T
Vendor security profile
team
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs2
Critical0
CISA KEV0
Public exploit0
Patch rate%0
Avg. CVSS5.9
12-month vulnerability rate
0
0
0
0
0
0
0
1
0
0
1
0
CVE KEV
CVE severity distribution
2toplam CVE
Medium2 (100%)
Patch and exploitation view
%0
Verified patch
%0
CISA KEV
%0
Public exploit
0Patch available
0Partial
0Workaround
0Vendor: no patch
2Unknown
Latest vulnerabilities
7.2
CVE-2026-100147
FunnelKit <= 3.16.0.5 - Unauthenticated Stored Cross-Site Scripting via Order Fields (shipping/billing)
T
Patch status unknownEPSS %0
5.1
CVE-2016-20098
Moderator Toolbox before 4.0.14 Stored XSS via Removal Reasons Configuration
T
Patch verifiedEPSS %0
6.5
CVE-2026-62029
WordPress WPFunnels plugin <= 3.13.3 - Cross Site Scripting (XSS) vulnerability
WT
Patch status unknownEPSS %0
6.5
CVE-2026-39756
WordPress Wappointment plugin <= 2.7.7 - Insecure Direct Object References (IDOR) vulnerability
WT
Patch status unknownEPSS %0
6.5
CVE-2026-104386
WordPress WP VR plugin <= 9.1.3 - Broken Access Control vulnerability
WT
Patch status unknownEPSS %0
6.4
CVE-2026-92727
EmbedPress <= 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slidesShow' Block Attribute
W
Patch status unknownEPSS %0
9.3
CVE-2026-103922
Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path
I
Patch status unknownEPSS %0
6.5
CVE-2026-97251
WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.3 - Insecure Direct Object References (IDOR) vulnerability
M
Patch status unknownEPSS %0
8.6
CVE-2026-95588
WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Arbitrary File Deletion vulnerability
AN
Patch status unknownEPSS %0
6.4
CVE-2026-96256
Gutenberg Essential Blocks <= 6.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker' Attribute
W
Patch status unknownEPSS %0