30697
CVEs
2361
Critical
9042
High
6
KEV
6391
PoC
10107
Unpatched C/H
14.8%
Patch Rate
1.3%
Avg EPSS
Severity Breakdown
CRITICAL
2361
HIGH
9042
MEDIUM
18980
LOW
307
Monthly CVE Trend
Affected Products (30)
Wordpress Plugin
16987
PHP
5679
Wordpress Theme
1505
Open Redirect
117
Debian Linux
88
Woocommerce
66
Givewp
60
Royal Elementor Addons
57
Download Manager
52
Essential Addons For Elementor
51
Contest Gallery
50
Ninja Forms
49
Ultimatemember
49
Ninjaforms
47
Tutor Lms
47
Photo Gallery
44
Icegram
43
Learnpress
39
Wpforo Forum
35
Mstore Api
35
Wp Job Portal
34
The Plus Addons For Elementor
34
Brizy
34
Ultimate Member
34
Premium Addons For Elementor
33
Profilepress
33
Registrationmagic
32
Happy Addons For Elementor
31
Quiz And Survey Master
31
Profilegrid
30
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2016-10033 | The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \". Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available. | CRITICAL | 9.8 | 94.5% | 228 |
KEV
PoC
|
| CVE-2016-10045 | The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 93.4%. | CRITICAL | 9.8 | 93.4% | 177 |
PoC
|
| CVE-2023-6553 | The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 93.3%. | CRITICAL | 9.8 | 93.3% | 177 |
PoC
|
| CVE-2024-5084 | The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'file_upload_action' function in all versions up to,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 93.2%. | CRITICAL | 9.8 | 93.2% | 177 |
PoC
|
| CVE-2024-44000 | Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote attackers to hijack logged-in sessions, including administrator accounts, by recovering weakly protected session credentials. With a 93.13% EPSS score (100th percentile) and publicly available exploit code, this is among the most likely-to-be-exploited vulnerabilities currently tracked. Successful exploitation yields full WordPress site takeover. | CRITICAL | 9.8 | 93.1% | 177 |
PoC
No patch
|
| CVE-2024-8353 | The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 via deserialization of untrusted input. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 91.9%. | CRITICAL | 9.8 | 91.9% | 176 |
PoC
|
| CVE-2020-36847 | The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulnerability. Attackers can upload PHP files disguised with image extensions and then rename them back to .php using the plugin's built-in rename functionality, bypassing all upload restrictions. | CRITICAL | 9.8 | 86.1% | 170 |
PoC
|
| CVE-2025-11749 | The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint when the No-Auth URL feature is enabled. Unauthenticated attackers can extract this token to gain full API access, compromising AI assistant configurations and potentially accessing connected LLM provider API keys. | CRITICAL | 9.8 | 85.9% | 170 |
PoC
No patch
|
| CVE-2025-27007 | The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unauthenticated attackers to elevate their access to administrator level. This is a separate, broader vulnerability than the earlier CVE-2025-3102, affecting more installations since it works even on configured instances. | CRITICAL | 9.8 | 84.0% | 168 |
PoC
No patch
|
| CVE-2016-1209 | The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST request. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 80.6%. | CRITICAL | 9.8 | 80.6% | 165 |
PoC
No patch
|
| CVE-2024-4443 | The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘listingfields’ parameter in all versions up to, and. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 94.0%. | CRITICAL | 9.8 | 94.0% | 163 |
PoC
|
| CVE-2026-63030 | Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint route confusion flaw that, when chained with the author__not_in WP_Query SQL injection (CVE-2026-60137), lets attackers inject SQL and ultimately execute arbitrary code on the underlying host. Publicly available exploit code exists (a ProjectDiscovery Nuclei template and WPScan advisory), and the CISA SSVC framework rates the flaw as automatable with total technical impact, though it is not currently listed in CISA KEV. The vulnerability was reported by WPScan and patched in the WordPress 7.0.2 and 6.9.5 releases. | CRITICAL | 9.8 | 8.9% | 163 |
KEV
PoC
|
| CVE-2024-1698 | SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote attackers to append arbitrary SQL queries via the 'type' parameter and exfiltrate sensitive database contents. Publicly available exploit code exists and the EPSS score of 93.74% (100th percentile) indicates very high probability of exploitation attempts in the wild, though the CVE is not currently listed in CISA KEV. | CRITICAL | 9.8 | 93.7% | 163 |
PoC
|
| CVE-2023-6875 | The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 93.7%. | CRITICAL | 9.8 | 93.7% | 163 |
PoC
No patch
|
| CVE-2024-1512 | The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union based SQL Injection via the 'user' parameter of the /lms/stm-lms/order/items REST. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 93.6%. | CRITICAL | 9.8 | 93.6% | 163 |
PoC
No patch
|