Know which CVEs
actually matter.

Remote code execution in The Events Calendar WordPress plugin (StellarWP) through version 6.17.3 lets unauthenticated attackers run arbitrary PHP on the server by abusing Element_Classes::parse_array(). A plain-array widget 'classes' payload evades the is_safe_widget_instance() object check and reaches a callable-invocation sink; the chain fires when do_blocks() renders a single-event page whose comment area contains a crafted wp:legacy-widget block. Reported by Wordfence with a 9.8 CVSS; no public exploit identified at time of analysis, and the flaw is only reachable on sites that enable comments on tribe_events posts.

Remote code execution in The Events Calendar plugin for WordPress (StellarWP) affects all versions up to and including 6.17.4, allowing unauthenticated attackers to run arbitrary PHP on the server via unsafe deserialization. The is_safe_widget_instance guard is bypassed because PHP fires magic methods during pre-parse and enable_rendering_widget_copied() forges a valid wp_hash integrity attribute before unserialize() executes; the malicious block markup reaches the sink through the V2 single-event template running do_blocks() over buffered comment HTML. Reported by Wordfence with a CVSS of 9.8; no public exploit identified at time of analysis, though the vulnerability is well-documented with pinpointed source-line references.

Unauthenticated arbitrary file read in GitLab CE/EE lets remote attackers retrieve files from the GitLab server via the repository commits API, which fails to confine paths and does not enforce authentication. All 18.7 releases through 19.3.2 are affected across the fix lines (before 19.1.8, 19.2.6, and 19.3.2). This is confirmed actively exploited (CISA KEV) and publicly available exploit code exists, making it an emergency-patch priority for any internet-reachable GitLab instance.

Unauthenticated option-overwrite in DT LMS <=1.1 allows any remote attacker to modify arbitrary plugin settings stored in the WordPress wp_options table by calling three unprotected AJAX handlers - dtlms_save_poc_settings, dtlms_save_skin_settings, and dtlms_save_options_settings - that are registered on wp_ajax_nopriv_* with no nonce validation, no capability check, and no input filtering before update_option() is invoked. Confirmed by Wordfence with direct source-code references; a patch commit (changeset 3585901) is present in the WordPress plugin repository but the exact released version number is not stated in available data. No public exploit code and no CISA KEV listing identified at time of analysis.

Authenticated SQL injection in the Smart Marketing SMS and Newsletters Forms WordPress plugin (versions ≤5.1.24) allows subscriber-level users to append arbitrary SQL to existing database queries, extracting sensitive data from the WordPress database. The vulnerability resides in insufficient input escaping on a user-supplied parameter before it reaches an existing SQL query, requiring only a low-privilege account and the plugin's sync/mapping feature to be in its typical operational state. No public exploit or active exploitation has been identified; the fix is available via WordPress SVN changeset 3663923.

Remote code execution is achievable in Tutor LMS WordPress plugin (≤4.0.7) via a PHP Object Injection flaw in the withdrawal account AJAX handler that exploits a subtle interaction between `esc_sql()` percent-escaping and PHP serialized string-length declarations. Authenticated attackers with subscriber-level access — or unauthenticated attackers on sites with user registration enabled, the typical eLearning configuration — can inject an arbitrary serialized object stream and trigger the well-documented `GuzzleHttp\Cookie\FileCookieJar` POP chain to write a webshell to an attacker-specified path. No public exploit or KEV listing is confirmed at time of analysis, but a fix changeset is available and the POP chain is reliably reachable due to the plugin's bundled PayPal Composer autoloader.

SQL injection in the MPG - Multiple Page Generator WordPress plugin (all versions through 4.2.1) allows authenticated attackers holding only subscriber-level accounts to append arbitrary SQL into existing database queries via a crafted URL path, enabling full exfiltration of the WordPress database including password hashes, user PII, and stored credentials. The flaw originates in SpintaxController.php and Helper.php where URL-path parameters are interpolated into queries without adequate escaping or use of WordPress's prepare() API; the code path is only reachable when the [mpg_spintax] shortcode is rendered in site-wide components such as footers or template parts. No public exploit code has been identified at time of analysis, and an upstream fix has been committed to the WordPress plugin SVN repository (changeset 3687328) as reported by Wordfence.

Unauthenticated sensitive information exposure in the Royal Addons for Elementor WordPress plugin (all versions ≤1.7.1066) allows any remote attacker to enumerate arbitrary postmeta values from all published posts via a blind, character-by-character substring oracle. The critical enabler is that the AJAX nonce protecting the search endpoint is publicly emitted in page HTML via wp_localize_script whenever any Royal Elementor widget loads - no session, login, or prior action is required to obtain it. Postmeta data can include private field values, API keys, or other sensitive content stored by themes and other plugins, making the practical impact site-dependent but potentially significant beyond the CVSS 5.3 base score.

Local file inclusion and remote code execution in GEO my WP WordPress plugin (≤4.5.5.3) allow unauthenticated attackers to include arbitrary PHP files via the `gmw_posts_locator_ajax_info_window_loader` AJAX handler, which accepted attacker-controlled template paths and passed them to a PHP `require` statement without adequate allowlist enforcement. At minimum this exposes sensitive PHP files such as wp-config.php; when PEAR is installed with `register_argc_argv` enabled, attackers can leverage pearcmd.php to write and execute arbitrary PHP code, achieving full unauthenticated RCE. No public exploit has been identified at time of analysis, though the Wordfence advisory and vulnerable source code are publicly available, substantially reducing the development effort for a proof-of-concept.

Time-based blind SQL injection in rtMedia for WordPress, BuddyPress and bbPress (all versions through 4.7.11) enables unauthenticated remote attackers to exfiltrate arbitrary data from the WordPress database. The flaw stems from RTMediaQuery::query() merging raw $_REQUEST input into internal query parameters while only validating top-level array keys, allowing the nested 'compare' subvalue to bypass input validation and reach an unparameterized SQL sink. Exploitation requires only that a public-facing page exist with an rtMedia shortcode present - no authentication, interaction, or special server configuration is needed. No public exploit code or CISA KEV listing was identified at time of analysis.

The Product XML Feed Manager for WooCommerce WordPress plugin before 3.1.1 does not restrict which object method its product shortcode may call, nor check the user's capability over the targeted product, allowing users with contributor-level access to delete arbitrary WooCommerce products by previewing a post that contains the shortcode.

The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions that relay prompts to its configured AI providers, allowing unauthenticated attackers to make those third-party API calls, and consume the associated cost, using the site's own configured API keys.

The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX action that lists stored chat sessions, allowing unauthenticated attackers to retrieve the name, email address and phone number of every chat visitor by requesting a wide date range.