CVE-2026-94077Medium· 6.5▾ SunlitContributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-94672Medium· 4.3Contributor Insecure Direct Object References (IDOR) in Safe SVG <= 2.5.0 versions.
CVE-2026-111625Medium· 5.010up Distributor before 2.3.2 Missing Authorization via dt_push AJAX Action
CVE-2026-111628Medium· 5.010up Distributor before 2.3.2 PHP Object Injection via set_meta()
CVE-2026-111631Medium· 5.4Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manage_options users
CVE-2026-110227Medium· 5.3Missing Authorization vulnerability in 10up Restricted Site Access restricted-site-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restricted Site Access: from n/a through 7.6.2.
CVE-2026-62088Medium· 5.3WordPress ElasticPress plugin <= 5.3.4 - Sensitive Data Exposure vulnerability