Unknown Workeera vulnerabilities

3 CVEs affecting Unknown Workeera, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-77018, published 2026-08-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-77018, published 2026-08-27. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable…
CVE-2026-77016, published 2026-08-27. Critical severity, CVSS 9.6. EPSS: 0.4% chance of exploitation in the next 30 days. The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain the stored file path before deleting it,…
CVE-2026-77017, published 2026-08-27. High severity, CVSS 7.7. EPSS: 0.4% chance of exploitation in the next 30 days. The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it, allowing…