Open redirect vulnerability in FunnelKit Automation By Autonami WordPress plugin allows phishing attacks. An unauthenticated attacker can redirect users to malicious external sites via crafted URLs. No public exploit or active exploitation identified, and EPSS score is low (0.04%).
CVE-2025-6069 is a security vulnerability (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
An unrestricted file upload vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to upload arbitrary files on affected installations.
The Poll, Survey & Quiz Maker Plugin by Opinion Stage plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on several functions in all versions up to, and including, 19.9.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to change the email address for the account connection, and disconnect the plugin. Previously created content will still be displayed and functional if the account is disconnected.
Missing authorization in CubeWP Forms for WordPress allows authenticated attackers with low privileges to exploit incorrectly configured access controls, potentially leading to unauthorized data modification. The vulnerability affects versions up to 1.1.5 and has a low EPSS score with no public exploit identified.
Missing authorization in myCred WordPress plugin up to version 2.9.4.2 allows authenticated attackers with low privileges to exploit incorrectly configured access control security levels, potentially modifying data. No public exploit or active exploitation has been identified, and EPSS score is low (0.06%).
A security vulnerability in Missing Authorization vulnerability in tychesoftwares Arconix FAQ (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Unauthorized settings changes in the Advanced Settings WordPress plugin through version 3.0.1 via Cross-Site Request Forgery allow attackers to perform state-altering actions on behalf of a logged-in administrator. The flaw stems from missing CSRF token validation on privileged requests, requiring user interaction to exploit. With a CVSS score of 4.3, a very low EPSS (0.03%) and no known active exploitation or public exploit, the immediate risk is low.
Cross-Site Request Forgery (CSRF) in Responsive Plus WordPress plugin up to version 3.2.2 allows an attacker to trick an authenticated admin into performing unintended actions, such as changing plugin settings. The vulnerability has a low EPSS score (0.03%) and no evidence of active exploitation or public exploit code.
Cross-Site Request Forgery (CSRF) vulnerability in YITHEMES YITH PayPal Express Checkout for WooCommerce allows Cross Site Request Forgery. This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.49.0.