18
CVEs
4
Critical
8
High
0
KEV
0
PoC
12
Unpatched C/H
0.0%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
4
HIGH
8
MEDIUM
6
LOW
0
Monthly CVE Trend
Affected Products (16)
Wordpress Plugin
37
Forminator Forms Contact Form Payment Form Custom Form Builder
15
Forminator Forms
10
PHP
8
Broken Link Checker
3
Defender Security
3
Branda
3
Wpmu Dev Dashboard
2
Hustle Email Marketing Lead Generation Optins Popups
2
Hustle
2
Smush Image Compression And Optimization
2
Defender
2
Jwt Attack
1
Hummingbird Performance Cache Page Speed Optimization For Core Web Vitals Critical Css Minify Css Defer Css Javascript Cdn
1
Hummingbird
1
Smartcrawl
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-15748 | Unauthenticated arbitrary file upload leading to remote code execution affects the Forminator Forms WordPress plugin (WPMU DEV) in all versions through 1.56.1. The public form-submission handler trusts attacker-controlled upload field configuration injected through a forged Select field value, and the dangerous-extension blocklist in handle_file_upload uses exact-key matching that is bypassed with pipe-alternative MIME type keys, letting an attacker drop an executable PHP file on the server. Reported by Wordfence and carrying a CVSS 9.8, this is a critical, network-reachable flaw with no authentication barrier, though there is no public exploit identified at time of analysis. | CRITICAL | 9.8 | 1.2% | 50 |
No patch
|
| CVE-2026-83627 | Remote code execution in the Hummingbird performance/caching plugin for WordPress (versions up to and including 3.21.0) lets unauthenticated attackers write arbitrary PHP into a web-accessible debug-log file and execute it with a single anonymous request. The plugin's protective '<?php die(); ?>' header is silently dropped due to a PHP namespace bug in a class_exists() check, and unsanitized cookie names are written straight into wp-content/wphb-logs/page-caching-log.php. Reported by Wordfence with no public exploit identified at time of analysis; exploitation depends on a non-default Debug Log configuration. | CRITICAL | 9.8 | 0.8% | 50 |
No patch
|
| CVE-2026-76581 | Authentication bypass in the WPMU DEV Dashboard WordPress plugin (all versions through 5.0.1) lets an unauthenticated attacker forge a valid administrator session by abusing an HMAC signature-verification flaw in the Hub SSO login flow. Because the signing routine in the unauthenticated wdpsso_step1 action covers a different, unseparated field concatenation than the verifier in wdpsso_step2, an attacker can obtain a legitimately signed token and replay it with fields rearranged to authenticate as admin. No public exploit is identified at time of analysis, but the network-reachable, unauthenticated nature and 9.8 CVSS make this a high-priority patch item. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-92229 | Unauthenticated attackers can execute arbitrary WordPress shortcodes through the Forminator Forms plugin (all versions up to and including 1.57.2) because a value reaching do_shortcode in the quizzes front-action handler is not properly validated. A site is only reachable through this path if Forminator is installed and active and a form or quiz routes through the vulnerable front-action, and the real-world damage is bounded by which shortcodes other installed plugins register - benign shortcodes mean limited impact, while data- or state-changing shortcodes raise it substantially. No public exploit code or confirmed in-the-wild activity (CISA KEV) was identified at time of analysis; note that the vendor-assigned CVSS 9.1 overstates the assessed impact, which our analysis places at CVSS 6.5 (C:L/I:L) for fully remote, unauthenticated, low-complexity exploitation. | CRITICAL | 9.1 | 0.4% | 46 |
No patch
|
| CVE-2026-15459 | Authentication bypass in WPMU DEV Dashboard (WordPress plugin) versions up to and including 5.0.0 enables unauthenticated remote attackers to invoke privileged Hub actions - including remote code execution by installing a plugin from an attacker-controlled URL, takeover of an administrator account via SSO, deletion of plugins and themes, and forced WordPress core upgrades - on any site not yet connected to the WPMU DEV Hub. The default post-installation state is unconnected, meaning every fresh installation is immediately exposed until Hub onboarding is completed. No public exploit or CISA KEV listing has been identified at time of analysis, though the impact ceiling (unauthenticated RCE) and the breadth of default-state exposure make this a high-priority remediation target. | HIGH | 8.1 | 0.5% | 41 |
No patch
|
| CVE-2026-18323 | Stored Cross-Site Scripting in the Forminator Forms WordPress plugin (all versions through 1.57.0.2) allows unauthenticated attackers to inject persistent JavaScript payloads that auto-execute in the WordPress admin panel when an administrator views the Submissions page. The attack vector is the Save-and-Continue draft AJAX endpoint, which is registered without privilege checks (nopriv), bypassing radio field option-membership validation and permitting arbitrary values to be stored. Payload execution is triggered automatically via the bundled Inputmask library's data-attribute callback binding, requiring no further attacker interaction after initial injection. No public exploit code or CISA KEV listing is identified at time of analysis, though the unauthenticated, zero-complexity attack path and high-value admin-panel target represent meaningful real-world risk. | HIGH | 7.2 | 0.3% | 36 |
No patch
|
| CVE-2026-18324 | Stored Cross-Site Scripting in the Forminator Forms WordPress plugin (all versions through 1.57.0.1) enables unauthenticated attackers to inject persistent malicious scripts via Rich-Text Textarea fields, which execute in any visitor's or administrator's browser upon page access. The flaw originates from insufficient input sanitization at submission time and missing output escaping at render time, with vulnerable code paths confirmed across multiple plugin files including textarea.php, abstract-class-front-action.php, and admin-page-entries.php. A patched release (1.57.0.2) is confirmed available via the WordPress plugin repository changeset; no public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 7.2 | 0.3% | 36 |
No patch
|
| CVE-2026-18325 | Stored XSS in the Forminator Forms WordPress plugin (≤1.56.1) permits unauthenticated attackers to permanently inject arbitrary JavaScript into pages by exploiting two compounding logic flaws: sanitize_array() silently skips all filtering for keys prefixed with 'select-', and set_field_data() treats a user-supplied 'return' member as a trusted internal flag, allowing a forged upload record with a malicious file_url to be persisted in the database. Because the payload is stored rather than reflected, a single unauthenticated HTTP request creates a persistent script that executes in every subsequent visitor's browser on the affected page. No public exploit code or CISA KEV listing is confirmed at time of analysis, though Wordfence's disclosure provides sufficient technical specificity to reconstruct the attack. | HIGH | 7.2 | 0.3% | 36 |
No patch
|
| CVE-2026-18328 | DOM-based reflected XSS in the Forminator Forms WordPress plugin (all versions up to and including 1.57.0) allows unauthenticated network attackers to execute arbitrary JavaScript in victim browsers by embedding a payload in the 'error_description' URL parameter, which the plugin's front.stripe.js writes to the DOM without sanitization. The attack surface expanded significantly when Stripe Checkout Sessions became the plugin's default payment method in version 1.56.0, meaning any site that upgraded to 1.56.0 or 1.57.0 without changing payment settings is exposed on pages hosting a Forminator form. No public exploit has been identified at time of analysis, but the vulnerable code paths at four specific locations in front.stripe.js are publicly documented in Wordfence's disclosure, with the fix released in version 1.57.0.1. | HIGH | 7.2 | 0.2% | 36 |
No patch
|
| CVE-2026-75528 | Stored XSS in the Broken Link Checker WordPress plugin (versions ≤ 2.4.13) allows unauthenticated attackers to inject persistent JavaScript into the WordPress admin link log via a multi-hop redirect-based payload delivery mechanism. The plugin's HTTP checker follows attacker-controlled redirects and stores the redirect destination URL verbatim in the link log without sanitization; the admin table printer then renders this unsanitized content to any administrator who views the link log. No public exploit has been identified at time of analysis, and a vendor-released patch is confirmed available as version 2.4.13.1. | HIGH | 7.2 | 0.3% | 36 |
No patch
|
| CVE-2026-85235 | Stored cross-site scripting in the Forminator Forms WordPress plugin (all versions up to and including 1.57.2) allows unauthenticated attackers to plant a script payload in a form submission by abusing insufficient sanitization of a Rich-Text Textarea field. The payload is stored as entry data and only fires when a logged-in administrator opens that specific submission in the Forminator Entries view and clicks the attacker-planted link, at which point WordPress core's jQuery handler on `.contextual-help-tabs a` evaluates the entity-decoded href as HTML inside the administrator's authenticated wp-admin session. The assessed CVSS 3.1 score is 7.2 (HIGH), driven primarily by the scope change and the vendor's PR:N/UI:N vector, though the independent assessment rates user interaction as required (UI:R) because the exploit is not automatic: it demands a public form containing a rich-text textarea field, a high-privilege victim, and a deliberate click. No public exploit code has been identified at time of analysis, and the plugin is not listed in CISA KEV, so the issue is not confirmed as actively exploited. | HIGH | 7.2 | 0.3% | 36 |
No patch
|
| CVE-2026-92144 | Stored cross-site scripting in the Forminator Forms plugin for WordPress (all versions up to and including 1.57.2) lets unauthenticated attackers inject arbitrary JavaScript into pages through the 'postdata-1[post-custom]' input of a Post Data form field, because the plugin neither sanitizes the submitted value on input nor escapes it on output. The attack chain is fully unauthenticated: the submission nonce normally required by the plugin is freely retrievable by anyone through the publicly reachable wp_ajax_nopriv_forminator_get_nonce AJAX endpoint, so an attacker needs no account and no prior access. Impact is deferred rather than immediate - the injected script only fires when a victim subsequently views the poisoned page or form submission (for example an administrator reviewing entries, or a visitor loading a post the plugin created), and only sites exposing a published form that contains a Post Data field are reachable. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV), though the assessed CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (reported base score 7.2, with the scope change and low confidentiality/integrity impact reflecting script injection into a trusted origin). | HIGH | 7.2 | 0.5% | 36 |
No patch
|
| CVE-2026-101335 | Unauthenticated arbitrary shortcode execution in the WordPress plugin Forminator Forms (Contact Form, Payment Form & Custom Form Builder) affects all versions up to and including 1.58.1, allowing remote attackers to run any WordPress shortcode registered on the target site by submitting a quiz form. Exploitation is gated by a non-default configuration: a published quiz whose email/notification template contains the {quiz_result} merge tag, after which attacker bytes injected via the User-Agent header or the referer_url POST parameter (neither of which is stripped of the '[' and ']' shortcode delimiters by sanitize_text_field()/esc_html()) are fed to do_shortcode(). The assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (Attack Complexity High, unauthenticated) because the quiz-result template precondition must be met; no public exploit code and no CISA KEV active-exploitation entry were identified at time of analysis, and real-world impact scales with which dangerous shortcodes other installed plugins or themes expose. | MEDIUM | 6.5 | 0.3% | 33 |
No patch
|
| CVE-2026-96562 | Arbitrary shortcode execution in the WordPress Broken Link Checker plugin (all versions up to and including 2.4.14.1) allows an unauthenticated commenter to embed a shortcode payload in a comment's href or src attribute; once that comment is approved through the site's normal moderation workflow, the plugin's link parser passes the value to do_shortcode during a scheduled WP-Cron scan, executing the shortcode with no further attacker interaction. The published CVSS v3.1 base score is 6.5 (AV:N/AC:L/PR:N/UI:N), but the practical vector carries a user-interaction precondition (UI:R) because moderator approval is required, and impact is bounded by which shortcodes are registered on the target site. No public exploit code has been identified at time of analysis. | MEDIUM | 6.5 | 0.3% | 33 |
No patch
|
| CVE-2026-103911 | Unauthenticated shortcode injection in the Forminator Forms WordPress plugin (≤1.58.1) allows remote attackers to execute arbitrary registered shortcodes by sending a GET request to the search results page on any block-theme install, or by submitting an anonymous comment on any post with comments enabled. With a CVSS score of 6.5 and no public exploit identified at time of analysis, the practical impact is bounded by which shortcodes are present on the target site, but the exceptionally low exploitation barrier-no authentication, no user interaction, and no Forminator-specific configuration-makes this an elevated-priority issue. | MEDIUM | 6.5 | 0.3% | 33 |
No patch
|