3443
CVEs
391
Critical
1241
High
2
KEV
891
PoC
1287
Unpatched C/H
27.8%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
391
HIGH
1241
MEDIUM
1718
LOW
93
Monthly CVE Trend
Affected Products (30)
Wordpress Plugin
16987
PHP
5679
Wordpress Theme
1505
Open Redirect
117
Debian Linux
88
Woocommerce
66
Givewp
60
Royal Elementor Addons
57
Download Manager
52
Essential Addons For Elementor
51
Contest Gallery
50
Ninja Forms
49
Ultimatemember
49
Ninjaforms
47
Tutor Lms
47
Photo Gallery
44
Icegram
43
Learnpress
39
Wpforo Forum
35
Mstore Api
35
Wp Job Portal
34
The Plus Addons For Elementor
34
Brizy
34
Ultimate Member
34
Premium Addons For Elementor
33
Profilepress
33
Registrationmagic
32
Happy Addons For Elementor
31
Quiz And Survey Master
31
Profilegrid
30
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-63030 | Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint route confusion flaw that, when chained with the author__not_in WP_Query SQL injection (CVE-2026-60137), lets attackers inject SQL and ultimately execute arbitrary code on the underlying host. Publicly available exploit code exists (a ProjectDiscovery Nuclei template and WPScan advisory), and the CISA SSVC framework rates the flaw as automatable with total technical impact, though it is not currently listed in CISA KEV. The vulnerability was reported by WPScan and patched in the WordPress 7.0.2 and 6.9.5 releases. | CRITICAL | 9.8 | 8.9% | 163 |
KEV
PoC
|
| CVE-2026-60137 | SQL injection in WordPress core (6.8.x before 6.8.6, 6.9.x before 6.9.5, 7.0.x before 7.0.2) arises from improper sanitisation of the author__not_in parameter in WP_Query, allowing an attacker to inject SQL when a plugin or theme forwards untrusted input into that parameter. Reported by WPScan and rated CVSS 9.1, it can lead to full database disclosure on affected sites, but exploitation is not reachable through unmodified core alone - a vulnerable plugin or theme code path is required. No public exploit identified at time of analysis and it is not listed in CISA KEV, though CISA SSVC flags the technical impact as total and the flaw as automatable. | MEDIUM | 5.9 | 4.0% | 139 |
KEV
PoC
|
| CVE-2026-18391 | PHP Object Injection escalating to unauthenticated remote code execution affects the WooCommerce Subscriptions WordPress plugin from version 4.7.0 up to (but not including) 9.1.0, but only on stores running WooCommerce's High-Performance Order Storage (HPOS). The plugin unserializes attacker-controlled input without validation, and a gadget chain in bundled dependencies turns that into arbitrary code execution. Publicly available exploit code exists and a vendor patch (9.1.0) is available, but this is not listed in CISA KEV; the EPSS score of 28% is elevated, indicating meaningful exploitation probability. | CRITICAL | 9.8 | 28.0% | 97 |
PoC
|
| CVE-2026-15039 | Unauthenticated arbitrary file upload in the Giftware WordPress plugin before 4.2.10 allows remote attackers to upload PHP files through an upload path that fails to validate file type (CWE-434), leading to remote code execution on the underlying web server. The flaw carries a CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N) and publicly available exploit code exists per WPScan, though it is not currently listed in CISA KEV; the EPSS score of 22% reflects meaningful but not top-tier near-term exploitation probability. | CRITICAL | 9.8 | 22.0% | 91 |
PoC
|
| CVE-2026-16051 | Remote code execution in the WPMU DEV Dashboard (wpmudev-updates) WordPress plugin before 5.0.1 allows an attacker who can obtain or replay a single valid signed management request to push and execute arbitrary code on the site. The plugin's remote management interface installs packages without verifying their integrity and without replay protection, so a captured legitimate management call can be reused to install an attacker-controlled package. WPScan reports publicly available exploit code and the plugin scores CVSS 9.8; EPSS is elevated at 22%, but there is no public exploit identified as actively exploited in the wild (not in CISA KEV). | CRITICAL | 9.8 | 22.0% | 91 |
PoC
|
| CVE-2026-18961 | Authentication bypass in the VentraConnect Social Login WordPress plugin (all versions ≤ 1.4.3) allows unauthenticated attackers to fully hijack any existing WordPress account - including administrators - by weaponizing Spotify's unverified email field. The plugin's Generic::normalize_common() blindly copies the email value returned by Spotify's /v1/me API endpoint into the normalized user profile, and User_Links::link_or_login_user() then matches that value against WordPress accounts via get_user_by('email') and issues a persistent session cookie via wp_set_auth_cookie() without any email-verified assertion, mailbox challenge, or approval step. No public exploit has been identified at time of analysis, but the attack surface is fully network-accessible, requires no victim interaction, and yields complete site compromise; CVSS rates this 8.1 High with AC:H reflecting the prerequisite of a controlled Spotify account bearing the target's email address. | HIGH | 8.1 | 45.0% | 86 |
No patch
|
| CVE-2026-18366 | Privilege escalation and account takeover in the Events Manager WordPress plugin before 7.4.1 lets unauthenticated attackers reset passwords, promote accounts to Administrator, or delete accounts whose user ID collides with the ID of one of the plugin's own posts. The flaw stems from the plugin overriding WordPress's own capability decisions for unrelated privileged user actions. Publicly available exploit code exists (WPScan), EPSS is a notable 15%, and SSVC rates it automatable with total technical impact, though it is not currently listed in CISA KEV. | CRITICAL | 9.8 | 15.0% | 84 |
PoC
|
| CVE-2026-18474 | Unauthenticated SQL injection in WP Directory Kit WordPress plugin (all versions before 1.5.6) allows remote attackers to read arbitrary data from the WordPress database, including user credentials and sensitive site content. The flaw was reported by WPScan, a public proof-of-concept exploit is available, and exploitation requires no authentication - though it is conditioned on a non-default search field type being configured in the plugin. Patch version 1.5.6 resolves the vulnerability; sites using customized search field configurations are the exposed population. | HIGH | 8.6 | 19.0% | 82 |
PoC
|
| CVE-2026-13613 | SQL injection in the KiviCare WordPress plugin (all versions before 4.5.2) enables authenticated clinic staff users to execute arbitrary SQL against the underlying WordPress database. Unsanitized user-supplied parameters are passed directly into SQL queries, granting an attacker full read, write, and delete access to database contents including patient records and credentials. With a publicly available proof-of-concept, an EPSS of 17%, and a CVSS of 8.8, this is a high-priority patch for any healthcare-sector WordPress deployment running this plugin - though no CISA KEV-confirmed active exploitation has been identified at time of analysis. | HIGH | 8.8 | 17.0% | 81 |
PoC
|
| CVE-2026-16538 | Financial/business-logic bypass in the Wallet for WooCommerce WordPress plugin (all versions before 1.6.10) lets a customer credit their wallet balance for less than the amount actually paid, because the plugin credits the top-up before confirming the sum the payment gateway actually collected. Any registered store customer can effectively mint store credit at a discount, causing direct monetary loss to the merchant. Publicly available exploit code exists (WPScan); the flaw is not listed in CISA KEV, and EPSS is a moderate 13%. | CRITICAL | 9.1 | 13.0% | 78 |
PoC
|
| CVE-2026-16977 | Second-order SQL injection in Form Maker by 10Web WordPress plugin (all versions before 1.15.45) allows any subscriber-level authenticated user to execute arbitrary SQL against the WordPress database by submitting crafted input to database-backed choice fields, yielding high confidentiality and integrity impact. A publicly available proof-of-concept from WPScan lowers the exploitation barrier, and an EPSS of 16% reflects above-baseline real-world risk. No active exploitation is confirmed in CISA KEV at time of analysis, though the combination of low required privilege, network accessibility, and public exploit code makes this a credible near-term threat on unpatched installations. | HIGH | 8.1 | 16.0% | 76 |
PoC
|
| CVE-2026-18057 | SQL injection in the Events Manager WordPress plugin (versions before 7.4.1) allows any subscriber-level or higher authenticated user to manipulate raw SQL queries and tamper with booking consent records belonging to other users. The flaw arises from a user-controlled value being interpolated directly into a database query without sanitization (CWE-89), enabling both unauthorized data disclosure and integrity violations against other users' booking records. A publicly available proof-of-concept exists per WPScan's disclosure, and an EPSS score of 16% reflects meaningful exploitation likelihood, though active exploitation has not been formally confirmed in CISA's KEV catalog. | HIGH | 8.1 | 16.0% | 76 |
PoC
|
| CVE-2026-18230 | SQL injection in WP Directory Kit WordPress plugin (all versions before 1.5.6) allows any authenticated user - including low-privilege Subscribers - to query or manipulate the WordPress database via an AJAX endpoint that performs no input sanitization and enforces no authorization check. With a publicly available proof-of-concept reported by WPScan and an EPSS of 16%, the exploitation barrier is low for any site with user registration enabled. A vendor patch is available in version 1.5.6. | HIGH | 8.1 | 16.0% | 76 |
PoC
|
| CVE-2026-13171 | Unauthenticated account creation in the Eventin WordPress plugin (all versions before 4.1.20) allows any remote attacker to register arbitrary email addresses as WordPress user accounts and inject order records by exploiting a missing authorization check on the waiting-list registration handler. The dual impact - rogue account creation and order record injection - can be chained with WordPress's built-in password reset flow to achieve full account takeover for any email address on the system. With a publicly available exploit and a 15% EPSS score placing this well above the median exploitation probability, this represents an elevated and realistic risk for all WordPress sites running the unpatched plugin; no CISA KEV listing is confirmed at time of analysis. | HIGH | 8.2 | 15.0% | 76 |
PoC
|
| CVE-2026-66659 | Blind SQL injection in the Essekia "Tablesome Table" WordPress plugin (versions up to and including 1.2.9) lets remote attackers inject malicious SQL into database queries, enabling inference-based extraction of database contents. The CVSS 3.1 score of 9.3 reflects unauthenticated network exploitability with a scope change (S:C), meaning the impact reaches the underlying WordPress database beyond the plugin itself. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV. | CRITICAL | 9.3 | 29.0% | 76 |
No patch
|