Unauthenticated missing authorization in the Abandoned Contact Form 7 WordPress plugin allows remote attackers to modify plugin data and cause a denial of service. The flaw affects versions up to 2.0 and stems from incorrectly configured access control levels, enabling any unauthenticated user to perform actions that should be restricted. The exploitation probability is low (EPSS 0.08%), and no active exploitation has been confirmed.
Unauthorized access to restricted whistleblowing data in the Trusty Whistleblowing WordPress plugin (≤1.5.2) allows remote, unauthenticated attackers to retrieve confidential reports via a missing authorization check. The vulnerability has no reported active exploitation or public exploit, but carries a CVSS score of 8.2 due to high confidentiality impact and low attack complexity. EPSS data indicates a 0.06% probability of exploitation in the wild, suggesting low immediate risk.
PHP local file inclusion
Local file inclusion in AncoraThemes CityGov WordPress theme through version 1.9 allows unauthenticated remote attackers to include arbitrary local files, potentially leading to information disclosure or code execution. Attack complexity is high, and no active exploitation has been confirmed; EPSS indicates a low likelihood of widespread exploitation.
A security vulnerability in ovatheme BRW allows PHP Local File Inclusion (CVSS 8.1). High severity vulnerability requiring prompt remediation.
Local file inclusion in ApusWP Domnoo WordPress theme up to version 1.49 allows unauthenticated remote attackers to read arbitrary server files, potentially exposing credentials and leading to full site compromise. Exploitation requires high attack complexity and no user interaction. There is no public exploit or active exploitation confirmed at this time.
Local File Inclusion in the National Weather Service Alerts WordPress plugin through version 1.3.5 allows unauthenticated attackers to read arbitrary local files on the server, potentially exposing sensitive configuration data or enabling further attacks like remote code execution via log poisoning. No public exploit or active exploitation has been reported, and EPSS indicates a low probability of exploitation (0.16%).
A security vulnerability in thembay Diza allows PHP Local File Inclusion (CVSS 8.1). High severity vulnerability requiring prompt remediation.
A security vulnerability in codesupplyco Networker allows PHP Local File Inclusion (CVSS 8.1). High severity vulnerability requiring prompt remediation.
A security vulnerability in thembay Greenmart allows PHP Local File Inclusion (CVSS 8.1). High severity vulnerability requiring prompt remediation.
Local file inclusion in the FW Gallery WordPress plugin (versions up to 8.0.0) allows unauthenticated attackers to include arbitrary local files, potentially exposing sensitive data like configuration files. The high attack complexity suggests exploitation depends on specific server conditions, not default configurations. No public exploit or active exploitation has been confirmed at time of analysis.
A security vulnerability in thembay Puca allows PHP Local File Inclusion (CVSS 8.1). High severity vulnerability requiring prompt remediation.
Local file inclusion in the SERPed.net WordPress plugin (versions ≤4.6) enables unauthenticated attackers to read arbitrary files on the server, potentially leading to remote code execution. No patch is available, and the plugin may be closed or abandoned. Exploitation risk is tempered by high attack complexity and a low EPSS score (0.16%), though successful exploitation yields full confidentiality, integrity, and availability impact.
A security vulnerability in snstheme SNS Vicky allows PHP Local File Inclusion (CVSS 8.1). High severity vulnerability requiring prompt remediation.
A remote code execution vulnerability (CVSS 8.1). High severity vulnerability requiring prompt remediation.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme PrintXtore allows PHP Local File Inclusion.
Unauthenticated Local File Inclusion in Zenny WordPress theme (up to version 1.7.5) allows remote attackers to include arbitrary local files, potentially achieving remote code execution and full server compromise. No known active exploitation or public exploit code is available at this time, and the EPSS score of 0.16% indicates a low probability of widespread attacks.
A security vulnerability in goalthemes Sofass allows PHP Local File Inclusion (CVSS 8.1). High severity vulnerability requiring prompt remediation.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme allows PHP Local File Inclusion. This issue affects Samex - Clean, Minimal Shop WooCommerce WordPress Theme: from n/a through 2.6.
A security vulnerability in real-web RealtyElite allows PHP Local File Inclusion (CVSS 8.1). High severity vulnerability requiring prompt remediation.
Local File Inclusion in Zikzag Core WordPress plugin through version 1.4.5 allows unauthenticated attackers to include arbitrary local files, potentially leading to information disclosure or remote code execution. The vulnerability carries a CVSS score of 8.1 with high attack complexity, and no known public exploit or active exploitation has been identified at this time.
Roo Code is an AI-powered autonomous coding agent. The project-specific MCP configuration for the Roo Code agent is stored in the `.roo/mcp.json` file within the VS Code workspace. Because the MCP configuration format allows for execution of arbitrary commands, prior to version 3.20.3, it would have been possible for an attacker with access to craft a prompt to ask the agent to write a malicious command to the MCP configuration file. If the user had opted-in to auto-approving file writes within the project, this would have led to arbitrary command execution. This issue is of moderate severity, since it requires the attacker to already be able to submit prompts to the agent (for instance through a prompt injection attack), for the user to have MCP enabled (on by default), and for the user to have enabled auto-approved file writes (off by default). Version 3.20.3 fixes the issue by adding an additional layer of opt-in configuration for auto-approving writing to Roo's configuration files, including all files within the `.roo/` folder.
PHP Local File Inclusion in the Davenport WordPress theme versions up to 1.3 permits unauthenticated attackers to execute arbitrary code via a path traversal flaw, enabling full server compromise. The vulnerability has a CVSS 8.1 with high attack complexity and a low EPSS score of 0.06%, indicating reduced real-world exploitation probability. No active exploitation or public exploit has been identified at this time.
Remote path traversal in Katerio Magazine 1.5.1 and below allows unauthenticated attackers to include arbitrary local PHP files, potentially leading to remote code execution. The vulnerability is rated 8.1 CVSS, but real-world exploitation probability is low (EPSS 0.06%), and no active exploitation or public exploit code has been identified.
Authenticated path traversal in the WordPress Image Shadow plugin up to version 1.1.0 allows low-privileged users to delete arbitrary files on the server, leading to a high availability impact. The vulnerability requires an authenticated attacker with minimal privileges and can be exploited over the network with low complexity. No active exploitation or public exploit code is known at this time, reflected by a very low EPSS score of 0.08%.
Authenticated SQL injection exists in the WP Forum Server WordPress plugin up to version 1.8.2, enabling high-privileged attackers (administrators) to read arbitrary data from the database. Exploitation requires administrative access and results in high confidentiality impact; no active exploitation or public exploit is known, and EPSS indicates a very low probability of widespread use.
Authenticated SQL injection in the Wow-Company Hover Effects plugin for WordPress up to version 2.1.2 allows high-privilege attackers to extract sensitive information from the website database. The vulnerability requires administrative access to the plugin interface, but successful exploitation can fully compromise data confidentiality. No active exploitation or public exploit code has been identified at the time of analysis.
High-privilege SQL injection in the YaySMTP WordPress plugin (versions through 2.6.5) allows authenticated administrators to extract sensitive database information via network requests. No active exploitation or public exploit code has been identified, and EPSS predicts a low 0.05% chance of exploitation in the near term.
During the initial setup of the device the user connects to an access point broadcast by the Sight Bulb Pro. During the negotiation, AES Encryption keys are passed in cleartext. If captured, an attacker may be able to decrypt communications between the management app and the Sight Bulb Pro which may include sensitive information such as network credentials.
A security vulnerability in devnex Devnex Addons For Elementor allows PHP Local File Inclusion (CVSS 7.5). High severity vulnerability requiring prompt remediation.
Local file inclusion in WPB Category Slider for WooCommerce 1.71 and earlier allows authenticated low-privilege users (e.g., subscribers) to include arbitrary local files on the WordPress host, potentially leading to sensitive data disclosure or remote code execution. No evidence of active exploitation or public exploit code exists; the EPSS score of 0.16% (36th percentile) indicates a low probability of widespread attacks.
A security vulnerability in nicdark Hotel Booking allows PHP Local File Inclusion (CVSS 7.5). High severity vulnerability requiring prompt remediation.
Local File Inclusion in the Gmedia Photo Gallery WordPress plugin (≤1.23.0) allows low-privileged authenticated attackers to include arbitrary local files on the server, potentially leading to sensitive data exposure or code execution. No active exploitation has been reported, and the EPSS exploitation probability is low (0.16%).
Local file inclusion in CTUsers WordPress plugin up to 1.0.0 allows unauthenticated attackers to include arbitrary local files via a crafted request. Exploitation requires user interaction and high attack complexity, but can lead to full compromise of the affected server, including disclosure of sensitive data or code execution. The vulnerability is not known to be actively exploited and has a low EPSS probability score.
An issue in Hikvision DS-2CD1321-I V5.7.21 build 230819 allows attackers to cause a Denial of Service (DoS) via sending a crafted POST request to the endpoint /ISAPI/Security/challenge. The vendor has stated that upgrading to V5.7.23_SP2 fixes the issue.
An OS command injection issue exists in multiple versions of TB-eye network recorders and AHD recorders. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who is logging in to the device.
The Ninja Tables - Easy Data Table Builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.18 via the args[url] parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
A remote code execution vulnerability (CVSS 7.2). High severity vulnerability requiring prompt remediation.
Reflected cross-site scripting in the LMS WordPress theme by designthemes allows unauthenticated attackers to execute arbitrary scripts in a victim's browser via a crafted link, affecting all versions up to 9.1. User interaction is required, enabling session hijacking or data theft. No public exploit code or active exploitation has been identified, and EPSS predicts very low exploitation likelihood.
Reflected Cross-Site Scripting in the xili-dictionary WordPress plugin through version 2.12.5.2 allows attackers to execute arbitrary scripts in a victim's browser. A remote attacker can craft a malicious link that, when clicked by a user visiting an affected site, can steal cookies, redirect browsers, or deface content. No active exploitation or public exploit is currently known, and EPSS indicates a low probability of widespread exploitation.
Reflected cross-site scripting in the Infility Global WordPress plugin (≤2.12.7) allows unauthenticated remote attackers to execute arbitrary script in a victim's browser via a crafted link. No public exploit or active exploitation has been identified; the EPSS score is 0.04%, indicating low exploitation probability despite a CVSS 3.1 score of 7.1.
Reflected Cross-Site Scripting in the CSS3 Vertical Web Pricing Tables WordPress plugin allows unauthenticated attackers to inject arbitrary web scripts. Version 1.9 and earlier are affected, and exploitation requires a victim to click a crafted link. No active exploitation or public exploit code has been reported, and the EPSS score of 0.04% indicates a very low probability of real-world attacks.
Unauthenticated remote attackers can inject arbitrary web scripts via a crafted URL due to improper input sanitization in the Flexo Counter WordPress plugin through version 1.0001. When a victim clicks the link, malicious JavaScript executes in their browser, potentially leading to session theft or defacement. No active exploitation or public exploit is confirmed, and EPSS indicates very low exploitation probability (0.04%, 13th percentile).
Reflected cross-site scripting in the Bulk YouTube Post Creator WordPress plugin up to version 1.0 allows unauthenticated attackers to inject malicious scripts by tricking an authenticated user into clicking a crafted link. An attacker could hijack the victim's session, steal sensitive data, or perform actions on the victim's behalf within the context of the affected site. EPSS indicates very low exploitation probability (0.04%), and no active exploitation has been confirmed.
Reflected cross-site scripting in the Off-Canvas Sidebars & Menus (Slidebars) WordPress plugin up to version 0.5.8.4 allows unauthenticated attackers to inject arbitrary web scripts via crafted requests. Successful exploitation requires a victim to click a malicious link, leading to script execution in the victim's browser, which may steal session cookies or deface pages. No evidence of active exploitation or public exploit code exists at this time.
Reflected cross-site scripting (XSS) in the WordPress plugin FormLift for Infusionsoft Web Forms (versions up to 7.5.20) allows remote unauthenticated attackers to inject arbitrary web scripts via user-supplied input. Exploitation requires a victim to click a malicious link, but can lead to session theft, phishing, and other browser-based attacks. The vulnerability carries a CVSS score of 7.1, though EPSS indicates a very low (0.04%) probability of exploitation; no active exploitation or public exploit code has been identified.
Reflected Cross-Site Scripting (XSS) in the mojoomla School Management WordPress plugin allows unauthenticated attackers to inject arbitrary web scripts via unsanitized input, exploiting victims who click a crafted link. This vulnerability affects plugin versions through 92.0.0, with no known public exploit or active exploitation reported at the time of analysis.
Reflected cross-site scripting in the Sneeit MagOne WordPress theme up to version 8.5 allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by enticing them to click a specially crafted link. This can lead to session hijacking, data theft, or site defacement. No public exploit or active exploitation has been reported, and the EPSS probability is very low at 0.04%.
Reflected cross-site scripting in the Smart Notification WordPress plugin up to version 10.3 enables unauthenticated attackers to execute arbitrary JavaScript in the browser of a victim who clicks a crafted link. This can lead to session hijacking, credential theft, or malicious actions on behalf of the victim. While no active exploitation or public exploit code is currently reported, the low CVSS impact and very low EPSS score suggest limited real-world risk at this time.
Reflected cross-site scripting in the HYDRO WordPress theme (versions ≤2.8) allows unauthenticated attackers to inject arbitrary web scripts after a victim clicks a crafted link, enabling session hijacking or unauthorized actions in the victim's browser. No public exploit code or active exploitation was identified at time of analysis, and EPSS predicts very low exploitation probability (0.04%).