10up
Vulnerability activity for 10up: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 4
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 7
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 7
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 5.4MediumOct 16, 202610up Distributor Auth bypass / access controlCVE-2026-111631Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manage_options users. Attackers can call dt_verify_external_connection with a chosen endpointId and url to send stored connection credentials to attacker-controlled servers, or abuse dt_begin_authorization to create connections.
- 5.0MediumOct 16, 202610up Distributor DeserializationCVE-2026-11162810up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers can store a serialized PHP string as meta, which set_meta() in includes/utils.php unserializes on the destination site, storing attacker-defined objects whose impact depends on loaded gadget classes.
- 5.0MediumOct 16, 202610up Distributor Auth bypass / access controlCVE-2026-11162510up Distributor before 2.3.2 contains a missing authorization vulnerability in ajax_push() that allows Contributor-level multisite users to publish posts on other network sites. Attackers can use the dt-push nonce with a chosen connection id and postStatus to create draft or published posts on sites they cannot access.
- 5.3MediumOct 14, 202610up Restricted Site Access Auth bypass / access controlCVE-2026-110227Missing Authorization vulnerability in 10up Restricted Site Access restricted-site-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restricted Site Access: from n/a through 7.6.2.
- 4.3MediumSep 30, 202610up Safe SVG Auth bypass / access controlCVE-2026-94672Contributor Insecure Direct Object References (IDOR) in Safe SVG <= 2.5.0 versions.
- 6.5MediumSep 30, 202610up Safe SVG XSSCVE-2026-94077Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions.
- 5.3MediumSep 11, 202610up ElasticPress Information disclosureCVE-2026-62088Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded Sensitive Data. This issue affects ElasticPress: from n/a through 5.3.4.
Top products
- Distributor3 CVEs in the last year
- Safe SVG2 CVEs in the last year
- Restricted Site Access1 CVE in the last year
- ElasticPress1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.