Stored cross-site scripting in Code Engine WordPress plugin through 0.3.2 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when other users view the affected page. No public exploit or active exploitation identified.
Stored cross-site scripting in WP Register Profile With Shortcode plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject malicious scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.
Stored cross-site scripting in WP Engine's Gutenberg Blocks - ACF Blocks Suite plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at time of analysis.
Stored cross-site scripting (XSS) in Anant Addons for Elementor plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject malicious scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
DOM-based Cross-Site Scripting (XSS) in Buying Buddy IDX CRM WordPress plugin up to version 2.3.0 allows authenticated attackers with low privileges to inject malicious scripts via crafted input, leading to potential data theft or session hijacking. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in Fyrebox Quizzes WordPress plugin up to version 3.0 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into quiz pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at this time.
DOM-Based Cross-Site Scripting (XSS) in the Fitness Park WordPress theme through version 1.1.1 allows authenticated attackers with contributor-level access or higher to inject malicious scripts. The vulnerability is triggered when a user interacts with a crafted link, leading to script execution in the victim's browser. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
DOM-based Cross-Site Scripting (XSS) in Spark Multipurpose WordPress theme versions up to 1.0.7 allows authenticated attackers with low privileges to inject malicious scripts via crafted input, leading to potential data theft or session hijacking. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
Cross-Site Request Forgery (CSRF) in Real Estate Manager WordPress plugin up to version 7.3 allows an attacker to trick an authenticated admin into performing unintended actions, such as modifying settings or deleting data, without their consent. The vulnerability has a CVSS score of 6.5 (Medium) with low EPSS probability (0.02%), and no public exploit or active exploitation has been identified.
Cross-Site Request Forgery (CSRF) in the WordPress plugin Mailing Group Listserv up to version 3.0.5 allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying mailing list settings or deleting subscribers, by luring them to a malicious page. The vulnerability has a CVSS score of 6.5 (Medium) with a network attack vector and low complexity, but requires user interaction. No public exploit or active exploitation has been identified, and the EPSS score is very low (0.02%).
The Euro FxRef Currency Converter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's currency shortcode in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Server-Side Request Forgery (SSRF) in BoldGrid Post and Page Builder plugin for WordPress allows authenticated attackers with low privileges to make the server send crafted requests to internal or external resources. This can lead to information disclosure or limited internal network scanning. No public exploit or active exploitation has been identified, and EPSS score is low (0.05%).
PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to version 6.7.2, there is a potential polynomial Regular Expression Denial of Service (ReDoS) vulnerability in the PowSyBl's DataSource mechanism. If successfully exploited, a malicious actor can cause significant CPU consumption due to regex backtracking - even with polynomial patterns. This issue has been patched in com.powsybl:powsybl-commons: 6.7.2.
A command injection vulnerability was discovered in the TrustyAI Explainability toolkit.
Stored cross-site scripting in Ninja Team File Manager Pro for WordPress allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. The vulnerability affects versions up to 1.8.8 and has a low EPSS score (0.04%) with no public exploit or active exploitation reported.
Stored cross-site scripting (XSS) in Login/Signup Popup plugin for WordPress versions up to 2.9.4 allows authenticated users with high privileges (e.g., administrators) to inject malicious scripts that execute when other users view the affected page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in Spoki WordPress plugin up to version 2.16.0 allows authenticated attackers with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
Stored cross-site scripting (XSS) in CP Polls WordPress plugin up to version 1.0.81 allows authenticated users with high privileges to inject malicious scripts that execute when other users view poll data. No public exploit or active exploitation identified.
Stored cross-site scripting in ATP Call Now WordPress plugin up to version 1.0.3 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation identified; EPSS score is low (0.04%).
Stored cross-site scripting in CodePen Embed Block plugin for WordPress allows authenticated users with high privileges to inject malicious scripts. This issue affects versions through 1.1.1 and has a low EPSS score with no public exploit identified.
Stored cross-site scripting in WP-FB-AutoConnect plugin for WordPress allows authenticated administrators to inject malicious scripts via improperly neutralized input. Affects versions up to 4.6.3. No public exploit or active exploitation identified; EPSS score is low (0.04%).
Stored cross-site scripting (XSS) in Better Random Redirect WordPress plugin versions up to 1.3.20 allows authenticated users with high privileges (e.g., administrators) to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in RDFa Breadcrumb WordPress plugin through version 2.3 allows authenticated users with high privileges (e.g., administrators) to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation identified; EPSS score is low (0.04%).
Stored cross-site scripting in Simple Sticky Footer WordPress plugin up to version 1.3.5 allows authenticated users with high privileges to inject arbitrary web scripts into pages, which execute when other users access the affected page. No public exploit or active exploitation identified; EPSS score is low (0.04%).
Stored cross-site scripting in Tealium WordPress plugin up to version 2.1.17 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in WP Voting Contest plugin for WordPress allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. The vulnerability affects versions up to 5.8 and has a low EPSS score with no public exploit identified.
Stored cross-site scripting (XSS) in the WordPress plugin IP Based Login through version 2.4.2 allows authenticated administrators to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting vulnerability in the Hand Talk WordPress plugin up to version 6.0 allows authenticated users with high privileges to inject malicious scripts into web pages. An attacker with admin-level access can store XSS payloads that execute when other users view affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.
Stored cross-site scripting (XSS) vulnerability in the PDPA Consent for Thailand WordPress plugin up to version 1.1.1 allows authenticated users with high privileges (e.g., administrators) to inject malicious scripts into web pages. This can lead to session hijacking, defacement, or redirection to malicious sites when other users view the affected page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting (XSS) in CSV Importer Improved WordPress plugin up to version 0.6.1 allows authenticated users with high privileges to inject malicious scripts via imported CSV data. The vulnerability is triggered when an administrator views the imported data, leading to script execution in the admin context. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting (XSS) in Inventory Presser WordPress plugin up to version 15.0.0 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
Stored cross-site scripting in Recipes manager - WPH plugin for WordPress allows authenticated users with high privileges to inject malicious scripts. Versions through 1.0.4 are affected. No public exploit or active exploitation identified.
An issue was discovered in the COROS application through 3.8.12 for Android. Bluetooth pairing and bonding is neither initiated nor enforced by the application itself. Also, the watch does not enforce pairing and bonding. As a result, any data transmitted via BLE remains unencrypted, allowing attackers within Bluetooth range to eavesdrop on the communication. Furthermore, even if a user manually initiates pairing and bonding in the Android settings, the application continues to transmit data without requiring the watch to be bonded. This fallback behavior enables attackers to exploit the communication, for example, by conducting an active machine-in-the-middle attack.
Buffer overflow in OpenVPN ovpn-dco-win version 1.3.0 and earlier and version 2.5.8 and earlier allows a local user process to send a too large control message buffer to the kernel driver resulting in a system crash
Missing authorization in Kata Plus WordPress plugin up to version 1.5.3 allows low-privileged attackers to exploit incorrectly configured access controls, leading to limited integrity and availability impact. No public exploit or active exploitation has been identified, and EPSS score is low (0.07%).
A remote code execution vulnerability (CVSS 5.4). Remediation should follow standard vulnerability management procedures.
Missing authorization in WooCommerce Fortnox Integration plugin for WordPress allows authenticated attackers with low privileges to exploit incorrectly configured access controls, potentially leading to unauthorized modifications. The vulnerability affects all versions up to 4.5.5 and has a CVSS score of 5.4 (medium), with no public exploit or active exploitation reported.
Missing authorization in Zapier for WordPress plugin up to version 1.5.2 allows authenticated attackers with low privileges to exploit broken access controls, potentially leading to unauthorized data access or modification. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%).
A security vulnerability in osama (CVSS 5.3) that allows accessing functionality not properly constrained. Remediation should follow standard vulnerability management procedures.
A security vulnerability in Missing Authorization vulnerability in tggfref WP-Recall (CVSS 5.3) that allows accessing functionality not properly constrained. Remediation should follow standard vulnerability management procedures.
Missing authorization in Contact Form 7 AWeber Extension up to version 0.1.38 allows unauthenticated attackers to exploit incorrectly configured access controls, potentially causing limited availability impact. No public exploit or active exploitation has been identified, and the EPSS score is low (0.08%).
Missing authorization in RafflePress Giveaways and Contests plugin for WordPress allows unauthenticated attackers to access functionality that should be restricted to authorized users. This affects versions through 1.12.17 and can lead to unauthorized modification of giveaway settings or data. No public exploit or active exploitation has been identified.
CVE-2025-49995 is a security vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
Missing authorization in Cookie-Script.com WordPress plugin up to version 1.2.1 allows unauthenticated attackers to exploit incorrectly configured access controls, potentially modifying plugin settings. No public exploit or active exploitation has been identified, and EPSS score is low (0.06%).
A security vulnerability in Missing Authorization vulnerability in contentstudio ContentStudio (CVSS 5.3) that allows accessing functionality not properly constrained. Remediation should follow standard vulnerability management procedures.
Missing authorization in App Builder WordPress plugin up to version 5.5.3 allows unauthenticated attackers to exploit incorrectly configured access controls, potentially accessing sensitive information. No public exploit or active exploitation has been identified, and EPSS score is low (0.06%).
Missing authorization in WPFactory CRM ERP Business Solution for WordPress allows unauthenticated attackers to modify data without authentication. The vulnerability affects versions up to and including 1.13, with a CVSS score of 5.3 and low EPSS probability (0.06%). No public exploit or active exploitation has been identified.
A security vulnerability in Missing Authorization vulnerability in thanhtungtnt Video List Manager (CVSS 5.3) that allows accessing functionality not properly constrained. Remediation should follow standard vulnerability management procedures.
Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.0.1, contains an improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to denial of service, information disclosure, and information tampering.
Server-Side Request Forgery (SSRF) in the WordPress plugin Auto Upload Images versions up to 3.3.2 allows authenticated attackers with low privileges to make the server send crafted requests to internal or external resources. This can lead to limited information disclosure or limited manipulation of internal services. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).