Wazuh Manager versions before 4.11.0 present a legitimately moderate denial-of-service issue rather than an inflated high-CVSS finding: analysisd can be crashed by a malformed CISCAT message sent through the agent communication channel. The attacker must control or impersonate an already enrolled agent, or have compromised an endpoint with a valid agent key, so this is not arbitrary unauthenticated internet access. Impact is limited to availability of analysisd, with no data exposure or code execution; no public exploit or CISA KEV entry was identified at time of analysis, and the vendor-released fix is 4.11.0.
SQL injection in TypeORM's MySQL driver affects releases before 0.3.26 when an application passes attacker-influenced object values into repository.save or repository.update: the underlying sqlstring call runs with stringifyObjects defaulted to false, so nested objects are serialized into the SQL statement instead of being escaped. Exposure is conditional on the application routing untrusted structured input (an object rather than a plain scalar) into those persistence methods, and the assessed impact is partial data read or modification (C:L/I:L/A:N) rather than full database compromise. The vendor fix is released in 0.3.26; EPSS is 0.27% (18th percentile), the issue is not in CISA KEV, and no confirmed public exploit code was identified at time of analysis although a public technical write-up exists.
Authenticated users with even the lowest WordPress role (Subscriber) can install and activate whitelisted Doppler Forms extensions on sites running the Doppler Forms plugin through version 2.5.1. This occurs because the install_extension AJAX action lacks capability checks and nonce verification, constituting a broken access control issue. While the impact is limited to whitelisted extensions, it allows low-privilege users to modify the plugin's extension set; no public exploit has been identified and the EPSS score is 0.22%.
Stored cross-site scripting in the Rehub WordPress theme affects all versions prior to 19.9.9.1, allowing an authenticated attacker holding only low-privilege content-submission rights to plant a persistent script payload that executes when another user or an administrator later views the affected page. The flaw carries a moderate CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), indicating that exploitation requires an account on the target site plus victim interaction, which concentrates real-world risk on multi-author blogs, membership and marketplace sites rather than single-admin installations. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and EPSS places exploitation likelihood at roughly 0.20% (9th percentile), so prioritization should follow normal authenticated-XSS patch cycles rather than emergency response. The reported vector contains PR:L, confirming the attacker must be authenticated at low privilege; the specific vulnerable input field is not named in the available description, and upgrading to Rehub 19.9.9.1 or later is the stated fix boundary.
Stored cross-site scripting in the ThimPress Eduma WordPress theme (versions through 5.7.6) allows an authenticated low-privileged user, such as a student or instructor, to inject malicious JavaScript that executes when an administrator or other user views the affected page. The vulnerability requires victim interaction (UI:R) and is rated moderate severity (CVSS 6.5); EPSS is low at 0.20% and no public exploit code has been identified at time of analysis, nor is it listed in CISA KEV. Successful exploitation could lead to session hijacking, data theft, or unauthorized actions in the context of the victim's browser session.
Jannah Extensions 1.1.4 and earlier for WordPress contains a DOM-based cross-site scripting issue that an authenticated low-privilege user can leverage when a victim views a crafted page carrying the payload. Successful exploitation may execute script in the victim's browser within a changed scope, but the requirement for authentication plus user interaction and only low confidentiality, integrity, and availability impact limit the practical risk. EPSS is 0.17% (5th percentile) and no public exploit identified at time of analysis.
Stored cross-site scripting in the ThemeSphere SmartMag WordPress theme (all versions up to and including 10.3.1) lets an authenticated low-privileged user - for example a contributor or author able to submit content into the affected theme field - plant persistent JavaScript that runs in the browser of a privileged user who later views the poisoned page. Exploitation requires both a valid WordPress account and victim interaction, so the attacker cannot trigger execution unaided, and the practical impact is script execution in the victim's session (session/data theft, administrative actions performed as the victim, or defacement of rendered pages) rather than direct server compromise. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is very low at 0.17% (5th percentile).
DOM-based cross-site scripting in the TieLabs Sahifa WordPress theme (all releases before 5.8.6) allows a low-privileged authenticated user to inject script that executes in a victim's browser when the victim loads a crafted page or clicks an attacker-supplied link. The assessed vector requires a valid session (PR:L) and victim interaction (UI:R), with scope change but only limited confidentiality/integrity impact and no availability impact, so practical risk is moderate while the raw network-vector score of 6.5 overstates it. No public exploit code and no confirmed active exploitation have been identified, and EPSS is low at 0.17% (5th percentile). TieLabs shipped Sahifa 5.8.6 to remediate the flaw.
Arbitrary file read vulnerability in Anti-Malware Security and Brute-Force Firewall WordPress plugin (versions up to 4.23.81) allows authenticated Subscriber-level users to read sensitive files from the server via unprotected AJAX endpoints. The vulnerability combines missing capability checks with information exposure in multiple GOTMLS_* AJAX actions, enabling attackers with minimal WordPress privileges to access arbitrary file contents including configuration files and credentials. No public exploit code has been confirmed at this time, though the vulnerability is trivial to exploit given the low authentication barrier.
Local privilege escalation in WatchGuard Mobile VPN with SSL client on Windows allows a low-privileged local user to inject and execute arbitrary commands with elevated system privileges via a command injection flaw (CWE-77). This vulnerability is explicitly described as an additional, previously unmitigated attack path for CVE-2024-4944, indicating that the earlier advisory's remediation was incomplete and the underlying injection surface persists in another code path. No public exploit identified at time of analysis, but the local-only attack vector limits exposure to insider threats and post-compromise lateral movement scenarios. A vendor-released patch is available in version 12.11.5.
Stored cross-site scripting in CKAN's markdown rendering helper allows an authenticated user who can create or edit dataset, resource, organization or group descriptions to plant a markdown payload that executes in the browser of any user who later views the affected page. CKAN releases before 2.10.9, and 2.11.0 through 2.11.3, are affected because helpers.markdown_extract() regex-stripped HTML tags instead of sanitizing the converted markdown, then handed the result to the template layer as a trusted HTML literal; the vendor rates this medium (CVSS 6.3), and our review re-scores it with scope changed (stored payload can act in the victim's session context). No public exploit identified at time of analysis, and no CISA KEV listing.
Reflected cross-site scripting in the LiteSpeed Cache plugin for WordPress (all versions up to and including 7.5.0.1) lets an attacker inject arbitrary script into a page by supplying crafted URLs that are echoed back unescaped. Exploitation requires the plugin's debug mode to be enabled - a non-default configuration - plus a victim tricked into clicking a malicious link (UI:R), and the injected code runs only in that victim's browser context, limiting the impact to session and DOM-level confidentiality/integrity loss rather than server compromise. There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV); EPSS is 0.38% (29th percentile), indicating low predicted real-world exploitation activity, and an upstream fix commit exists but only as a 7.6-rc4 release-candidate build.
Session fixation in CKAN (CWE-384) allows an attacker to pre-plant a known session identifier that becomes authenticated after the victim logs in, because the application failed to regenerate session IDs on login. Only deployments reconfigured away from CKAN's default cookie-based sessions to server-side storage such as SESSION_TYPE=redis are exposed; the attacker must also be able to set a cookie in the victim's browser or steal an existing valid session, and the victim must then complete an interactive login. Fixed in CKAN 2.10.9 and 2.11.4, with no public exploit code or confirmed active exploitation identified at time of analysis.
Wazuh managers before 4.10.2 contain an out-of-bounds read in the Windows Event Channel decoder (DecodeWinevt) that is reachable by a compromised or maliciously enrolled agent sending a crafted winevt message. The over-read is triggered while parsing the message, but the leaked memory is only exposed when the manager runs with the non-default analysisd.debug=2 setting because the faulty access is evaluated in an mdebug2 diagnostic call; publicly available exploit code exists, with no CISA KEV confirmation of active exploitation. Consistent with the assessed CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:L), impact is limited: a privileged/trusted agent position is required, attack complexity is high, and only limited confidentiality and availability effects are expected.
Field Masking rules in Search Guard 3.1.1 and earlier can be bypassed as an inference oracle: although masked IP-address fields are redacted in the _source of returned documents, queries submitted against those fields still return matching hits, letting a low-privileged authenticated user reconstruct the redacted IP values incrementally. The flaw is confined to installations that apply Field Masking (FM) to IP-type fields; deployments using Field Level Security (FLS) on those same fields are not affected, which is also the vendor's documented workaround. Risk is moderate rather than critical: exploitation requires valid low-privilege search access to an index containing such masked fields, works only where FM rather than FLS is configured, and is a slow enumeration technique rather than a wholesale data dump, with EPSS at 0.27% (18th percentile), no CISA KEV listing, and no public exploit code identified at time of analysis.
Field-Level Security (FLS) exclusion rules in Search Guard FLX 3.1.1 and earlier are enforced incompletely on object-valued fields: while an excluded object is correctly stripped from the _source returned by search operations, its child attributes remain queryable, letting an authenticated user with search access infer or reconstruct the contents of the supposedly hidden object. This is a CWE-200 information-disclosure issue rated 6.0 under CVSS 4.0 and assessed as CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N (high confidentiality impact, no integrity or availability impact). There is no public exploit identified at time of analysis and the EPSS score is low (0.27%, 18th percentile), but the vendor has released a fix in Search Guard FLX 3.1.2.
Information disclosure in the Jenkins Eggplant Runner Plugin (0.0.1.301.v963cffe8ddb_8 and earlier) weakens a built-in Java runtime safeguard by clearing the `jdk.http.auth.tunneling.disabledSchemes` system property, which by default stops the JDK from answering a proxy 407 challenge with Basic credentials over an HTTP CONNECT tunnel. The practical exposure is narrow: it only matters when the Jenkins controller or agent makes outbound HTTPS connections through a proxy that uses Basic authentication, and a privileged attacker already positioned to intercept traffic between Jenkins and that proxy must be present to observe the re-enabled credential exchange - reflected in the High attack-complexity rating (CVSS 5.9, AC:H, PR:N, UI:N). There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and EPSS is low at 0.32% (23rd percentile); this is a moderate-priority hardening issue rather than an urgent one.
Stored cross-site scripting in VillaTheme Email Template Customizer for WooCommerce (versions up to and including 1.2.17) allows an authenticated high-privilege user to inject malicious JavaScript into email template fields, which then executes in the browser of another user who views the affected template. The flaw requires both elevated privileges (PR:H) and victim interaction (UI:R), and no public exploit or active exploitation has been identified at time of analysis (EPSS 0.18%).
Cryptographic validation of Arista EOS software upgrade images can be bypassed when a specifically crafted file is dropped into the upgrade ISO, allowing a tampered image to be accepted as genuine because integrity checking does not fail closed. The flaw is local and operator-dependent: an attacker must already have write access to stage content on the upgrade media (PR:L) and an administrator must then actually run the upgrade from that tampered ISO (UI:R), as reflected in CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N (5.9). There is no confidentiality or availability impact - the payoff is integrity loss (I:H) with a scope change, meaning the compromised image can influence components beyond the upgrade process itself; no public exploit code has been identified at time of analysis and the EPSS score is negligible (0.09%, 0th percentile), so this is a moderate, config/operator-dependent integrity issue rather than an urgent remote-exploitation priority.
Stored XSS in Premmerce Product Search for WooCommerce through version 2.2.5 allows high-privilege authenticated users to inject malicious scripts that execute in the context of other users' browsers, affecting website visitors and administrators. The vulnerability requires user interaction (page view) to trigger payload execution and has low EPSS exploitation probability (0.02%), indicating minimal real-world risk despite the network-accessible attack vector. No public exploit code or active exploitation has been confirmed.
Stored cross-site scripting (XSS) vulnerability in Automattic WooCommerce through version 10.0.2 allows attackers to inject malicious scripts that persist in the application and execute in the browsers of other users. The vulnerability stems from improper input neutralization during web page generation, enabling authenticated or lower-privileged users to compromise the integrity of the WooCommerce storefront and potentially steal customer data or perform actions on behalf of administrators.
Keras Model.load_model fails to enforce safe_mode=True for the StringLookup layer's vocabulary path handling, so a malicious .keras archive can cause arbitrary local file reads and server-side requests when a victim loads it. This CWE-502 deserialization-class flaw affects the Keras model-loading path and is assessed as confidentiality-focused, requiring user interaction to load the untrusted model; SSRF reach depends on the host's network access and available tf.io.gfile handlers. No public exploit was identified at time of analysis.
Unauthenticated SSRF in Halo CMS 2.21 exposes internal network infrastructure to remote attackers via the Thumbnail via-uri endpoint, which performs server-side HTTP GET requests to attacker-supplied URLs without allowlist or blocklist enforcement. Beyond initiating outbound connections to attacker-controlled hosts, the endpoint issues a 307 redirect that leaks internal URLs in the Location header, enabling internal network reconnaissance. EPSS is low (0.27%, 19th percentile) with no CISA KEV listing, but a public researcher disclosure document exists, lowering the barrier to exploitation.
Missing permission checks in Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier allow authenticated Jenkins users to invoke MCP tools that trigger builds and read job and cloud configuration they are not authorized to access. The flaw requires a valid Jenkins account with at least low-level privileges (CVSS vector PR:L) and affects only instances where the plugin is installed and enabled. No public exploit code identified at time of analysis; EPSS is 0.26% (16th percentile), indicating low exploitation likelihood.
Cross-site request forgery in the Jenkins Extensible Choice Parameter Plugin (239.v5f5c278708cf and earlier) allows an attacker to lure an authenticated Jenkins user with an active session into submitting a crafted request that causes the plugin to execute sandboxed Groovy code, producing limited integrity and availability impact while leaving confidentiality unaffected (CVSS 5.4). The CVSS vector shows the attacker needs no privileges of their own (PR:N) but the attack only succeeds with victim interaction (UI:R), so it cannot be carried out directly. No public exploit code has been identified at time of analysis, the issue is not confirmed actively exploited (CISA KEV), and EPSS is low at 0.26% (16th percentile), consistent with a moderate-priority issue rather than a top-tier one.
Credential disclosure in the Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows authenticated users holding only Overall/Read permission to point the plugin at an attacker-controlled URL and capture Jenkins-stored credentials. Exploitation is not trivial: the attacker must already possess a valid credentials ID (obtained through another method per the description) and must control the endpoint the plugin contacts, which is why this is assessed as a moderate, authenticated-access issue rather than an urgent priority; this maps to an assessed vector of AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N. No public exploit has been identified at time of analysis, the issue is not in CISA KEV, and EPSS is low at 0.24% (14th percentile).
Cross-site request forgery in the Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows an attacker to ride a victim's active, authenticated Jenkins session and make the plugin connect to an attacker-specified URL using attacker-specified Jenkins credentials IDs, with the result that credentials stored in Jenkins are captured by the attacker. Two preconditions materially constrain real-world exploitation: the attacker must already possess valid credential IDs 'obtained through another method' (the flaw abuses credentials, it does not disclose their identifiers), and a logged-in Jenkins user must be induced to trigger the forged request. No public exploit code has been identified at time of analysis, EPSS is 0.21% (10th percentile), and the issue is not confirmed actively exploited (no CISA KEV listing), making this a moderate-severity, low-priority item in practice.
Missing authorization in MasterStudy Elementor Widgets (versions up to and including 1.2.4) allows an authenticated attacker with a low-privilege account-such as a student or subscriber on a WordPress site with open registration-to bypass access controls and perform actions or access data intended for higher-privileged roles. The CVSS v3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) indicates network-reachable, low-complexity exploitation with partial confidentiality and integrity impact but no availability impact, and no public exploit code is identified at time of analysis (EPSS 0.18%).
Missing authorization controls in Premmerce Wholesale Pricing for WooCommerce (versions through 1.1.10) permit authenticated low-privileged users to invoke restricted plugin functionality without proper capability checks, resulting in unauthorized data modification and limited availability disruption. The CVSS vector (PR:L) confirms exploitation requires an authenticated WordPress account, constraining the attack surface to registered users. EPSS at 0.03% (10th percentile) and absence from CISA KEV indicate negligible observed exploitation activity at time of analysis.
Missing authorization controls in the MasterStudy LMS Pro WordPress plugin (all versions prior to 4.7.16) allow authenticated low-privilege users to exploit incorrectly configured access control levels, resulting in limited unauthorized integrity and availability impact. The flaw (CWE-862) indicates that one or more plugin endpoints or AJAX handlers execute privileged operations without verifying the calling user's capabilities. With EPSS at 0.03% and no CISA KEV listing, real-world exploitation risk is currently low, though the network-accessible attack vector means any authenticated site user could attempt to trigger the flaw without special conditions or user interaction.
Session expiration bypass in Arista EOS allows authenticated local attackers to perform file-system operations (e.g., scp, sftp) on multiplexed SSH sessions after a configured timeout has expired, provided SSH session multiplexing is configured on the client side. Exploitation requires a low-privileged SSH user (PR:L) and local access (AV:L), and only affects specific Arista platforms; default deployments without client-side multiplexing are not exposed. No public exploit code or active exploitation has been identified, and EPSS is low (0.11%, percentile 1%).
Unauthenticated access control bypass in Blog Designer PRO WordPress plugin (versions through 3.4.8) allows remote attackers to invoke ACL-restricted functionality without holding any WordPress account, resulting in limited unauthorized data modification. The provided CVSS vector confirms the attack is network-accessible with no authentication, no user interaction, and low complexity (AV:N/AC:L/PR:N/UI:N), though impact is bounded to integrity-only modifications with no confidentiality or availability consequence. No public exploit has been identified and EPSS places this at the 18th percentile (0.06%), indicating no observed mass exploitation - this vulnerability is also absent from CISA KEV.
Missing authorization in the Masterstudy Elementor Widgets WordPress plugin (versions through 1.2.4) allows unauthenticated remote attackers to access ACL-restricted functionality, resulting in unauthorized integrity impact. The CVSS vector (PR:N, AV:N, AC:L) confirms network-accessible exploitation without credentials, though impact is constrained to limited write operations (I:L) with no confidentiality or availability consequence. No public exploit has been identified at time of analysis, and EPSS probability is extremely low at 0.04% (11th percentile), indicating minimal observed exploitation activity.
Broken access control in the wpresidence WordPress theme (versions through 5.3.2) exposes one or more endpoints that can be reached and triggered by unauthenticated remote attackers, resulting in unauthorized write-level actions against the site. The CVSS vector (PR:N, AV:N, AC:L) confirms no authentication is required, and the 'Authentication Bypass' tag indicates authorization checks are entirely absent rather than merely misconfigured. No public exploit code has been identified and EPSS sits at 0.04% (11th percentile), indicating very low real-world exploitation probability at this time.
Missing authorization in Facebook for WooCommerce plugin versions up to 3.5.7 allows authenticated attackers to bypass access controls and dismiss administrative notices through incorrectly configured security levels. The vulnerability enables privilege escalation or information disclosure via improper access control enforcement, though the low EPSS score (0.03%, 9th percentile) suggests limited real-world exploitation likelihood despite the broken access control flaw.
Cross-site request forgery in Ays Pro Popup box WordPress plugin versions up to 5.5.4 allows attackers to perform unauthorized actions (such as modifying plugin settings or creating popups) on behalf of authenticated administrators without their knowledge or consent. The vulnerability requires victim interaction (clicking a malicious link while logged in) but carries low exploitation probability (EPSS 0.02%, percentile 4%), suggesting limited real-world attack pressure despite the theoretical risk.
Path traversal in Allegra's DatabaseBackupBL class lets high-privileged authenticated remote attackers read files accessible to the service account, potentially exposing sensitive configuration or backup data. The flaw is network-reachable but requires an elevated account and access to database-backup functionality, limiting practical exposure to trusted administrators or compromised privileged sessions. No public exploit code or confirmed active exploitation was identified in the provided intelligence.
Missing permission check in Jenkins Themis Plugin 1.4.1 and earlier allows any authenticated user holding the low-privilege Overall/Read permission to make the Jenkins controller open an outbound HTTP connection to a server the attacker chooses. Exploitation requires user interaction to trigger the connection, and the assessed impact is limited to integrity only (no confidentiality or availability loss), which keeps real-world risk low despite the network-reachable attack vector. The CVSS 3.1 base score is 4.3, EPSS is 0.29% (20th percentile), no public exploit code or active exploitation has been identified at time of analysis, and the vendor advisory confirms a fix. Note that the published vector lists PR:N while the described Overall/Read prerequisite means the issue is in practice authenticated-only.
Broken access control in the Call Now Button WordPress plugin (all versions up to and including 1.5.4) lets any authenticated user with Subscriber-level access or higher call several administrative AJAX handlers that omit capability checks, exposing links to the site owner's connected billing portal, chat session tokens, and domain status information, and - per the vendor description - permitting modification of billing details. The issue was only partially fixed in 1.5.4 and fully fixed in 1.5.5; no public exploit code was identified at time of analysis, the CVE is not listed in CISA KEV, and EPSS is 0.27% (18th percentile), so real-world urgency is moderate-to-low rather than an emergency, with exposure rising sharply on sites that allow open user registration. Authentication requirements are confirmed as low-privileged but authenticated (CVSS vector PR:L), so an attacker must first obtain a valid subscriber account on the target site.
Credential ID enumeration in Jenkins Publish to Bitbucket Plugin 0.4 and earlier lets any authenticated user holding Overall/Read permission list the IDs of credentials stored in Jenkins, because the plugin omits a permission check (CWE-862) on the endpoint that exposes that information. Only credential identifiers are disclosed - the underlying secret values are never exposed - so the practical impact is reconnaissance that can aid follow-on attacks, widening only where Overall/Read is granted to anonymous users or a large untrusted user base. No public exploit code or confirmed active exploitation has been identified (EPSS 0.27%, roughly the 17th percentile), making this a low-to-moderate risk information-disclosure issue rather than a priority emergency.
Information disclosure in the Jenkins Curseforge Publisher Plugin 1.0 causes the stored CurseForge API key to be rendered unmasked (in cleartext) on the plugin's job configuration form, so any user who can reach that form can read the credential. According to the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), exploitation requires an authenticated Jenkins user with at least the privileges needed to view the job configuration, and impact is limited to confidentiality - no integrity or availability effect - although downstream risk depends on what the leaked CurseForge API key is authorized to do. There is no public exploit identified at time of analysis, EPSS is low at 0.26% (16th percentile), and the root cause is CWE-311 (missing protection/masking of sensitive data) in version 1.0 of this specific plugin, not in Jenkins core. This is a low-to-moderate severity credential-exposure issue rather than a high-priority emergency, and it also exposes the key to anyone able to observe the configuring user's screen.
The Jenkins Nexus Task Runner Plugin 0.9.2 and earlier omits a permission check on a plugin endpoint, so an authenticated Jenkins user holding only Overall/Read permission can make the Jenkins controller open outbound connections to an arbitrary attacker-chosen URL using credentials referenced by ID from Jenkins' credential store (CVSS 4.3, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Exposure is bounded: the assessed impact is integrity-only, with no direct secret disclosure or availability effect, and exploitation requires the attacker to already be authenticated with read access. EPSS is 0.25% (15th percentile) and there is no public exploit code and no confirmed active exploitation (not in CISA KEV), so this is a low-priority issue despite being a genuine vulnerability; real-world risk rises only where Overall/Read is granted to anonymous or low-trust accounts.
Missing permission checks in Jenkins Start Windocks Containers Plugin 1.4 and earlier let any authenticated user holding the baseline Overall/Read permission force the Jenkins controller to make an outbound HTTP connection to a URL of the attacker's choosing, a classic server-side request forgery (SSRF) pattern with integrity-only impact. Only Jenkins instances with the plugin installed are affected; the Jenkins core itself is not vulnerable, and exploitation requires a valid account with at least read-level access, so anonymous or unauthenticated attacks are not indicated by the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, score 4.3). Severity signals are mutually consistent and point to a genuine-but-low-priority issue: EPSS is just 0.25% (15th percentile), no public exploit code has been identified at time of analysis, and there is no CISA KEV listing indicating active exploitation.
Authenticated attackers with Subscriber-level access or above can bind a fresh installation of the Call Now Button WordPress plugin (versions up to and including 1.5.3) to an attacker-controlled nowbuttons.com account and inject malicious buttons, due to a missing capability check on the plugin's activate function. The flaw only affects fresh installs where no nowbuttons.com API key has been configured, and it requires a low-privilege account, resulting in a low-to-moderate risk rating (CVSS 4.3, EPSS 0.23%). No public exploit code has been identified at time of analysis.
Cross-site request forgery in Jenkins Themis Plugin 1.4.1 and earlier lets an attacker cause an affected Jenkins controller to open an outbound connection to an attacker-specified HTTP server by luring a victim into visiting malicious web content. The affected endpoint performs no CSRF validation, so the forged request is executed in the security context of the victim's active Jenkins session; the CVSS vector (AV:N/AC:L/PR:N/UI:R) means the attacker needs no credentials but must persuade a logged-in user to interact with attacker-controlled content. Impact is confined to integrity (C:N/I:L/A:N), EPSS is only 0.23% (percentile 12), and no public exploit code or confirmed active exploitation has been identified at time of analysis (CISA KEV: not listed).
Information disclosure in Arista EOS allows authenticated low-privilege (restricted) users to view sensitive configuration database contents, including user password hashes, through a debug API. With a CVSS score of 4.3 and a low EPSS score of 0.22%, this is a moderate-risk flaw that requires a valid restricted account and is read-only in impact; no public exploit has been identified at time of analysis.
Cross-site request forgery in the Jenkins Nexus Task Runner Plugin 0.9.2 and earlier lets an attacker force an outbound connection to an attacker-specified URL using attacker-specified credentials, riding the session of a logged-in Jenkins user who is tricked into loading hostile web content. Successful abuse requires victim interaction plus a concurrently authenticated Jenkins session holding the relevant configuration permissions, and the impact is limited to unauthorized outbound requests and credential use rather than code execution or data disclosure. EPSS is low at roughly 0.21% (10th percentile), there is no CISA KEV entry, and no public exploit identified at time of analysis.
Cross-site request forgery in the Jenkins Start Windocks Containers Plugin 1.4 and earlier lets an attacker cause the Jenkins controller to open an outbound connection to a URL of the attacker's choosing by luring a victim into submitting a forged request. The assessed impact is limited to the integrity of that connection endpoint (CVSS 4.3, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) - an SSRF-style issue rather than code execution or data disclosure - and it only succeeds when Jenkins' default CSRF crumb protection is disabled or bypassable and a victim with an active authenticated session is socially engineered. EPSS is very low (0.21%, 10th percentile), there is confirmed actively exploited status absent from CISA KEV, and no public exploit identified at time of analysis; this makes it a moderate-to-low priority, and the multiple signals agree rather than conflict.
Jenkins OpenShift Pipeline Plugin 1.0.57 and earlier exposes OpenShift authorization tokens in cleartext within job config.xml files, allowing users with Item/Extended Read permission or controller filesystem access to read those credentials. Exploitation requires an authenticated Jenkins user with that specific permission and a configured token, so impact is low-to-moderate information disclosure; no public exploit identified at time of analysis, and EPSS is 0.20% (9th percentile).
Cleartext storage of CurseForge API keys in Jenkins Curseforge Publisher Plugin 1.0 writes the secret in plaintext into each configured job's config.xml on the Jenkins controller, allowing users who hold Item/Extended Read permission on that job - or anyone with read access to the controller filesystem - to retrieve the key. The issue is remote and network-reachable but requires low privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, score 4.3), is an information-disclosure-only condition with no code execution or integrity/availability impact, and there is no public exploit identified at time of analysis and no confirmed active exploitation (EPSS 0.17%, 6th percentile). Realistic exposure is limited to the confidentiality of the CurseForge API key and whatever that key authorizes on CurseForge, and only when a key has actually been configured in a job.