicly available exploit details have been published by WPScan; no active exploitation has been confirmed in CISA KEV at time of analysis. | CRITICAL | 10.0 | 0.2% | 70 |
PoC
No patch
|
| CVE-2026-77770 | Unauthenticated arbitrary site-option deletion in the miniOrange 2FA WordPress plugin (versions 5.3.24 through before 6.3.1, and 18.0 through before 19.3) lets any visitor delete arbitrary wp_options entries because option names are taken directly from request input without validating a legitimate transaction. Deleting the right options can lock every administrator out of the WordPress dashboard or fully deactivate the two-factor plugin, stripping the site of its 2FA protection. Publicly available exploit code exists (WPScan) and a vendor patch is available; the flaw is rated CVSS 10.0. | CRITICAL | 10.0 | 0.1% | 70 |
PoC
|
| CVE-2026-77009 | Remote code execution in the WatchMan-Site7 WordPress plugin (all versions through 4.2.0) allows any authenticated user - including a low-privilege subscriber - to run arbitrary PHP on the server because the plugin's debugging console, which evaluates user-supplied PHP, is not access-restricted. Publicly available exploit code exists (reported by WPScan), and with CVSS 9.9 this represents full server compromise from the lowest authenticated role. There is no public evidence of active in-the-wild exploitation at time of analysis. | CRITICAL | 9.9 | 0.3% | 70 |
PoC
No patch
|
| CVE-2026-19092 | Unauthenticated arbitrary PHP function invocation in the Tutor LMS WordPress plugin before 4.0.6 lets remote attackers overwrite internal template variables via request data and call any zero-argument PHP function, returning its output to the attacker. This enables information disclosure and potentially broader compromise depending on which functions are reachable. Publicly available exploit code exists (reported by WPScan), though the flaw is not listed in CISA KEV. | CRITICAL | 9.8 | 0.4% | 69 |
PoC
|
| CVE-2026-75860 | Full site takeover in the JSON Options WordPress plugin (versions through 0.0.4) is possible because one of its actions runs on every request without any capability check or nonce verification, exposing arbitrary WordPress option updates to unauthenticated users. An attacker can flip the users_can_register option on and set default_role to administrator, then self-register an admin account. Publicly available exploit code exists (reported by WPScan), and the flaw is rated CVSS 9.8 with SSVC technical impact assessed as total. | CRITICAL | 9.8 | 0.3% | 69 |
PoC
No patch
|
| CVE-2025-9314 | Unauthenticated arbitrary file upload in the Developer Tools WordPress plugin (versions through 1.1.3) lets remote attackers upload malicious files via the bundled, legacy SWFUpload component, typically leading to remote code execution when a PHP webshell is placed in a web-accessible directory. Any WordPress site running this plugin at or below 1.1.3 is exposed with no authentication required. Publicly available exploit code exists (reported by WPScan), though there is no public evidence of active exploitation. | CRITICAL | 9.8 | 0.3% | 69 |
PoC
No patch
|
| CVE-2026-10522 | Privilege escalation to full site takeover affects the MemberHero WordPress plugin through version 6.9, where the frontend registration flow fails to restrict which account fields a visitor may set, letting unauthenticated attackers self-register with an arbitrary role - including Administrator. Version 6.9 was advertised as the fix but the patch is incomplete, so current installs remain exploitable to gain admin access and hijack existing accounts, and no fully-fixed release exists at time of analysis. Publicly available exploit code exists (WPScan), though EPSS remains low at 0.15% (4th percentile). | CRITICAL | 9.8 | 0.1% | 69 |
PoC
No patch
|
| CVE-2026-78362 | Site takeover in the SEO Flow by LupsOnline WordPress plugin (versions 3.0.0 through before 3.0.3) stems from improper validation of the credential supplied with the plugin's API requests, allowing unauthenticated attackers to be served in the security context of the administrator who configured the plugin. Because the flaw grants effective administrator-level access, an attacker can fully compromise the affected WordPress site. Publicly available exploit code exists (published by WPScan), though EPSS remains low at 0.15% (4th percentile), and there is no public exploit identified as active in the wild. | CRITICAL | 9.8 | 0.1% | 69 |
PoC
|
| CVE-2026-16259 | Account takeover in the Uix UserCenter WordPress plugin (all versions through 1.0.3) lets unauthenticated attackers seize any account, including administrators. The plugin's profile-update action never checks that the targeted account belongs to the requester and authorizes the action with a token signed by a hardcoded key that is identical on every installation, so an attacker can forge a valid token for any user and overwrite that user's email and password. Rated CVSS 9.8 with publicly available exploit code (WPScan), though EPSS is low at 0.14%. | CRITICAL | 9.8 | 0.1% | 69 |
PoC
No patch
|
| CVE-2026-14559 | Authentication bypass in the Teddy Bear Customize Addon WordPress plugin (through version 1.0.5) lets unauthenticated attackers log in as any registered user - including administrators - by supplying only that user's email address, because the login routine never verifies the account password. WPScan reports a publicly available exploit, and with CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) this is a trivially weaponizable full account-takeover; no active-exploitation (KEV) listing exists at this time. | CRITICAL | 9.8 | 0.1% | 69 |
PoC
No patch
|
| CVE-2026-14563 | Authentication bypass in the Advanced Customized Prompts WordPress plugin (versions through 1.0.1) lets an unauthenticated attacker obtain a valid authenticated session for any registered account by supplying only an email address, because an unauthenticated action issues the session without ever verifying the password. Attackers can log in as any user - including administrators - or create arbitrary new accounts, yielding full site takeover. Publicly available exploit code exists (reported by WPScan), though there is no public exploit identified as actively exploited in CISA KEV. | CRITICAL | 9.8 | 0.1% | 69 |
PoC
No patch
|
| CVE-2026-77012 | Unauthenticated file read, SSRF, and arbitrary file write affect the 爱采集数据采集和发布插件 (an auto-collection/scraping-and-publishing) WordPress plugin through version 1.0.0, because one of its unauthenticated endpoints trusts a hardcoded default secret instead of a per-install value and fails to validate supplied URLs and destination paths. Remote attackers with no authentication can read arbitrary server files, coerce the server into issuing arbitrary outbound requests and returning the responses, and write attacker-controlled content outside the uploads directory. Publicly available exploit code exists (reported by WPScan), though EPSS remains low at 0.14% (3rd percentile). | CRITICAL | 9.3 | 0.1% | 67 |
PoC
No patch
|
| CVE-2026-74232 | Root-level remote code execution affects a family of Zbtlink, MoreQuick, and related OEM routers/APs (e.g. L3_V2_8 3.0.0.4.528, WE826-T2 19.1101, ZBT-7628, ZBT-ZBT7621, AP522, AP7628, HC5661A, HK300, MAP-N10) that ship a factory backdoor implant named 'yunmgrd' beaconing to a hardcoded cloud C2 over unauthenticated cleartext UDP. Because the channel is unauthenticated and in cleartext, a remote attacker on the network path can hijack it, impersonate the C2, and run arbitrary commands as root - additionally tampering with DNS, stealing PPPoE credentials, and opening reverse SSH tunnels. Reported by VulnCheck with publicly available exploit code; not currently listed in CISA KEV. | CRITICAL | 9.3 | 0.5% | 66 |
PoC
No patch
|