Authentication bypass in TM2 Monitoring v3.04 allows remote attackers to circumvent login controls and access the application, which additionally stores and discloses user credentials in plaintext. Publicly available exploit code exists (POC published by researcher stSLAYER for RT-Systems' TM2), enabling full compromise of confidentiality, integrity, and availability. Not listed in CISA KEV and EPSS probability is low (0.32%), so no confirmed active exploitation despite the critical 9.8 CVSS score.
Unrestricted file upload in the Medcity WordPress theme before version 1.1.9 allows unauthenticated attackers to upload a web shell, leading to complete compromise of the web server. This vulnerability, rated critical with CVSS 10.0 and CWE-434, is not currently listed in CISA KEV, and the EPSS score of 0.06% indicates low probability of widespread exploitation.
Remote code execution in Beplusthemes Alone WordPress theme through version 7.8.3 allows unauthenticated attackers to inject and execute arbitrary code via a code injection vulnerability. With a critical CVSS score of 10.0 and network-based exploitation requiring no privileges or user interaction, this vulnerability enables complete system compromise. EPSS exploitation probability is low (0.06%, 17th percentile), and no public exploit or CISA KEV listing identified at time of analysis.
PHP object injection in UNIVERSAM WordPress plugin through deserialization of untrusted data allows remote unauthenticated attackers to achieve critical impact including remote code execution, complete data compromise, and denial of service. Affects all versions up to and including 9.03. EPSS exploitation probability is relatively low at 0.10% (28th percentile), with no public exploit identified at time of analysis, suggesting a lower immediate real-world risk despite the critical CVSS 9.8 score.
PHP object injection in BoldThemes Addison WordPress theme versions prior to 1.4.8 enables unauthenticated remote attackers to execute arbitrary code through unsafe deserialization. The vulnerability carries a critical CVSS 9.8 score with network-accessible attack vector requiring no privileges or user interaction. No public exploit identified at time of analysis, with EPSS indicating 10th percentile exploitation probability (0.10%), suggesting low observed exploitation likelihood despite high theoretical severity.
PHP object injection in BoldThemes Goldenblatt WordPress theme versions prior to 1.3.0 enables unauthenticated remote attackers to execute arbitrary code through deserialization of untrusted data. The vulnerability scores 9.8 (Critical) with network-exploitable attack vector requiring no privileges or user interaction. EPSS indicates low probability (0.10%, 28th percentile) of active exploitation, and no public exploit or KEV listing identified at time of analysis, suggesting theoretical high severity but currently limited real-world exploitation activity.
PHP object injection in WooCommerce Vehicle Parts Finder plugin versions up to 3.7 enables remote unauthenticated attackers to achieve arbitrary code execution via deserialization of untrusted data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network-accessible exploitation without authentication or user interaction. Reported by Patchstack audit team, this represents a critical pre-authentication vulnerability in WordPress e-commerce environments. EPSS data unavailable; not currently listed in CISA KEV, suggesting limited widespread exploitation at time of disclosure.
Unauthenticated remote code execution in TF Woo Product Grid Addon for Elementor versions up to 1.0.1 allows complete site compromise via PHP object injection. The vulnerability stems from insecure deserialization (CWE-502) of untrusted input, exploitable without authentication or user interaction. No
SQL injection in WordPress SMS Alert Order Notifications plugin through version 3.8.5 allows remote unauthenticated attackers to extract sensitive database contents via network-accessible injection points. The vulnerability achieves scope change with high confidentiality impact, enabling cross-boundary data exfiltration from the WordPress database. EPSS data unavailable; not currently listed in CISA KEV, indicating no confirmed widespread active exploitation at time of analysis, though the unauthenticated remote attack vector presents significant risk for WordPress installations using this plugin.
SQL injection in ThemeMove Learts Addons for WordPress prior to version 1.7.5 allows unauthenticated remote attackers to execute arbitrary SQL commands. Exploitation can exfiltrate sensitive database contents (C:H) and, to a limited degree, affect data availability (A:L). The vulnerability currently has no known public exploit, and EPSS predicts very low exploitation probability (0.04%).
Blind SQL injection in Crocoblock JetSearch plugin (WordPress) versions up to 3.5.10 allows unauthenticated remote attackers to extract database contents via crafted search queries. The vulnerability carries a critical CVSS 9.3 score due to network-based exploitation requiring no authentication or user interaction, though EPSS exploitation probability remains low at 0.04% (12th percentile), and no public exploit identified at time of analysis. The flaw enables data exfiltration from WordPress databases hosting sites using the vulnerable search plugin.
Arbitrary file upload in the WordPress Zippy plugin (<=1.7.0) allows authenticated administrators to upload malicious files, leading to remote code execution and full server compromise. No public exploit or active exploitation has been identified at time of analysis. EPSS score of 0.06% indicates low likelihood of widespread exploitation.
Remote code execution in the s2Member WordPress plugin (≤ version 250905) allows unauthenticated attackers to inject and execute arbitrary PHP code, potentially leading to full site compromise. The vulnerability has a CVSS score of 9.0 but a very low EPSS exploitation probability (0.06%) and is not listed in CISA KEV; no public exploit is known at the time of analysis.
Privilege escalation in FantasticPlugins SUMO Memberships for WooCommerce (versions ≤7.8.0) allows authenticated users with low-level privileges to elevate permissions and gain unauthorized high-level access to WordPress site functions. The vulnerability stems from incorrect privilege assignment (CWE-266), enabling attackers to bypass intended access controls. With CVSS 8.8 (High) severity, the flaw permits complete compromise of confidentiality, integrity, and availability. EPSS probability is low (0.06%, 17th percentile), and no public exploit identified at time of analysis, though Patchstack has published advisory details.
Privilege escalation in N-Media Simple User Registration (WordPress plugin) through version 6.8 allows authenticated low-privilege users to elevate their access to administrator-level permissions via incorrect privilege assignment. With EPSS at 0.06% (17th percentile) and no public exploit identified at time of analysis, real-world exploitation risk remains low despite the high CVSS score. The vulnerability requires low-privilege authentication (PR:L) but has low attack complexity (AC:L) and no user interaction (UI:N), making it straightforward to exploit once an attacker has basic user credentials.
Password recovery exploitation in WordPress Emails Catch All plugin <=3.5.3 allows low-privileged authenticated attackers to reset any user’s password via an authentication bypass using an alternate channel. Successful exploitation grants full access to the target WordPress site, including data theft and site takeover. While rated High severity, the EPSS signal indicates very low real-world exploitation probability and no active exploitation is confirmed at this time.
Arbitrary file deletion in ThimPress WP Pipes plugin for WordPress (up to version 1.4.3) allows unauthenticated attackers to delete arbitrary files on the server via path traversal. This network-based, high-severity vulnerability (CVSS 8.6) has a low EPSS exploitation probability (0.09%) and is not listed in CISA KEV, with no known public exploit code at time of analysis.
Unauthenticated attackers can bypass access controls in the MultiVendorX WooCommerce plugin (versions up to 4.2.23), leading to unauthorized modification of plugin functionality with high integrity impact. The vulnerability has a low EPSS score (0.06%) and no known public exploit or active exploitation at time of analysis.
SQL injection in the Hydra Booking WordPress booking plugin (versions through 1.1.10) allows authenticated users with low privileges to extract sensitive data from the underlying database, with a scope-changed CVSS rating indicating the injection may reach beyond WordPress-specific tables to other databases accessible by the shared MySQL user. The vulnerability requires only a low-privilege account (PR:L) and no user interaction, making it exploitable by any registered WordPress user. No public exploit code or active exploitation has been identified; EPSS stands at 0.07% (21st percentile), suggesting low real-world exploitation activity at time of analysis.
SQL injection in the AnyComment WordPress commenting plugin (versions through 0.3.6) allows authenticated low-privilege users to extract data from the underlying WordPress MySQL database by sending crafted requests. The scope-changed CVSS vector (S:C/C:H) indicates the injection can traverse beyond the plugin's own tables and reach the full WordPress database schema - including wp_users, wp_options, and other sensitive stores. No public exploit identified at time of analysis; EPSS at 0.03% (8th percentile) reflects very low current exploitation likelihood.
Local File Inclusion in ThemeMove Businext theme versions prior to 2.4.4 allows unauthenticated attackers to include arbitrary local PHP files, potentially leading to information disclosure or remote code execution. Exploitation is complex and requires the ability to place PHP code in a file accessible by the server. No known public exploit or active exploitation has been identified at this time, and EPSS estimates a low probability of exploitation.
Local file inclusion in the SmilePure WordPress theme before version 1.8.5 allows unauthenticated remote attackers to read arbitrary files on the server, leading to sensitive information disclosure such as database credentials. Exploitation requires high complexity and no exploit code or active attacks have been observed.
We are tasked with producing a comprehensive JSON analysis. The input provides CVE ID, description, CVSS vector, CWE, and some multi-source intel: EPSS score (0.07%, percentile 22%), tags "Path Traversal", and a reference to Patchstack. There is no KEV listing, no explicit POC availability, no patch version stated beyond "through <= 3.3.5", meaning affected versions up to 3.3.5. The reference URL is a Patchstack advisory. Let's read the URL content? Not provided directly but the advisory likely describes the vulnerability. Since we only have the description, we need to synthesize using all data: CVE description, CVSS vector, EPSS, tags, reference. There is no CPE string, but the product is "Workreap (theme's plugin) workreap" from AmentoTech. It is a WordPress theme plugin. The CVSS vector: AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H. So attack vector Network, low complexity, privileges required Low, no user interaction, scope changed, confidentiality none, integrity none, availability high. That suggests a path traversal leading to availability impact (file deletion maybe? The Patchstack URL says "arbitrary-file-deletion-vulnerability", confirming impact: arbitrary file deletion via path traversal. The CWE-22 path traversal. Now, we need to produce fields. Let's start. product_name: "Workreap" (1-3 words, the specific product name). So "Workreap" is the theme's plugin. Could be "Workreap plugin" but only 1-3 words, so "Workreap". If "Workreap (theme's plugin)" that's more than 3 words, but "Workreap" alone is fine. summary: synthesize: Path traversal vulnerability in Workreap plugin for WordPress (theme's plugin) through version 3.3.5 allows authenticated attackers (PR:L) to delete arbitrary files on the server, causing denial of service (A:H). No confidentiality or integrity impact, but high availability impact. EPSS 0.07% indicates low exploit likelihood. No KEV listing. Not mention of active exploitation. So: "Authenticated attackers can exploit a path traversal vulnerability in Workreap plugin versions <= 3.3.5 to delete arbitrary files, resulting in denial of service. The vulnerability has a CVSS 3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H), indicating network-based low-complexity attack with no user interaction beyond authentication. EPSS score of 0.07% suggests low probability of exploitation in the wild, and no evidence of active exploitation is available." That's a good summary. technical_context: Mention underlying technology: WordPress plugin, path traversal due to improper sanitization of user-supplied input in file operations. CWE-22. Product Workreap by AmentoTech, a theme plugin. CPE data not provided, but we can infer CPES: likely cpe:2.3:a:amentotech:workreap:... The reference Patchstack advisory shows the plugin slug "workreap". The vulnerability leads to arbitrary file deletion. The affected product is the Workreap plugin. So technical_context: "The Workreap plugin is a WordPress theme companion plugin that likely handles file uploads or paths, where insufficient sanitization allows a path traversal attack (CWE-22). An attacker with low-privilege user access can manipulate file paths to traverse directories, potentially deleting files outside the intended directory. The CVSS vector confirms network attack vector, low attack complexity, and no user interaction required after authentication." risk_assessment: Use CVSS vector: Network, low complexity, low privileges, no UI, scope changed, no CIA except A:H. So a low-privileged (e.g., subscriber) user can cause denial of service by deleting files. EPSS 0.07% (low probability). No KEV, no POC mentioned. SSVC decision might be: exploitation none, automatable yes (network, low complexity), technical impact partial (availability only), so priority might be lower. So risk is moderate: high CVSS but low EPSS suggests while the impact is serious, exploitation is not widespread or likely. "Risk is moderate: CVSS 7.7 indicates a critical availability impact, but the EPSS score of 0.07% (22nd percentile) suggests very low probability of real-world exploitation. No active exploitation or publicly available exploit code is reported. The attack requires authenticated access (low privileges), which reduces the attack surface slightly. However, the low complexity and network vector make it automatable once authenticated." affected_products: "Workreap plugin for WordPress versions n/a through 3.3.5. The vendor is AmentoTech. For details, see Patchstack advisory: https://patchstack.com/database/Wordpress/Plugin/workreap/vulnerability/wordpress-workreap-theme-s-plugin-plugin-3-3-5-arbitrary-file-deletion-vulnerability?_s_id=cve" That's concise. remediation: There's no patch information in input other than "through <= 3.3.5", implying that versions up to 3.3.5 are affected. Typically, a fix would be in a later version, but the advisory might not specify. The Patchstack URL might have remediation. Since we don't have the content, we must rely on the description: "through <=3.3.5" so fix likely in version after 3.3.5. We should state: "Upgrade Workreap plugin to a patched version later than 3.3.5. If no update is available, consider disabling the plugin or restricting file access permissions on the server to limit impact. Monitor the vendor’s release page and Patchstack advisory for updates." However, we can't confirm a specific version. So: "No patched version is specified in the available data; however, versions up to 3.3.5 are affected. Immediately update to a version newer than 3.3.5 when released, or disable the plugin until a fix is available. As a compensating control, restrict the web server process's write permissions to critical directories, though this may affect plugin functionality. Refer to the Patchstack advisory for official remediation." exploit_scenario: "An authenticated user, such as a subscriber, sends a malicious request with a crafted file path parameter to a vulnerable endpoint in the Workreap plugin, leveraging path traversal sequences (e.g., "../") to specify a target file outside the intended directory. The application processes the path without proper sanitization, resulting in deletion of that file and causing service disruption." That's realistic. No POC noted, so no mention. exploitation_conditions: Need to extract specific conditions from description. The description says: "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AmentoTech Workreap (theme's plugin) workreap allows Path Traversal." So the vulnerability exists when the plugin processes file paths (likely during file deletion operations). The CVSS says PR:L, so attacker must have low privileges (authenticated as subscriber or similar). No user interaction. So conditions: "The attacker must have a low-privilege user account on the WordPress site (authenticated). The Workreap plugin must be active and the vulnerable endpoint accessible. No special feature needs to be enabled beyond the plugin's normal operation. Exploitation does not require user interaction." That's it. attack_chain: We'll craft a chain: "Authenticate to WordPress as low-privilege user → Craft malicious request with path traversal payload targeting sensitive file → Send request to vulnerable Workreap endpoint → Plugin processes path without sanitization → File at traversed path is deleted → Service disruption (denial of service due to missing critical file)." confidence_notes: "Exploitation conditions derived from CVSS vector (PR:L) and Patchstack advisory. No public exploit availability confirmed. No CISA KEV listing. EPSS suggests low exploitation likelihood. Patch availability not specified in the input; update guidance inferred from affected version range." prevalence: "medium" - Workreap is a WordPress theme plugin, probably used by some websites but not as ubiquitous as core plugins. Could be low? But I'd estimate medium: WordPress plugin usage is common, but it's a theme-specific plugin, not a general-purpose plugin. So "low" might be more accurate. However, we need to be real: theme companion plugins can have decent install base. But without stats, I'd say "medium" is safe. Prevalence basis: "WordPress theme companion plugin used with Workreap theme". So "medium" because it's not a top plugin but tied to a commercial theme. I'll put prevalence "low"? Let's see input: no install numbers. I'll gauge: "AmentoTech Workreap" theme's plugin. ThemeForest maybe. I'll check: "workreap" theme on ThemeForest has ~3,000 sales? That might be low. So prevalence "low". Prevalence basis: "commercial WordPress theme plugin with limited install base". So prevalence: "low". If unknown, we could say unknown, but we can estimate. I'll go with "low". Prevalence basis: "specialized commercial theme companion plugin, not widely deployed". assessed_cvss_vector: My own independent CVSS. The given vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H. I need to output my own assessment. It seems accurate: network attack vector, low complexity, privileges low, no user interaction, scope changed because the vulnerable component is the plugin and the impact is on the file system? Actually, scope changed because the vulnerable component (plugin) impacts a resource outside its scope (other files on server). S:C is appropriate. Impact: confidentiality none (C:N), integrity none (I:N), availability high (A:H). So I'd output the same vector. Rationale: "Authenticated low-privilege user can delete arbitrary files, causing availability impact; no confidentiality or integrity loss." So vector: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H". For CVSS 4.0: I need to map. CVSS 4.0 base vector: AV:N, AC:L, AT:N (no attack requirement specified), PR:L, UI:N, VC:N, VI:N, VA:H (vulnerable system availability high), SC:N, SI:N, SA:N (subsequent system? The scope changed in 3.1 is handled differently in 4.0. In CVSS 4.0, if there is a scope change, the impact to the subsequent system (the one whose security relies on the vulnerable component) is denoted by SC, SI, SA. The vulnerable system itself is the plugin component, which has VC, VI, VA. Since the vulnerability only deletes files (affect the system's availability), VA:H. The subsequent system (the filesystem) is the same host, but the scope is changed: the vulnerable component is the plugin and the impact is on the server files. In CVSS 4.0, scope is not explicitly captured the same way; instead, we have vulnerable system metrics and subsequent system metrics. The attacker's action affects the vulnerable component with VA:H (availability of the plugin? Actually, the file deletion impacts the server's availability, not the plugin's availability. But CVSS 4.0 definition: "Vulnerable System metrics refer to the system that contains the vulnerable component and is most directly impacted by the vulnerability." The plugin is the vulnerable component, and the system hosting it is the vulnerable system. The availability impact on that system is high (server files deleted, causing DoS). So VC:N, VI:N, VA:H. No subsequent system impact because the vulnerability directly affects the vulnerable system. So SC, SI, SA are N. So CVSS 4.0 vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N. That seems right. The 3.1 scope change translates to a CVSS 4.0 situation where the vulnerable system is the server (the component is the plugin), and there is no subsequent system. Actually, in 3.1 scope changed because the component (plugin) is separate from the impacted resource (files). In 4.0, that's captured by the fact that the vulnerable system is the server, and the vulnerability impacts the server's availability. So no subsequent system. So vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N. Good. assessed_cvss_rationale: "Authenticated low-privileged network attack requires no user interaction, targeting file deletion causing high availability impact, no confidentiality or integrity loss." assessed_cvss40_vector: as above. Now, all fields must be plain text
Arbitrary file deletion in the Taskbot WordPress plugin through version 6.4 allows authenticated low-privilege users to delete critical files via path traversal, leading to denial of service. No active exploitation or public exploit is reported; EPSS score is low (0.07%).
Arbitrary file deletion in PT Luxa Addons WordPress plugin versions ≤1.2.2 allows authenticated attackers with low privileges (e.g., subscriber) to delete arbitrary files on the server via path traversal, leading to denial of service. The vulnerability is remotely exploitable but requires an authenticated account; no public exploit or active exploitation has been observed at this time, and EPSS indicates a very low exploitation probability (0.06%).
SQL injection in the WooCommerce Advanced Coupons plugin (<= 4.6.8) allows authenticated attackers with administrator privileges to execute arbitrary SQL queries, potentially extracting sensitive data from the database. Exploitation requires high-level access rights, and no active exploitation or public exploit has been reported. EPSS score is very low (0.03%), indicating low probability of widespread exploitation.
Local file inclusion in Crocoblock JetReviews plugin versions through 3.0.0 allows authenticated attackers with low-level privileges to read arbitrary files on the WordPress server via PHP file inclusion flaws. With EPSS at 0.13% (33rd percentile), exploitation likelihood is currently low. No active exploitation confirmed (not in CISA KEV), but Patchstack has cataloged the vulnerability indicating professional security research attention. Attackers can access sensitive configuration files, credentials, and potentially chain with other vulnerabilities for code execution.
Local file inclusion in the WoodMart WordPress theme before version 8.3.2 allows authenticated low-privilege users (e.g., subscribers) to include arbitrary PHP files on the server, potentially leading to remote code execution, information disclosure, or complete site compromise. Exploitation requires only low-level access but is of high complexity (CVSS 7.5, EPSS 0.13%), and no public exploit or active exploitation has been observed at the time of analysis.
Unauthenticated information disclosure in the VibeThemes WPLMS WordPress plugin (≤1.9.9.7) allows remote attackers to access restricted functionality and read sensitive data without any interaction or privileges. The vulnerability stems from a missing authorization check, making exploitation trivial, though EPSS indicates a low probability of real-world exploitation at this time.
Local file inclusion in WP Abstracts (wp-abstracts-manuscripts-manager) plugin for WordPress versions ≤ 2.7.4 allows unauthenticated attackers to read arbitrary local files. Exploitation requires user interaction and high attack complexity, potentially leading to full server compromise. The EPSS probability is very low (0.05%), and no active exploitation or public exploit code is currently known.
High integrity impact vulnerability in WordPress Tablesome Table Premium plugin versions <= 1.1.23 allows unauthenticated attackers to modify plugin functionality due to missing authorization checks. An attacker can access features not properly constrained by ACLs, potentially altering table configurations or data. No active exploitation or public exploit code is reported, but the flaw is remotely exploitable with low complexity.
Unauthenticated access to sensitive data in BuddyPress up to version 14.3.4 allows remote attackers to read confidential information due to a missing authorization check. This vulnerability affects the popular WordPress social networking plugin and can be exploited without user interaction. Public exploit code is not known to exist, and EPSS indicates a very low probability (0.04%) of active exploitation.
Code injection in WP Last Modified Info plugin versions ≤1.9.4 allows authenticated attackers with low-level privileges to execute arbitrary code remotely via vulnerable code generation controls. The CVSS 7.4 rating reflects network accessibility, low attack complexity, and scope change enabling cross-boundary impact. EPSS probability is minimal (0.05%, 15th percentile), no active exploitation confirmed (not in CISA KEV), and no public exploit code identified at time of analysis, suggesting limited real-world exploitation activity despite the critical vulnerability class.
Remote code injection in the Kalium WordPress theme (versions ≤ 3.25) allows unauthenticated attackers to execute arbitrary PHP code on the server. The vulnerability has a CVSS 3.1 base score of 7.2 (High) with low confidentiality and integrity impact and no availability impact. No active exploitation has been reported to date, and the EPSS score (0.09%) indicates a low probability of widespread exploitation.
Privilege escalation in Dokan (WordPress multi-vendor marketplace plugin) versions up to 4.1.3 allows high-privileged users to elevate their permissions beyond intended role boundaries. Reported by Patchstack audit team with EPSS exploitation probability of 0.08% (24th percentile), indicating low real-world exploitation likelihood. No confirmed active exploitation (not in CISA KEV) or public proof-of-concept identified at time of analysis.
Missing authorization in the Billingo WordPress plugin (versions ≤4.3.0) enables authenticated high-privilege users to escalate privileges through unprotected API endpoints. CVSS 7.2 indicates network-accessible exploitation requiring high-privilege authentication with high impact across confidentiality, integrity, and availability. EPSS score of 0.06% (18th percentile) suggests low observed exploitation probability. No CISA KEV listing or public exploit identified at time of analysis, though Patchstack vulnerability database confirms the vulnerability class as both authentication bypass and privilege escalation.
Privilege escalation in the WooCommerce Wholesale Suite (woocommerce-wholesale-prices) plugin for WordPress through version 2.2.4.2 allows an already-authenticated user to gain privileges beyond what they were assigned. Rated CVSS 7.2 (high) with a network vector but requiring high privileges, the flaw stems from incorrect privilege assignment (CWE-266) and can lead to full compromise of the affected store's confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.05%, 16th percentile), indicating limited near-term mass-exploitation likelihood.
Reflected cross-site scripting (XSS) in the Contact Form by Supsystic WordPress plugin (versions through 1.7.36) allows unauthenticated remote attackers to execute malicious JavaScript in victims' browsers via crafted URLs. The vulnerability enables session hijacking, credential theft, and malicious actions performed in the context of the victim's authenticated session. EPSS probability indicates low exploitation likelihood (0.07%, 22nd percentile) with no public exploit identified at time of analysis.
Reflected Cross-Site Scripting (XSS) in WordPress plugin oik-privacy-policy versions ≤1.4.10 allows remote attackers to execute arbitrary JavaScript in victims' browsers. Exploitation requires user interaction (victim must click malicious link). EPSS probability is low (0.07%, 22nd percentile), and no active exploitation is confirmed. Reported by Patchstack security audit team, indicating professional vulnerability disclosure.
Reflected cross-site scripting (XSS) in Crocoblock JetSearch WordPress plugin versions through 3.5.10 allows unauthenticated remote attackers to execute arbitrary JavaScript in victim browsers via maliciously crafted URLs. The vulnerability requires user interaction (clicking a malicious link) but carries a changed scope, meaning successful exploitation can impact resources beyond the vulnerable component. EPSS probability is low (0.07%, 22nd percentile), indicating minimal observed exploitation attempts, and no public exploit code or CISA KEV listing exists at time of analysis.
Reflected cross-site scripting in the WordPress Likert Survey Master plugin allows unauthenticated attackers to inject arbitrary web scripts via a crafted URL. Successful exploitation requires tricking an administrator into clicking the link while authenticated, potentially leading to session hijacking or malicious actions performed in the victim's browser context. No active exploitation or public exploit code has been identified, and the EPSS score indicates very low exploit likelihood (0.07%).
Reflected cross-site scripting in the MultiSite Clone Duplicator WordPress plugin through version 1.5.3 allows attackers to execute arbitrary JavaScript in victims' browsers when they click a crafted link. Successful exploitation could lead to session hijacking, data theft, or unauthorized actions on behalf of the user. No active exploitation or public exploits are known, and EPSS predicts very low exploitation likelihood (0.06%).
Stored cross-site scripting in the Toast Mobile Menu WordPress plugin (<=1.0.8) allows unauthenticated attackers to inject malicious scripts that execute when a user views an infected page, potentially leading to session hijacking or content manipulation. No active exploitation or public proof-of-concept is confirmed at time of analysis, and the EPSS score indicates a low probability of real-world attacks.
Reflected cross-site scripting in NextMove Lite (WordPress thank-you page plugin) versions ≤2.24.0 allows unauthenticated remote attackers to execute malicious JavaScript in victim browsers via crafted URLs. The vulnerability requires user interaction (clicking a malicious link) but achieves scope change per CVSS vector, enabling session hijacking, credential theft, or malicious actions under victim's WordPress session. EPSS score of 0.03% (8th percentile) indicates low probability of mass exploitation, though XSS vulnerabilities are commonly used in targeted social engineering campaigns against WordPress site administrators.
Reflected cross-site scripting in the CropRefine WordPress plugin (<= 1.2.1) allows unauthenticated attackers to inject arbitrary web scripts by tricking a user into clicking a crafted link. The vulnerability, reported by Patchstack, has a CVSS 7.1 high severity but a very low EPSS exploitation probability (0.03%), and no active exploitation or public exploit code has been identified.
Reflected cross-site scripting in bbPress Notify plugin versions up to 2.19.5 allows unauthenticated remote attackers to execute malicious JavaScript in victim browsers through crafted URLs. The vulnerability stems from improper input sanitization during web page generation (CWE-79). With CVSS 7.1 and changed scope (S:C), successful exploitation enables session hijacking, credential theft, and malicious actions in the victim's context. EPSS score of 0.03% (8th percentile) indicates low observed exploitation probability, and no active exploitation is confirmed (not in CISA KEV), though Patchstack has publicly documented the vulnerability.
Reflected cross-site scripting in Robokassa payment gateway for WooCommerce (versions ≤1.8.5) allows remote attackers to execute malicious JavaScript in victim browsers through specially crafted URLs. The scope-change CVSS flag indicates attackers can impact resources beyond the vulnerable plugin itself, potentially compromising WooCommerce admin sessions or customer payment data. EPSS probability is low (0.03%, 8th percentile), and no active exploitation or public POC has been identified at time of analysis.
Reflected cross-site scripting in the Easy WooCommerce Customizer WordPress plugin (versions up to and including 1.0.2) allows unauthenticated remote attackers to inject arbitrary JavaScript into a victim's browser session by tricking them into clicking a crafted URL. The vulnerability carries a changed scope (S:C), meaning injected script runs in the victim's browser context and can access cookies, session tokens, or perform actions on behalf of the authenticated user. No public exploit code has been identified and EPSS probability is minimal at 0.03%, indicating very low current real-world exploitation activity.
Reflected XSS in the NEX-Forms LITE WordPress plugin (all versions prior to 8.2) allows unauthenticated remote attackers to inject and execute malicious JavaScript in a victim's browser by luring them to a crafted URL. The script runs in the browser's page context with scope change, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit code or active exploitation has been identified; the EPSS score of 0.03% at the 8th percentile reflects negligible current exploitation activity.
Reflected cross-site scripting in WP Tactical Popup plugin for WordPress (≤1.1) allows unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser via a crafted URL. Exploitation requires user interaction (clicking a malicious link), potentially leading to session hijacking or content manipulation. No active exploitation or public exploit has been identified at this time.