Unauthenticated SQL injection in the Cozmoslabs Paid Member Subscriptions WordPress plugin up to version 2.15.1 allows remote attackers with no privileges to execute arbitrary SQL commands via a specially crafted request. Successful exploitation can expose highly sensitive data from the database, with a low but possible impact on availability. The vulnerability carries a CVSS base score of 7.5 (High), an EPSS score of 0.03% indicating very low exploitation likelihood, and no known public exploit or active attacks at the time of analysis.
Whale browser before 4.32.315.22 allow an attacker to bypass the Same-Origin Policy in a dual-tab environment.
Authenticated arbitrary file upload in the Download Plugin for WordPress ≤2.2.8 allows Administrator-level users to upload arbitrary files due to missing file type validation in the dpwap_plugin_locInstall function, leading to remote code execution. Publicly available exploit code exists, though EPSS indicates a low probability of widespread exploitation. No active exploitation has been confirmed by CISA KEV.
Remote code injection in the Bearsthemes Alone WordPress theme up to version 7.8.2 allows unauthenticated attackers to execute arbitrary code on the server, potentially reading sensitive data or altering site content. No public exploit code or active exploitation has been confirmed, with EPSS estimating a very low 0.05% exploitation probability.
Server-side request forgery in TeconceTheme Allmart 1.0.0 allows unauthenticated remote attackers to force the WordPress site to make requests to internal
Reflected Cross-Site Scripting (XSS) in the JobSearch WordPress plugin (through version 2.9.0) allows unauthenticated attackers to inject web scripts by tricking a user into clicking a crafted link. The vulnerability could lead to cookie theft, session hijacking, or defacement, though EPSS predicts very low exploitation likelihood (0.03%) and no public exploit or active exploitation is known.
Reflected cross-site scripting in the WP-Recall WordPress plugin up to version 16.26.14 allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted link. No public exploit or active exploitation is confirmed; the vulnerability has a low EPSS score of 0.03%.
Stored cross-site scripting in the Video List Manager WordPress plugin up to version 1.7 enables unauthenticated attackers to inject malicious scripts that execute in the browsers of users viewing affected pages, potentially leading to credential theft, session hijacking, or site defacement. No active exploitation has been reported, and EPSS score of 0.03% indicates a low probability of widespread exploitation in the wild. Exploitation requires user interaction, as the victim must visit the compromised page.
We need to produce a JSON analysis based on the provided data. The CVE is CVE-2025-49866, a reflected XSS vulnerability in the Beautiful Cookie Consent Banner WordPress plugin (by Nikel) versions through 4.6.1. The CVSS vector is provided: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1. EPSS is 0.03% (very low). No KEV, no mention of POC or exploitation. Tags: XSS. References from Patchstack. CWE-79. Now, we must fill the JSON fields following strict guidelines. First, product_name: "1-3 words ONLY. The specific product or service name affected." The product is "Beautiful Cookie Consent Banner". That's 3 words. So product_name: "Beautiful Cookie Consent Banner". Note: It's a WordPress plugin, but the name itself is fine. summary: 2-3 sentence plain-language synthesis. Use all data. Don't start with "A vulnerability" etc. Start with impact verb and product. "Reflected cross-site scripting" is the impact. So: "Reflected cross-site scripting in the Beautiful Cookie Consent Banner WordPress plugin allows attackers to inject arbitrary web scripts via a crafted URL." But need to be specific: "Improper Neutralization of Input During Web Page Generation" is the root cause. Affected product: Beautiful Cookie Consent Banner up to 4.6.1. Attacker can perform reflected XSS. No mention of active exploitation or POC. EPSS is low. So summary: "Reflected cross-site scripting in the Beautiful Cookie Consent Banner WordPress plugin (<=4.6.1) allows unauthenticated attackers to execute arbitrary JavaScript in a victim’s browser. Exploitation requires user interaction (clicking a malicious link), and the low EPSS score (0.03%) suggests exploitation is unlikely." That's good, but need to add EPSS and if any exploitation status. No KEV, no known POC. So phrase: "no public exploit identified at time of analysis". technical_context: Explain underlying technology/library/protocol. CPE? We have no CPE strings in the input, just EUVD affected versions. But we can describe it as a
Reflected cross-site scripting in the Neom Blog WordPress theme (versions up to 0.0.9) allows unauthenticated
Reflected DOM-based cross-site scripting (XSS) in the WordPress Team Showcase plugin (versions prior to 25.05.13) allows unauthenticated attackers to inject arbitrary scripts via a crafted URL. When a logged-in user or other site visitor clicks the link, the script executes in their browser, potentially stealing session cookies or performing actions on their behalf. No public exploit code or active exploitation has been reported, and the vendor has released patch version 25.05.13.
Reflected cross-site scripting in the Testimonials Showcase WordPress plugin through version 1.9.16 allows unauthenticated attackers to execute arbitrary JavaScript in the context of a victim user's browser session. An attacker can craft a malicious link that, when clicked by a user (any role) with an active WordPress session, will execute the attacker-supplied code, potentially stealing session tokens, defacing the page, or performing actions on the user's behalf. No active exploitation or public proof-of-concept is known at this time, and EPSS indicates very low exploitation probability (0.03%).
Reflected cross-site scripting in the Rankie WordPress plugin up to version 1.8.2 allows unauthenticated attackers to inject arbitrary web scripts via a crafted URL. An attacker can trick a logged-in user into clicking the link, potentially leading to session cookie theft or credential phishing. No active exploitation is confirmed and no public exploit code has been identified.
We need to produce a comprehensive analysis in JSON. The CVE is about a Reflected XSS in a WordPress theme "Pressroom - News Magazine WordPress Theme" up to version 6.9. We have multiple sources: EPSS low, no KEV, no explicit POC mentioned (none in input). The vulnerability is reported by Patchstack, so likely they have details. Need to synthesize. Let's fill each field: - product_name: The specific product name in 1-3 words. "Pressroom Theme" (since it's a WordPress theme, maybe "Pressroom WordPress Theme" or just "Pressroom"? Brief: "Pressroom Theme" but "Pressroom - News Magazine WordPress Theme" is the full name. The EUVD says: "Pressroom - News Magazine WordPress Theme n/a ≤6.9". So I'll use "Pressroom Theme". Keep it concise: "Pressroom WordPress Theme" (3 words). The vulnerability is in the theme, so product name: "Pressroom Theme". - summary: 2-3 sentences, original synthesis, not copy description. Start with impact verb and product. "Reflected cross-site scripting in the Pressroom WordPress theme through version 6.9 allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser via a crafted URL." Mention affected product (theme, versions). Note that exploitation requires user interaction (UI:R in CVSS vector). Actively exploited? No KEV, no POC mentioned. EPSS low 0.03%, so not high. So summary: "Reflected cross-site scripting in the Pressroom WordPress theme through version 6.9 allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser when they click a malicious link. Successful exploitation could lead to session hijacking, defacement, or sensitive data exposure." Not exploited actively, no known POC. - technical_context: Underlying technology: WordPress theme, PHP, reflected XSS due to improper output escaping (CWE-79). CVE description says "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" so reflected XSS. CWE-79. The affected product is a WordPress theme. How
Reflected cross-site scripting in the Homey WordPress theme (versions ≤2.4.5) allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted link. The vulnerability has a CVSS score of 7.1 (High) but an EPSS probability of 0.03%, indicating minimal exploitation likelihood; no active exploitation or public exploit code has been reported.
Reflected Cross-Site Scripting (XSS) in the SB Breadcrumbs WordPress plugin up to version 1.0 allows unauthenticated attackers to inject arbitrary web scripts via a crafted URL, potentially hijacking user sessions, defacing the site, or redirecting visitors to malicious pages. No active exploitation or public exploit code has been identified at this time.
Reflected cross-site scripting (XSS) in WP Wall ≤1.7.3 lets attackers execute arbitrary JavaScript in victims' browsers via crafted links. The WordPress plugin fails to properly sanitize reflected input, requiring user interaction. No active exploitation or public exploit is confirmed, and EPSS probability is very low (0.03%).
Reflected cross-site scripting in the OTWthemes Content Manager Light WordPress plugin through version 3.2 allows an unauthenticated attacker to inject arbitrary web scripts. Successful exploitation requires tricking an authenticated administrator into clicking a crafted link, after which the attacker may steal session tokens, deface content, or perform other actions in the victim’s browser context. At the time of analysis, no public exploit code or active exploitation has been identified.
In the Linux kernel, the following vulnerability has been resolved: jfs: fix array-index-out-of-bounds read in add_missing_indices stbl is s8 but it must contain offsets into slot which can go from 0 to 127. Added a bound check for that error and return -EIO if the check fails. Also make jfs_readdir return with error if add_missing_indices returns with an error.
In the Linux kernel, the following vulnerability has been resolved: can: kvaser_pciefd: refine error prone echo_skb_max handling logic echo_skb_max should define the supported upper limit of echo_skb[] allocated inside the netdevice's priv. The corresponding size value provided by this driver to alloc_candev() is KVASER_PCIEFD_CAN_TX_MAX_COUNT which is 17. But later echo_skb_max is rounded up to the nearest power of two (for the max case, that would be 32) and the tx/ack indices calculated further during tx/rx may exceed the upper array boundary. Kasan reported this for the ack case inside kvaser_pciefd_handle_ack_packet(), though the xmit function has actually caught the same thing earlier. BUG: KASAN: slab-out-of-bounds in kvaser_pciefd_handle_ack_packet+0x2d7/0x92a drivers/net/can/kvaser_pciefd.c:1528 Read of size 8 at addr ffff888105e4f078 by task swapper/4/0 CPU: 4 UID: 0 PID: 0 Comm: swapper/4 Not tainted 6.15.0 #12 PREEMPT(voluntary) Call Trace: <IRQ> dump_stack_lvl lib/dump_stack.c:122 print_report mm/kasan/report.c:521 kasan_report mm/kasan/report.c:634 kvaser_pciefd_handle_ack_packet drivers/net/can/kvaser_pciefd.c:1528 kvaser_pciefd_read_packet drivers/net/can/kvaser_pciefd.c:1605 kvaser_pciefd_read_buffer drivers/net/can/kvaser_pciefd.c:1656 kvaser_pciefd_receive_irq drivers/net/can/kvaser_pciefd.c:1684 kvaser_pciefd_irq_handler drivers/net/can/kvaser_pciefd.c:1733 __handle_irq_event_percpu kernel/irq/handle.c:158 handle_irq_event kernel/irq/handle.c:210 handle_edge_irq kernel/irq/chip.c:833 __common_interrupt arch/x86/kernel/irq.c:296 common_interrupt arch/x86/kernel/irq.c:286 </IRQ> Tx max count definitely matters for kvaser_pciefd_tx_avail(), but for seq numbers' generation that's not the case - we're free to calculate them as would be more convenient, not taking tx max count into account. The only downside is that the size of echo_skb[] should correspond to the max seq number (not tx max count), so in some situations a bit more memory would be consumed than could be. Thus make the size of the underlying echo_skb[] sufficient for the rounded max tx value. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
In the Linux kernel, the following vulnerability has been resolved: ext4: fix out of bounds punch offset Punching a hole with a start offset that exceeds max_end is not permitted and will result in a negative length in the truncate_inode_partial_folio() function while truncating the page cache, potentially leading to undesirable consequences. A simple reproducer: truncate -s 9895604649994 /mnt/foo xfs_io -c "pwrite 8796093022208 4096" /mnt/foo xfs_io -c "fpunch 8796093022213 25769803777" /mnt/foo kernel BUG at include/linux/highmem.h:275! Oops: invalid opcode: 0000 [#1] SMP PTI CPU: 3 UID: 0 PID: 710 Comm: xfs_io Not tainted 6.15.0-rc3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014 RIP: 0010:zero_user_segments.constprop.0+0xd7/0x110 RSP: 0018:ffffc90001cf3b38 EFLAGS: 00010287 RAX: 0000000000000005 RBX: ffffea0001485e40 RCX: 0000000000001000 RDX: 000000000040b000 RSI: 0000000000000005 RDI: 000000000040b000 RBP: 000000000040affb R08: ffff888000000000 R09: ffffea0000000000 R10: 0000000000000003 R11: 00000000fffc7fc5 R12: 0000000000000005 R13: 000000000040affb R14: ffffea0001485e40 R15: ffff888031cd3000 FS: 00007f4f63d0b780(0000) GS:ffff8880d337d000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000001ae0b038 CR3: 00000000536aa000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> truncate_inode_partial_folio+0x3dd/0x620 truncate_inode_pages_range+0x226/0x720 ? bdev_getblk+0x52/0x3e0 ? ext4_get_group_desc+0x78/0x150 ? crc32c_arch+0xfd/0x180 ? __ext4_get_inode_loc+0x18c/0x840 ? ext4_inode_csum+0x117/0x160 ? jbd2_journal_dirty_metadata+0x61/0x390 ? __ext4_handle_dirty_metadata+0xa0/0x2b0 ? kmem_cache_free+0x90/0x5a0 ? jbd2_journal_stop+0x1d5/0x550 ? __ext4_journal_stop+0x49/0x100 truncate_pagecache_range+0x50/0x80 ext4_truncate_page_cache_block_range+0x57/0x3a0 ext4_punch_hole+0x1fe/0x670 ext4_fallocate+0x792/0x17d0 ? __count_memcg_events+0x175/0x2a0 vfs_fallocate+0x121/0x560 ksys_fallocate+0x51/0xc0 __x64_sys_fallocate+0x24/0x40 x64_sys_call+0x18d2/0x4170 do_syscall_64+0xa7/0x220 entry_SYSCALL_64_after_hwframe+0x76/0x7e Fix this by filtering out cases where the punching start offset exceeds max_end.