Local file inclusion in Jobmonster theme (≤4.8.2) allows authenticated attackers to include arbitrary local files, potentially exposing sensitive data or achieving code execution via chaining. The vulnerability requires low-privileged access (PR:L) and high attack complexity (AC:H), reducing real-world exploitability. EPSS score 0.22% suggests low exploitation probability, and no active exploits are confirmed.
Authenticated local file inclusion in Select Core WordPress plugin versions <2.6 allows low-privileged attackers to include arbitrary local files. Under certain configurations, this can escalate to full site compromise, including information disclosure and code execution. At time of analysis, no public exploit or active exploitation has been identified; CVSS 7.5 and EPSS 0.22% indicate a high-severity but currently low-probability risk.
Local File Inclusion in Dream-Theme's The7 WordPress theme (versions prior to 12.8.1.1) allows authenticated attackers with low privileges to read arbitrary server files through improper filename validation in PHP include statements. With a 0.17% EPSS score and no confirmed active exploitation, this represents a moderate risk primarily in shared hosting environments where authenticated users exist. The 7.5 CVSS score reflects high confidentiality and integrity impact, though exploitation requires high attack complexity and authenticated access.
Local file inclusion in WordPress UDesign Core plugin up to 4.14.0 allows authenticated low-privilege attackers to include arbitrary local files, potentially exposing sensitive data or enabling code execution. The vulnerability requires high attack complexity and is not known to be actively exploited, but carries high impact if successfully leveraged.
A local file inclusion vulnerability in the Ronneby Theme Core WordPress plugin (≤1.5.68) allows authenticated low-privilege attackers to include arbitrary local PHP files, potentially leading to sensitive data exposure or code execution. Exploitation requires an account on the WordPress site and high attack complexity due to filename manipulation. No active exploitation or public exploit code has been reported.
Local file inclusion in the Urna WordPress theme version 2.5.12 and earlier allows authenticated low-privilege users to include arbitrary local files, potentially leading to remote code execution. The vulnerability is not known to be actively exploited and has a very low EPSS score, though the CVSS base score is 7.5 due to potential for full system compromise.
A serialization bug in matrix-sdk-base allows remote attackers to cause denial-of-service by sending rooms with custom m.room.join_rules values, which stalls the sync process and prevents all room processing. The vulnerability affects matrix-sdk-base versions 0.14.1 and prior and has a high availability impact (CVSS 7.5) with a patch available in version 0.16.0. With a low EPSS score of 0.06% and no KEV listing, this represents a moderate real-world risk primarily concerning service availability rather than active exploitation.
Downloads Panel in Mozilla Firefox and Thunderbird allows remote spoofing attacks enabling integrity compromise without authentication. Affects Firefox <146, Thunderbird <146, Firefox ESR <140.7, and Thunderbird ESR <140.7. The authentication bypass flaw (CWE-290) permits network-based attackers to manipulate download information displayed to users with low attack complexity and no user interaction required. Despite CVSS 7.5 (High), EPSS score of 0.02% (3rd percentile) indicates minimal real-world exploitation likelihood. No active exploitation confirmed (not in CISA KEV), and no public exploit identified at time of analysis.
Privilege escalation in Microsoft Exchange Server 2016 (and Subscription Edition per vendor tagging) allows an authenticated attacker on the network to elevate privileges through improper input validation (CWE-20). The flaw carries a CVSS 7.5 score with high impact to confidentiality, integrity, and availability, though attack complexity is rated High. No public exploit identified at time of analysis.
Local memory-safety flaw in the Linux kernel's AMD GPU (amdgpu) driver allows an authenticated local user to submit a user queue (userq) whose buffer virtual address and size are not validated against a legitimate VM mapping. Because the driver failed to confirm the userq object resides in a valid GPU virtual-memory mapping before use, a low-privileged process with GPU device access could reference out-of-bounds or unmapped memory, tagged as an information-disclosure issue with additional integrity and availability impact. No public exploit identified at time of analysis; EPSS is low (0.19%, 9th percentile), consistent with a local-only kernel driver bug rather than a mass-exploited network flaw.
JIT compiler miscompilation in Mozilla Firefox and Thunderbird's JavaScript engine enables remote attackers to achieve limited confidentiality, integrity, and availability impact without authentication or user interaction. Affects Firefox < 146, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird ESR < 140.6. Vendor-released patches available in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6. No public exploit identified at time of analysis, with EPSS score of 0.11% (30th percentile) indicating low predicted exploitation probability.
Memory corruption vulnerabilities in Mozilla Firefox 145 and Thunderbird 145 enable remote code execution via multiple memory safety bugs. Unauthenticated remote attackers can exploit these flaws (CWE-787 buffer overflow) through network-based attack vectors with low complexity, requiring no user interaction. Mozilla has released patches in Firefox 146 and Thunderbird 146. EPSS score of 0.07% (21st percentile) suggests low observed exploitation probability, and no public exploit identified at time of analysis, though the vendor's assessment indicates memory corruption with exploitable potential.
A critical remote code execution vulnerability exists in CSLA .NET framework versions 5.5.4 and below due to insecure deserialization when using WcfProxy with the obsolete NetDataContractSerializer. This vulnerability allows unauthenticated remote attackers to execute arbitrary code on affected systems without user interaction, potentially leading to complete system compromise. While no active exploitation has been reported in CISA KEV and no public POC is mentioned, the vulnerability's network-exposed nature and low attack complexity make it a high-priority security concern.
Authenticated OS command injection in Fortinet FortiSandbox (versions 5.0.0-5.0.2, 4.4.0-4.4.7, all 4.2.x, all 4.0.x) and FortiSandbox Cloud (24.1 and all 23.x) allows a high-privileged remote attacker to execute arbitrary commands by sending crafted HTTP/HTTPS requests to the management interface. No public exploit identified at time of analysis and the issue is not currently listed in CISA KEV, but the breadth of affected major versions and the network-reachable attack surface make this a notable post-authentication risk for security appliance operators.
Stored cross-site scripting in the Themify Portfolio Post WordPress plugin through version 1.3.0 allows authenticated attackers to embed arbitrary web scripts into portfolio items, which execute in victims’ browsers upon viewing. This can enable session theft, credential capture, or malicious redirects. No active exploitation or public exploit code has been reported, and the EPSS exploitation probability is low (0.06%).
We are tasked with synthesizing data about CVE-2025-67534 into a comprehensive JSON analysis. We must use ALL provided data: references, EPSS, KEV status (not mentioned, assume false), patch availability, CPE strings (none provided), and tags (CSRF, XSS). First, parse the description: "Cross-Site Request Forgery (CSRF) vulnerability in Jacques Malgrange Rencontre rencontre allows Stored XSS. This issue affects Rencontre: from n/a through <= 3.13.7." CVSS: 7.1, vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. CWE-352. EPSS: 0.03% (low). No KEV mentioned, so not actively exploited. No POC data. Patch? Reference is a Patchstack database entry for a WordPress plugin. We need to infer patch availability. The reference URL likely describes the vulnerability and might say if a patch exists. Since no explicit fix version is mentioned beyond "<= 3.13.7", it's probable that the next version after 3.13.7 is a fix, but not confirmed. I'll say "Patch availability not confirmed; likely fix in version >3.13.7" but careful: rule says "If patch data says NOT available: 'No vendor-released patch identified at time of analysis'". We don't have explicit patch data. I'll note: "Upstream fix not independently confirmed; likely version after 3.13.7 addresses the issue" but avoid inventing version numbers. For remediation, I can say "Upgrade to Rencontre version 3.13.8 or higher if available, or apply vendor-provided patch" but careful: we only know <= 3.13.7 affected, so fix version would be 3.13.8. Patchstack might indicate the fix version. Since the reference is a Patchstack URL, they usually show the fixed version. So I'll assume the fix is in a later version. I'll state: "Vendor patch likely available in version 3.13.8 or later" but the rule says to cite exact fix versions from input data. The input data doesn't mention a specific fix version, only "through <= 3.13.7". I'll check: "Patch available per vendor advisory" would fit if the advisory says patch available. The reference URL is
Cross-Site Request Forgery in WordPress New User Approve plugin (versions ≤3.2.3) enables unauthenticated remote attackers to trick authenticated administrators into executing unauthorized actions via crafted requests. With EPSS probability of 0.02% (5th percentile) and no evidence of active exploitation (not in CISA KEV), this represents a moderate real-world risk despite a CVSS 7.1 score. The vulnerability requires user interaction (UI:R) but no attacker privileges (PR:N), making it viable through social engineering tactics like phishing emails containing malicious links.
Cross-site request forgery (CSRF) in Create Posts & Terms WordPress plugin through version 1.3.1 enables attackers to inject malicious scripts that persist in the application database. Exploitation requires tricking an authenticated administrator into visiting a malicious page while logged into WordPress. The vulnerability chains CSRF with stored XSS, allowing attackers to execute arbitrary JavaScript in victims' browsers across sessions with potential for privilege escalation, data theft, and site compromise. EPSS score and exploitation data not available, but Patchstack database listing indicates security researcher disclosure.
Deserialization of untrusted data in WP Maps WordPress plugin versions up to 4.8.6 allows high-privileged authenticated users to inject and instantiate arbitrary PHP objects, potentially leading to code execution or privilege escalation. While the CVSS score of 6.5 reflects high confidentiality and integrity impact, the requirement for administrator-level privileges (PR:H) and user interaction (UI:R) significantly constrains real-world exploitability. EPSS score of 0.04% indicates minimal observed exploitation likelihood despite the vulnerability's technical severity.
Stored cross-site scripting vulnerability in the WP-ShowHide WordPress plugin (versions through 1.05) allows authenticated attackers with contributor-level access to inject arbitrary web scripts. When a
Stored cross-site scripting in the REHub Framework WordPress plugin versions below 19.9.9.7 permits authenticated attackers to inject malicious scripts. When a victim, such as an administrator, views the tainted content, the script executes in their browser, potentially stealing session data or performing actions on their behalf. The vulnerability has a low EPSS score (0.06%) and no public exploit or reported active exploitation.
DOM-based Cross-Site Scripting in the CridioStudio ListingPro Lead Form plugin for WordPress allows authenticated attackers with low privileges to inject arbitrary JavaScript into pages viewed by other users. Exploitation requires the attacker to submit crafted input via the vulnerable lead form and convince a victim to visit a page where the tainted data is rendered unsafely, enabling session hijacking, phishing, or browser-based attacks. No active exploitation or public exploit code has been identified.
Missing authorization in WP Delicious plugin versions up to 1.9.1 enables authenticated attackers with low privileges (e.g., subscriber) to modify data with high integrity impact. This WordPress plugin vulnerability (CWE-862) has a CVSS base score of 6.5, no confidentiality impact, and requires no user interaction. At this time, no public exploit code or active exploitation has been reported.
DOM-based cross-site scripting (XSS) in muffingroup Betheme WordPress theme versions up to 28.2 allows authenticated attackers with low privileges to inject malicious scripts that execute in the context of other users' browsers. The vulnerability requires user interaction (UI:R) and affects the confidentiality, integrity, and availability of affected installations; EPSS exploitation probability is low at 0.04%, and no public exploit code or active exploitation has been confirmed.
DOM-based cross-site scripting in Dream-Theme The7 WordPress theme versions before 12.9.0 allows authenticated users to inject malicious scripts that execute in the context of other users' browsers via improperly sanitized input during web page generation. The vulnerability requires user interaction (UI:R) and authenticated access (PR:L), limiting real-world exploitability despite a moderate CVSS score of 6.5. EPSS exploitation probability is low at 0.04th percentile, and no public exploit code or active exploitation has been reported.
Stored cross-site scripting (XSS) in Master Addons for Elementor through version 2.0.9.9.4 allows authenticated users with limited privileges to inject malicious scripts that execute in the browsers of other site visitors, potentially compromising administrator accounts or stealing sensitive data. The vulnerability requires user interaction (UI:R) and affects the plugin's input sanitization during web page generation. With an EPSS score of 0.04% and no confirmed active exploitation, this represents a lower real-world risk despite the moderate CVSS base score of 6.5.
Stored cross-site scripting (XSS) in SimpLy Gallery WordPress plugin (versions up to 3.3.2.1) allows authenticated users with low privileges to inject malicious scripts that execute in the browsers of other site visitors, potentially leading to session hijacking, credential theft, or site defacement. The vulnerability requires user interaction (UI:R) and affects confidentiality, integrity, and availability. No public exploit code or active exploitation has been confirmed; EPSS score of 0.04% indicates low real-world exploitation probability despite the moderate CVSS rating.
Stored cross-site scripting (XSS) in Generic Elements for Elementor plugin versions 1.2.9 and earlier allows authenticated users with limited privileges to inject malicious scripts that execute in the context of other users' browsers, potentially leading to session hijacking, credential theft, or malware distribution. The vulnerability requires user interaction (clicking a malicious link) and affects WordPress installations using this plugin. EPSS exploitation probability is low at 0.04%, and no public exploit code or active exploitation has been identified.
Same-origin policy bypass in Firefox and Thunderbird request handling allows unauthenticated remote attackers to access sensitive information from cross-origin resources with low attack complexity and no user interaction required. The vulnerability affects Firefox versions below 146, Firefox ESR below 115.31 and 140.6, Thunderbird below 146, and Thunderbird ESR below 140.6. No public exploit code has been identified at time of analysis, and the EPSS score of 0.04% indicates low real-world exploitation probability despite the moderate CVSS rating.
DOM-based cross-site scripting in WordPress plugin WP Ultimate Review versions ≤2.3.7 allows remote attackers to execute malicious JavaScript in victims' browsers via crafted input that is improperly sanitized during client-side page rendering. The vulnerability requires user interaction (CVSS UI:R) but no authentication (PR:N), enabling attacks via social engineering or malicious links. Exploitation probability is low (EPSS 0.04%, 14th percentile), with no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV).
A Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Add Custom Codes (versions through 4.80) allows unauthenticated attackers, with no privileges, to trick a site administrator into executing unintended requests. Successful exploitation leads to high integrity impact—attackers can modify plugin settings, potentially injecting malicious content. No evidence of active exploitation or public exploit code exists, and the EPSS probability is extremely low (0.03%).
Stored cross-site scripting (XSS) in Porto Theme - Functionality plugin for WordPress allows authenticated users with low privileges to inject malicious scripts into web pages that execute in the browsers of other site visitors. The vulnerability affects Porto Theme - Functionality versions below 3.7.3 and has a low exploitation probability (EPSS 0.01%), but requires user interaction and authenticated access to exploit, limiting immediate risk to well-managed WordPress installations with access controls.
DOM-Based Cross-Site Scripting (XSS) in KALLYAS WordPress theme versions below 4.25.0 allows authenticated users with low privileges to inject malicious scripts that execute in the browsers of other users, potentially stealing session cookies, credentials, or performing unauthorized actions on their behalf. The vulnerability requires user interaction (clicking a malicious link) and affects the theme's web page generation routines. EPSS probability is 0.01% (very low), suggesting minimal real-world exploitation likelihood despite the moderate CVSS score of 6.5.
Stored or reflected cross-site scripting in phpIPAM v1.7.3 enables remote unauthenticated attackers to inject malicious JavaScript into the Request IP form via the `instructions` parameter, which is subsequently rendered in the admin-facing `/app/admin/instructions/edit-result.php` endpoint. When an authenticated administrator views the affected page, the injected script executes in their browser session, potentially enabling session token theft, credential harvesting, or unauthorized administrative actions. No public exploit identified at time of analysis, though a technical disclosure post exists at glitch0ne.com; EPSS of 0.22% at the 13th percentile confirms low opportunistic exploitation pressure.
Stored cross-site scripting (XSS) in @tiptap/extension-link before version 2.10.4 allows attackers to execute arbitrary JavaScript by injecting javascript: URL payloads into link attributes during link creation or modification. The vulnerability requires user interaction to trigger the payload and impacts the integrity of affected web applications. Publicly available exploit code exists, and a vendor-released patch is available in version 2.10.4.
Stored cross-site scripting in the Rencontre WordPress plugin up to version 3.13.7 allows authenticated attackers with high privileges to inject malicious scripts into fields rendered on pages accessed by other users. Successful exploitation could lead to session hijacking, data exfiltration, or defacement when victims view the affected content. No active exploitation or public exploit code has been confirmed at this time.
Stored cross-site scripting (XSS) in the WP eBay Product Feeds WordPress plugin (≤3.4.9) allows authenticated attackers with high privileges to inject malicious scripts into pages viewed by other users. The vulnerability affects all versions up to and including 3.4.9. Public exploit availability is unknown and EPSS indicates very low exploitation probability (0.06%).
Stored cross-site scripting (XSS) in the Calendly Embedder WordPress plugin (versions ≤ 1.1.7.2) allows authenticated administrators to inject malicious scripts that execute in other users' browsers when viewing affected pages. The vulnerability requires high privileges and user interaction, resulting in low confidentiality, integrity, and availability impact. No active exploitation or public exploit code is known, and EPSS indicates a 0.06% probability of exploitation.
Stored XSS in Make Section & Column Clickable For Elementor WordPress plugin (versions through 2.4) allows authenticated users with high privileges to inject malicious scripts that execute in other users' browsers. The vulnerability requires user interaction (UI:R) and affects site confidentiality, integrity, and availability with limited scope. EPSS score of 0.04% indicates low exploitation probability despite the presence of a public vulnerability disclosure.
DOM-based cross-site scripting (XSS) in ThimPress WP Hotel Booking plugin versions up to 2.2.8 allows authenticated users with high privileges to inject malicious scripts that execute in the context of other users' browsers. The vulnerability requires user interaction (UI:R) and high administrator privileges (PR:H), limiting its real-world impact despite a moderate CVSS score of 5.9. EPSS exploitation probability is very low at 0.04%, indicating minimal practical attack likelihood.
Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.3.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Incorrectly configured access control in WebCodingPlace Image Caption Hover Pro allows authenticated attackers with low privileges to modify plugin data and disrupt service. The vulnerability affects all plugin versions prior to 20.0 and requires only a low-privilege account on the WordPress site. Exploitation probability is very low (EPSS 0.05%) and no active attacks are reported.
Broken access control in the Listdom WordPress plugin up to version 5.0.1 allows authenticated low-privileged attackers to modify data and potentially disrupt service, as missing authorization checks can be exploited without user interaction. No active exploitation or public exploit has been reported at the time of analysis, and EPSS indicates a very low probability (0.05%) of exploitation.
This WordPress plugin (versions ≤4.3.1) misses authorization checks on its order delivery date update functionality, allowing unauthenticated attackers to modify delivery dates and cause limited disruption after tricking a user into clicking a crafted link. The vulnerability requires targeted user interaction but no privileges, and while no active exploitation or public exploit is known at this time, the low EPSS score (0.05%) indicates minimal immediate risk.
Low-privilege WordPress users can modify booking data and disrupt scheduling in vcita Meeting Scheduler plugin versions up to 4.5.5 due to missing authorization checks. Exploitation requires an authenticated subscriber-level account but has no user interaction, allowing unauthorized integrity and availability impact. No active exploitation or public exploit code has been identified.
A missing authorization check in the Steve Truman Page View Count WordPress plugin (≤ 2.9.0) allows authenticated attackers with low privileges to modify plugin settings without appropriate access controls. This can lead to limited integrity and availability impacts, such as disrupting plugin functionality or altering its behavior. The vulnerability has a low EPSS exploitation probability (0.05%) and is not known to be actively exploited in the wild.
Missing authorization in themezaa Litho Addons for WordPress (versions through 3.5) allows authenticated users to bypass access controls and gain unauthorized read/write access to sensitive data. The vulnerability stems from incorrectly configured access control security levels that fail to properly validate user permissions before exposing functionality. With an EPSS score of 0.04% and CVSS 5.4, exploitation requires valid authentication but no advanced attack complexity; this represents a moderate privilege escalation risk for multi-user WordPress installations.
Missing authorization in Яндекс Доставка (Boxberry) WordPress plugin version 2.34 and earlier allows authenticated users to access or modify resources they should not be permitted to via incorrectly configured access control. An attacker with valid credentials can exploit broken access control mechanisms to view or modify sensitive data without proper privilege validation, though the CVSS 5.4 score reflects limited direct impact (confidentiality and integrity), and the 0.04% EPSS score indicates low real-world exploitation probability.
Privilege escalation through missing authorization in the WordPress Debug Log Viewer plugin (≤2.0.3) allows authenticated low-privilege users to view and modify debug logs, exposing sensitive data such as database credentials or error details. No active exploitation or public PoC is currently known, and the EPSS score is extremely low (0.03%).
Reflected XSS in Talent Software's e-BAP Automation platform (versions before build 42957) allows unauthenticated remote attackers to inject and execute malicious scripts in a victim's browser by tricking them into clicking a crafted URL. The CVSS vector (PR:N/UI:R) confirms no attacker authentication is needed, but successful exploitation depends on social-engineering a valid application user. No active exploitation has been confirmed (not in CISA KEV) and EPSS sits at 0.02% (7th percentile), indicating low near-term exploitation probability.