32
CVEs
2
Critical
9
High
0
KEV
0
PoC
11
Unpatched C/H
0.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
9
MEDIUM
21
LOW
0
Monthly CVE Trend
Affected Products (18)
Wordpress Plugin
60
Wp Erp
18
Wp Project Manager
16
Happy Addons For Elementor
9
PHP
6
User Frontend
6
Wp User Frontend
6
Wedocs
4
Erp
4
Dokan Pro
3
Wemail
3
Storegrowth Upsell Bogo Quick View Direct Checkout Side Cart For Woocommerce
3
Subscribe2
1
Woocommerce Conversion Tracking
1
Recaptcha Integration
1
Storegrowth
1
Wp Erp Pro
1
Wp Project Manager Pro
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-78262 | Insecure deserialization in weDevs WP Project Manager (WordPress plugin) versions up to and including 4.0.6 allows remote unauthenticated attackers to inject crafted PHP objects (CWE-502) into the application. With CVSS:3.1 base score 9.8 (AV:N/AC:L/PR:N/UI:N) and full confidentiality, integrity, and availability impact, successful exploitation can lead to arbitrary object instantiation and, given a suitable POP gadget chain in the plugin or WordPress core, remote code execution or data compromise. Reported by Patchstack and tracked as ENISA EUVD-2026-65169; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-18080 | Unrestricted file upload in the wedevs WP ERP plugin (ERP: Complete HR, Accounting & CRM Suite for WooCommerce) for WordPress, in all versions through 1.17.8, allows unauthenticated attackers to write attacker-controlled PHP into wp-content/uploads/ via the save_attachments() function when the CRM IMAP Email Connect feature parses inbound email attachments. Because file extension validation and path normalization are both missing, a crafted email with a forged References header and a path-traversal filename escapes the .htaccess-protected crm-attachments directory, enabling remote code execution on hosts where PHP executes in the uploads directory. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS base score of 9.8 reflects the unauthenticated, network-reachable nature of the flaw. | CRITICAL | 9.8 | 0.7% | 49 |
No patch
|
| CVE-2026-12224 | Privilege escalation in the Dokan Pro WooCommerce multivendor plugin for WordPress (all versions through 5.0.4) allows an authenticated vendor-level attacker to grant themselves or a controlled vendor_staff account the WordPress administrator capability, resulting in full site takeover. The flaw stems from the update_capabilities() REST handler accepting arbitrary capability strings with no allowlist, only checking for the dokandar capability. No public exploit has been identified at time of analysis, and no EPSS or KEV signals were supplied; however, the issue is reported by Wordfence and exploitation is straightforward on sites where the Vendor Staff module is enabled and vendor self-registration is permitted. | HIGH | 8.8 | 0.2% | 44 |
No patch
|
| CVE-2026-5127 | PHP object injection in User Frontend plugin for WordPress versions up to 4.3.1 allows authenticated attackers with Subscriber-level access or above to achieve remote code execution via unsafe deserialization of the wpuf_files parameter during form submission. The vulnerability chains input validation failures during form processing with unconditional use of maybe_unserialize() when rendering post content, enabling attackers to inject malicious PHP objects that can execute arbitrary code, delete files, or trigger other attacks through available Property-Oriented Programming (POP) chains. Wordfence disclosed detailed code references showing the vulnerable data flow across multiple plugin files including wpuf-functions.php, FieldableTrait.php, and Frontend_Form_Ajax.php, with both trunk and version 4.2.10 code paths exhibiting the flaw. | HIGH | 8.8 | 0.1% | 44 |
No patch
|
| CVE-2026-81283 | PHP Object Injection in the WP User Frontend WordPress plugin (versions ≤ 4.3.10) allows any subscriber-level authenticated attacker to submit crafted serialized PHP payloads over the network, triggering unsafe deserialization. If a usable gadget chain exists among the site's installed plugins or themes - common in the broad WordPress ecosystem - this can escalate to arbitrary code execution, file write, or full site compromise. Reported by Patchstack; no public exploit code or CISA KEV listing identified at time of analysis. | HIGH | 8.8 | 0.5% | 44 |
No patch
|
| CVE-2026-12077 | SQL injection in the Dokan Pro WordPress multivendor marketplace plugin (all versions ≤ 5.0.4) lets unauthenticated remote attackers inject SQL through the 'latitude' and 'longitude' request parameters, enabling extraction of arbitrary database contents such as user credentials, API keys, and order data. The flaw is time-based (blind) and requires no authentication or user interaction, but no public exploit code or active exploitation has been identified at time of analysis. No EPSS or CISA KEV signal was provided in the source data. | HIGH | 7.5 | 0.3% | 38 |
No patch
|
| CVE-2026-66466 | Broken access control in the StoreGrowth: Smart Sales Booster for WooCommerce plugin (versions <= 2.1.1) permits unauthenticated remote attackers to bypass authorization checks and perform privileged store management actions. The root cause is a missing authorization gate (CWE-862), meaning certain plugin endpoints execute sensitive operations without verifying the caller's identity or permissions. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the zero-friction exploitation conditions - no authentication, no user interaction, network-accessible - make this a straightforward target for opportunistic scanning. | HIGH | 7.5 | 0.2% | 38 |
No patch
|
| CVE-2026-4834 | Unauthenticated SQL injection in the WP ERP Pro WordPress plugin (versions through 1.5.1) allows remote attackers to extract sensitive database contents by manipulating the 'search_key' parameter. The flaw stems from missing input escaping and unprepared SQL statements, enabling UNION-based or appended query attacks against any WordPress site running the affected plugin. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV. | HIGH | 7.5 | 0.1% | 38 |
No patch
|
| CVE-2026-32485 | A missing authorization vulnerability exists in weDevs WP User Frontend plugin through version 4.2.8, allowing attackers to bypass access control checks and perform unauthorized actions. The vulnerability stems from incorrectly configured access control security levels (CWE-862: Missing Authorization), enabling attackers with varying privilege levels to access or modify restricted functionality. All installations of WP User Frontend up to and including version 4.2.8 are vulnerable, and immediate patching is strongly recommended. | HIGH | 7.5 | 0.0% | 38 |
No patch
|
| CVE-2026-13440 | Stored cross-site scripting in StoreGrowth Sales Booster for WooCommerce allows unauthenticated attackers to inject web scripts via the 'message_popup' AJAX parameter. The vulnerability arises because the required nonce is exposed to all frontend visitors, completely bypassing the intended access control. Exploitation leads to arbitrary script execution in the browsers of any user who views an injected popup page, compromising session data and site integrity. | HIGH | 7.2 | 0.3% | 36 |
No patch
|
| CVE-2026-73393 | Unauthenticated cross-site scripting in the Subscribe2 WordPress plugin (versions <= 10.46) allows a remote unauthenticated attacker to inject arbitrary JavaScript into pages rendered by victims who follow a crafted link. The CVSS scope-change metric (S:C) indicates the injected script executes outside the vulnerable component's security boundary, enabling session hijacking, credential theft, or unauthorized administrative actions against any user - including site administrators - who can be socially engineered into triggering the payload. No public exploit code or active exploitation has been confirmed at time of analysis, though the zero-privilege attack entry point lowers the barrier for opportunistic abuse. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-11421 | SQL injection in the WP ERP WordPress plugin (all versions through 1.17.4) allows authenticated CRM Agent-role users to extract arbitrary data from the WordPress database by supplying a crafted 'erpadvancefilter' parameter to the CRM AJAX handler. The root flaw is a sanitization gap: sanitize_text_field strips HTML but preserves single quotes, which are then interpolated verbatim into a single-quoted SQL WHERE clause inside erp_crm_contact_advance_filter() before execution via $wpdb->get_results(), bypassing WordPress's parameterized query protections entirely. No public exploit has been identified at time of analysis, but the vulnerable code paths are fully documented in WordPress plugin trac source references provided by Wordfence. | MEDIUM | 6.5 | 0.3% | 33 |
No patch
|
| CVE-2026-13011 | SQL Injection in WP ERP (wedevs) versions through 1.17.5 allows authenticated HR Manager-level users to exfiltrate arbitrary data from the WordPress database via the unsanitized `orderby` parameter in the leave management module. The flaw resides in `functions-leave.php` and `LeaveRequestsListTable.php`, where user-supplied sort parameters are interpolated directly into SQL queries without escaping or prepared statements. No public exploit code is confirmed and this CVE is not listed in the CISA KEV catalog, but the confidentiality impact is high given the plugin stores HR records, payroll data, and CRM contacts. | MEDIUM | 6.5 | 0.3% | 33 |
No patch
|
| CVE-2026-78470 | SQL injection in WP Project Manager Pro (WordPress plugin by weDevs, all versions through 4.0.1) allows authenticated attackers holding Subscriber-level access or higher to append arbitrary SQL clauses to existing plugin queries, enabling extraction of sensitive data from the WordPress database. The CVSS vector confirms high confidentiality impact with no integrity or availability consequences - the primary risk is database read access, potentially exposing user credentials and application data. No public exploit code or active exploitation has been identified at time of analysis, though the low privilege requirement (any registered WordPress user) meaningfully broadens the viable attacker pool. | MEDIUM | 6.5 | 0.2% | 33 |
No patch
|
| CVE-2026-12079 | Time-based blind SQL injection in the Dokan Pro WordPress plugin allows network-accessible authenticated attackers with Subscriber-level privileges to extract sensitive data from the underlying WordPress database. The flaw resides in the 'orderby' parameter, which is insufficiently escaped and passed into unparameterized SQL queries across all plugin versions through 5.0.4. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low privilege bar - any registered subscriber - substantially widens the realistic attacker pool on marketplace and multi-vendor WordPress sites. | MEDIUM | 6.5 | 0.2% | 33 |
No patch
|