10
CVEs
3
Critical
6
High
0
KEV
0
PoC
9
Unpatched C/H
0.0%
Patch Rate
0.5%
Avg EPSS
Severity Breakdown
CRITICAL
3
HIGH
6
MEDIUM
1
LOW
0
Monthly CVE Trend
Affected Products (15)
Wordpress Plugin
29
Forminator Forms
10
Forminator Forms Contact Form Payment Form Custom Form Builder
10
PHP
8
Defender Security
3
Branda
3
Wpmu Dev Dashboard
2
Defender
2
Hustle
2
Smush Image Compression And Optimization
2
Broken Link Checker
2
Smartcrawl
1
Hummingbird
1
Jwt Attack
1
Hummingbird Performance Cache Page Speed Optimization For Core Web Vitals Critical Css Minify Css Defer Css Javascript Cdn
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-15748 | Unauthenticated arbitrary file upload leading to remote code execution affects the Forminator Forms WordPress plugin (WPMU DEV) in all versions through 1.56.1. The public form-submission handler trusts attacker-controlled upload field configuration injected through a forged Select field value, and the dangerous-extension blocklist in handle_file_upload uses exact-key matching that is bypassed with pipe-alternative MIME type keys, letting an attacker drop an executable PHP file on the server. Reported by Wordfence and carrying a CVSS 9.8, this is a critical, network-reachable flaw with no authentication barrier, though there is no public exploit identified at time of analysis. | CRITICAL | 9.8 | 1.2% | 50 |
No patch
|
| CVE-2026-83627 | Remote code execution in the Hummingbird performance/caching plugin for WordPress (versions up to and including 3.21.0) lets unauthenticated attackers write arbitrary PHP into a web-accessible debug-log file and execute it with a single anonymous request. The plugin's protective '<?php die(); ?>' header is silently dropped due to a PHP namespace bug in a class_exists() check, and unsanitized cookie names are written straight into wp-content/wphb-logs/page-caching-log.php. Reported by Wordfence with no public exploit identified at time of analysis; exploitation depends on a non-default Debug Log configuration. | CRITICAL | 9.8 | 0.8% | 50 |
No patch
|
| CVE-2026-76581 | Authentication bypass in the WPMU DEV Dashboard WordPress plugin (all versions through 5.0.1) lets an unauthenticated attacker forge a valid administrator session by abusing an HMAC signature-verification flaw in the Hub SSO login flow. Because the signing routine in the unauthenticated wdpsso_step1 action covers a different, unseparated field concatenation than the verifier in wdpsso_step2, an attacker can obtain a legitimately signed token and replay it with fields rearranged to authenticate as admin. No public exploit is identified at time of analysis, but the network-reachable, unauthenticated nature and 9.8 CVSS make this a high-priority patch item. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-15459 | Authentication bypass in WPMU DEV Dashboard (WordPress plugin) versions up to and including 5.0.0 enables unauthenticated remote attackers to invoke privileged Hub actions - including remote code execution by installing a plugin from an attacker-controlled URL, takeover of an administrator account via SSO, deletion of plugins and themes, and forced WordPress core upgrades - on any site not yet connected to the WPMU DEV Hub. The default post-installation state is unconnected, meaning every fresh installation is immediately exposed until Hub onboarding is completed. No public exploit or CISA KEV listing has been identified at time of analysis, though the impact ceiling (unauthenticated RCE) and the breadth of default-state exposure make this a high-priority remediation target. | HIGH | 8.1 | 0.5% | 41 |
No patch
|
| CVE-2026-18323 | Stored Cross-Site Scripting in the Forminator Forms WordPress plugin (all versions through 1.57.0.2) allows unauthenticated attackers to inject persistent JavaScript payloads that auto-execute in the WordPress admin panel when an administrator views the Submissions page. The attack vector is the Save-and-Continue draft AJAX endpoint, which is registered without privilege checks (nopriv), bypassing radio field option-membership validation and permitting arbitrary values to be stored. Payload execution is triggered automatically via the bundled Inputmask library's data-attribute callback binding, requiring no further attacker interaction after initial injection. No public exploit code or CISA KEV listing is identified at time of analysis, though the unauthenticated, zero-complexity attack path and high-value admin-panel target represent meaningful real-world risk. | HIGH | 7.2 | 0.3% | 36 |
No patch
|
| CVE-2026-18324 | Stored Cross-Site Scripting in the Forminator Forms WordPress plugin (all versions through 1.57.0.1) enables unauthenticated attackers to inject persistent malicious scripts via Rich-Text Textarea fields, which execute in any visitor's or administrator's browser upon page access. The flaw originates from insufficient input sanitization at submission time and missing output escaping at render time, with vulnerable code paths confirmed across multiple plugin files including textarea.php, abstract-class-front-action.php, and admin-page-entries.php. A patched release (1.57.0.2) is confirmed available via the WordPress plugin repository changeset; no public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 7.2 | 0.3% | 36 |
No patch
|
| CVE-2026-18325 | Stored XSS in the Forminator Forms WordPress plugin (≤1.56.1) permits unauthenticated attackers to permanently inject arbitrary JavaScript into pages by exploiting two compounding logic flaws: sanitize_array() silently skips all filtering for keys prefixed with 'select-', and set_field_data() treats a user-supplied 'return' member as a trusted internal flag, allowing a forged upload record with a malicious file_url to be persisted in the database. Because the payload is stored rather than reflected, a single unauthenticated HTTP request creates a persistent script that executes in every subsequent visitor's browser on the affected page. No public exploit code or CISA KEV listing is confirmed at time of analysis, though Wordfence's disclosure provides sufficient technical specificity to reconstruct the attack. | HIGH | 7.2 | 0.3% | 36 |
No patch
|
| CVE-2026-18328 | DOM-based reflected XSS in the Forminator Forms WordPress plugin (all versions up to and including 1.57.0) allows unauthenticated network attackers to execute arbitrary JavaScript in victim browsers by embedding a payload in the 'error_description' URL parameter, which the plugin's front.stripe.js writes to the DOM without sanitization. The attack surface expanded significantly when Stripe Checkout Sessions became the plugin's default payment method in version 1.56.0, meaning any site that upgraded to 1.56.0 or 1.57.0 without changing payment settings is exposed on pages hosting a Forminator form. No public exploit has been identified at time of analysis, but the vulnerable code paths at four specific locations in front.stripe.js are publicly documented in Wordfence's disclosure, with the fix released in version 1.57.0.1. | HIGH | 7.2 | 0.2% | 36 |
No patch
|
| CVE-2026-75528 | Stored XSS in the Broken Link Checker WordPress plugin (versions ≤ 2.4.13) allows unauthenticated attackers to inject persistent JavaScript into the WordPress admin link log via a multi-hop redirect-based payload delivery mechanism. The plugin's HTTP checker follows attacker-controlled redirects and stores the redirect destination URL verbatim in the link log without sanitization; the admin table printer then renders this unsanitized content to any administrator who views the link log. No public exploit has been identified at time of analysis, and a vendor-released patch is confirmed available as version 2.4.13.1. | HIGH | 7.2 | 0.3% | 36 |
No patch
|
| CVE-2026-12998 | Unauthenticated enumeration of sequential draft entry IDs in the Forminator Forms WordPress plugin (all versions up to and including 1.55.0.2) exposes other users' saved draft form submissions - including names, email addresses, phone numbers, postal addresses, and free-form message content - to any remote attacker who can iterate integer values on the 'draft' parameter. The root cause is CWE-639: the plugin retrieves draft records by a user-supplied integer key without validating that the requesting session owns the referenced entry. Exploitation is constrained to forms where the 'Save and Continue' feature is explicitly enabled; no public exploit has been identified at time of analysis, and a fix commit is referenced in the WordPress plugin repository. | MEDIUM | 5.3 | 0.3% | 27 |
No patch
|