Local file inclusion in Majestic Support WordPress plugin versions ≤1.0.7 allows authenticated attackers with low-level privileges to include arbitrary PHP files from the server filesystem via improper filename control in include/require statements. With CVSS 7.5 (High), the vulnerability requires high attack complexity but can lead to complete confidentiality, integrity, and availability compromise. EPSS score of 0.10% (28th percentile) suggests low probability of mass exploitation. No public exploit code identified and not present in CISA KEV at time of analysis, though Patchstack tracking indicates vendor awareness.
Out-of-bounds read in the Linux kernel's ksmbd in-kernel SMB server allows a 4-byte read past a declared IPC payload boundary when handle_response() in transport_ipc.c dereferences a message handle without first validating that the payload is at least 4 bytes long. The flaw is triggered by a malformed or truncated message from the userspace ksmbd.mountd helper, potentially leaking a small amount of adjacent kernel memory or crashing the kernel. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low at 0.19% (9th percentile).
Arbitrary file read vulnerability in Anti-Malware Security and Brute-Force Firewall WordPress plugin (versions up to 4.23.81) allows authenticated Subscriber-level users to read sensitive files from the server via unprotected AJAX endpoints. The vulnerability combines missing capability checks with information exposure in multiple GOTMLS_* AJAX actions, enabling attackers with minimal WordPress privileges to access arbitrary file contents including configuration files and credentials. No public exploit code has been confirmed at this time, though the vulnerability is trivial to exploit given the low authentication barrier.
Local privilege escalation in WatchGuard Mobile VPN with SSL client on Windows allows a low-privileged local user to inject and execute arbitrary commands with elevated system privileges via a command injection flaw (CWE-77). This vulnerability is explicitly described as an additional, previously unmitigated attack path for CVE-2024-4944, indicating that the earlier advisory's remediation was incomplete and the underlying injection surface persists in another code path. No public exploit identified at time of analysis, but the local-only attack vector limits exposure to insider threats and post-compromise lateral movement scenarios. A vendor-released patch is available in version 12.11.5.
Stored XSS in Premmerce Product Search for WooCommerce through version 2.2.5 allows high-privilege authenticated users to inject malicious scripts that execute in the context of other users' browsers, affecting website visitors and administrators. The vulnerability requires user interaction (page view) to trigger payload execution and has low EPSS exploitation probability (0.02%), indicating minimal real-world risk despite the network-accessible attack vector. No public exploit code or active exploitation has been confirmed.
Stored cross-site scripting (XSS) vulnerability in Automattic WooCommerce through version 10.0.2 allows attackers to inject malicious scripts that persist in the application and execute in the browsers of other users. The vulnerability stems from improper input neutralization during web page generation, enabling authenticated or lower-privileged users to compromise the integrity of the WooCommerce storefront and potentially steal customer data or perform actions on behalf of administrators.
Unauthenticated SSRF in Halo CMS 2.21 exposes internal network infrastructure to remote attackers via the Thumbnail via-uri endpoint, which performs server-side HTTP GET requests to attacker-supplied URLs without allowlist or blocklist enforcement. Beyond initiating outbound connections to attacker-controlled hosts, the endpoint issues a 307 redirect that leaks internal URLs in the Location header, enabling internal network reconnaissance. EPSS is low (0.27%, 19th percentile) with no CISA KEV listing, but a public researcher disclosure document exists, lowering the barrier to exploitation.
Missing authorization controls in Premmerce Wholesale Pricing for WooCommerce (versions through 1.1.10) permit authenticated low-privileged users to invoke restricted plugin functionality without proper capability checks, resulting in unauthorized data modification and limited availability disruption. The CVSS vector (PR:L) confirms exploitation requires an authenticated WordPress account, constraining the attack surface to registered users. EPSS at 0.03% (10th percentile) and absence from CISA KEV indicate negligible observed exploitation activity at time of analysis.
Missing authorization controls in the MasterStudy LMS Pro WordPress plugin (all versions prior to 4.7.16) allow authenticated low-privilege users to exploit incorrectly configured access control levels, resulting in limited unauthorized integrity and availability impact. The flaw (CWE-862) indicates that one or more plugin endpoints or AJAX handlers execute privileged operations without verifying the calling user's capabilities. With EPSS at 0.03% and no CISA KEV listing, real-world exploitation risk is currently low, though the network-accessible attack vector means any authenticated site user could attempt to trigger the flaw without special conditions or user interaction.
Unauthenticated access control bypass in Blog Designer PRO WordPress plugin (versions through 3.4.8) allows remote attackers to invoke ACL-restricted functionality without holding any WordPress account, resulting in limited unauthorized data modification. The provided CVSS vector confirms the attack is network-accessible with no authentication, no user interaction, and low complexity (AV:N/AC:L/PR:N/UI:N), though impact is bounded to integrity-only modifications with no confidentiality or availability consequence. No public exploit has been identified and EPSS places this at the 18th percentile (0.06%), indicating no observed mass exploitation - this vulnerability is also absent from CISA KEV.
Missing authorization in the Masterstudy Elementor Widgets WordPress plugin (versions through 1.2.4) allows unauthenticated remote attackers to access ACL-restricted functionality, resulting in unauthorized integrity impact. The CVSS vector (PR:N, AV:N, AC:L) confirms network-accessible exploitation without credentials, though impact is constrained to limited write operations (I:L) with no confidentiality or availability consequence. No public exploit has been identified at time of analysis, and EPSS probability is extremely low at 0.04% (11th percentile), indicating minimal observed exploitation activity.
Broken access control in the wpresidence WordPress theme (versions through 5.3.2) exposes one or more endpoints that can be reached and triggered by unauthenticated remote attackers, resulting in unauthorized write-level actions against the site. The CVSS vector (PR:N, AV:N, AC:L) confirms no authentication is required, and the 'Authentication Bypass' tag indicates authorization checks are entirely absent rather than merely misconfigured. No public exploit code has been identified and EPSS sits at 0.04% (11th percentile), indicating very low real-world exploitation probability at this time.
Missing authorization in Facebook for WooCommerce plugin versions up to 3.5.7 allows authenticated attackers to bypass access controls and dismiss administrative notices through incorrectly configured security levels. The vulnerability enables privilege escalation or information disclosure via improper access control enforcement, though the low EPSS score (0.03%, 9th percentile) suggests limited real-world exploitation likelihood despite the broken access control flaw.
Cross-site request forgery in Ays Pro Popup box WordPress plugin versions up to 5.5.4 allows attackers to perform unauthorized actions (such as modifying plugin settings or creating popups) on behalf of authenticated administrators without their knowledge or consent. The vulnerability requires victim interaction (clicking a malicious link while logged in) but carries low exploitation probability (EPSS 0.02%, percentile 4%), suggesting limited real-world attack pressure despite the theoretical risk.
Broken access control in the Evergreen Content Poster WordPress plugin (versions through 1.4.5) permits authenticated low-privilege users to invoke restricted plugin functionality without proper authorization checks. The root cause is CWE-862 (Missing Authorization), where the plugin fails to verify whether the requesting user holds the appropriate role before executing sensitive operations - allowing, at minimum, availability-impacting disruption to content scheduling workflows. No public exploit code has been identified at time of analysis, and the EPSS score of 0.03% (10th percentile) signals minimal observed exploitation activity.
Cross-Site Request Forgery in the Super Store Finder WordPress plugin (versions through 7.5) enables remote unauthenticated attackers to perform unauthorized state-changing actions by forging requests on behalf of authenticated users. The plugin fails to implement WordPress nonce validation on one or more sensitive endpoints, meaning a logged-in administrator tricked into visiting a malicious page can have plugin data or settings modified without consent. With an EPSS of 0.02% (4th percentile), no KEV listing, and no public exploit identified at time of analysis, this is a genuine but low-urgency finding appropriate for routine patch cycles.
Cross-Site Request Forgery in the Premmerce Product Search for WooCommerce WordPress plugin (versions ≤ 2.2.4) enables a remote attacker to forge state-changing requests on behalf of an authenticated WordPress user. The attack requires no privileges from the attacker but depends on social engineering an authenticated administrator or shop manager into visiting a malicious page while logged in. No public exploit has been identified at time of analysis, and EPSS at 0.01% (3rd percentile) reflects very low real-world exploitation probability.
Cross-Site Request Forgery in the Premmerce WordPress plugin (versions through 1.3.19) enables network-based attackers to forge state-changing requests on behalf of authenticated WordPress users without their knowledge. The attack succeeds when a logged-in user visits an attacker-controlled page, causing the victim's browser to silently submit a crafted request to their WordPress site. No active exploitation is confirmed (absent from CISA KEV), no public exploit code has been identified, and EPSS sits at 0.01% (3rd percentile), collectively indicating very low real-world exploitation probability at this time.
Cross-Site Request Forgery in the WP Rentals WordPress theme (WpEstate) through version 3.13.1 allows unauthenticated remote attackers to perform unauthorized state-changing actions by tricking authenticated site users into visiting a crafted page. The CVSS vector (PR:N/UI:R) confirms the attacker needs no credentials themselves but must socially engineer a logged-in victim. With an EPSS of 0.01% (3rd percentile), no public exploit code, and no CISA KEV listing, real-world exploitation risk is low at this time.
Cross-site request forgery in the Stockie Extra WordPress plugin (versions through 1.2.11) enables unauthenticated remote attackers to perform unauthorized state-changing actions by tricking a logged-in WordPress user into visiting attacker-controlled content. The CVSS vector (PR:N/UI:R/I:L) confirms exploitation requires no attacker authentication but mandates victim interaction, and impact is bounded to limited integrity modification - not full site compromise. No public exploit identified at time of analysis; EPSS of 0.01% at the 3rd percentile indicates negligible exploitation interest in the wild.
Cross-Site Request Forgery in the PowerPress Podcasting WordPress plugin (versions through 11.13.12) enables remote attackers to perform unauthorized state-changing actions against the plugin by tricking an authenticated WordPress administrator into visiting a malicious page. The CVSS vector (PR:N/UI:R/I:L) confirms exploitation requires no attacker authentication but mandates a social-engineering step to lure a logged-in admin. No public exploit identified at time of analysis; EPSS at 0.01% (3rd percentile) reflects minimal observed exploitation interest.