7
CVEs
3
Critical
4
High
0
KEV
0
PoC
7
Unpatched C/H
0.0%
Patch Rate
0.5%
Avg EPSS
Severity Breakdown
CRITICAL
3
HIGH
4
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (15)
Wordpress Plugin
29
Forminator Forms
10
Forminator Forms Contact Form Payment Form Custom Form Builder
10
PHP
8
Defender Security
3
Branda
3
Wpmu Dev Dashboard
2
Defender
2
Hustle
2
Smush Image Compression And Optimization
2
Broken Link Checker
2
Smartcrawl
1
Hummingbird
1
Jwt Attack
1
Hummingbird Performance Cache Page Speed Optimization For Core Web Vitals Critical Css Minify Css Defer Css Javascript Cdn
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-15748 | Unauthenticated arbitrary file upload leading to remote code execution affects the Forminator Forms WordPress plugin (WPMU DEV) in all versions through 1.56.1. The public form-submission handler trusts attacker-controlled upload field configuration injected through a forged Select field value, and the dangerous-extension blocklist in handle_file_upload uses exact-key matching that is bypassed with pipe-alternative MIME type keys, letting an attacker drop an executable PHP file on the server. Reported by Wordfence and carrying a CVSS 9.8, this is a critical, network-reachable flaw with no authentication barrier, though there is no public exploit identified at time of analysis. | CRITICAL | 9.8 | 1.2% | 50 |
No patch
|
| CVE-2026-83627 | Remote code execution in the Hummingbird performance/caching plugin for WordPress (versions up to and including 3.21.0) lets unauthenticated attackers write arbitrary PHP into a web-accessible debug-log file and execute it with a single anonymous request. The plugin's protective '<?php die(); ?>' header is silently dropped due to a PHP namespace bug in a class_exists() check, and unsanitized cookie names are written straight into wp-content/wphb-logs/page-caching-log.php. Reported by Wordfence with no public exploit identified at time of analysis; exploitation depends on a non-default Debug Log configuration. | CRITICAL | 9.8 | 0.8% | 50 |
No patch
|
| CVE-2026-76581 | Authentication bypass in the WPMU DEV Dashboard WordPress plugin (all versions through 5.0.1) lets an unauthenticated attacker forge a valid administrator session by abusing an HMAC signature-verification flaw in the Hub SSO login flow. Because the signing routine in the unauthenticated wdpsso_step1 action covers a different, unseparated field concatenation than the verifier in wdpsso_step2, an attacker can obtain a legitimately signed token and replay it with fields rearranged to authenticate as admin. No public exploit is identified at time of analysis, but the network-reachable, unauthenticated nature and 9.8 CVSS make this a high-priority patch item. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-18323 | Stored Cross-Site Scripting in the Forminator Forms WordPress plugin (all versions through 1.57.0.2) allows unauthenticated attackers to inject persistent JavaScript payloads that auto-execute in the WordPress admin panel when an administrator views the Submissions page. The attack vector is the Save-and-Continue draft AJAX endpoint, which is registered without privilege checks (nopriv), bypassing radio field option-membership validation and permitting arbitrary values to be stored. Payload execution is triggered automatically via the bundled Inputmask library's data-attribute callback binding, requiring no further attacker interaction after initial injection. No public exploit code or CISA KEV listing is identified at time of analysis, though the unauthenticated, zero-complexity attack path and high-value admin-panel target represent meaningful real-world risk. | HIGH | 7.2 | 0.3% | 36 |
No patch
|
| CVE-2026-18324 | Stored Cross-Site Scripting in the Forminator Forms WordPress plugin (all versions through 1.57.0.1) enables unauthenticated attackers to inject persistent malicious scripts via Rich-Text Textarea fields, which execute in any visitor's or administrator's browser upon page access. The flaw originates from insufficient input sanitization at submission time and missing output escaping at render time, with vulnerable code paths confirmed across multiple plugin files including textarea.php, abstract-class-front-action.php, and admin-page-entries.php. A patched release (1.57.0.2) is confirmed available via the WordPress plugin repository changeset; no public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 7.2 | 0.3% | 36 |
No patch
|
| CVE-2026-18328 | DOM-based reflected XSS in the Forminator Forms WordPress plugin (all versions up to and including 1.57.0) allows unauthenticated network attackers to execute arbitrary JavaScript in victim browsers by embedding a payload in the 'error_description' URL parameter, which the plugin's front.stripe.js writes to the DOM without sanitization. The attack surface expanded significantly when Stripe Checkout Sessions became the plugin's default payment method in version 1.56.0, meaning any site that upgraded to 1.56.0 or 1.57.0 without changing payment settings is exposed on pages hosting a Forminator form. No public exploit has been identified at time of analysis, but the vulnerable code paths at four specific locations in front.stripe.js are publicly documented in Wordfence's disclosure, with the fix released in version 1.57.0.1. | HIGH | 7.2 | 0.2% | 36 |
No patch
|
| CVE-2026-75528 | Stored XSS in the Broken Link Checker WordPress plugin (versions ≤ 2.4.13) allows unauthenticated attackers to inject persistent JavaScript into the WordPress admin link log via a multi-hop redirect-based payload delivery mechanism. The plugin's HTTP checker follows attacker-controlled redirects and stores the redirect destination URL verbatim in the link log without sanitization; the admin table printer then renders this unsanitized content to any administrator who views the link log. No public exploit has been identified at time of analysis, and a vendor-released patch is confirmed available as version 2.4.13.1. | HIGH | 7.2 | 0.3% | 36 |
No patch
|