1158
CVEs
151
Critical
413
High
0
KEV
317
PoC
448
Unpatched C/H
34.1%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
151
HIGH
413
MEDIUM
546
LOW
45
Monthly CVE Trend
Affected Products (30)
Wordpress Plugin
16984
PHP
5677
Wordpress Theme
1505
Open Redirect
116
Debian Linux
88
Woocommerce
66
Givewp
60
Royal Elementor Addons
57
Download Manager
52
Essential Addons For Elementor
51
Contest Gallery
50
Ninja Forms
49
Ultimatemember
49
Ninjaforms
47
Tutor Lms
47
Photo Gallery
44
Icegram
43
Learnpress
39
Wpforo Forum
35
Mstore Api
35
Wp Job Portal
34
The Plus Addons For Elementor
34
Brizy
34
Ultimate Member
34
Premium Addons For Elementor
33
Profilepress
33
Registrationmagic
32
Happy Addons For Elementor
31
Quiz And Survey Master
31
Profilegrid
30
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-82222 | Unauthenticated PHP object injection in the GiveWP WordPress donation plugin (all versions through 4.16.7.1) lets remote attackers reach a deserialization sink and chain it into remote code execution on the hosting server. The flaw is network-reachable with no authentication or user interaction and carries a maximum CVSS of 10.0; Patchstack's public write-up details the full object-injection-to-RCE chain, though no in-the-wild exploitation has been confirmed. Because GiveWP handles donation and payment workflows, a successful attack fully compromises the site and any donor data it processes. | CRITICAL | 10.0 | 0.4% | 70 |
PoC
No patch
|
| CVE-2026-4357 | Unrestricted file upload in the Embed HTML5 Game WordPress plugin (versions through 1.3) lets unauthenticated attackers upload arbitrary files - including PHP scripts - because the plugin neither restricts who may upload nor validates file type, enabling planting of PHP backdoors and full remote code execution. WPScan reports the flaw with a publicly available exploit, and the CVSS 10.0 rating reflects unauthenticated network exploitation with complete impact. No CISA KEV listing exists, but the combination of PR:N and a public PoC makes opportunistic scanning likely. | CRITICAL | 10.0 | 0.3% | 70 |
PoC
No patch
|
| CVE-2026-81648 | Missing authorization on an AJAX endpoint in the CryptoPayment Gateway WordPress plugin (versions 1.2.1 through 1.2.2) lets remote unauthenticated attackers invoke administrative operations. An attacker can delete arbitrary files on the server, overwrite the payment gateway configuration, and read stored wallet credentials in cleartext. Publicly available exploit detail exists (reported by WPScan); there is no public evidence of active exploitation at time of analysis, though the CVSS vector (10.0, AV:N/AC:L/PR:N/UI:N/S:C) marks it as trivially exploitable. | CRITICAL | 10.0 | 0.3% | 70 |
PoC
No patch
|
| CVE-2026-14560 | Unauthenticated remote code execution in the Teddy Bear Customize Addon WordPress plugin (all versions through 1.0.5) allows attackers to upload arbitrary PHP files to the server and execute code. The plugin's upload handler trusts the client-supplied MIME/content type and preserves the original attacker-controlled filename, so a request declaring an image content type while carrying a .php payload lands as an executable script in the webroot. Publicly available exploit details have been published by WPScan; no active exploitation has been confirmed in CISA KEV at time of analysis. | CRITICAL | 10.0 | 0.2% | 70 |
PoC
No patch
|
| CVE-2026-77770 | Unauthenticated arbitrary site-option deletion in the miniOrange 2FA WordPress plugin (versions 5.3.24 through before 6.3.1, and 18.0 through before 19.3) lets any visitor delete arbitrary wp_options entries because option names are taken directly from request input without validating a legitimate transaction. Deleting the right options can lock every administrator out of the WordPress dashboard or fully deactivate the two-factor plugin, stripping the site of its 2FA protection. Publicly available exploit code exists (WPScan) and a vendor patch is available; the flaw is rated CVSS 10.0. | CRITICAL | 10.0 | 0.1% | 70 |
PoC
|
| CVE-2026-77009 | Remote code execution in the WatchMan-Site7 WordPress plugin (all versions through 4.2.0) allows any authenticated user - including a low-privilege subscriber - to run arbitrary PHP on the server because the plugin's debugging console, which evaluates user-supplied PHP, is not access-restricted. Publicly available exploit code exists (reported by WPScan), and with CVSS 9.9 this represents full server compromise from the lowest authenticated role. There is no public evidence of active in-the-wild exploitation at time of analysis. | CRITICAL | 9.9 | 0.3% | 70 |
PoC
No patch
|
| CVE-2026-19632 | Unauthenticated administrator account takeover affects the TranslatePress - Translate Multilingual sites with AI Translation plugin for WordPress in all versions through 3.3.1, where the 'trp_get_translations_regular' AJAX action returns raw translation-dictionary entries without access control. Because an administrator's password-reset URL can be persisted into the secondary-language dictionary as a translatable string, an unauthenticated attacker can read the plaintext reset key and login parameters and seize the admin account. Reported by Wordfence; no public exploit identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 9.8 | 0.8% | 70 |
PoC
No patch
|
| CVE-2026-78006 | Remote code execution in The Events Calendar plugin for WordPress (StellarWP) affects all versions up to and including 6.17.4, allowing unauthenticated attackers to run arbitrary PHP on the server via unsafe deserialization. The is_safe_widget_instance guard is bypassed because PHP fires magic methods during pre-parse and enable_rendering_widget_copied() forges a valid wp_hash integrity attribute before unserialize() executes; the malicious block markup reaches the sink through the V2 single-event template running do_blocks() over buffered comment HTML. Reported by Wordfence with a CVSS of 9.8; no public exploit identified at time of analysis, though the vulnerability is well-documented with pinpointed source-line references. | CRITICAL | 9.8 | 0.8% | 70 |
PoC
No patch
|
| CVE-2026-18351 | Remote code execution in the Drag and Drop File Upload for Elementor Forms WordPress plugin (versions up to and including 1.6.0) allows unauthenticated attackers to upload executable PHP files through the elementor_file_upload handler. The is_file_type_valid() function trusts an attacker-controlled 'type' parameter as regex keys in its MIME allowlist, so a crafted extension bypasses the intended blacklist and is subsequently normalized to a .php extension by sanitize_file_name(). Reported by Wordfence with a CVSS of 9.8; no public exploit identified at time of analysis, but the unauthenticated network-facing RCE makes this a high-priority patch. | CRITICAL | 9.8 | 0.8% | 70 |
PoC
No patch
|
| CVE-2026-11613 | Local File Inclusion in the Divi Ajax Filter WordPress plugin (all versions through 5.1.2) lets remote unauthenticated attackers include and execute arbitrary .php files on the server via the 'custom_loop_template' parameter. Reported by Wordfence and rated CVSS 9.8, it enables access-control bypass, sensitive-data disclosure, and - where an attacker can plant a .php file (e.g. through an upload) - remote code execution. No public exploit has been identified at time of analysis and the plugin is not in CISA KEV. | CRITICAL | 9.8 | 0.5% | 69 |
PoC
No patch
|
| CVE-2026-19092 | Unauthenticated arbitrary PHP function invocation in the Tutor LMS WordPress plugin before 4.0.6 lets remote attackers overwrite internal template variables via request data and call any zero-argument PHP function, returning its output to the attacker. This enables information disclosure and potentially broader compromise depending on which functions are reachable. Publicly available exploit code exists (reported by WPScan), though the flaw is not listed in CISA KEV. | CRITICAL | 9.8 | 0.4% | 69 |
PoC
|
| CVE-2026-75860 | Full site takeover in the JSON Options WordPress plugin (versions through 0.0.4) is possible because one of its actions runs on every request without any capability check or nonce verification, exposing arbitrary WordPress option updates to unauthenticated users. An attacker can flip the users_can_register option on and set default_role to administrator, then self-register an admin account. Publicly available exploit code exists (reported by WPScan), and the flaw is rated CVSS 9.8 with SSVC technical impact assessed as total. | CRITICAL | 9.8 | 0.3% | 69 |
PoC
No patch
|
| CVE-2025-9314 | Unauthenticated arbitrary file upload in the Developer Tools WordPress plugin (versions through 1.1.3) lets remote attackers upload malicious files via the bundled, legacy SWFUpload component, typically leading to remote code execution when a PHP webshell is placed in a web-accessible directory. Any WordPress site running this plugin at or below 1.1.3 is exposed with no authentication required. Publicly available exploit code exists (reported by WPScan), though there is no public evidence of active exploitation. | CRITICAL | 9.8 | 0.3% | 69 |
PoC
No patch
|
| CVE-2026-10522 | Privilege escalation to full site takeover affects the MemberHero WordPress plugin through version 6.9, where the frontend registration flow fails to restrict which account fields a visitor may set, letting unauthenticated attackers self-register with an arbitrary role - including Administrator. Version 6.9 was advertised as the fix but the patch is incomplete, so current installs remain exploitable to gain admin access and hijack existing accounts, and no fully-fixed release exists at time of analysis. Publicly available exploit code exists (WPScan), though EPSS remains low at 0.15% (4th percentile). | CRITICAL | 9.8 | 0.1% | 69 |
PoC
No patch
|
| CVE-2026-78362 | Site takeover in the SEO Flow by LupsOnline WordPress plugin (versions 3.0.0 through before 3.0.3) stems from improper validation of the credential supplied with the plugin's API requests, allowing unauthenticated attackers to be served in the security context of the administrator who configured the plugin. Because the flaw grants effective administrator-level access, an attacker can fully compromise the affected WordPress site. Publicly available exploit code exists (published by WPScan), though EPSS remains low at 0.15% (4th percentile), and there is no public exploit identified as active in the wild. | CRITICAL | 9.8 | 0.1% | 69 |
PoC
|