Unauthenticated users on an adjacent network with the Sight Bulb Pro can run shell commands as root through a vulnerable proprietary TCP protocol available on Port 16668. This vulnerability allows an attacker to run arbitrary commands on the Sight Bulb Pro by passing a well formed JSON string.
Insufficient access controls in the WPManiax WP DB Booster plugin for WordPress up to version 1.0.1 allow authenticated low-privilege users to read sensitive data and cause limited availability impact. No public exploit or active exploitation has been identified. The vulnerability carries a medium-severity CVSS base score of 5.4 and a very low EPSS exploitation probability (0.07%).
IBM Cloud Pak System 2.3.5.0, 2.3.3.7, 2.3.3.7 iFix1 on Power and 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.4.0, 2.3.4.1 on Intel operating systems is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
Unauthenticated cross-site request forgery in the Virusdie WordPress plugin through version 1.1.3 allows remote attackers to trick authenticated administrators into performing unintended actions, such as modifying plugin settings or triggering scans. Exploitation requires user interaction and no public exploit or active exploitation has been identified; EPSS indicates a very low exploitation probability.
Cross-site request forgery (CSRF) vulnerability in the Address Autocomplete via Google for Gravity Forms WordPress plugin allows attackers to perform unauthorized actions on behalf of logged-in administrators, such as modifying plugin settings. The flaw affects plugin versions through 1.3.4 and requires user interaction (admin clicking a link). No public exploit or active exploitation has been identified; EPSS score is low (0.02%).
Cross-site request forgery in the Writesonic WordPress plugin through version 1.0.4 enables attackers to trick administrators into unknowingly triggering actions such as modifying plugin settings or disrupting service. No active exploitation or public exploit code has been reported, and EPSS indicates a low 0.02% probability of exploitation.
Buffer Overflow vulnerability exists in multiple versions of TB-eye network recorders and AHD recorders. The CGI process may be terminated abnormally by processing a specially crafted request.
CVE-2025-6705 is a security vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
Sensitive information exposure in the Accept Authorize.NET Payments WordPress plugin up to version 2.5 allows unauthenticated remote attackers to retrieve embedded sensitive data from sent form submissions. The vulnerability has a CVSS base score of 5.3 with low confidentiality impact and requires no user interaction, but there is no evidence of public exploit code or active exploitation; EPSS probability is very low (0.06%).
Unauthenticated exposure of sensitive data in Accept Stripe Payments Using Contact Form 7 plugin up to version 3.0 sends embedded secrets (e.g., API keys) in network traffic, allowing remote attackers to retrieve that data. The vulnerability stems from insertion of sensitive information into sent data, with a CVSS 5.3 base score. No active exploitation or public proof-of-concept has been identified at this time, and the EPSS exploitation probability is very low (0.06%).
Information disclosure in Roland Beaussant Audio Editor & Recorder plugin for WordPress up to version 2.2.3 allows unauthenticated remote attackers to access sensitive system information. The vulnerability has a low exploitation probability (EPSS 0.06%) and no known public exploit code, but successful exploitation could leak embedded sensitive data.
CVE-2025-53304 is a security vulnerability (CVSS 5.3) that allows accessing functionality not properly constrained. Remediation should follow standard vulnerability management procedures.
A security vulnerability in Missing Authorization vulnerability in iCount iCount Payment Gateway (CVSS 5.3) that allows accessing functionality not properly constrained. Remediation should follow standard vulnerability management procedures.
Missing authorization in the HurryTimer WordPress plugin through version 2.13.1 allows unauthenticated, remote attackers to modify plugin data (low integrity impact) with no user interaction. The vulnerability arises from incorrectly configured access controls, enabling unauthorized action via network requests. No active exploitation or public exploit code is confirmed, and EPSS probability is very low (0.06%).
A vulnerability was found in HKUDS LightRAG up to 1.3.8. It has been declared as critical. Affected by this vulnerability is the function upload_to_input_dir of the file lightrag/api/routers/document_routes.py of the component File Upload. The manipulation of the argument file.filename leads to path traversal. It is possible to launch the attack on the local host. The identifier of the patch is 60777d535b719631680bcf5d0969bdef79ca4eaf. It is recommended to apply a patch to fix this issue.
Software installed and running inside a Guest VM may override Firmware's state and gain access to the GPU.
Arbitrary file read vulnerability in the Plugin Inspector WordPress plugin up to version 1.5 allows authenticated administrators to read arbitrary files on the server via a path traversal attack. The vulnerability requires high privileges but can expose sensitive configuration and data. No active exploitation or public exploit code has been observed, and the EPSS score indicates a low probability of widespread exploitation.
Missing authorization checks in the WPKit For Elementor WordPress plugin (versions ≤ 1.1.0) allow unauthenticated attackers to escalate privileges via crafted requests that modify arbitrary WordPress options. The vulnerability requires user interaction and can lead to privilege escalation without user awareness. No active exploitation is confirmed, and EPSS indicates a very low exploitation probability (0.09%).
Low-privileged authenticated users can bypass authorization checks in the Cron Logger WordPress plugin up to version 1.3.0, leading to limited service disruption. The flaw allows attackers with subscriber-level or similar low access to cause availability impact without any interaction. No evidence of active exploitation or public exploit code exists.
A security vulnerability in Missing Authorization vulnerability in danbriapps Pre-Publish Post Checklist (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Unauthorized modification of dashboard widget sidebars in WordPress plugin Dashboard Widget Sidebar ≤1.2.3 allows authenticated users with low privileges to alter sidebar configurations. This missing authorization check permits exploitation of incorrectly configured access controls, leading to limited data integrity impact. No active exploitation or public exploit is known; EPSS probability is very low (0.05%).
Missing authorization in PlatiOnline Payments plugin for WordPress up to 6.3.2 allows authenticated attackers with low privileges to modify payment-related data. The vulnerability, stemming from broken access control, impacts only integrity (CVSS 4.3). No public exploit or active exploitation is known, and EPSS indicates very low exploitation probability.
Data manipulation in QuantumCloud ChatBot 6.7.3 and below allows authenticated low-privilege users to bypass missing authorization checks and modify plugin data. The vulnerability has a CVSS 3.1 base score of 4.3 (Medium) and an EPSS probability of 0.05%, indicating low exploitation likelihood. No active exploitation has been confirmed, and no public exploit code is available at time of analysis.
CVE-2025-46708 is a security vulnerability (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Cross-site request forgery in the Aioseo Multibyte Descriptions WordPress plugin (versions up to 0.0.6) allows unauthenticated attackers to perform state-changing actions on behalf of a logged-in administrator, such as altering plugin settings, by tricking them into clicking a malicious link. Exploitation requires user interaction, and no active exploitation or public exploit code has been reported; EPSS indicates a very low exploitation probability (0.02%).
Cross-site request forgery in the Slickstream WordPress plugin up to version 2.0.3 allows an unauthenticated attacker to trick an authenticated administrator into performing unintended actions, such as altering plugin settings. The vulnerability requires user interaction and has a low integrity impact. No active exploitation or public exploit code has been reported, and EPSS indicates a very low chance of real-world exploitation.
Cross-Site Request Forgery (CSRF) in the opicron Image Cleanup WordPress plugin (versions up to 1.9.2) allows unauthenticated attackers to trick authenticated administrators into performing unauthorized actions on the affected site. The vulnerability carries a CVSS base score of 4.3 (Medium) with low integrity impact only, and no public exploit or active exploitation has been observed.
Cross-Site Request Forgery in the Blend Media WordPress CTA plugin up to version 1.6.9 allows unauthenticated attackers to deceive logged-in administrators into executing unwanted actions, such as modifying plugin settings, through specially crafted requests. The vulnerability has a medium CVSS base score of 4.3 due to required user interaction and low integrity impact, with no confidentiality or availability loss. No active exploitation or public exploit code has been identified.
Cross-Site Request Forgery (CSRF) in the My Wp Brand WordPress plugin allows attackers to trick authenticated administrators into performing unintended actions on the plugin’s settings. Affected versions up to 1.1.3 lack proper request origin verification, enabling state-changing operations with only low integrity impact. No active exploitation or public exploit code is known, and EPSS rates exploitation probability as very low (0.02%).
Cross-site request forgery in the WordPress plugin Import external attachments (≤1.5.12) allows an unauthenticated attacker to trick an administrator into performing unintended actions, such as modifying settings or triggering imports, by enticing them to click a malicious link while logged in. The vulnerability has low integrity impact and requires user interaction, with no confidentiality or availability impact. No active exploitation or public exploit code has been identified, and with the affected plugin’s niche deployment, the real-world risk is minimal.
Cross-Site Request Forgery in the Hide Admin Bar From Front End WordPress plugin (≤1.0.0) allows unauthenticated attackers to trick site administrators into performing unintended actions, such as modifying plugin settings that control admin bar visibility. No active exploitation or public exploit code is known, and the EPSS exploitation probability is very low (0.02%).
Cross-site request forgery (CSRF) in the ONet Regenerate Thumbnails plugin for WordPress allows remote attackers to trick administrators into triggering unauthorized thumbnail regeneration. Affected versions include n/a through 1.5. The vulnerability has a CVSS 4.3 score, requires user interaction, and there is no evidence of active exploitation or public exploit code.
A Cross-Site Request Forgery vulnerability in the WP YouTube Live WordPress plugin up to version 1.10.0 allows unauthenticated attackers to trick an authenticated administrator into unknowingly performing actions, such as modifying plugin configuration. This can lead to limited integrity impact with no confidentiality or availability loss. No active exploitation or public exploit code has been observed, and the EPSS probability of exploitation is very low (0.02%).
Cyrlitera WordPress plugin versions through 1.2.0 contain a cross-site request forgery (CSRF) vulnerability allowing remote attackers to craft requests that, when submitted by an authenticated administrator, can modify plugin settings. There is no evidence of active exploitation, and EPSS predicts a very low exploitation probability (0.02%).
Cross-site request forgery in PDF Invoice Builder plugin versions up to 1.2.148 enables remote unauthenticated attackers to trick authenticated administrators into performing actions that modify invoice data, leading to limited integrity impact (CVSS 4.3). No exploit code or active exploitation is publicly reported; the EPSS exploitation probability is extremely low at 0.02%.
Unauthorized modification of cookie consent settings in the Cookiebot WordPress plugin up to version 4.5.8 allows unauthenticated attackers to perform Cross-Site Request Forgery (CSRF) attacks. An attacker can trick a logged-in administrator into clicking a malicious link, leading to changes in cookie consent configuration. No active exploitation (CISA KEV) or public exploit code has been identified, and EPSS indicates very low exploitation probability (0.02%).
Cross-Site Request Forgery in the Burst Statistics WordPress plugin (≤2.0.6) could allow an attacker to trick an authenticated administrator into performing unintended actions, such as modifying plugin settings, by submitting a crafted request. Exploitation requires user interaction and no public exploit code or active exploitation is known. The very low EPSS score (0.02%) further indicates minimal real-world risk.
The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.7. This is due to missing or incorrect nonce validation on the syncCalendar() function. This makes it possible for unauthenticated attackers to trigger a calendar sync via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.