Stored cross-site scripting in Photospace Responsive WordPress plugin versions up to 2.2.0 allows authenticated administrators to inject malicious scripts that execute in the context of other users' sessions. The vulnerability, assigned CVE-2025-62899, can lead to limited compromise of confidentiality, integrity, and availability. With a very low EPSS score (0.02%) and no exploit code publicly available, current exploitation likelihood is minimal.
Missing authorization checks in the Admin Management Xtended WordPress plugin (versions through 2.5.1) allow authenticated users to exploit incorrectly configured access control levels, performing administrative operations beyond their assigned role boundary. The CVSS scope change component (S:C) signals the vulnerability's impact crosses the exploiting user's permission boundary within the WordPress installation, enabling privilege escalation within the CMS. No public exploit code has been identified at time of analysis, and the EPSS score of 0.05% (16th percentile) indicates very low real-world exploitation probability currently.
SQL injection in Abdullah-Hasan-Sajjad's Online-School PHP application allows remote unauthenticated attackers to manipulate database queries through the Email parameter in the student login endpoint. All versions up to commit f09dda77b4c29aa083ff57f4b1eb991b98b68883 are affected, with a publicly available exploit report published via GitHub. The vendor was contacted prior to disclosure but did not respond, meaning no patch exists and the application remains unpatched.
SQL injection in CLTPHP 3.0 exposes the application's database to unauthenticated remote attackers via the `keyword` parameter in the `/home/search.html` search endpoint. The vulnerability stems from unsanitized user input being passed directly into SQL query construction, enabling data extraction and potential modification. A public proof-of-concept exploit has been disclosed (E:P in the CVSS 4.0 vector), though EPSS of 0.03% at the 7th percentile indicates low observed exploitation activity and no CISA KEV listing at time of analysis.
Unauthenticated remote attackers can bypass authorization controls in TS Demo Importer plugin for WordPress (versions ≤0.1.3), enabling high-impact integrity and availability compromise through misconfigured access control. EPSS scoring at 7th percentile (0.07%) suggests low observed exploitation probability. No CISA KEV listing indicates no confirmed active exploitation at time of analysis, though the authentication bypass tag and critical CVSS 9.1 rating warrant immediate attention for exposed WordPress installations.
Missing authorization in the MDZ Persian Admin Fonts WordPress plugin (versions through 4.1.03) allows low-privileged authenticated users to perform actions reserved for administrators due to absent capability checks. The CVSS vector (PR:L, AV:N, S:U) confirms that any authenticated WordPress user - such as a subscriber or contributor - can reach the vulnerable endpoints over the network with no user interaction required. No public exploit code has been identified at time of analysis, and EPSS sits at 0.06% (18th percentile), indicating negligible observed exploitation activity.
Broken access control in IgnitionDeck WordPress plugin (versions ≤2.0.15) enables authenticated users to bypass authorization checks and perform unauthorized actions with elevated privileges. The vulnerability requires low-privilege authentication but has low attack complexity (CVSS 8.8, AV:N/AC:L/PR:L), allowing compromise of confidentiality, integrity, and availability. EPSS probability is low (0.05%, 15th percentile), and no public exploit is identified at time of analysis, suggesting limited active targeting despite the high severity rating.
Broken access control in WP Flights & Hotels Booking WP Plugin (adiaha-hotel) versions ≤3.1 allows authenticated users with low privileges to bypass authorization checks and gain unauthorized access to high-impact functionality. Attackers can achieve complete compromise of confidentiality, integrity, and availability within the plugin's scope. EPSS score of 0.05% (15th percentile) indicates low observed exploitation probability, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Missing authorization in the GoCache CDN WordPress plugin (versions through 1.3.6) allows low-privileged authenticated users to invoke restricted plugin actions beyond their intended access level, resulting in limited integrity and availability impact against CDN configuration. Reported by Patchstack via coordinated disclosure, with no public exploit code identified and an EPSS of 0.03% (10th percentile), indicating very low near-term exploitation probability. No active exploitation has been confirmed by CISA KEV.
Broken access control in Conversios.io WooCommerce analytics plugin (versions ≤7.2.13) allows authenticated low-privilege users to access or modify high-sensitivity data without proper authorization checks. The vulnerability enables privilege escalation where any authenticated user can bypass intended access restrictions to read confidential information or alter plugin settings/data. EPSS score of 0.03% (9th percentile) indicates low predicted exploitation probability; no public exploit identified at time of analysis.
Denial of service in Apache Tomcat occurs when multipart upload errors leave temporary disk files uncleaned, allowing attackers to exhaust disk space faster than garbage collection reclaims it. Affected versions 8.5.0-8.5.100 (EOL), 9.0.0-M1-9.0.109, 10.1.0-M1-10.1.46, and 11.0.0-M1-11.0.11 require authenticated access (PR:L) and high attack complexity, making real-world exploitation limited despite the medium CVSS score.
Unauthenticated access to CSV export data in the MSTW CSV EXPORTER plugin for WordPress versions up to 1.4 allows an attacker to retrieve exported information without any authentication. The issue arises from a missing authorization check on a publicly accessible export endpoint. No active exploitation or public exploit code is known, and the EPSS score of 0.06% indicates a very low probability of widespread exploitation.
An unauthenticated attacker can exploit missing authorization checks in the Everest Backup WordPress plugin (<=2.3.8) to trigger resource-intensive backup operations without any privileges, causing a low impact on server availability. No active exploitation or public proof-of-concept is known, and the EPSS score is very low (0.06%).
Unauthorized access to restricted functionality in Sunshine Photo Cart plugin for WordPress allows unauthenticated attackers to perform unauthorized actions. The vulnerability affects all versions up to and including 3.5.3, and stems from missing authorization checks that enable attackers to access functionality not properly constrained by Access Control Lists. With a low EPSS score (0.04%) and no reported active exploitation, the real-world risk is limited, though the flaw has a CVSS 5.3 medium rating.
Broken access control in the Sendle Shipping WordPress plugin (official-sendle-shipping-method) versions through 6.02 allows unauthenticated remote attackers to invoke plugin functionality that should be restricted to authorized users. The flaw stems from missing authorization checks (CWE-862), meaning certain shipping-related actions are accessible without any privilege verification. Real-world impact is limited to availability disruption (CVSS A:L), with no confidentiality or integrity impact identified. No public exploit code exists and EPSS places exploitation probability at 0.04% (11th percentile), indicating negligible active threat at time of analysis.
Unauthorized information disclosure in Export Categories plugin for WordPress through version 1.0 allows unauthenticated attackers to access category data due to a missing authorization check (CWE-862). Only category information is exposed, with no integrity or availability impact. The vulnerability has a low CVSS base score of 5.3, very low EPSS exploitation probability (0.04%), and no reports of active exploitation or public proof-of-concept.
Sensitive system information disclosure in ThemeHunk WP Popup Builder plugin for WordPress (versions ≤1.3.8) allows unauthenticated remote attackers to retrieve embedded sensitive data without authentication. The vulnerability presents a CVSS 7.5 HIGH severity with confirmed network-based exploitation requiring no user interaction. EPSS score of 0.03% (10th percentile) indicates minimal observed exploitation activity, and no public exploit identified at time of analysis. The flaw stems from improper exposure of sensitive information to unauthorized control spheres (CWE-497).
Sensitive data exposure in Atarim Visual Collaboration WordPress plugin (versions through 4.2.1) allows unauthenticated remote attackers to retrieve embedded confidential information via network-accessible endpoints. The vulnerability enables direct extraction of sensitive data with no authentication required and low attack complexity. EPSS score of 0.03% (10th percentile) indicates minimal current exploitation probability, and no public exploit code or CISA KEV listing exists at time of analysis.
Missing authorization controls in the Baidu SEO Collection WordPress plugin versions up to 2.1.4 allow unauthenticated remote attackers to access restricted functionality and retrieve sensitive information without proper permission checks. The vulnerability affects the plugin's core access control mechanisms, enabling unauthorized information disclosure with a CVSS score of 5.3. EPSS exploitation probability is low at 0.03%, and no active exploitation has been confirmed.
Link Whisper Free WordPress plugin through version 0.9.2 allows unauthenticated remote attackers to read sensitive information via missing authorization checks on API endpoints. The vulnerability enables bypassing access controls to retrieve data that should be restricted, confirmed with CVSS 5.3 and EPSS 0.03% exploitation probability. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in RealMag777 MDTF (WordPress Meta Data Filter and Taxonomy Filter) plugin versions up to 1.3.6 allows low-privileged authenticated users to bypass authorization controls and access or modify sensitive metadata and taxonomy filter configurations. While rated CVSS 8.1 (High), real-world exploitation risk remains moderate with EPSS at 0.03% (9th percentile) and no confirmed active exploitation or public exploit code identified at time of analysis. This authentication bypass vulnerability was disclosed by Patchstack's security audit team.
Missing authorization in RelyWP Coupon Affiliates plugin (versions up to 7.2.0) allows unauthenticated remote attackers to access restricted functionality and read sensitive data due to inadequate access control list (ACL) enforcement. The vulnerability requires no authentication and has low attack complexity, enabling attackers to bypass WordPress permission checks and retrieve coupon-related information not intended for public access.
Improper neutralization of HTML script tags in WP Recipe Maker through version 10.0.x enables reflected cross-site scripting (XSS) attacks against users. The vulnerability affects the Brecht WP Recipe Maker WordPress plugin and requires user interaction (clicking a malicious link) to exploit. An attacker can inject arbitrary JavaScript into the page context, achieving code execution in the victim's browser with potential to steal session tokens or perform actions on behalf of authenticated users. The vulnerability has low real-world exploitation probability (EPSS 0.02%) and does not appear to be actively exploited in the wild.
Sensitive data exposure in the Publitio WordPress plugin (versions ≤2.2.5) allows unauthenticated remote attackers to retrieve embedded sensitive information through network requests. The vulnerability exposes confidential data with high impact to confidentiality (CVSS C:H), though exploitation probability remains low (EPSS 3rd percentile). No public exploit identified at time of analysis, and exploitation requires no privileges or user interaction (PR:N/UI:N), making it trivially exploitable if targeted.
Server-Side Request Forgery in the Codeless Slider Templates WordPress plugin (versions ≤1.0.3) enables authenticated low-privilege users to induce the server to make arbitrary outbound HTTP requests, potentially reaching internal network resources such as cloud metadata services or private APIs. The CVSS vector (AV:N/AC:H/PR:L/S:C/C:L/I:L) confirms network exploitation requires an authenticated WordPress account and high attack complexity, with scope change indicating cross-boundary impact on internal infrastructure. No active exploitation is confirmed - EPSS sits at 0.03% (10th percentile) and no KEV listing exists - placing this firmly in the low real-world priority tier despite the scope change.
Open redirect in the WP Gravity Forms Zoho CRM and Bigin WordPress plugin (versions ≤ 1.2.8) allows unauthenticated remote attackers to redirect victims from a trusted WordPress site to an arbitrary attacker-controlled URL, enabling phishing attacks. The CVSS Scope:Changed designation reflects that the trust boundary of the originating WordPress site is crossed, lending legitimacy to malicious links. No public exploit code and no CISA KEV listing have been identified; EPSS of 0.03% (8th percentile) confirms very low observed exploitation probability at time of analysis.
An access control vulnerability in the SEO Meta Description Updater WordPress plugin (versions ≤1.2.0) allows low-privileged authenticated users to modify plugin settings without proper authorization. This missing authorization flaw (CWE-862) can be exploited over the network without user interaction, leading to unauthorized manipulation of SEO meta descriptions. No public exploit or active exploitation has been identified.
Missing authorization in Clicksend CF7 Plugin for WordPress versions ≤1.4.0 allows authenticated attackers to modify SMS notification settings without proper capability checks. The vulnerability has a low CVSS score of 4.3, no known public exploit, and an EPSS score of 0.06% indicating very low exploitation probability.
An access control weakness in Referral Link Tracker for WordPress up to 1.1.4 allows authenticated users with minimal privileges to interact with restricted plugin functionality, leading to limited availability impact. No data exposure or integrity tampering is indicated, and there is no evidence of active exploitation or public exploit code.
Broken access control in Revive Old Posts (tweet-old-post) WordPress plugin through version 9.3.3 allows authenticated attackers with low-level privileges to escalate permissions and execute high-impact operations including data exfiltration, modification, and service disruption. EPSS score of 0.05% (15th percentile) indicates low probability of mass exploitation, though the 8.8 CVSS score reflects significant potential damage once low-privilege access is obtained. No public exploit identified at time of analysis, and no CISA KEV listing exists.
Broken access control in Welcart e-Commerce WordPress plugin through version 2.11.24 allows authenticated users to bypass authorization checks and perform unauthorized actions with elevated privileges. This authentication bypass vulnerability (CWE-862) enables low-privileged authenticated attackers to access, modify, or delete data beyond their permission level, potentially compromising store operations, customer data, and site integrity. EPSS score of 0.05% (15th percentile) suggests low immediate exploitation probability, though no public exploit has been identified at time of analysis.
Broken access control in QuantumCloud ChatBot plugin for WordPress through version 7.7.3 allows authenticated attackers with low privileges to exploit misconfigured authorization checks, potentially leading to high-impact data breaches, unauthorized modifications, and service disruption. EPSS scoring indicates low exploitation probability (0.05%, 15th percentile), and no public exploit identified at time of analysis. The vulnerability stems from missing authorization controls (CWE-862), requiring only network access and low-privilege credentials with no user interaction, making it readily exploitable once an account is compromised.
WordPress Table Block by RioVizual plugin versions through 3.0.0 contains a broken access control vulnerability allowing authenticated attackers with low privileges to bypass authorization checks and perform high-impact actions including data theft, modification, and service disruption. The CVSS score of 8.8 reflects network-accessible exploitation with low complexity requiring only minimal authentication. EPSS score of 0.05% (15th percentile) suggests low immediate exploitation probability, with no public exploit identified at time of analysis.
Broken access control in MSN Partner Hub WordPress plugin allows authenticated attackers with low privileges to bypass authorization controls and gain unauthorized access to high-privilege functions. This CWE-862 missing authorization flaw affects versions through 2.9, enabling authenticated users to execute actions beyond their intended permission level. EPSS score of 0.05% (15th percentile) indicates low observed exploitation probability, and no public exploit code or CISA KEV listing exists at time of analysis.
Missing authorization in Reoon Email Verifier for WordPress allows authenticated users to exploit incorrectly configured access control, potentially causing low-impact service disruption. Affected versions up to 2.0.1 are vulnerable. No active exploitation or public exploit code is known, and EPSS indicates a 0.04% exploitation probability.
Missing authorization in Smart WeTransfer WordPress plugin up to version 1.3 allows authenticated users with low privileges to trigger actions that degrade service availability. The vulnerability is not known to be actively exploited, and EPSS indicates a low 0.04% probability of exploitation.
The KiotViet Sync WordPress plugin through version 1.8.5 exposes restricted administrative functions to low-privileged authenticated users due to missing authorization checks (CWE-862), allowing unauthorized data modification via the plugin's sync operations. The flaw is network-exploitable with low privilege requirements and no user interaction, though impact is limited to integrity (I:L) with no confidentiality or availability consequences. No public exploit code exists and EPSS sits at 0.03% (10th percentile), indicating very low exploitation probability despite the broken access control classification.
Missing authorization checks in WebinarPress (wp-webinarsystem) WordPress plugin version 1.33.28 and earlier allow authenticated low-privileged users to perform availability-impacting actions beyond their intended access level. The flaw stems from incorrectly configured access control security levels (CWE-862), enabling a WordPress subscriber-tier user to invoke plugin functionality restricted to higher roles. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS probability stands at 0.03%, indicating low real-world exploitation interest currently.
Authenticated low-privilege users of the Seriously Simple Podcasting WordPress plugin (version ≤ 3.13.0) can bypass access controls to modify podcast content. This missing authorization flaw (CWE-862) results from incorrectly configured access control security levels. Exploitation has not been observed in the wild (EPSS 0.03%).
Missing authorization checks in WP-Lister Lite for eBay 3.8.3 and earlier allow low-privileged authenticated attackers to modify plugin data. The vulnerability has a CVSS base score of 4.3 and an EPSS score of 0.03%, indicating low exploitation probability; no active exploitation is currently known.
Missing authorization controls in the Open Close WooCommerce Store plugin (versions ≤4.9.9) allow authenticated low-privileged users to bypass access restrictions and perform unauthorized high-impact operations, potentially modifying store configuration or accessing sensitive data. With CVSS 8.1 (High severity) but only 0.03% EPSS (9th percentile), this represents a significant vulnerability for affected WordPress/WooCommerce sites, though no public exploit or active exploitation (CISA KEV) has been identified at time of analysis. The authentication requirement (PR:L) substantially limits attack surface compared to unauthenticated vulnerabilities.
Content injection via stored script-tag HTML in the xSmart WordPress theme through version 1.2.9.4 allows low-privileged authenticated users to embed unsanitized HTML - including script-bearing tags - into pages served to other site visitors. The flaw originates from inadequate output escaping in the Jthemes-developed theme and is classified as CWE-80 (Basic XSS / HTML tag injection). No public exploit code or active exploitation has been identified; EPSS sits at 0.02% (6th percentile), consistent with low threat-actor interest at time of analysis.
Cross-Site Request Forgery in the Simple Content Templates WordPress plugin ≤2.2.61 allows unauthenticated attackers to trick logged-in administrators into performing unauthorized actions with low integrity impact. Exploitation requires victim interaction via a crafted link and has no known active exploitation or public exploit, while EPSS indicates a very low (0.02%) probability of widespread exploitation.
Cross-site request forgery in the Off-Canvas Sidebars plugin for WordPress (≤0.5.8.5) allows unauthenticated attackers to trick administrators into modifying sidebar settings via a crafted link. Successful exploitation requires user interaction and leads to limited integrity impact with no confidentiality or availability consequences. No evidence of active exploitation or public exploit code exists at this time.
Cross-site request forgery in the Premmerce Brands for WooCommerce plugin for WordPress up to version 1.2.13 allows unauthenticated attackers to trick authenticated administrators into executing unintended actions, such as modifying brand settings. The vulnerability has a low EPSS score (0.02%) and no active exploitation is reported. A successful attack results in a limited integrity impact with no confidentiality or availability loss.
Cross-site request forgery in the Raychat WordPress plugin (versions through 2.2.1) enables an unauthenticated attacker to induce unauthorized state-changing actions on behalf of an authenticated user without their knowledge. The attack is constrained by a mandatory user-interaction requirement - a victim with an active authenticated session must visit a malicious page. EPSS at 0.02% (5th percentile) confirms negligible exploitation probability, and no public exploit or CISA KEV listing has been identified at time of analysis.
Cross-Site Request Forgery in the Entrada WordPress theme (Waituk, versions through 5.7.7) enables a remote unauthenticated attacker to perform unauthorized state-changing actions by tricking an authenticated user into visiting a crafted page. The missing or insufficient nonce validation on sensitive form or AJAX endpoints allows the victim's browser to unwittingly submit forged requests, resulting in limited integrity impact. With an EPSS score of 0.01% (3rd percentile), no CISA KEV listing, and no public exploit code identified at time of analysis, real-world risk is low despite the network-accessible vector.