Plugin-Upload

WordPress — Pre-Auth XSS to RCE Chain via Login Page Parser Differential (CVE-2026-64638, "XSS2Shell") new EPSS 31%CVE-2026-64638webHIGH 8.9Unverified2026-08-09UpdraftPlus WordPress Plugin — Unauthenticated RPC Key Bypass to Admin Creation & RCE (CVE-2026-10795) newCVE-2026-10795webCRITICALUnverified2026-07-05Budibase Authentication Bypass to Plugin-Upload Reverse Shell — CVE-2026-31816 new EPSS 15%CVE-2026-31816webCRITICALUnverified2026-07-05