5
CVEs
2
Critical
2
High
0
KEV
0
PoC
4
Unpatched C/H
0.0%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
2
MEDIUM
1
LOW
0
Monthly CVE Trend
Affected Products (18)
Wordpress Plugin
60
Wp Erp
18
Wp Project Manager
16
Happy Addons For Elementor
9
PHP
6
User Frontend
6
Wp User Frontend
6
Wedocs
4
Erp
4
Dokan Pro
3
Wemail
3
Storegrowth Upsell Bogo Quick View Direct Checkout Side Cart For Woocommerce
3
Subscribe2
1
Woocommerce Conversion Tracking
1
Recaptcha Integration
1
Storegrowth
1
Wp Erp Pro
1
Wp Project Manager Pro
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-78262 | Insecure deserialization in weDevs WP Project Manager (WordPress plugin) versions up to and including 4.0.6 allows remote unauthenticated attackers to inject crafted PHP objects (CWE-502) into the application. With CVSS:3.1 base score 9.8 (AV:N/AC:L/PR:N/UI:N) and full confidentiality, integrity, and availability impact, successful exploitation can lead to arbitrary object instantiation and, given a suitable POP gadget chain in the plugin or WordPress core, remote code execution or data compromise. Reported by Patchstack and tracked as ENISA EUVD-2026-65169; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-18080 | Unrestricted file upload in the wedevs WP ERP plugin (ERP: Complete HR, Accounting & CRM Suite for WooCommerce) for WordPress, in all versions through 1.17.8, allows unauthenticated attackers to write attacker-controlled PHP into wp-content/uploads/ via the save_attachments() function when the CRM IMAP Email Connect feature parses inbound email attachments. Because file extension validation and path normalization are both missing, a crafted email with a forged References header and a path-traversal filename escapes the .htaccess-protected crm-attachments directory, enabling remote code execution on hosts where PHP executes in the uploads directory. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS base score of 9.8 reflects the unauthenticated, network-reachable nature of the flaw. | CRITICAL | 9.8 | 0.7% | 49 |
No patch
|
| CVE-2026-81283 | PHP Object Injection in the WP User Frontend WordPress plugin (versions ≤ 4.3.10) allows any subscriber-level authenticated attacker to submit crafted serialized PHP payloads over the network, triggering unsafe deserialization. If a usable gadget chain exists among the site's installed plugins or themes - common in the broad WordPress ecosystem - this can escalate to arbitrary code execution, file write, or full site compromise. Reported by Patchstack; no public exploit code or CISA KEV listing identified at time of analysis. | HIGH | 8.8 | 0.5% | 44 |
No patch
|
| CVE-2026-73393 | Unauthenticated cross-site scripting in the Subscribe2 WordPress plugin (versions <= 10.46) allows a remote unauthenticated attacker to inject arbitrary JavaScript into pages rendered by victims who follow a crafted link. The CVSS scope-change metric (S:C) indicates the injected script executes outside the vulnerable component's security boundary, enabling session hijacking, credential theft, or unauthorized administrative actions against any user - including site administrators - who can be socially engineered into triggering the payload. No public exploit code or active exploitation has been confirmed at time of analysis, though the zero-privilege attack entry point lowers the barrier for opportunistic abuse. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-78470 | SQL injection in WP Project Manager Pro (WordPress plugin by weDevs, all versions through 4.0.1) allows authenticated attackers holding Subscriber-level access or higher to append arbitrary SQL clauses to existing plugin queries, enabling extraction of sensitive data from the WordPress database. The CVSS vector confirms high confidentiality impact with no integrity or availability consequences - the primary risk is database read access, potentially exposing user credentials and application data. No public exploit code or active exploitation has been identified at time of analysis, though the low privilege requirement (any registered WordPress user) meaningfully broadens the viable attacker pool. | MEDIUM | 6.5 | 0.2% | 33 |
No patch
|