Overview 37 matches · 0 in Waratek scope · 0 protected · 1 CISA KEV · 8 public PoC · 2 EPSS ≥ 0.5
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
37
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
37
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
37
100.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
0
0.0%
split by
peak 7 / quarter
Q4 231
Not applicable1
High1
not blocked1
Exploited1
Q1 240
Q2 245
Not applicable5
Critical2
High3
not blocked5
Exploited5
Q3 242
Not applicable2
Critical2
not blocked2
Exploited2
Q4 242
Not applicable2
Critical1
Medium1
not blocked2
Exploited2
Q1 254
Not applicable4
Critical4
not blocked4
Exploited4
Q2 253
Not applicable3
Critical3
not blocked3
Exploited3
Q3 251
Not applicable1
Critical1
not blocked1
Exploited1
Q4 251
Not applicable1
High1
not blocked1
Exploited1
Q1 265
Not applicable5
Critical3
High2
not blocked5
Exploited5
Q2 267
Not applicable7
Critical4
High2
Medium1
not blocked7
Exploited7
Q3 265
Not applicable5
Critical4
High1
not blocked5
Exploited5
Q4 261
Not applicable1
Critical1
not blocked1
Exploited1
Q4 23Q2 24Q4 24Q2 25Q4 25Q2 26Q4 26
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-110372 | Critical | 2026-10-18 | Not applicable | Exploited | Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through 1.1.40. |
| CVE-2026-32566 | Critical | 2026-08-27 | Not applicable | Exploited | Unauthenticated Privilege Escalation in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions. |
| CVE-2026-32558 | Critical | 2026-08-24 | Not applicable | Exploited | Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress <= 8.9.1 versions. |
| CVE-2026-28165 | Critical | 2026-08-24 | Not applicable | Exploited | Unauthenticated Privilege Escalation in Digits <= 9.2 versions. |
| CVE-2026-61979 | High | 2026-08-13 | Not applicable | Exploited | Unauthenticated Privilege Escalation in SAML SP Single Sign On <= 5.4.3 versions. |
| CVE-2026-57813 | Critical | 2026-07-13 | Not applicable | Exploited | Incorrect Privilege Assignment vulnerability in properfraction MailOptin mailoptin allows Privilege Escalation.This issue affects MailOptin: from n/a through <= 1.2.77.3. |
| CVE-2026-56033 | Critical | 2026-06-26 | Not applicable | Exploited | Unauthenticated Privilege Escalation in Dokan Pro <= 5.0.4 versions. |
| CVE-2026-54196 | Medium | 2026-06-17 | Not applicable | Exploited | Incorrect Privilege Assignment vulnerability in Jetmonsters JetFormBuilder allows Privilege Escalation. This issue affects JetFormBuilder: from n/a through 3.6.1. |
| CVE-2026-49058 | Critical | 2026-06-17 | Not applicable | Exploited | Unauthenticated Privilege Escalation in LoginPress Pro <= 6.2.2 versions. |
| CVE-2026-49780 | High | 2026-06-15 | Not applicable | Exploited | Customer Privilege Escalation in Dokan <= 5.0.2 versions. |
| CVE-2026-49083 | High | 2026-06-15 | Not applicable | Exploited | Contributor Privilege Escalation in LatePoint <= 5.5.1 versions. |
| CVE-2026-49060 | Critical | 2026-06-11 | Not applicable | Exploited | Incorrect Privilege Assignment vulnerability in Hippoo Mobile App for WooCommerce allows Privilege Escalation. This issue affects Hippoo Mobile App for WooCommerce: from n/a through 1.9.4. |
| CVE-2026-48172 | Critical | 2026-05-21 | Not applicable | Exploited | LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If you get no output, you have not been hit with exploitation of the vulnerability. If there is output, we recommend you examine the IP addresses in the list, determine if they are valid IP addresses, and if not, block them. To determine damage done, examine the system logs for use by the detected IP addresses. The issue is related to mishandling of Redis enable/disable features. The recommended minimum version is 2.4.7. |
| CVE-2026-27542 | Critical | 2026-03-19 | Not applicable | Exploited | Incorrect Privilege Assignment vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Privilege Escalation. This issue affects Woocommerce Wholesale Lead Capture: through 2.0.3.1. |
| CVE-2026-27541 | High | 2026-03-05 | Not applicable | Exploited | Incorrect Privilege Assignment vulnerability in Josh Kohlbach Wholesale Suite allows Privilege Escalation. This issue affects Wholesale Suite: through 2.2.6. |
| CVE-2025-67953 | High | 2026-01-22 | Not applicable | Exploited | Incorrect Privilege Assignment vulnerability in Booking Activities Team Booking Activities booking-activities allows Privilege Escalation.This issue affects Booking Activities: from n/a through <= 1.16.44. |
| CVE-2026-23800 | Critical | 2026-01-16 | Not applicable | Exploited | Incorrect Privilege Assignment vulnerability in Modular DS modular-connector allows Privilege Escalation.This issue affects Modular DS: from 2.5.2 before 2.6.0. |
| CVE-2026-23550 | Critical | 2026-01-14 | Not applicable | Exploited | Incorrect Privilege Assignment vulnerability in Modular DS Modular DS modular-connector allows Privilege Escalation.This issue affects Modular DS: from n/a through <= 2.5.1. |
| CVE-2025-49924 | High | 2025-10-22 | Not applicable | Exploited | Incorrect Privilege Assignment vulnerability in Josh Kohlbach Wholesale Suite woocommerce-wholesale-prices allows Privilege Escalation.This issue affects Wholesale Suite: from n/a through <= 2.2.4.2. |
| CVE-2025-49867 | Critical | 2025-07-04 | Not applicable | Exploited | Incorrect Privilege Assignment vulnerability in InspiryThemes RealHomes realhomes allows Privilege Escalation.This issue affects RealHomes: from n/a through <= 4.4.0. |
| CVE-2025-47539 | Critical | 2025-05-23 | Not applicable | Exploited | Incorrect Privilege Assignment vulnerability in Arraytics Eventin wp-event-solution allows Privilege Escalation.This issue affects Eventin: from n/a through <= 4.0.26. |
| CVE-2025-31918 | Critical | 2025-05-23 | Not applicable | Exploited | Incorrect Privilege Assignment vulnerability in quantumcloud Simple Business Directory Pro simple-business-directory-pro allows Privilege Escalation.This issue affects Simple Business Directory Pro: from n/a through < 15.6.9. |
| CVE-2025-27007 | Critical | 2025-05-01 | Not applicable | Exploited | Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through <= 1.0.82. |
| CVE-2024-8420 | Critical | 2025-02-28 | Not applicable | Exploited | The DHVC Form plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.4.7. This is due to the plugin allowing a user to supply the 'role' field when registering. This makes it possible for unauthenticated attackers to register as an administrator on sites. |
| CVE-2024-56000 | Critical | 2025-02-18 | Not applicable | Exploited | Incorrect Privilege Assignment vulnerability in SeventhQueen K Elements k-elements allows Privilege Escalation.This issue affects K Elements: from n/a through < 5.4.0. |
| CVE-2024-13421 | Critical | 2025-02-12 | Not applicable | Exploited | The Real Estate 7 WordPress theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.5.1. This is due to the plugin not properly restricting the roles allowed to be selected during registration. This makes it possible for unauthenticated attackers to register a new administrative user account. |
| CVE-2024-12213 | Critical | 2025-02-12 | Not applicable | Exploited | The WP Job Board Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to 2.3.16. This is due to the plugin allowing a user to supply the 'role' field when registering. This makes it possible for unauthenticated attackers to register as an administrator on vulnerable sites. Please note that this may have been patched sooner, however, the oldest available version for us to confirm this is patched in was 1.2.85. |
| CVE-2024-13030 | Medium | 2024-12-30 | Not applicable | Exploited | A vulnerability was found in D-Link DIR-823G 1.0.2B05_20181207. It has been rated as critical. This issue affects the function SetAutoRebootSettings/SetClientInfo/SetDMZSettings/SetFirewallSettings/SetParentsControlInfo/SetQoSSettings/SetVirtualServerSettings of the file /HNAP1/ of the component Web Management Interface. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2024-50550 | Critical | 2024-10-29 | Not applicable | Exploited | Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Privilege Escalation.This issue affects LiteSpeed Cache: from n/a through <= 6.5.1. |
| CVE-2024-28000 | Critical | 2024-08-21 | Not applicable | Exploited | Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: from n/a through <= 6.3.0.1. |
| CVE-2024-43153 | Critical | 2024-08-13 | Not applicable | Exploited | Incorrect Privilege Assignment vulnerability in WofficeIO Woffice woffice.This issue affects Woffice: from n/a through <= 5.4.10. |
| CVE-2024-35700 | Critical | 2024-06-04 | Not applicable | Exploited | Incorrect Privilege Assignment vulnerability in DeluxeThemes Userpro userpro.This issue affects Userpro: from n/a through <= 5.1.8. |
| CVE-2024-32959 | High | 2024-05-17 | Not applicable | Exploited | Incorrect Privilege Assignment vulnerability in Sirv CDN and Image Hosting Sirv sirv.This issue affects Sirv: from n/a through <= 7.2.2. |
| CVE-2024-32507 | High | 2024-05-17 | Not applicable | Exploited | Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.This issue affects Login with phone number: from n/a through 1.7.16. |
| CVE-2024-24882 | Critical | 2024-05-17 | Not applicable | Exploited | Incorrect Privilege Assignment vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - LMS: from n/a through <= 1.7.2. |
| CVE-2024-22145 | High | 2024-05-17 | Not applicable | Exploited | Incorrect Privilege Assignment vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through <= 0.1.0.8. |
| CVE-2023-6009 | High | 2023-11-22 | Not applicable | Exploited | The UserPro plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.4 due to insufficient restriction on the 'userpro_update_user_profile' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'wp_capabilities' parameter during a profile update. |