Missing authorization checks in wpdevart Booking Calendar WordPress plugin (versions ≤ 3.2.30) allow unauthenticated remote attackers to modify appointment booking data, resulting in low integrity impact. The vulnerability has a CVSS base score of 5.3, EPSS score 0.05% (16th percentile), and no known active exploitation or public exploit code.
Missing authorization in the Woffice Core WordPress plugin ≤5.4.30 allows unauthenticated remote attackers to cause limited denial-of-service (availability impact) by exploiting incorrectly configured access control. No confidentiality or integrity impact has been identified. EPSS indicates very low exploitation probability (0.05%) and no active exploitation or public exploit code is known.
Missing authorization in Post SMTP WordPress plugin (≤3.6.1) allows unauthenticated remote attackers to perform restricted administrative actions due to improperly enforced access control on one or more plugin endpoints. Reported by Patchstack and tracked as CWE-862, the flaw permits integrity-affecting operations without requiring any authentication or user interaction. No public exploit code exists and EPSS sits at 0.05% (16th percentile), indicating low observed exploitation interest at time of analysis.
Unauthorized information disclosure in the Yandex.Metrica WordPress plugin (versions up to 1.2.2) allows unauthenticated attackers to access sensitive data via missing authorization checks. No public exploit code or active exploitation has been identified at this time; the EPSS probability of exploitation is very low (0.05%).
Missing authorization in ListingPro Lead Form plugin for WordPress enables unauthenticated attackers to modify lead data due to improper access controls. Affects versions up to 1.0.7. No active exploitation or public proof-of-concept has been identified at time of analysis, and the EPSS score of 0.05% indicates low current exploitation probability, though the remote unauthenticated nature makes the vulnerability easily exploitable if targeted.
Missing authorization in the Traveler WordPress theme (<=3.2.6) allows unauthenticated attackers to perform actions with low integrity impact, bypassing access controls. No active exploitation or public exploit was identified at time of analysis, and EPSS indicates very low exploitation probability.
Missing authorization in the WP ERP plugin for WordPress versions up to 1.16.7 allows unauthenticated remote attackers to bypass access controls and modify data. The vulnerability has a CVSS 5.3 rating and only impacts integrity, with no confidentiality or availability loss. No active exploitation or public proof-of-concept is known, and the EPSS score is very low at 0.05%.
Unauthenticated information disclosure in the Hype WordPress plugin (versions <=1.0.5) arises from a missing authorization check, allowing remote attackers to access restricted data. No active exploitation or public exploit code is reported, and EPSS estimates a very low exploitation likelihood (0.05%), making this a low-priority issue for most organizations unless the exposed information is highly sensitive.
Missing authorization controls in IDonate WordPress plugin through version 2.1.15 allows unauthenticated remote attackers to access sensitive information due to incorrectly configured access control security levels. The vulnerability has a low EPSS score (0.04%, 13th percentile) and no public exploit code or active exploitation is documented, indicating limited real-world attack incentive despite network-accessible attack surface.
WPForms Google Sheet Connector plugin through version 4.0.0 allows unauthenticated remote attackers to modify data by exploiting missing authorization checks on access control mechanisms. The vulnerability enables unauthorized manipulation of form submissions and Google Sheet integrations without proper permission validation, affecting WordPress installations using this plugin.
Media Library Assistant WordPress plugin through version 3.29 allows authenticated users to bypass authorization controls and access or modify content they should not have permission to reach via user-controlled keys in access control mechanisms. The vulnerability requires an authenticated user with limited privileges (PR:L) and affects confidentiality and integrity of stored media library data, though with relatively low exploitation probability (EPSS 0.04%) and no confirmed active exploitation at time of analysis.
Missing authorization in ExpressTech Systems Quiz And Survey Master WordPress plugin through version 10.3.2 allows unauthenticated remote attackers to read sensitive quiz and survey data by exploiting incorrectly configured access control security levels. The vulnerability is assigned CVSS 5.3 (moderate), affects the plugin across multiple versions, and enables unauthorized information disclosure without requiring authentication or user interaction.
Missing authorization in Easy Payment Payment Gateway for PayPal (woo-paypal-gateway) WordPress plugin versions up to 9.0.53 allows unauthenticated remote attackers to access sensitive payment gateway data through improper access control configuration. The vulnerability enables unauthorized information disclosure with low confidentiality impact. EPSS score of 0.04% indicates minimal observed exploitation probability despite network accessibility and no authentication requirement.
Missing authorization in Eupago Gateway For Woocommerce allows unauthenticated remote attackers to modify data via incorrectly configured access control, affecting versions up to 4.7.1. The vulnerability enables integrity compromise without requiring authentication or user interaction, though with low attack complexity. EPSS scoring of 0.04% indicates minimal real-world exploitation probability despite moderate CVSS severity.
Missing authorization controls in Mario Peshev WP-CRM System plugin up to version 3.4.6 allow unauthenticated remote attackers to modify data through incorrectly configured access control security levels. The CVSS 5.3 score reflects low integrity impact with no confidentiality or availability consequences, but the vulnerability exposes the plugin to unauthorized data manipulation attacks without authentication.
Bertha AI WordPress plugin through version 1.13 allows unauthenticated attackers to modify content via incorrectly configured access control, enabling unauthorized changes to website data without authentication. The vulnerability stems from missing authorization checks on sensitive operations, classified as CWE-862 (Missing Authorization). While CVSS scores 5.3 (medium severity), EPSS exploitation probability is minimal at 0.04%, indicating low real-world attack likelihood despite the straightforward attack vector.
Insertion of sensitive information into sent data in auxin-elements WordPress plugin versions up to 2.17.15 allows unauthenticated remote attackers to retrieve embedded sensitive data through network-accessible responses. The vulnerability exposes information with low confidentiality impact and affects the Shortcodes and extra features for Phlox theme plugin across all versions through 2.17.15, with EPSS scoring indicating 0.04% likelihood of exploitation.
Arbitrary shortcode execution in GiveWP plugin for WordPress up to version 4.13.1 allows unauthenticated remote attackers to inject and execute arbitrary shortcodes, potentially leading to information disclosure or full code execution depending on the site's installed shortcodes. The vulnerability is categorized as code injection (CWE-94) with a CVSS base score of 5.3, reflecting only confidentiality impact in the official scoring, though advisory tags suggest RCE capability. No active exploitation or public exploit code is known, and EPSS predicts a very low 0.04% exploitation probability.
Cross-site scripting in Talent Software e-BAP Automation (versions 1.8.96 through pre-v.41815) allows unauthenticated remote attackers to inject arbitrary JavaScript into web pages served by the application. The CVSS vector assigns UI:N (no user interaction required), which is atypical for XSS and may suggest a stored or persistent injection variant that auto-executes rather than a reflected type requiring a victim to click a crafted link. No public exploit identified at time of analysis, and the EPSS score of 0.03% (10th percentile) signals very low current exploitation interest; however, the unauthenticated network exposure warrants patching in internet-facing deployments.
Spoofing via UI misrepresentation in Microsoft Exchange Server 2016 and Exchange Server Subscription Edition allows unauthenticated network attackers to falsify critical sender or authentication information as rendered by the Exchange interface. Rooted in CWE-451 (UI Misrepresentation of Critical Information), the flaw enables an attacker to craft messages or interactions that Exchange presents deceptively, undermining trust signals recipients rely upon to distinguish legitimate from malicious communications. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog; however, the PR:N/AC:L vector means exploitation requires no credentials and minimal attacker sophistication.
Server-Side Request Forgery in ThemesInflow Hercules Core plugin for WordPress allows authenticated, low-privilege attackers to forge server-side requests. Exploitation is complex and yields only limited confidentiality and integrity impact on internal services. No public exploit or active exploitation has been reported.
Open redirect in CRM Perks WP Gravity Forms FreshDesk Plugin up to 1.3.5 allows unauthenticated attackers to craft URLs that redirect users to arbitrary untrusted sites, facilitating phishing attacks. The vulnerability has no known active exploitation or public exploit, and EPSS indicates a very low exploitation probability.
Missing authorization in Elated-Themes The Aisle WordPress theme version 2.9 and below allows authenticated low-privilege users to modify data without proper permission checks. The vulnerability, rated Medium (CVSS 4.3), requires a valid user account but no other preconditions; it has a low EPSS score (0.07%) and is not known to be actively exploited.
Missing authorization in the Powerlift theme for WordPress allows authenticated attackers with low privileges to bypass access controls and perform unauthorized modifications to theme data. The vulnerability affects all versions prior to 3.2.1 and requires only a valid WordPress user account to exploit. No active exploitation or public exploit code has been identified, and the EPSS score suggests low real-world exploitation probability.
Insufficient access controls in Webba Booking plugin for WordPress (versions up to 6.2.1) allow authenticated attackers with low privileges to modify booking data. EPSS score is low, and no active exploitation is reported.
Authorization bypass through user-controlled key in ThimPress Thim Elementor Kit plugin up to version 1.3.3 allows authenticated attackers to modify data via insecure direct object references. The vulnerability has a CVSS base score of 4.3, a low EPSS exploitation probability (0.07%), and no known public exploit or active exploitation.
Missing authorization in Fluent Booking WordPress plugin through version 1.9.11 allows authenticated low-privileged users to modify data without proper access controls. This integrity-only flaw can lead to unauthorized changes in booking information on affected sites.
Missing authorization in the Trinity Audio WordPress plugin up to version 5.23.3 allows authenticated attackers with low privileges to modify plugin data without the required capabilities, leading to potential integrity issues on affected sites. The vulnerability has a medium CVSS score of 4.3 and a very low EPSS exploitation probability (0.05%), with no evidence of active exploitation or public exploit code at this time.
Missing authorization in the WooCommerce Thank You Page Customizer plugin (versions <= 1.1.8) allows authenticated attackers with low privileges to view thank-you page customization data that should be restricted to administrators. The vulnerability, categorized as CWE-862, has a CVSS score of 4.3 (medium) and a very low EPSS exploitation probability (0.05%), with no evidence of active exploitation or public proof-of-concept code.
Improper access control in Metagauss EventPrime (WordPress event calendar plugin) up to version 4.2.4.1 allows authenticated, low-privileged users (e.g., subscriber) to modify limited event data without proper authorization checks. The vulnerability carries a medium CVSS 4.3 severity, with no confidentiality or availability impact, and an EPSS score of 0.05% indicating a very low exploitation probability. No public exploit or active exploitation (CISA KEV) has been observed.
Authenticated information disclosure in ThimPress WP Hotel Booking plugin for WordPress up to version 2.2.7 allows low-privileged users to retrieve embedded sensitive data, such as configuration details. No active exploitation or public exploit code is known at this time, and EPSS indicates a very low probability of widespread exploitation.
Unauthorized data access in the cf7-salesforce WordPress plugin (Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms) up to version 1.4.6 allows low-privileged authenticated users to view sensitive information. The missing authorization vulnerability enables attackers with subscriber-level access to bypass access control security levels and access data they should not see. No active exploitation or public exploit has been identified, and the EPSS probability is very low.
Authenticated low-privilege users can exploit missing authorization in the VanKarWai Lobo WordPress theme through version 2.8.6, resulting in low-availability impact via broken access control. No public exploit or active exploitation has been reported; EPSS probability is very low (0.05%).
An authenticated low-privilege user on WordPress can exploit missing authorization checks in Elastic Email Sender plugin up to version 1.2.20 to cause availability disruption, such as disabling email sending functionality. This vulnerability, reported by Patchstack, carries a medium CVSS 4.3 but extremely low EPSS probability of exploitation, and no evidence of active exploitation exists.
Information disclosure in the My Tickets WordPress plugin through 2.1.0 allows authenticated attackers with low privileges to access sensitive data via a missing authorization check. The vulnerability has a CVSS base score of 4.3, low EPSS exploitation probability (0.05%), and is not listed in CISA KEV nor associated with public exploit code.
Missing authorization vulnerability in Actionwear Products Sync plugin for WordPress up to 2.3.3 allows authenticated attackers with low privileges to disrupt product synchronization operations. The flaw stems from improperly configured access control levels, leading to availability impact. No public exploit or active exploitation is known, and EPSS indicates very low exploitation probability.
Authenticated low-privilege users can modify calendar data in My Calendar WordPress plugin versions <= 3.6.16 due to missing authorization checks, allowing unauthorized integrity impact. The flaw has a CVSS score of 4.3, very low exploitation probability (EPSS 0.05%), and no known active exploitation or public exploit code at time of analysis.
Unauthenticated modification of invoice data in the WooCommerce PDF Invoices & Packing Slips plugin version 4.9.1 and below allows authenticated low-privilege users (e.g., Shop Managers) to alter invoice or packing slip contents without proper authorization. This missing authorization vulnerability stems from a broken access control check, leading to integrity compromise of PDF documents. No exploitation in the wild or public proof-of-concept are known, and EPSS indicates very low likelihood (0.05%).
Missing authorization checks in Elementor Website Builder (WordPress plugin) through version 3.33.0 allow authenticated low-privilege users to perform actions beyond their intended access level. Exploitation requires a valid WordPress account with low privileges (PR:L per CVSS vector), and the impact is limited to partial integrity modification with no confidentiality or availability consequences. No public exploit code or active exploitation has been identified; EPSS places this at the 14th percentile, reflecting low real-world exploitation probability.
Xagio SEO WordPress plugin through version 7.1.0.35 contains a missing authorization vulnerability that allows authenticated users to perform unauthorized actions due to incorrectly configured access control security levels. The vulnerability has a CVSS score of 4.3 with low real-world exploitation probability (EPSS 0.04%), affecting authenticated users who can bypass intended access restrictions to modify plugin functionality or settings.
Missing authorization controls in the Notification for Telegram WordPress plugin through version 3.5 allow authenticated users to modify notification settings they should not have access to, resulting in limited integrity impact. The vulnerability requires valid user credentials (PR:L in CVSS vector) and affects the plugin's access control enforcement rather than authentication bypass. With an EPSS score of 0.04% and no confirmed active exploitation, this represents a low-probability real-world risk despite the authentication bypass tag.
Ergonet Cache plugin versions up to 1.0.13 allows authenticated users to bypass access control checks and modify unauthorized data due to missing authorization validation. The vulnerability requires user authentication (PR:L) but has low real-world risk per EPSS (0.04%), though it can lead to unauthorized content modification in affected WordPress installations.
Happy Addons for Elementor through version 3.20.3 allows authenticated users to access functionality they should not have permission to use due to missing authorization checks on API endpoints or admin functions. The vulnerability requires valid user authentication and results in information disclosure, with a CVSS score of 4.3 and an extremely low EPSS exploitation probability of 0.04%, suggesting minimal real-world attack incentive despite the access control flaw.
Porto Theme - Functionality plugin for WordPress (versions before 3.7.3) allows authenticated users to access sensitive information through broken access control, enabling privilege escalation or information disclosure without proper authorization checks. While the vulnerability requires valid WordPress credentials and has low CVSS severity (4.3), the confirmed patch availability and authentication requirement reduce immediate risk. No public exploit code or active exploitation has been identified at the time of analysis.
Authenticated users can access sensitive contact form data and functionality they should not have permission to view or modify due to missing authorization checks in Contact Form by BestWebSoft plugin versions up to 4.3.6. The vulnerability allows logged-in attackers with low-level privileges to bypass access controls and view contact information or modify form settings with only network access and no additional user interaction required. This is not actively exploited according to available intelligence, though the access control bypass pattern is a common attack vector.
Paysera WooCommerce Payment Gateway plugin through version 3.10.0 contains a missing authorization flaw allowing authenticated users with lower privilege levels to access or perform actions intended for higher-privilege roles, resulting in limited information disclosure. The vulnerability stems from incorrectly configured access control checks and has an EPSS score of 0.04% (11th percentile), indicating low real-world exploitation probability despite the CVSS 4.3 rating and authenticated attack vector.
A cross-site request forgery vulnerability in the CWW Companion WordPress plugin up to version 1.3.2 allows unauthenticated attackers to trick admin users into performing unintended actions, such as modifying plugin
Cross-site request forgery in vcita Online Booking & Scheduling Calendar plugin for WordPress versions <=4.5.5 enables an unauthenticated attacker to trick a logged-in administrator into performing unintended actions, such as modifying calendar settings, due to missing CSRF token validation. No known active exploitation or public exploit code exists; EPSS predicts very low exploitation likelihood (0.03%).
Cross-Site Request Forgery in the Quick Contact Form WordPress plugin through version 8.2.5 allows unauthenticated attackers to trick authenticated administrators into performing unintended actions, such as modifying form settings. No active exploitation or public exploit code is known, and EPSS indicates a very low probability of real-world exploitation.
Cross-site request forgery (CSRF) in the kubiq PDF Thumbnail Generator WordPress plugin (versions through 1.4) allows remote attackers to perform unauthorized actions on behalf of authenticated administrators via crafted requests. Successful exploitation requires user interaction, such as tricking an admin to click a link, and could result in limited integrity impact, like altering plugin settings. No public exploit code or active exploitation has been reported; EPSS indicates a very low exploitation probability.