10up has 7 CVEs on record. Disclosure cadence is accelerating: 7 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 4. The median CVSS is 5.3 (medium). None have a confirmed exploitation report. The most common weakness class is CWE-862 (3). Most affected products: Distributor (3), safe-svg (2), elasticpress (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.3
- Publish → KEV
- —
- Last 90 days
- 7 prev 0
Products
- Distributor 3
- safe-svg 2
- elasticpress 1
- restricted-site-access 1
Worst active — by depth score
CVE-2026-94077Medium· 6.5Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions.36CVE-2026-111631Medium· 5.4Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manage_options users30CVE-2026-110227Medium· 5.3Missing Authorization vulnerability in 10up Restricted Site Access restricted-site-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restricted Site Access: from n/a through 7.6.2.29CVE-2026-62088Medium· 5.3WordPress ElasticPress plugin <= 5.3.4 - Sensitive Data Exposure vulnerability29CVE-2026-111628Medium· 5.010up Distributor before 2.3.2 PHP Object Injection via set_meta()28
10up vulnerabilities
CVEs affecting 10up, newest first. Open any entry for full detail, references, and exploit status.
7 CVEsRSS
CVE-2026-111625Medium· 5.010up Distributor before 2.3.2 Missing Authorization via dt_push AJAX Action
10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajax_push() that allows Contributor-level multisite users to publish posts on other network sites. Attackers can use the dt-push nonce with a chosen connecti…
CVE-2026-111628Medium· 5.010up Distributor before 2.3.2 PHP Object Injection via set_meta()
10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers can store a serialized PHP string as meta…
CVE-2026-111631Medium· 5.4Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manage_options users
Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manage_options users. Attackers can call dt_verify_external_connection wi…
CVE-2026-110227Medium· 5.3Missing Authorization vulnerability in 10up Restricted Site Access restricted-site-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restricted Site Access: from n/a through 7.6.2.
Missing Authorization vulnerability in 10up Restricted Site Access restricted-site-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restricted Site Access: from n/a through 7.6.2.
CVE-2026-94077Medium· 6.5Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions.
Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions.
CVE-2026-94672Medium· 4.3Contributor Insecure Direct Object References (IDOR) in Safe SVG <= 2.5.0 versions.
Contributor Insecure Direct Object References (IDOR) in Safe SVG <= 2.5.0 versions.
CVE-2026-62088Medium· 5.3WordPress ElasticPress plugin <= 5.3.4 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded Sensitive Data. This issue affects ElasticPress: from n/a through 5.3.4.