Stored cross-site scripting (XSS) in SourceCodester Student Result Management System 1.0 allows an authenticated user with high privileges to inject arbitrary JavaScript via the Remark field on the Grading System page. The exploit is publicly available, but EPSS score is low (0.06%) and no active exploitation has been reported.
CVE-2024-22330 is a security vulnerability (CVSS 5.9). Remediation should follow standard vulnerability management procedures.
Stored cross-site scripting in the Simple Membership WordPress plugin ≤4.6.3 allows authenticated administrators to inject malicious scripts that execute when another user views a crafted page. The attack requires high privileges and user interaction; no active exploitation or public exploit code is known. Impact is limited to low confidentiality and integrity compromise on the victim's browser session.
Stored cross-site scripting (XSS) vulnerability in SeedProd's 404 Page plugin for WordPress allows authenticated users with high privileges to inject malicious scripts. Affected versions prior to 1.0.2 are vulnerable; a patch is available. No public exploit or active exploitation has been identified.
Stored cross-site scripting (XSS) in WPtouch 4.3.60 and earlier allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
Stored cross-site scripting in Chaport WordPress plugin up to version 1.1.5 allows authenticated users with high privileges to inject malicious scripts that execute when other users view the affected page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in Post Custom Templates Lite allows authenticated high-privilege attackers to inject scripts that execute in other users' browsers. Affected versions up to 1.14. No active exploitation or public exploit code identified; EPSS indicates very low exploitation likelihood.
Stored cross-site scripting in Pinterest Verify Meta Tag WordPress plugin up to version 1.3 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation identified.
Stored cross-site scripting in the Melipayamak WordPress plugin version 2.2.12 and earlier allows high-privilege authenticated users to inject malicious scripts that execute in other users' browsers, potentially hijacking sessions or redirecting to malicious sites. Exploitation requires user interaction; no active exploitation or public proof-of-concept has been observed, and EPSS indicates very low exploitation probability.
Cross-site scripting in the IFrame Widget WordPress plugin allows stored script injection by authenticated high-privilege users. Affected versions up to 4.1 enable attackers to execute arbitrary JavaScript in the browsers of visitors, potentially compromising user sessions or site integrity. No active exploitation or public exploit code is confirmed, and EPSS predicts low exploitation likelihood.
Stored cross-site scripting (XSS) in Broadly for WordPress plugin up to version 3.0.2 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored Cross-Site Scripting (XSS) in the Responsify WP WordPress plugin version 1.9.11 and earlier allows authenticated attackers with high privileges to inject arbitrary web scripts into pages viewed by other users. The injected code executes in the victim’s browser when they access an affected page, potentially leading to session hijacking, content manipulation, or other client-side attacks. No public exploit code or active exploitation has been reported at this time.
Stored cross-site scripting in the WordPress plugin «Подсказки» от DaData.ru up to version 1.0.6 allows authenticated users with high privileges to inject malicious scripts that execute when other users view the affected page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in ACF: Yandex Maps Field plugin for WordPress up to version 1.1 allows authenticated users with high privileges to inject malicious scripts that execute when other users view the affected page. No public exploit or active exploitation identified.
Stored cross-site scripting in WP Biographia 4.0.0 and earlier allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
Stored cross-site scripting in Powie's Uptime Robot WordPress plugin up to version 0.9.7 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in Deetronix Booking Ultra Pro WordPress plugin 1.1.20 and earlier allows authenticated high-privilege attackers to inject arbitrary web scripts. Users who view affected plugin pages can trigger execution, leading to session hijacking or malicious actions in their browser context. No active exploitation or public exploit code has been identified, and EPSS indicates a very low exploitation probability (0.04%, 13th percentile).
Stored cross-site scripting in WP Featured Content Slider 2.6 and earlier allows authenticated users with high privileges to inject malicious scripts that execute when other users view the slider. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in Global Translator WordPress plugin up to version 2.0.2 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation identified.
Stored cross-site scripting in Elegant Visitor Counter plugin for WordPress up to version 3.1 allows authenticated users with high privileges (e.g., administrators) to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
Stored cross-site scripting (XSS) in AppBanners WordPress plugin up to version 1.5.14 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in the Read More Login WordPress plugin (≤2.0.3) allows high-privileged attackers to inject scripts executed by other users. Exploitation requires administrator access and user interaction, and no public exploit or active exploitation has been identified. The vulnerability poses limited risk due to required privileges and very low exploitation probability (EPSS 0.04%).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marchetti Design Next Event Calendar allows Stored XSS. This issue affects Next Event Calendar: from n/a through 1.2.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hanhdo205 Bang tinh vay allows Stored XSS. This issue affects Bang tinh vay: from n/a through 1.0.1.
The Developer Formatter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom CSS in all versions up to, and including, 2015.0.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Sensitive data exposure in Foxit eSign for WordPress plugin allows authenticated administrators to retrieve embedded sensitive information, potentially revealing secrets stored within the plugin. Versions up to 2.0.3 are affected. No active exploitation or public exploit has been identified.
An out-of-bounds read vulnerability has been reported to affect File Station 5. If a local attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.4847 and later
Buffer overflow vulnerability in the DFile module Impact: Successful exploitation of this vulnerability may affect availability.
In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Address reentrant enqueue adding class to eltree twice Savino says: "We are writing to report that this recent patch (141d34391abbb315d68556b7c67ad97885407547) [1] can be bypassed, and a UAF can still occur when HFSC is utilized with NETEM. The patch only checks the cl->cl_nactive field to determine whether it is the first insertion or not [2], but this field is only incremented by init_vf [3]. By using HFSC_RSC (which uses init_ed) [4], it is possible to bypass the check and insert the class twice in the eltree. Under normal conditions, this would lead to an infinite loop in hfsc_dequeue for the reasons we already explained in this report [5]. However, if TBF is added as root qdisc and it is configured with a very low rate, it can be utilized to prevent packets from being dequeued. This behavior can be exploited to perform subsequent insertions in the HFSC eltree and cause a UAF." To fix both the UAF and the infinite loop, with netem as an hfsc child, check explicitly in hfsc_enqueue whether the class is already in the eltree whenever the HFSC_RSC flag is set. [1] https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=141d34391abbb315d68556b7c67ad97885407547 [2] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L1572 [3] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L677 [4] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L1574 [5] https://lore.kernel.org/netdev/8DuRWwfqjoRDLDmBMlIfbrsZg9Gx50DHJc1ilxsEBNe2D6NMoigR_eIRIG0LOjMc3r10nUUZtArXx4oZBIdUfZQrwjcQhdinnMis_0G7VEk=@willsroot.io/T/#u
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to modify memory or crash processes. We have already fixed the vulnerability in the following versions: QTS 5.2.4.3079 build 20250321 and later QuTS hero h5.2.4.3079 build 20250321 and later
A cross-site scripting (XSS) vulnerability has been reported to affect License Center. If exploited, the vulnerability could allow remote attackers who have gained user access to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version: License Center 1.9.49 and later
A security vulnerability in Missing Authorization vulnerability in onOffice GmbH onOffice for WP-Websites (CVSS 5.4). Remediation should follow standard vulnerability management procedures.
Broken access control in Activity Plus Reloaded for BuddyPress up to version 1.1.2 allows authenticated attackers with low privileges to modify activity data or perform unauthorized actions. The vulnerability is due to missing authorization checks (CWE-862) and has a low EPSS score (0.07%), with no public exploit or active exploitation reported.
Missing authorization vulnerability in WP Compress for MainWP allows authenticated attackers with low privileges to exploit incorrectly configured access control security levels, potentially leading to unauthorized modification of settings or data. The issue affects versions through 6.30.32 and has a low EPSS score of 0.07%, with no public exploit or active exploitation confirmed.
Missing authorization in the WordPress Accessibility Suite plugin up to version 4.19 allows authenticated attackers with low privileges to exploit incorrectly configured access controls, leading to unauthorized modification of settings or data. The vulnerability has a CVSS score of 5.4 (medium) and a low EPSS probability of 0.07%, with no evidence of active exploitation or public exploit code.
CVE-2025-29013 is a security vulnerability (CVSS 5.4). Remediation should follow standard vulnerability management procedures.
Missing authorization check in Elastic Email Subscribe Form for WordPress up to version 1.2.2 allows authenticated low-privilege users to modify plugin settings or data, leading to limited integrity and availability impacts. No confidentiality loss, and EPSS indicates very low exploitation likelihood. No active exploitation reported.
Missing authorization vulnerability in No Spam At All WordPress plugin up to version 1.3 allows authenticated attackers with low privileges to exploit incorrectly configured access controls, leading to unauthorized modification of plugin settings or data. No public exploit or active exploitation has been identified, and EPSS score is low (0.07%).
A security vulnerability in Missing Authorization vulnerability in codelobster Responsive Flipbooks (CVSS 5.4). Remediation should follow standard vulnerability management procedures.
A remote code execution vulnerability (CVSS 5.4). Remediation should follow standard vulnerability management procedures.
Missing authorization in Responsive Plus WordPress plugin up to version 3.2.0 allows authenticated attackers with low privileges to exploit incorrectly configured access controls, leading to unauthorized modification of settings or content. No public exploit or active exploitation has been identified, and the EPSS score is low (0.07%).
Server-Side Request Forgery (SSRF) in SmartDataSoft Car Repair Services WordPress theme up to version 5.0 allows unauthenticated attackers to coerce the server into making arbitrary requests, potentially leading to internal network scanning or data exfiltration. This issue carries a CVSS 5.4 score with changed scope, but exploitation is hindered by high attack complexity. No active exploitation or public exploit code has been identified at time of analysis.
Cross-Site Request Forgery in Hive Support WordPress plugin up to version 1.2.2 allows unauthenticated attackers to modify AI/chat settings, including API keys, by tricking a site administrator into clicking a malicious link. No public exploit or active exploitation identified, and EPSS score is low (0.03%).
Cross-Site Request Forgery in the Anti-Spam: Spam Protection plugin for WordPress allows unauthenticated attackers to delete pending comments and re-enable blocked users by tricking a site administrator into clicking a malicious link. The vulnerability affects all versions up to and including 2024.7 due to missing nonce validation in specific files. No public exploit or active exploitation has been identified, and the EPSS score is low at 0.03%.
Cross-Site Request Forgery (CSRF) in Print Invoice & Delivery Notes for WooCommerce up to version 5.5.0 allows an attacker to perform unauthorized actions on behalf of an authenticated admin, such as modifying invoice templates or delivery notes. The vulnerability requires user interaction (clicking a crafted link) and has a low EPSS score (0.03%), indicating low exploitation likelihood. No public exploit or active exploitation has been reported.
Cross-Site Request Forgery (CSRF) in Elite Video Player for WordPress allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying settings or deleting data. The vulnerability affects versions up to and including 10.0.5. No public exploit or active exploitation has been identified, and the EPSS score is low (0.03%).
Cross-Site Request Forgery (CSRF) in Advanced Post List WordPress plugin up to version 0.5.6.2 allows an attacker to trick an authenticated admin into performing unintended actions, such as modifying plugin settings or deleting data, by luring them to a malicious page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.03%).
A Cross-Site Request Forgery vulnerability in the Global Translator WordPress plugin through version 2.0.2 allows attackers to perform unauthorized actions on behalf of authenticated users, potentially modifying plugin settings or disrupting service. Exploitation requires an administrator to visit a malicious website while logged in. No public exploit code or active exploitation has been identified.
Cross-Site Request Forgery (CSRF) in Pay with Contact Form 7 plugin for WordPress allows an attacker to trick an authenticated admin into performing unintended actions, such as modifying plugin settings or initiating unauthorized transactions. Affected versions are through 1.0.4. No public exploit or active exploitation has been identified, and EPSS score is low (0.03%).
Code injection vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and executing certain commands that can be executed with view permission.