Unknown Vitepos vulnerabilities

3 CVEs affecting Unknown Vitepos, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-14238, published 2026-08-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-14237, published 2026-08-10. High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days. The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet…
CVE-2026-8157, published 2026-06-22. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned when creating new users via one of its REST API endpoints, allowing authenticated users with a…
CVE-2026-14238, published 2026-08-10. Medium severity, CVSS 4.1. EPSS: 0.3% chance of exploitation in the next 30 days. The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in one of its report endpoints, allowing…