Reflected Cross-Site Scripting (XSS) in the Munzir myshouts-shoutbox WordPress plugin (versions ≤ 0.9) allows unauthenticated attackers to inject and execute arbitrary web scripts in a victim’s browser by tricking them into clicking a crafted link. The vulnerability arises from improper neutralization of user input during web page generation, enabling script execution in the context of the affected site. No active exploitation or public exploit code has been identified, and EPSS indicates a low probability of real-world exploitation (0.03%).
Cross-Site Request Forgery in SUMO Memberships for WooCommerce plugin prior to version 7.8.0 allows remote attackers to trick authenticated administrators into performing unintended actions, such as modifying membership settings or user roles, with limited impact on confidentiality, integrity, and availability. The vulnerability has a CVSS score of 7.1 but a very low EPSS exploitation probability (0.02%). No active exploitation is reported, and no public exploit code is known.
Stored Cross-Site Scripting (XSS) can be injected into WordPress sites running the Video Blogster Lite plugin up to version 1.2 via a Cross-Site Request Forgery (CSRF) attack. An unauthenticated attacker can trick an authenticated administrator into clicking a crafted link, leading to persistent JavaScript execution in the browsers of site visitors. There is no evidence of active exploitation or public exploit code at this time, and the EPSS model predicts a very low probability of widespread use.
Reflected cross-site scripting in Email Attachment by Order Status & Products WordPress plugin versions ≤1.0.1 allows remote unauthenticated attackers to execute arbitrary JavaScript in victim browsers through low-complexity attacks requiring user interaction. The vulnerability enables cross-site scope impact (S:C), allowing attackers to compromise confidentiality, integrity, and availability at a low level across security boundaries. No active exploitation or public POC is confirmed at time of analysis, with EPSS data unavailable for this recently published CVE.
Stored cross-site scripting (XSS) in Crocoblock JetElements For Elementor plugin through version 2.7.8 allows authenticated users with low privileges to inject malicious scripts that execute in the browsers of site visitors, potentially compromising site integrity and user sessions. The vulnerability requires user interaction (UI:R) and affects authenticated users (PR:L), limiting immediate blast radius but posing persistent risk to WordPress installations using this Elementor extension.
Stored XSS in Crocoblock JetEngine WordPress plugin versions 3.7.3 and earlier allows authenticated users with limited privileges to inject malicious scripts that execute in the browsers of other users, including administrators. The vulnerability requires user interaction (UI:R) to trigger and affects confidentiality, integrity, and availability with limited scope. With EPSS at 0.07% and no KEV status indicating active exploitation, this represents a low-probability but real risk requiring patching in multi-user WordPress environments.
Reflected cross-site scripting (XSS) in Crocoblock JetBlog WordPress plugin through version 2.4.4 allows authenticated users to inject malicious scripts that execute in other users' browsers when they interact with crafted links. The vulnerability requires user interaction (UI:R) and authenticated access (PR:L), limiting but not eliminating real-world risk; EPSS score of 0.07% indicates low exploitation probability despite the moderate CVSS 6.5 rating.
Stored Cross-Site Scripting (XSS) in Crocoblock JetBlog WordPress plugin through version 2.4.4.1 allows authenticated users with low privileges to inject malicious scripts that persist in web pages and execute in the browsers of other site visitors, potentially compromising session tokens, stealing sensitive data, or performing unauthorized actions. EPSS score of 0.07% and lack of public exploit code indicate low real-world exploitation probability despite the moderate CVSS 6.5 score.
DOM-based cross-site scripting (XSS) in Crocoblock JetWooBuilder plugin through version 2.1.20 allows authenticated users with low privileges to inject malicious scripts that execute in other users' browsers when they interact with affected pages. The vulnerability requires user interaction (UI:R per CVSS) and affects the plugin's web page generation functions. No public exploit code or active exploitation has been confirmed, though the issue carries a moderate CVSS score of 6.5 and low EPSS probability (0.07%, 22nd percentile) suggesting limited real-world attack incentive despite the authentication requirement being relatively low-barrier for WordPress environments.
Stored XSS vulnerability in Crocoblock JetWooBuilder WordPress plugin versions up to 2.1.20.1 allows authenticated users with low privileges to inject malicious scripts that execute in the browsers of other users viewing affected pages, potentially leading to session hijacking, credential theft, or defacement. The vulnerability requires user interaction (UI:R) from victims and affects the confidentiality, integrity, and availability of website content. No public exploit code or active exploitation has been confirmed at time of analysis.
Stored cross-site scripting (XSS) in Crocoblock JetBlocks For Elementor plugin versions up to 1.3.18 allows authenticated users with low privileges to inject malicious scripts that execute in the browsers of other site visitors. The vulnerability requires user interaction (UI:R) and affects confidentiality and integrity, with an EPSS score of 0.06% indicating very low real-world exploitation likelihood despite the moderate CVSS 5.4 rating.
Authorization bypass in Houzez WordPress theme versions up to 4.2.5 allows authenticated users to access or modify resources they should not have permission to reach through insecure direct object reference (IDOR) vulnerabilities. An authenticated attacker with low privileges can exploit inadequately configured access controls to view or modify data belonging to other users, achieving limited information disclosure and integrity compromise. The vulnerability is not confirmed as actively exploited, though the attack vector is network-based with low complexity.
Information disclosure in PickPlugins Accordion WordPress plugin up to version 2.3.14 allows authenticated low-privileged users to access confidential data via missing authorization checks. The vulnerability has a CVSS 6.5 and a low EPSS score of 0.05%, indicating no active exploitation or public exploit at this time.
Missing authorization in the Breeze Checkout WordPress plugin (versions through 1.4.0) exposes restricted functionality to unauthenticated network attackers, enabling low-impact integrity and availability manipulation. The vulnerability stems from CWE-862 (Missing Authorization), where plugin endpoints fail to verify that the requesting party holds appropriate permissions before executing privileged operations. No public exploit code has been identified and EPSS probability sits at 0.05% (15th percentile), indicating low current exploitation activity despite the ease of network access implied by the CVSS vector.
Unauthorized order data export in WooCommerce Orders & Customers Exporter plugin <= 5.4 allows authenticated, low-privileged WordPress users to download sensitive customer and order information without needing administrative permissions. The vulnerability has a medium CVSS 6.5 score and an extremely low EPSS probability (0.04%), and no active exploitation or public exploit is reported.
Missing authorization in the Wikipedia Preview WordPress plugin (≤1.15.0) allows unauthenticated attackers to perform actions that should require authentication, leading to limited integrity and availability impact. Exploitation requires no user interaction and has low attack complexity, but no public exploit or active exploitation is reported, and the EPSS score is very low (0.04%). The flaw enables attackers to modify or disrupt plugin functionality without being authenticated.
Unauthenticated access in the Custom CSS plugin for WordPress up to version 1.4.0 allows attackers to inject arbitrary CSS or cause service disruption due to a missing authorization check. The affected component is the custom-css-editor, which can be triggered remotely without authentication, resulting in partial integrity and availability impact. No active exploitation or public proof-of-concept is known, and the EPSS score of 0.04% indicates low likelihood of widespread attacks.
Unauthenticated attackers can bypass access controls in SUMO Memberships for WooCommerce versions below 7.8.0 to perform unauthorized actions including content modification and deletion through incorrectly configured membership level enforcement. The vulnerability requires user interaction (UI:R) but affects confidentiality, integrity, and availability of protected content. No public exploit code or active exploitation has been confirmed.
Stored cross-site scripting in Cinza Grid WordPress plugin versions up to 1.2.1 allows authenticated contributors and above to inject arbitrary JavaScript into pages via the 'cgrid_skin_content' post meta field, which executes when other users view the affected pages. The vulnerability stems from missing input sanitization and output escaping in backend processing functions. CVSS 6.4 reflects moderate impact with network-accessible attack surface, though exploitation requires valid WordPress contributor-level credentials.
Stored Cross-Site Scripting in WP-Force Images Download WordPress plugin versions up to 1.8 allows authenticated contributors and above to inject arbitrary JavaScript via the 'class' attribute of the 'wpfid' shortcode due to insufficient input sanitization and output escaping. The vulnerability executes malicious scripts in the browser of any user viewing an affected page, potentially enabling account compromise, malware distribution, or defacement with CVSS 6.4 (medium severity). No public exploit code or confirmed active exploitation has been identified at time of analysis.
Missing authorization in Hydra Booking plugin versions <=1.1.9 allows authenticated low-privilege users to bypass access controls and perform unauthorized actions on booking data. An attacker could view, modify, or disrupt limited booking information, with no indication of active exploitation or publicly available exploit code.
Stored cross-site scripting in the Doctreat WordPress Theme through version 1.6.7 allows authenticated attackers to inject HTML and script code, enabling client-side code injection in visitors' browsers. Exploitation requires a contributor-level WordPress account but no user interaction from the victim. No public exploit code or active exploitation has been reported; EPSS indicates a very low likelihood of widespread attacks.
Stored cross-site scripting in the Werk aan de Muur WordPress plugin (≤1.5) allows authenticated users with high privileges to inject malicious scripts that execute in other administrators’ browser contexts, potentially leading to session hijacking or content manipulation. No public exploit code found; not listed in CISA KEV or reported as actively exploited. EPSS score indicates very low exploitation probability.
Stored cross-site scripting vulnerability in the Colibri Page Builder WordPress plugin allows authenticated editors or administrators to inject malicious scripts into pages. When other users view the affected page, the script executes, potentially leading to limited data theft, defacement, or session hijacking. Exploitation requires high privileges and user interaction; no active exploitation or public exploit code is known, and EPSS predicts a very low exploitation probability (0.02%).
DOM-based XSS in the Seriously Simple Podcasting WordPress plugin (versions through 3.11.1) enables a high-privileged attacker to inject malicious client-side scripts that execute in the browsers of visitors who subsequently view the affected podcast content. The CVSS vector (PR:H, UI:R) confirms this requires both admin-level WordPress access to introduce the payload and a victim's page interaction to trigger execution. With an EPSS of 0.02% (7th percentile), no CISA KEV listing, and no public exploit identified, real-world risk is low despite the network-accessible attack vector.
Sensitive data exposure in ThemeRuby Easy Post Submission plugin for WordPress (<=1.7.0) allows authenticated administrators to retrieve embedded sensitive information from outbound data transmissions. The flaw leverages CWE-201 to leak low-impact confidentiality, integrity, and availability with high attack complexity and changed scope. No active exploitation or public exploit exists; EPSS probability is very low (0.04%).
Server-Side Request Forgery in the Captcha.eu WordPress plugin (versions ≤ 1.0.61) allows unauthenticated remote attackers to make the server issue requests to internal or external services. This can lead to information disclosure or limited interaction with other systems, though high attack complexity reduces exploitability. No active exploitation or public exploit code is known, and EPSS indicates a very low probability of real-world attacks.
Missing authorization in the SmartCrawl SEO plugin for WordPress allows authenticated attackers with low privileges to modify plugin settings and potentially cause limited service disruption. Versions up to 3.14.3 are affected, requiring no user interaction and having a low CVSS score (5.4) and very low exploitation probability (EPSS 0.03%). No evidence of active exploitation or public exploit code exists at time of analysis.
Missing authorization in WP SMS plugin for WordPress up to 7.0.1 allows authenticated attackers to modify SMS settings and message content. This could alter notification behavior or enable limited service disruption, but the impact is moderate and requires low-privilege authentication. No active exploitation or public exploit code has been reported, and EPSS indicates very low exploitation probability.
The accessiBe WordPress plugin through version 2.10 fails to enforce proper authorization checks, allowing authenticated attackers with low privileges to modify restricted plugin settings and affect availability without authorization. This missing authorization vulnerability (CWE-862) can be exploited over the network with low attack complexity, leading to limited integrity and availability impacts (no confidentiality impact). No active exploitation or public exploit code has been identified at this time.
FreeBSD kernel fails to properly validate socket connection state when adding sockets to SO_REUSEPORT_LB load-balancing groups, allowing connected sockets to receive packets from arbitrary hosts instead of only from their connected peer. This breaks the fundamental contract of the connect(2) system call and sendto(2), creating a spoofing vulnerability where applications believe they are receiving authenticated peer traffic but may actually receive unsolicited packets from any host. The vulnerability affects remote attackers with user-level privileges on systems running vulnerable FreeBSD versions.
Missing authorization in the Templazee WordPress plugin (versions through 1.0.2) permits authenticated low-privileged users to invoke restricted plugin functionality by exploiting improperly enforced access control boundaries. The CVSS PR:L metric confirms that a valid WordPress account with minimal privileges - such as a subscriber - is sufficient to trigger the flaw over the network with no additional interaction required. No public exploit code is identified at time of analysis, and an EPSS score of 0.01% (1st percentile) signals extremely low observed exploitation probability.
Unauthorized functionality modification in DELUCKS SEO WordPress plugin versions 2.5.9 and below allows unauthenticated attackers to alter plugin data due to missing access controls. No active exploitation or public exploit code has been identified, and EPSS indicates a low exploitation probability despite the network‑accessible attack vector.
Unauthenticated, remote integrity impact in the CoSchedule WordPress plugin through version 3.4.0 stems from a missing authorization check. Attackers can modify plugin data without user interaction, but the low EPSS score of 0.04% and absence of known exploitation or public proof-of-concept limit real-world urgency. CVSS rates it 5.3, reflecting the low integrity-only impact.
Unauthenticated attackers can access functionality in WPComplete versions up to 2.9.5.3 that is not properly constrained by access controls, resulting in a low availability impact. The vulnerability (CWE-862) has a CVSS 5.3 score and an EPSS exploitation probability of only 0.04%, indicating low real-world risk.
Unauthenticated integrity modification in ZoloBlocks WordPress plugin up to 2.3.11 due to missing authorization checks. The vulnerability enables remote attackers to perform unauthorized changes with low integrity impact, with no confidentiality or availability impact. EPSS score is low (0.04%), indicating a very low probability of widespread exploitation.
The Whydonate WordPress plugin through version 4.0.15 lacks proper authorization checks, enabling unauthenticated attackers to remotely access restricted functionality. This can lead to service disruption or resource exhaustion, with no data exposure or system compromise. No active exploitation is reported, but the public advisory confirms the flaw.
Information disclosure in the MasterStudy LMS WordPress plugin up to version 3.6.20 allows high-privilege authenticated admins to retrieve embedded sensitive data. With a CVSS score of 4.9 and EPSS probability of 0.04%, no active exploitation or public exploit is known. The vulnerability requires administrative access, limiting real-world risk.
SQL injection in Email Tracker plugin for WordPress (versions up to 5.3.15) allows authenticated administrators to extract sensitive database information via the 'orderby' parameter due to insufficient escaping and query preparation. CVSS 4.9 reflects high confidentiality impact but requires high-privilege authenticated access; no public exploit code or active exploitation confirmed at analysis time.
Insufficient authorization checks in the WPeMatico RSS Feed Fetcher WordPress plugin (versions ≤2.8.3) allow authenticated attackers with low privileges (e.g., Subscriber) to modify plugin configurations without proper access control. No active exploitation or public exploit code has been reported; the EPSS probability is very low (0.05%).
Unauthorized data modification in Sovlix MeetingHub WordPress plugin through version 1.23.9 lets authenticated low-privilege attackers bypass authorization checks and alter meeting information. No active exploitation or public exploit is known; EPSS probability is 0.03%.
Missing authorization in the Front End Users WordPress plugin (≤3.2.33) allows authenticated attackers with low privileges to modify user data without proper access controls. The flaw stems from insufficient capability checks for certain actions, enabling unauthorized integrity impact with no confidentiality or availability loss. The vulnerability has a low EPSS score and no evidence of active exploitation or public exploits.
Missing authorization checks in the Repuso Social Proof Testimonials and Reviews widget for WordPress (<=5.29) allow authenticated attackers with low privileges to disrupt service availability. Exploitation probability is very low (EPSS 0.03%) and no active exploitation or public exploit code is known at this time.
Missing authorization checks in WPXPO WowRevenue 1.2.13 and earlier allow authenticated attackers with minimal privileges to modify plugin settings without proper capability checks, leading to limited integrity impact. This affects WordPress sites running the plugin and can be exploited remotely without user interaction.
An authenticated low-privilege user in WordPress with the One Page Express Companion plugin (versions ≤ 1.6.43) can exploit a missing authorization check to modify certain plugin data, leading to limited integrity impact. There is no known public exploit or active exploitation at this time.
Missing authorization in the Acknowledgify WordPress plugin (≤1.1.3) allows low-privilege authenticated users to modify plugin data without proper capability checks. The vulnerability, classified as CWE-862, carries a CVSS 3.1 base score of 4.3 (Medium) with low attack complexity and no user interaction. No public exploit or active exploitation has been reported, and EPSS assesses a 0.03% probability of exploitation.
WordPress UiChemy plugin up to 4.0.0 allows authenticated users with low privileges to modify plugin settings due to a missing authorization check. This could lead to unauthorized changes to plugin configuration. No active exploitation or public exploit code is known, and EPSS indicates a very low probability of exploitation.
Broken access control in the Smash Balloon Social Post Feed WordPress plugin (versions up to and including 4.3.2) allows authenticated users with low privileges to perform unauthorized modifications of social feed data or settings due to missing authorization checks. No active exploitation or public exploit has been identified at this time, and EPSS indicates very low exploitation probability.
Missing authorization in the MDTF (WordPress Meta Data & Taxonomy Filter) plugin up to version 1.3.3.9 allows authenticated low-privileged users to bypass intended access controls. An attacker with a subscriber-level account could exploit this flaw to cause a limited availability impact, such as disrupting the plugin's functionality. The flaw is rated Medium severity with an EPSS score of 0.03%, indicating a low probability of large-scale exploitation.
Cross-Site Request Forgery in the WP Media Categories plugin for WordPress allows unauthenticated attackers to trick a logged-in administrator into making unauthorized requests, potentially altering media category settings. The vulnerability affects versions up to 2.1.0 and has a low integrity impact with no confidentiality or availability loss. No evidence of active exploitation or public exploit code exists, and the EPSS probability is extremely low (0.02%).