Stored cross-site scripting in the Seven Stars WordPress theme by themeton allows unauthenticated attackers to inject malicious scripts into the site that execute when other users-such as admins-view the affected page. The vulnerability affects versions 1.4.4 and earlier, and while no active exploitation has been confirmed, publicly available proof-of-concept exploits likely exist given the nature of stored XSS. CVSS 7.1 indicates high severity, but EPSS estimates only a 0.04% probability of exploitation.
Stored cross-site scripting in Woocommerce Line Notify plugin for WordPress allows unauthenticated attackers to inject arbitrary web scripts that execute when a victim views an affected page, potentially leading to session hijacking or unauthorized actions. All versions up to 1.1.7 are vulnerable; no active exploitation or public proof-of-concept has been confirmed despite a High CVSS score of 7.1. The EPSS score of 0.04% indicates extremely low likelihood of real-world exploitation at this time.
Reflected cross-site scripting (XSS) in the WP Front User Submit / Front Editor WordPress plugin versions up to 4.9.3 allows unauthenticated attackers to inject arbitrary web scripts via a crafted URL. The attack requires user interaction (e.g., clicking a link) and can lead to script execution in the victim’s browser, potentially enabling data theft or defacement. No active exploitation or public exploit code has been reported, and EPSS indicates low probability of widespread exploitation.
Reflected cross-site scripting in the Evangelische Termine WordPress plugin allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a malicious link. Versions up to and including 3.3 are affected. Exploitation requires user interaction, and no active exploitation or public proof-of-concept has been identified at this time.
Reflected cross-site scripting in the Backwp WordPress plugin up to version 2.0.2 allows unauthenticated remote attackers to execute arbitrary JavaScript in the context of a victim's browser when a malicious link is clicked. The vulnerability has a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and an EPSS score of 0.04%, indicating a low probability of widespread exploitation. No public exploit code or active exploitation has been identified at the time of analysis.
Reflected cross-site scripting (XSS) in the Photo Express for Google WordPress plugin up to version 0.3.2 allows unauthenticated attackers to inject malicious scripts into web pages viewed by other users. Successful exploitation could lead to cookie theft, session hijacking, or defacement, but requires user interaction to click a crafted link. No active exploitation or public exploit code has been identified.
Stored cross-site scripting (XSS) in FasterThemes FastBook WordPress plugin through version 1.1 allows unauthenticated attackers to inject malicious scripts via web page input. When an administrator or other site user views the affected page, the script executes in their browser, potentially leading to session hijacking or credential theft. No active exploitation or public PoC is known, and EPSS estimates a very low exploitation probability (0.04%).
Reflected cross-site scripting (XSS) in the WPCRM WordPress plugin <= 3.2.0 allows unauthenticated attackers to inject arbitrary web scripts via crafted parameters. An attacker can trick a victim into clicking a malicious link, leading to session theft or defacement. No active exploitation or public exploit code has been identified, and EPSS indicates very low exploitation likelihood.
Stored cross-site scripting in the SpecFit Virtual Try-On Woocommerce plugin for WordPress allows unauthenticated attackers to inject malicious scripts into pages that are later viewed by other users, potentially leading to session hijacking, data theft, or site defacement. The vulnerability affects versions up to 7.0.6; no active exploitation or public exploit is known at the time of analysis, and the EPSS score is low (0.04%).
Reflected cross-site scripting in the Eventin WordPress plugin up to version 4.0.28 allows unauthenticated attackers to inject arbitrary web scripts via crafted URLs. When a victim clicks the link while authenticated, the malicious code executes in their browser, potentially leading to session hijacking or site defacement. At the time of analysis, no public exploit or active exploitation has been identified, and the EPSS score of 0.04% indicates very low exploitation probability.
Stored XSS via cross-site request forgery in the re.place WordPress plugin allows an attacker to store malicious scripts by tricking a logged-in administrator into clicking a crafted link. The vulnerability affects versions up to 0.2.1, and no active exploitation or public exploit code has been identified at the time of analysis.
Stored Cross-Site Scripting (XSS) in the RSS Digest WordPress plugin (versions up to 1.5) can be exploited via Cross-Site Request Forgery (CSRF), allowing unauthenticated attackers to trick site administrators into performing actions that inject malicious scripts. The injected payload persists and executes in the browsers of other users, leading to content manipulation, session theft, or site defacement. No active exploitation or public exploit code is known, and EPSS indicates a very low exploitation probability.
Cross-site request forgery in the Społecznościowa 6 PL 2013 WordPress plugin (versions <= 2.0.6) allows unauthenticated attackers to trick an administrator into executing unintended actions, leading to stored cross-site scripting. This enables injection of malicious scripts that execute in the browsers of other users, potentially stealing session cookies, defacing the site, or redirecting visitors. No active exploitation is confirmed, and the EPSS score is very low (0.02%).
Stored Cross-Site
Stored cross-site scripting (XSS) via cross-site request forgery (CSRF) in the Relocate Upload WordPress plugin up to version 0.24.1 allows an unauthenticated attacker to inject malicious scripts into the administrative interface. The attack requires an authenticated administrator to be tricked into clicking a crafted link, after which the injected script executes in the context of the admin user. No active exploitation or public exploit code has been identified, and EPSS data indicates a very low exploitation probability (0.02%).
Stored cross-site scripting (XSS) in the WordPress Twitch TV Embed Suite plugin allows attackers to inject malicious scripts. The vulnerability is reachable via a cross-site request forgery (CSRF) attack against authenticated administrators, affecting all plugin versions up to and including 2.1.0. No active exploitation or public exploit code has been confirmed, and the EPSS score is very low.
Stored cross-site scripting via cross-site request forgery in the OnionBuzz WordPress plugin (<=1.0.7) allows remote attackers to inject malicious scripts that execute in an administrator's browser when they are tricked into clicking a crafted link. The attack requires no authentication from the attacker, but does depend on user interaction. No active exploitation or public proof-of-concept has been identified at the time of analysis.
Cross-site request forgery in the Navayan Subscribe WordPress plugin allows unauthenticated attackers to inject persistent cross-site scripting payloads via crafted requests. Exploitation requires an authenticated administrator to click a malicious link, whereupon arbitrary JavaScript executes in the administrator’s browser, potentially leading to session theft, data manipulation, or further compromise. No active exploitation or public exploit code has been identified; EPSS indicates a low probability of broad exploitation.
Reflected XSS vulnerability in WordPress
Cross-site request forgery (CSRF) in the Image Slider With Description WordPress plugin up to version 9.2 enables stored cross-site scripting (XSS) attacks. An unauthenticated attacker can trick a site administrator into submitting a malicious request, leading to the injection of arbitrary web scripts that execute when a victim visits the affected page. The low EPSS score (0.02%) and absence from CISA KEV suggest no active exploitation, but the issue can compromise site integrity and user data.
Cross-site request forgery in the WP Forum Server WordPress plugin (up to 1.8.2) enables unauthenticated attackers to inject stored cross-site scripting (XSS) by tricking logged-in administrators into clicking a malicious link. Successful exploitation can lead to session hijacking or full
Stored Cross-Site Scripting (XSS) can be achieved through Cross-Site Request Forgery (CSRF) in the WP Permalink Translator plugin for WordPress, affecting versions up to 1.7.6. An attacker can trick an authenticated administrator into clicking a crafted link, leading to persistent script injection that executes in the browsers of other site visitors. EPSS predicts a very low exploitation probability (0.02%) and no active exploitation is confirmed.
Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) in the Additional Order Filters for WooCommerce WordPress plugin up to version 1.22 allows unauthenticated attackers to inject malicious scripts that execute in the context of an admin user. Exploitation requires tricking a logged-in administrator into clicking a crafted link, resulting in script storage that can compromise other admins' sessions and site data. The vulnerability has a CVSS base score of 7.1 but an extremely low EPSS exploitation probability (0.02%), and no active exploitation or public exploit code has been identified.
CVE-2025-40910 is a security vulnerability (CVSS 6.5) that allows attackers. Remediation should follow standard vulnerability management procedures.
A security vulnerability in pankaj (CVSS 6.5). Remediation should follow standard vulnerability management procedures.
Stored XSS in the My Resume Builder WordPress plugin (versions through 1.0.3) enables authenticated contributors to inject persistent JavaScript payloads into resume content that executes in the browsers of other users who view it. When a privileged user such as an administrator views the affected page, the injected script runs in their browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit has been identified at time of analysis, and the EPSS score of 0.04% indicates negligible observed exploitation interest.
DOM-based cross-site scripting in the WordPress Raise The Money plugin allows authenticated attackers with low privileges to inject malicious scripts, leading to code execution in victims' browsers. No active exploitation or public exploit code has been observed, and EPSS predicts a 0.04% chance of exploitation, indicating very low real-world risk.
Cross-site scripting in Free Downloads EDD WordPress plugin allows DOM-based XSS attacks against authenticated users with low privileges, potentially leading to session hijacking or malicious actions. The vulnerability affects versions up to 1.0.4 and has a low exploitation likelihood (EPSS 0.04%) with no public exploit or active exploitation reported.
DOM-Based Cross-Site Scripting in the Theme Junkie Team Content WordPress plugin (versions through 0.1.1) allows a low-privileged authenticated attacker to inject malicious scripts that execute in the browser of any user who views the affected page. Because the scope changes (S:C in the CVSS vector), the injected script can access session cookies and perform actions on behalf of higher-privileged users such as administrators. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.04% reflects very low observed exploitation probability.
Stored cross-site scripting in the WordPress Podcast Feed Player Widget and Shortcode plugin up to version 2.2.0 allows authenticated contributors to inject arbitrary JavaScript through shortcode or widget inputs. When an administrator views the affected page, the script executes in the admin's browser context, enabling session theft or actions on behalf of the admin. No evidence of active exploitation (CISA KEV not listed) and EPSS score is low (0.04%), reducing immediate priority.
Stored cross-site scripting (XSS) in the Smart Agenda WordPress plugin up to version 4.9 allows authenticated attackers with low-privilege accounts to inject malicious scripts that execute in the browsers of users viewing the compromised content. No known public exploit or active exploitation (CISA KEV) has been identified, and the EPSS score of 0.04% indicates a very low probability of exploitation in the wild.
DOM-based XSS in the WP DataTable WordPress plugin (versions up to and including 0.2.7) allows a low-privileged authenticated attacker to inject malicious client-side scripts that execute in a victim's browser session. The flaw is classified under CWE-79 and arises from insufficient input neutralization in a DOM manipulation path, meaning the payload is processed by the browser rather than the server. No public exploit code and no CISA KEV listing have been identified at the time of analysis; EPSS at 0.04% reflects a low near-term exploitation probability.
Stored cross-site scripting in the WordPress plugin WP Visual Sitemap up to version 1.0.2 allows authenticated attackers with contributor-level access or higher to inject malicious scripts into sitemap content. When an administrator or other privileged user views the affected content, the script executes in their browser, enabling session hijacking or site defacement. No public exploit or active exploitation is known, and EPSS probability is very low (0.04%).
Stored cross-site scripting in WordPress Thumbnail Editor plugin ≤2.3.3 allows authenticated users with low privileges to inject arbitrary web scripts that execute when an administrator views the affected content, potentially leading to privilege escalation or data theft. No active exploitation or public exploit code has been identified, and EPSS indicates very low exploitation probability (0.04%).
Stored cross-site scripting in the Football Pool WordPress plugin (≤2.12.5) enables authenticated attackers to inject malicious scripts into pages viewed by other users. Successful exploitation requires user interaction to trigger the stored payload, leading to potential data theft or session compromise. EPSS indicates very low current exploitation probability (0.04%).
DOM-Based Cross-Site Scripting (XSS) in the Popup addon for Ninja Forms WordPress plugin up to version 3.4 allows authenticated attackers with at least contributor-level access to inject and execute arbitrary JavaScript in the browser of a victim who interacts with a crafted popup. Successful exploitation could lead to session hijacking, credential theft, or complete site takeover in the context of a higher-privileged user. No active exploitation or public exploit code is known at this time, and the EPSS exploitation probability is low (0.04%).
Stored Cross-Site Scripting in WP AdCenter plugin up to version 2.6.0 allows authenticated users with low-level privileges to inject malicious scripts into ad content, which execute in the browsers of administrators viewing the affected pages, potentially leading to session hijacking or privilege escalation. No active exploitation or public exploit code has been identified, and the EPSS score indicates a very low probability of widespread exploitation.
DOM-based Cross-Site Scripting (XSS) in the Omnipress WordPress plugin through version 1.6.3 allows authenticated attackers with low privileges (e.g., contributor accounts) to inject malicious scripts that execute in the browser of an administrator or other user. The vulnerability is triggered via crafted page content and requires victim interaction (e.g., visiting a page). No active exploitation or public proof-of-concept has been identified, and the EPSS score is very low (0.04%), indicating minimal current exploitation risk.
DOM-based cross-site scripting (XSS) vulnerability in the VaultDweller Leyka WordPress plugin (versions ≤3.31.9) allows authenticated attackers to inject arbitrary JavaScript into pages viewed by other users. Successful exploitation requires a low-privileged attacker account and user interaction, potentially leading to session hijacking or page manipulation. No active exploitation or public exploit code has been confirmed at this time.
Stored cross-site scripting in HT Mega – Absolute Addons for WPBakery Page Builder allows authenticated attackers with low privileges to inject arbitrary web scripts. When an administrator or other high-privilege user views the injected content, the script executes in their browser, leading to session theft, account takeover, or site defacement. The vulnerability affects all versions up to 1.0.8; no active exploitation or public exploit code is known, and the EPSS probability is low.
DOM-based cross-site scripting in the CyberChimps Responsive Blocks WordPress plugin allows authenticated attackers to inject arbitrary JavaScript. The vulnerability affects plugin versions up to 2.0.6 and can be exploited by low-privileged users who create malicious block content, leading to script execution in the browsers of victims who view the affected page. No active exploitation or public exploit code has been identified at this time.
A DOM-based cross-site scripting (XSS) vulnerability in the HT Slider For Elementor WordPress plugin up to version 1.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the Inquiry Management functionality /mcgs/admin/readenq.php of the Phpgurukul Medical Card Generation System 1.0. The vulnerable endpoint allows an authenticated admin to delete inquiry records via a simple GET request, without requiring a CSRF token or validating the origin of the request.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the Manage Card functionality (/mcgs/admin/manage-card.php) of PHPGurukul Medical Card Generation System 1.0. The vulnerable endpoint allows an authorized admin to delete medical card records by sending a simple GET request without verifying the origin of the request.
The The Pack Elementor addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slider_options’ parameter in all versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The A/B Testing for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ab-testing-for-wp/ab-test-block' block in all versions up to, and including, 1.18.2 due to insufficient input sanitization and output escaping on the 'id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The isMobile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘device’ parameter in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Stored Cross-Site Scripting in the Osom Blocks WordPress plugin allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts via the class_name parameter, executing whenever a user views the compromised page. The vulnerability affects all versions up to 1.2.1 and carries a CVSS score of 6.4 (Medium) with an EPSS probability of 0.04%, indicating low exploitation likelihood. No active exploitation (KEV) or public exploit code has been identified at this time.
The Ninja Forms - The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use of a templating engine in all versions up to, and including, 3.10.2.1 due to insufficient output escaping on user data passed through the template. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.