An OS command injection issue exists in multiple versions of TB-eye network recorders and AHD recorders. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who is logging in to the device.
The Ninja Tables - Easy Data Table Builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.18 via the args[url] parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
A remote code execution vulnerability (CVSS 7.2). High severity vulnerability requiring prompt remediation.
Reflected cross-site scripting in the LMS WordPress theme by designthemes allows unauthenticated attackers to execute arbitrary scripts in a victim's browser via a crafted link, affecting all versions up to 9.1. User interaction is required, enabling session hijacking or data theft. No public exploit code or active exploitation has been identified, and EPSS predicts very low exploitation likelihood.
Reflected Cross-Site Scripting in the xili-dictionary WordPress plugin through version 2.12.5.2 allows attackers to execute arbitrary scripts in a victim's browser. A remote attacker can craft a malicious link that, when clicked by a user visiting an affected site, can steal cookies, redirect browsers, or deface content. No active exploitation or public exploit is currently known, and EPSS indicates a low probability of widespread exploitation.
Reflected cross-site scripting in the Infility Global WordPress plugin (≤2.12.7) allows unauthenticated remote attackers to execute arbitrary script in a victim's browser via a crafted link. No public exploit or active exploitation has been identified; the EPSS score is 0.04%, indicating low exploitation probability despite a CVSS 3.1 score of 7.1.
Reflected Cross-Site Scripting in the CSS3 Vertical Web Pricing Tables WordPress plugin allows unauthenticated attackers to inject arbitrary web scripts. Version 1.9 and earlier are affected, and exploitation requires a victim to click a crafted link. No active exploitation or public exploit code has been reported, and the EPSS score of 0.04% indicates a very low probability of real-world attacks.
Unauthenticated remote attackers can inject arbitrary web scripts via a crafted URL due to improper input sanitization in the Flexo Counter WordPress plugin through version 1.0001. When a victim clicks the link, malicious JavaScript executes in their browser, potentially leading to session theft or defacement. No active exploitation or public exploit is confirmed, and EPSS indicates very low exploitation probability (0.04%, 13th percentile).
Reflected cross-site scripting in the Bulk YouTube Post Creator WordPress plugin up to version 1.0 allows unauthenticated attackers to inject malicious scripts by tricking an authenticated user into clicking a crafted link. An attacker could hijack the victim's session, steal sensitive data, or perform actions on the victim's behalf within the context of the affected site. EPSS indicates very low exploitation probability (0.04%), and no active exploitation has been confirmed.
Reflected cross-site scripting in the Off-Canvas Sidebars & Menus (Slidebars) WordPress plugin up to version 0.5.8.4 allows unauthenticated attackers to inject arbitrary web scripts via crafted requests. Successful exploitation requires a victim to click a malicious link, leading to script execution in the victim's browser, which may steal session cookies or deface pages. No evidence of active exploitation or public exploit code exists at this time.
Reflected cross-site scripting (XSS) in the WordPress plugin FormLift for Infusionsoft Web Forms (versions up to 7.5.20) allows remote unauthenticated attackers to inject arbitrary web scripts via user-supplied input. Exploitation requires a victim to click a malicious link, but can lead to session theft, phishing, and other browser-based attacks. The vulnerability carries a CVSS score of 7.1, though EPSS indicates a very low (0.04%) probability of exploitation; no active exploitation or public exploit code has been identified.
Reflected Cross-Site Scripting (XSS) in the mojoomla School Management WordPress plugin allows unauthenticated attackers to inject arbitrary web scripts via unsanitized input, exploiting victims who click a crafted link. This vulnerability affects plugin versions through 92.0.0, with no known public exploit or active exploitation reported at the time of analysis.
Reflected cross-site scripting in the Sneeit MagOne WordPress theme up to version 8.5 allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by enticing them to click a specially crafted link. This can lead to session hijacking, data theft, or site defacement. No public exploit or active exploitation has been reported, and the EPSS probability is very low at 0.04%.
Reflected cross-site scripting in the Smart Notification WordPress plugin up to version 10.3 enables unauthenticated attackers to execute arbitrary JavaScript in the browser of a victim who clicks a crafted link. This can lead to session hijacking, credential theft, or malicious actions on behalf of the victim. While no active exploitation or public exploit code is currently reported, the low CVSS impact and very low EPSS score suggest limited real-world risk at this time.
Reflected cross-site scripting in the HYDRO WordPress theme (versions ≤2.8) allows unauthenticated attackers to inject arbitrary web scripts after a victim clicks a crafted link, enabling session hijacking or unauthorized actions in the victim's browser. No public exploit code or active exploitation was identified at time of analysis, and EPSS predicts very low exploitation probability (0.04%).
Stored cross-site scripting in the Seven Stars WordPress theme by themeton allows unauthenticated attackers to inject malicious scripts into the site that execute when other users-such as admins-view the affected page. The vulnerability affects versions 1.4.4 and earlier, and while no active exploitation has been confirmed, publicly available proof-of-concept exploits likely exist given the nature of stored XSS. CVSS 7.1 indicates high severity, but EPSS estimates only a 0.04% probability of exploitation.
Stored cross-site scripting in Woocommerce Line Notify plugin for WordPress allows unauthenticated attackers to inject arbitrary web scripts that execute when a victim views an affected page, potentially leading to session hijacking or unauthorized actions. All versions up to 1.1.7 are vulnerable; no active exploitation or public proof-of-concept has been confirmed despite a High CVSS score of 7.1. The EPSS score of 0.04% indicates extremely low likelihood of real-world exploitation at this time.
Reflected cross-site scripting (XSS) in the WP Front User Submit / Front Editor WordPress plugin versions up to 4.9.3 allows unauthenticated attackers to inject arbitrary web scripts via a crafted URL. The attack requires user interaction (e.g., clicking a link) and can lead to script execution in the victim’s browser, potentially enabling data theft or defacement. No active exploitation or public exploit code has been reported, and EPSS indicates low probability of widespread exploitation.
Reflected cross-site scripting in the Evangelische Termine WordPress plugin allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a malicious link. Versions up to and including 3.3 are affected. Exploitation requires user interaction, and no active exploitation or public proof-of-concept has been identified at this time.
Reflected cross-site scripting in the Backwp WordPress plugin up to version 2.0.2 allows unauthenticated remote attackers to execute arbitrary JavaScript in the context of a victim's browser when a malicious link is clicked. The vulnerability has a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and an EPSS score of 0.04%, indicating a low probability of widespread exploitation. No public exploit code or active exploitation has been identified at the time of analysis.
Reflected cross-site scripting (XSS) in the Photo Express for Google WordPress plugin up to version 0.3.2 allows unauthenticated attackers to inject malicious scripts into web pages viewed by other users. Successful exploitation could lead to cookie theft, session hijacking, or defacement, but requires user interaction to click a crafted link. No active exploitation or public exploit code has been identified.
Stored cross-site scripting (XSS) in FasterThemes FastBook WordPress plugin through version 1.1 allows unauthenticated attackers to inject malicious scripts via web page input. When an administrator or other site user views the affected page, the script executes in their browser, potentially leading to session hijacking or credential theft. No active exploitation or public PoC is known, and EPSS estimates a very low exploitation probability (0.04%).
Reflected cross-site scripting (XSS) in the WPCRM WordPress plugin <= 3.2.0 allows unauthenticated attackers to inject arbitrary web scripts via crafted parameters. An attacker can trick a victim into clicking a malicious link, leading to session theft or defacement. No active exploitation or public exploit code has been identified, and EPSS indicates very low exploitation likelihood.
Stored cross-site scripting in the SpecFit Virtual Try-On Woocommerce plugin for WordPress allows unauthenticated attackers to inject malicious scripts into pages that are later viewed by other users, potentially leading to session hijacking, data theft, or site defacement. The vulnerability affects versions up to 7.0.6; no active exploitation or public exploit is known at the time of analysis, and the EPSS score is low (0.04%).
Reflected cross-site scripting in the Eventin WordPress plugin up to version 4.0.28 allows unauthenticated attackers to inject arbitrary web scripts via crafted URLs. When a victim clicks the link while authenticated, the malicious code executes in their browser, potentially leading to session hijacking or site defacement. At the time of analysis, no public exploit or active exploitation has been identified, and the EPSS score of 0.04% indicates very low exploitation probability.
Stored XSS via cross-site request forgery in the re.place WordPress plugin allows an attacker to store malicious scripts by tricking a logged-in administrator into clicking a crafted link. The vulnerability affects versions up to 0.2.1, and no active exploitation or public exploit code has been identified at the time of analysis.
Stored Cross-Site Scripting (XSS) in the RSS Digest WordPress plugin (versions up to 1.5) can be exploited via Cross-Site Request Forgery (CSRF), allowing unauthenticated attackers to trick site administrators into performing actions that inject malicious scripts. The injected payload persists and executes in the browsers of other users, leading to content manipulation, session theft, or site defacement. No active exploitation or public exploit code is known, and EPSS indicates a very low exploitation probability.
Cross-site request forgery in the Społecznościowa 6 PL 2013 WordPress plugin (versions <= 2.0.6) allows unauthenticated attackers to trick an administrator into executing unintended actions, leading to stored cross-site scripting. This enables injection of malicious scripts that execute in the browsers of other users, potentially stealing session cookies, defacing the site, or redirecting visitors. No active exploitation is confirmed, and the EPSS score is very low (0.02%).
Stored Cross-Site
Stored cross-site scripting (XSS) via cross-site request forgery (CSRF) in the Relocate Upload WordPress plugin up to version 0.24.1 allows an unauthenticated attacker to inject malicious scripts into the administrative interface. The attack requires an authenticated administrator to be tricked into clicking a crafted link, after which the injected script executes in the context of the admin user. No active exploitation or public exploit code has been identified, and EPSS data indicates a very low exploitation probability (0.02%).
Stored cross-site scripting (XSS) in the WordPress Twitch TV Embed Suite plugin allows attackers to inject malicious scripts. The vulnerability is reachable via a cross-site request forgery (CSRF) attack against authenticated administrators, affecting all plugin versions up to and including 2.1.0. No active exploitation or public exploit code has been confirmed, and the EPSS score is very low.
Stored cross-site scripting via cross-site request forgery in the OnionBuzz WordPress plugin (<=1.0.7) allows remote attackers to inject malicious scripts that execute in an administrator's browser when they are tricked into clicking a crafted link. The attack requires no authentication from the attacker, but does depend on user interaction. No active exploitation or public proof-of-concept has been identified at the time of analysis.
Cross-site request forgery in the Navayan Subscribe WordPress plugin allows unauthenticated attackers to inject persistent cross-site scripting payloads via crafted requests. Exploitation requires an authenticated administrator to click a malicious link, whereupon arbitrary JavaScript executes in the administrator’s browser, potentially leading to session theft, data manipulation, or further compromise. No active exploitation or public exploit code has been identified; EPSS indicates a low probability of broad exploitation.
Reflected XSS vulnerability in WordPress
Cross-site request forgery (CSRF) in the Image Slider With Description WordPress plugin up to version 9.2 enables stored cross-site scripting (XSS) attacks. An unauthenticated attacker can trick a site administrator into submitting a malicious request, leading to the injection of arbitrary web scripts that execute when a victim visits the affected page. The low EPSS score (0.02%) and absence from CISA KEV suggest no active exploitation, but the issue can compromise site integrity and user data.
Cross-site request forgery in the WP Forum Server WordPress plugin (up to 1.8.2) enables unauthenticated attackers to inject stored cross-site scripting (XSS) by tricking logged-in administrators into clicking a malicious link. Successful exploitation can lead to session hijacking or full
Stored Cross-Site Scripting (XSS) can be achieved through Cross-Site Request Forgery (CSRF) in the WP Permalink Translator plugin for WordPress, affecting versions up to 1.7.6. An attacker can trick an authenticated administrator into clicking a crafted link, leading to persistent script injection that executes in the browsers of other site visitors. EPSS predicts a very low exploitation probability (0.02%) and no active exploitation is confirmed.
Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) in the Additional Order Filters for WooCommerce WordPress plugin up to version 1.22 allows unauthenticated attackers to inject malicious scripts that execute in the context of an admin user. Exploitation requires tricking a logged-in administrator into clicking a crafted link, resulting in script storage that can compromise other admins' sessions and site data. The vulnerability has a CVSS base score of 7.1 but an extremely low EPSS exploitation probability (0.02%), and no active exploitation or public exploit code has been identified.