CVE-2026-96837
WordPress CartFlows plugin <= 3.2.0 - Remote Code Execution (RCE) vulnerability
CVSS score
8.8
EPSS probability
%0.5
Risk score
0.0
Published
15 d ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
No verified public exploit code was found.
GitHub repositories, NVD exploit references and the Metasploit Framework were scanned. A record of active exploitation does not mean that public exploit code has been published.
Similar Vulnerabilities
8.8
CVE-2026-106599
WordPress SureCart plugin <= 4.9.3 - PHP Object Injection vulnerability
BF
Patch status unknownEPSS %0
8.8
CVE-2026-87741
ConvertPlus <= 3.6.3 - Authenticated (Subscriber+) PHP Object Injection via 'style' Parameter
BF
Patch status unknownEPSS %0
7.5
CVE-2026-80433
WordPress SureFeedback Client Site plugin <= 1.2.12 - Sensitive Data Exposure vulnerability
BF
Patch status unknownEPSS %0
7.2
CVE-2026-32553
WordPress OttoKit plugin <= 1.1.35 - Server Side Request Forgery (SSRF) vulnerability
BF
Patch status unknownEPSS %0
7.1
CVE-2026-66698
WordPress SureDash plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability
BF
Patch status unknownEPSS %0
6.5
CVE-2026-66688
WordPress Ultimate Addons for Elementor plugin <= 1.45.2 - Cross Site Scripting (XSS) vulnerability
BF
Patch status unknownEPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-96837"