815
CVEs
67
Critical
231
High
0
KEV
814
PoC
52
Unpatched C/H
87.1%
Patch Rate
0.9%
Avg EPSS
Severity Breakdown
CRITICAL
67
HIGH
231
MEDIUM
447
LOW
70
Monthly CVE Trend
Affected Products (30)
PHP
56
Kirki
11
Eventin
10
Masterstudy Lms Wordpress Plugin
9
Ai Engine
8
Registrationmagic
7
Profilegrid
7
Tutor Lms
7
User Registration Membership
7
Wp Directory Kit
7
Rank Math Seo
7
Booking For Appointments And Events Calendar
6
Mstore Api
6
Newsletters
6
Dokan
6
Royal Addons For Elementor
6
Wp Photo Album Plus
6
Easy Appointments
6
Passster
6
Miniorange 2fa
5
Frontend File Manager Plugin
5
Bit Form
5
User Frontend
5
Salon Booking System
5
Wpvivid Backup Migration Staging
5
Js Help Desk
5
Visualizer
4
Stripe Payment Forms By Wp Full Pay
4
Brizy
4
Wpfunnels
4
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-18391 | PHP Object Injection escalating to unauthenticated remote code execution affects the WooCommerce Subscriptions WordPress plugin from version 4.7.0 up to (but not including) 9.1.0, but only on stores running WooCommerce's High-Performance Order Storage (HPOS). The plugin unserializes attacker-controlled input without validation, and a gadget chain in bundled dependencies turns that into arbitrary code execution. Publicly available exploit code exists and a vendor patch (9.1.0) is available, but this is not listed in CISA KEV; the EPSS score of 28% is elevated, indicating meaningful exploitation probability. | CRITICAL | 9.8 | 28.0% | 97 |
PoC
|
| CVE-2026-15039 | Unauthenticated arbitrary file upload in the Giftware WordPress plugin before 4.2.10 allows remote attackers to upload PHP files through an upload path that fails to validate file type (CWE-434), leading to remote code execution on the underlying web server. The flaw carries a CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N) and publicly available exploit code exists per WPScan, though it is not currently listed in CISA KEV; the EPSS score of 22% reflects meaningful but not top-tier near-term exploitation probability. | CRITICAL | 9.8 | 22.0% | 91 |
PoC
|
| CVE-2026-16051 | Remote code execution in the WPMU DEV Dashboard (wpmudev-updates) WordPress plugin before 5.0.1 allows an attacker who can obtain or replay a single valid signed management request to push and execute arbitrary code on the site. The plugin's remote management interface installs packages without verifying their integrity and without replay protection, so a captured legitimate management call can be reused to install an attacker-controlled package. WPScan reports publicly available exploit code and the plugin scores CVSS 9.8; EPSS is elevated at 22%, but there is no public exploit identified as actively exploited in the wild (not in CISA KEV). | CRITICAL | 9.8 | 22.0% | 91 |
PoC
|
| CVE-2026-18366 | Privilege escalation and account takeover in the Events Manager WordPress plugin before 7.4.1 lets unauthenticated attackers reset passwords, promote accounts to Administrator, or delete accounts whose user ID collides with the ID of one of the plugin's own posts. The flaw stems from the plugin overriding WordPress's own capability decisions for unrelated privileged user actions. Publicly available exploit code exists (WPScan), EPSS is a notable 15%, and SSVC rates it automatable with total technical impact, though it is not currently listed in CISA KEV. | CRITICAL | 9.8 | 15.0% | 84 |
PoC
|
| CVE-2026-18474 | Unauthenticated SQL injection in WP Directory Kit WordPress plugin (all versions before 1.5.6) allows remote attackers to read arbitrary data from the WordPress database, including user credentials and sensitive site content. The flaw was reported by WPScan, a public proof-of-concept exploit is available, and exploitation requires no authentication - though it is conditioned on a non-default search field type being configured in the plugin. Patch version 1.5.6 resolves the vulnerability; sites using customized search field configurations are the exposed population. | HIGH | 8.6 | 19.0% | 82 |
PoC
|
| CVE-2026-13613 | SQL injection in the KiviCare WordPress plugin (all versions before 4.5.2) enables authenticated clinic staff users to execute arbitrary SQL against the underlying WordPress database. Unsanitized user-supplied parameters are passed directly into SQL queries, granting an attacker full read, write, and delete access to database contents including patient records and credentials. With a publicly available proof-of-concept, an EPSS of 17%, and a CVSS of 8.8, this is a high-priority patch for any healthcare-sector WordPress deployment running this plugin - though no CISA KEV-confirmed active exploitation has been identified at time of analysis. | HIGH | 8.8 | 17.0% | 81 |
PoC
|
| CVE-2026-16538 | Financial/business-logic bypass in the Wallet for WooCommerce WordPress plugin (all versions before 1.6.10) lets a customer credit their wallet balance for less than the amount actually paid, because the plugin credits the top-up before confirming the sum the payment gateway actually collected. Any registered store customer can effectively mint store credit at a discount, causing direct monetary loss to the merchant. Publicly available exploit code exists (WPScan); the flaw is not listed in CISA KEV, and EPSS is a moderate 13%. | CRITICAL | 9.1 | 13.0% | 78 |
PoC
|
| CVE-2026-16977 | Second-order SQL injection in Form Maker by 10Web WordPress plugin (all versions before 1.15.45) allows any subscriber-level authenticated user to execute arbitrary SQL against the WordPress database by submitting crafted input to database-backed choice fields, yielding high confidentiality and integrity impact. A publicly available proof-of-concept from WPScan lowers the exploitation barrier, and an EPSS of 16% reflects above-baseline real-world risk. No active exploitation is confirmed in CISA KEV at time of analysis, though the combination of low required privilege, network accessibility, and public exploit code makes this a credible near-term threat on unpatched installations. | HIGH | 8.1 | 16.0% | 76 |
PoC
|
| CVE-2026-18057 | SQL injection in the Events Manager WordPress plugin (versions before 7.4.1) allows any subscriber-level or higher authenticated user to manipulate raw SQL queries and tamper with booking consent records belonging to other users. The flaw arises from a user-controlled value being interpolated directly into a database query without sanitization (CWE-89), enabling both unauthorized data disclosure and integrity violations against other users' booking records. A publicly available proof-of-concept exists per WPScan's disclosure, and an EPSS score of 16% reflects meaningful exploitation likelihood, though active exploitation has not been formally confirmed in CISA's KEV catalog. | HIGH | 8.1 | 16.0% | 76 |
PoC
|
| CVE-2026-18230 | SQL injection in WP Directory Kit WordPress plugin (all versions before 1.5.6) allows any authenticated user - including low-privilege Subscribers - to query or manipulate the WordPress database via an AJAX endpoint that performs no input sanitization and enforces no authorization check. With a publicly available proof-of-concept reported by WPScan and an EPSS of 16%, the exploitation barrier is low for any site with user registration enabled. A vendor patch is available in version 1.5.6. | HIGH | 8.1 | 16.0% | 76 |
PoC
|
| CVE-2026-13171 | Unauthenticated account creation in the Eventin WordPress plugin (all versions before 4.1.20) allows any remote attacker to register arbitrary email addresses as WordPress user accounts and inject order records by exploiting a missing authorization check on the waiting-list registration handler. The dual impact - rogue account creation and order record injection - can be chained with WordPress's built-in password reset flow to achieve full account takeover for any email address on the system. With a publicly available exploit and a 15% EPSS score placing this well above the median exploitation probability, this represents an elevated and realistic risk for all WordPress sites running the unpatched plugin; no CISA KEV listing is confirmed at time of analysis. | HIGH | 8.2 | 15.0% | 76 |
PoC
|
| CVE-2026-14925 | Unauthenticated export file disclosure in Import WP WordPress plugin (all versions before 2.14.23) allows any remote attacker to download administrator-generated export files without credentials. The export download handler performs no authorization check, exposing files that may contain user PII including email addresses, login names, and role assignments. A publicly available exploit exists (reported by WPScan), and EPSS sits at 16%, indicating meaningful real-world exploitation interest; exploitation is contingent on two prerequisites that meaningfully reduce actual exposure relative to the raw CVSS score. | HIGH | 7.5 | 16.0% | 74 |
PoC
|
| CVE-2026-16253 | Unauthenticated exposure of the backup authorization secret in Total Upkeep WordPress plugin (all versions before 1.17.3) enables remote attackers to both exfiltrate sensitive backup archives and trigger arbitrary full-site restores that overwrite live site files and the database. WPScan disclosed a publicly available proof-of-concept exploit, and SSVC rates the attack as automatable, creating conditions for mass exploitation campaigns. The vendor-reported CVSS score of 7.5 covers only the confidentiality dimension and substantially understates real-world risk by omitting the integrity and availability destruction possible through forced site restores. | HIGH | 7.5 | 16.0% | 74 |
PoC
|
| CVE-2026-18048 | Unauthenticated arbitrary file deletion in WP Photo Album Plus (versions before 9.2.07.002) exposes WordPress sites to path traversal attacks through a public endpoint that accepts unvalidated client-controlled file path values with no authorization check in place. Any remote unauthenticated attacker can manipulate this path parameter to target and delete ZIP archives stored anywhere on the server, including directories outside the web root. A publicly available proof-of-concept exists, EPSS scores this at 16%, and no public exploit identified at time of analysis maps to confirmed mass exploitation - but the low attack complexity and zero authentication barrier make rapid weaponization realistic. | HIGH | 7.5 | 16.0% | 74 |
PoC
|
| CVE-2026-18049 | Unauthenticated information disclosure in WP Photo Album Plus (WordPress plugin, all versions before 9.2.07.002) allows any remote attacker to read arbitrary autoloaded WordPress option values by supplying a crafted suffix to a public, unprotected endpoint. The plugin constructs an option name from client-controlled input without restricting it to its own namespace or verifying any capability or nonce, exposing site-wide secrets stored in wp_options. A publicly available proof-of-concept exists, SSVC rates this as automatable with partial technical impact, and EPSS sits at 16%, indicating meaningful real-world exploitation interest despite the absence of a CISA KEV listing. | HIGH | 7.5 | 16.0% | 74 |
PoC
|