Reflected cross-site scripting in Talent Software UNIS allows unauthenticated remote attackers to inject and execute malicious JavaScript in a victim's browser session. All UNIS versions prior to build 42957 are affected, as disclosed by Turkey's national CERT (USOM). No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.02% (7th percentile) indicates very low observed exploitation probability.
Cross-site request forgery in GiveWP plugin through version 4.13.1 allows remote attackers to trick authenticated administrators into performing unauthorized actions, such as tampering with donation settings. The vulnerability requires user interaction and has a medium CVSS score of 5.4, with no active exploitation or public proof-of-concept identified. EPSS probability is very low at 0.02%.
Missing authorization in the Quick Interest Slider WordPress plugin (≤ 3.1.7) allows unauthenticated attackers to modify slider configuration data over the network. No active exploitation or public exploit code has been identified, and EPSS indicates a low exploitation probability (0.07%).
Unauthorized modification of plugin settings in Virtuaria PagSeguro for WooCommerce up to version 3.6.3 allows unauthenticated, remote attackers to alter sensitive data such as payment gateway configurations. This missing authorization vulnerability (CWE-862) has a low integrity impact with no confidentiality or availability impact. No active exploitation or public exploit code has been identified at time of analysis, and EPSS indicates a low probability of exploitation.
Improper HTML tag neutralization in sevenspark Contact Form 7 - Dynamic Text Extension through version 5.0.5 allows unauthenticated remote attackers to inject malicious scripts via a network-based attack with no user interaction required, resulting in confidentiality compromise through information disclosure. The vulnerability is classified as cross-site scripting (XSS) with low exploitability probability (EPSS 0.06%, percentile 18%), suggesting limited real-world attack incentive despite the network-accessible attack vector.
Missing access control in ConveyThis WordPress plugin through version 269.2 allows authenticated users with low-level privileges to execute unauthorized actions with high confidentiality, integrity, and availability impact. The vulnerability stems from improper enforcement of authorization checks (CWE-862), enabling privilege escalation by exploiting misconfigured access control security levels. No public exploit identified at time of analysis, with EPSS score of 0.06% indicating low predicted exploitation probability.
Sensitive data exposure in the INFINITUM FORM Geo Controller (cf-geoplugin) WordPress plugin through version 8.9.4 allows unauthenticated remote attackers to retrieve embedded sensitive data via network requests. The vulnerability, categorized as CWE-201, has low detection complexity without user interaction. While no active exploitation (CISA KEV) or public proof-of-concept is reported, the EPSS probability is low at 0.06%, and the publicly disclosed Patchstack advisory indicates a fix is available.
Permission bypass in Wbcom Designs lock-my-bp WordPress plugin through 2.1.1 allows unauthenticated attackers to modify plugin settings or data due to missing authorization checks. This vulnerability, classified as CWE-862 Missing Authorization, enables unauthorized integrity impact with no confidentiality or availability consequences. The low EPSS score (0.05%) indicates limited exploitation likelihood, and no active exploitation or public exploit code has been reported.
Missing authorization in the TrueBooker WordPress plugin allows unauthenticated attackers to remotely modify appointment booking data. The vulnerability affects versions up to and including 1.1.0 and is classified as CWE-862. No active exploitation or public exploit is known, and EPSS estimates a very low exploitation probability (0.05%).
Unauthorized data modification in the Constant Contact + WooCommerce WordPress plugin through version 2.4.1 allows unauthenticated attackers to alter integration settings, potentially disrupting email marketing synchronisation. No public exploit code or active exploitation reported, and EPSS indicates very low exploitation probability.
Unauthorized data modification in the WP Email Capture plugin for WordPress up to version 3.12.4 allows unauthenticated attackers to alter email capture settings or data through missing authorization checks. The vulnerability has a CVSS base score of 5.3 with low integrity impact and no confidentiality or availability impact. No active exploitation or public proof-of-concept has been identified, and the vulnerability is considered low risk.
Unauthenticated integrity impact in Easy Form Builder plugin up to 3.8.20 allows remote attackers to modify form settings or data due to missing authorization checks. The vulnerability, classified as CWE-862 (Missing Authorization), poses a medium severity risk (CVSS 5.3) with low integrity impact. No active exploitation or public exploit code has been identified at this time.
Unauthenticated access to a restricted endpoint in the Sitewide Notice WP WordPress plugin (versions up to 2.4.1) allows attackers to exploit a missing authorization check, resulting in low-impact availability disruption. The vulnerability requires no credentials or user interaction, but the impact is limited to minor service degradation (e.g., toggling notice state). No public exploit code or active exploitation has been identified; EPSS indicates very low exploitation probability.
Missing authorization checks in wpdevart Booking Calendar WordPress plugin (versions ≤ 3.2.30) allow unauthenticated remote attackers to modify appointment booking data, resulting in low integrity impact. The vulnerability has a CVSS base score of 5.3, EPSS score 0.05% (16th percentile), and no known active exploitation or public exploit code.
Missing authorization in the Woffice Core WordPress plugin ≤5.4.30 allows unauthenticated remote attackers to cause limited denial-of-service (availability impact) by exploiting incorrectly configured access control. No confidentiality or integrity impact has been identified. EPSS indicates very low exploitation probability (0.05%) and no active exploitation or public exploit code is known.
We need to process the CVE and multi-source data, and produce a comprehensive JSON analysis following the strict guidelines. First, identify the product: "Post SMTP" by Saad Iqbal. That's a WordPress plugin. So product_name: "Post SMTP". Three words max, "Post SMTP" is two words. Summary: Need to synthesize a 2-3 sentence original summary. Not copy description. Description says: "Missing Authorization vulnerability in Saad Iqbal Post SMTP post-smtp allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post SMTP: from n/a through <= 3.6.1." It's a missing authorization (CWE-862). CVSS 5.3, network, low complexity, no privileges, no user interaction, scope unchanged, no confidentiality impact, low integrity, no availability. So the attack is remote, unauthenticated, and results in low integrity impact (maybe modify some data). EPSS 0.05%, low exploitation probability. No KEV, no POC mentioned. So no active exploitation. Summary should start with impact verb: "Unauthorized data modification in Post SMTP plugin for WordPress..." Actually CVSS says integrity low, so attacker can modify something. "Unauthorized data modification" or "Incorrect access control allows unauthenticated attackers to modify..." Since PR:N, unauthenticated. So: "Incorrect access control in Post SMTP plugin for WordPress versions up to 3.6.1 allows unauthenticated attackers to modify certain data." Need to be specific: What data? Possibly plugin settings? Not described. So could be "unauthorized modification of plugin data" or "unauthorized access to features". Keep generic "modify certain data or settings". Mention EPSS low, no active exploitation. So: "Post SMTP versions up to 3.6.1 are affected by a missing authorization vulnerability enabling remote, unauthenticated attackers to modify plugin data. The low EPSS score (0.05%) and lack of known public exploits suggest limited real-world exploitation." Technical context: Underlying technology: WordPress plugin using HTTP. CWE-862: Missing Authorization. The plugin likely has an endpoint or function that doesn't check user capabilities. CPE would be for WordPress plugin post-smtp. Use that. Educational: explain that WordPress plugins often rely on WordPress's nonce and capability checks, missing authorization occurs when a function is not properly protected, allowing unauthenticated requests to perform actions reserved for admins. So: "Post SMTP is a WordPress plugin that handles SMTP email delivery. The vulnerability (CWE-862) stems from a missing authorization check on one of its endpoints or functions, likely failing to verify WordPress user capabilities or nonces, thereby allowing unauthenticated HTTP requests to execute actions that modify plugin configuration or data." Risk assessment: CVSS vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. So network, no complexity, no privileges, no user interaction, scope unchanged, only low integrity impact. EPSS 0.05% (low). Not in KEV. No POC mentioned. So real-world risk seems low despite network attack vector because impact is only integrity low and no confidentiality/availability, and no known exploitation. SSVC: Exploitation none, Automatable likely (low complexity, no interaction), Technical Impact low (integrity low). So priority likely not high. Compare signals: CVSS 5.3 Medium, EPSS very low, no active exploitation. So it's a medium severity but low likelihood of exploitation. Could be that function is limited to changing a minor setting, not critical. State that given missing data, impact might be limited. Missing: unclear what data is modified; only integrity low means no privilege escalation or code execution. So "The vulnerability's medium CVSS score (5.3) is driven by low integrity impact; no confidentiality or availability loss. EPSS indicates only 0.05% probability of exploitation, and no active exploitation is reported. Given the low impact and no public exploit, it is unlikely a high priority for most organizations, but should be patched to prevent potential abuse." Affected products: list products with versions. Post SMTP plugin version <= 3.6.1. No CPE explicitly provided, but we can infer: a WordPress plugin with slug "post-smtp". Advisory: Patchstack link. So: "Post SMTP plugin for WordPress, all versions up to and including 3.6.1. The vendor advisory is available at https://patchstack.com/database/Wordpress/Plugin/post-smtp/vulnerability/wordpress-post-smtp-plugin-3-6-1-broken-access-control-vulnerability?_s_id=cve." Remediation: No patch version mentioned in input. Only description says "from n/a through <= 3.6.1", so presumably fixed in version 3.6.2 or later? Patch is available per Patchstack? The reference link likely leads to a page that says fixed in 3.6.2. But input does not include patch version. I need to use only provided data. The input says "Patch available" or "not available"? In the common CVE JSON, there might be a field, but here only tags "Authentication Bypass" and no patch availability info. So I can't claim there's a patch unless I see it. I must state: "No vendor-released patch version identified in provided data; however, the Patchstack advisory likely indicates a fix in a version above 3.6.1. Upgrade to the latest version of Post SMTP." But the instruction: "If patch data says NOT available: 'No vendor-released patch identified at time of analysis'". Since no explicit patch data, I'll say "No released patched version independently confirmed in provided data; users should check the vendor's changelog for a fix." Suggest upgrading to version >3.6.1, or if unavailable, as a workaround: "restrict access to the WordPress admin area by IP or use a web application firewall to block unauthorized requests to vulnerable endpoints, though this may not fully mitigate if the vulnerability is within otherwise legitimate paths." So remediation paragraph: "Upgrade to the latest version of Post SMTP as soon as a fix is available; the issue affects versions up to 3.6.1. As an interim measure, restrict access to WordPress admin pages or apply a WAF rule to block suspicious requests targeting plugin endpoints. Note that such workarounds may interfere with legitimate admin functionality." Exploit scenario: realistic: Attacker sends HTTP request to the vulnerable endpoint without authentication, exploiting missing authorization to modify plugin settings (e.g., change SMTP server to attacker-controlled server, possibly intercepting emails). 2-3 sentences: "An unauthenticated attacker sends a crafted HTTP request to a vulnerable Post SMTP endpoint, bypassing authorization checks due to the missing capability verification. This could allow modifying plugin options, such as the SMTP configuration, potentially redirecting outgoing emails to an attacker-controlled server. No proof-of-concept is publicly known at this time." Use fact that no POC. Exploitation conditions: Need specific prerequisites. CVSS says PR:N, so no authentication. UI:N, no user interaction. So it's remote unauthenticated attack against default configurations. But I need to state if any feature or configuration required. Description says "Missing Authorization vulnerability ... allows Exploiting Incorrectly Configured Access Control Security Levels." This phrase "Exploiting Incorrectly Configured Access Control Security Levels" might imply that the vulnerability is present when the plugin's access control is configured incorrectly? Actually the description from Patchstack often says that for missing authorization, they say "allows Exploiting Incorrectly Configured Access Control Security Levels" meaning the vulnerability stems from the plugin not properly enforcing access control, not from misconfiguration by user. So it's likely that the plugin itself has a missing authorization check, so no special conditions: "No special conditions — remote unauthenticated exploitation against default installations of Post SMTP plugin up to version 3.6.1." But the description might hint that the vulnerability exists because the plugin has an incorrectly configured access control, which is the vulnerability. So it's inherent. So I'll go with "No special conditions — remote unauthenticated exploitation is possible against default configurations of Post SMTP versions up to 3.6.1." Also mention limiting factor: the low integrity impact. Attack chain: Steps: Reconnaissance (identify target WordPress site with Post SMTP) -> Craft malicious HTTP request to vulnerable endpoint -> Exploit missing authorization to modify data -> (Integrity impact). 5-step: Recon -> Delivery -> Exploit -> Execution -> Impact. So: "Identify a WordPress site running Post SMTP ≤3.6.1" → "Send an unauthenticated HTTP POST request to the vulnerable AJAX endpoint" → "Bypass missing capability check due to CWE-862" → "Execute unauthorized action (e.g., modify plugin settings)" → "Attacker alters SMTP configuration or other data". Keep concise. Use provided data; note that the endpoint is not specified, but it's some endpoint. So: "Identify WordPress site with Post SMTP plugin → Send unauthenticated HTTP request to vulnerable endpoint → Missing authorization allows execution regardless of user role → Attacker modifies plugin configuration or data". That's 4 steps. Confidence notes: Confirm that Patchstack reported it, NVD may have assigned. No explicit vendor confirmation from Post SMTP author? The advisory is on Patchstack, so likely vendor coordinated. So "Vulnerability confirmed by Patchstack report; exact affected versions and patch status not provided in supplied data. Exploitation conditions inferred from CVSS vector (PR:N, UI:N). No public exploit code or active exploitation known." Good. Prevalence: WordPress plugin "Post SMTP" is a popular SMTP plugin with over 300,000 active installations? I need to estimate. I know Post SMTP is widely used; it's a plugin to send email via SMTP. So likely "high" prevalence. But I must base on product, not just guess. If I'm unsure, I'd say "medium" or "high". With 300k+ active installs, it's high. So prevalence: "high" and basis: "widely-deployed WordPress SMTP plugin with hundreds of thousands of active installations". Assessed CVSS vector: I need to provide my own independent CVSS 3.1 vector. The provided one is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. That seems reasonable: network, low complexity, no privileges, no interaction, no scope change, confidentiality none, integrity low (modify some data), availability none. So I'll adopt that same, because it's accurate. So assessed_cvss_vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N". But I need to justify: "Network accessible, low complexity, no privileges required, no user interaction, only integrity impact low." So rationale: "Requires no authentication or user interaction; impact limited to low integrity modification, consistent with missing authorization." Assessed CVSS 4.0 vector: Map to 4.0. CVSS 4.0 base vector: AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Because scope unchanged, so vulnerable system impact: VC:N, VI:L, VA:N; subsequent system all N. So vector: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N" Now, make sure no markdown, just JSON. Return object with all fields. Let's assemble: - product_name: "Post SMTP" - summary: "Post SMTP versions up to 3.6.1 are affected by a missing authorization vulnerability enabling remote, unauthenticated attackers to modify plugin data. The low EPSS score (0.05%) and lack of known public exploits suggest limited real-world exploitation." - technical_context: "Post SMTP is a WordPress plugin for delivering email via SMTP. The vulnerability (CWE-862) arises from an endpoint lacking proper authorization checks, failing to verify user capabilities or nonces before executing actions. This allows unauthenticated HTTP requests to interact with plugin functions reserved for authenticated users." - risk_assessment: "CVSS 5.3 (Medium) with network vector and no privileges required, but impact limited to low integrity only. EPSS indicates a 0.05% probability of exploitation, and there is no evidence of active exploitation or public exploits. The low integrity impact and absence of confidentiality or availability risk reduce the real-world threat. Organizations should patch but need not treat this as critical." - affected_products: "Post SMTP plugin for WordPress, all versions up to and including 3.6.1. Refer to the Patchstack advisory for details: https://patchstack.com/database/Wordpress/Plugin/post-smtp/vulnerability/wordpress-post-smtp-plugin-3-6-1-broken-access-control-vulnerability?_s_id=c
Unauthorized information disclosure in the Yandex.Metrica WordPress plugin (versions up to 1.2.2) allows unauthenticated attackers to access sensitive data via missing authorization checks. No public exploit code or active exploitation has been identified at this time; the EPSS probability of exploitation is very low (0.05%).
Missing authorization in ListingPro Lead Form plugin for WordPress enables unauthenticated attackers to modify lead data due to improper access controls. Affects versions up to 1.0.7. No active exploitation or public proof-of-concept has been identified at time of analysis, and the EPSS score of 0.05% indicates low current exploitation probability, though the remote unauthenticated nature makes the vulnerability easily exploitable if targeted.
Missing authorization in the Traveler WordPress theme (<=3.2.6) allows unauthenticated attackers to perform actions with low integrity impact, bypassing access controls. No active exploitation or public exploit was identified at time of analysis, and EPSS indicates very low exploitation probability.
Missing authorization in the WP ERP plugin for WordPress versions up to 1.16.7 allows unauthenticated remote attackers to bypass access controls and modify data. The vulnerability has a CVSS 5.3 rating and only impacts integrity, with no confidentiality or availability loss. No active exploitation or public proof-of-concept is known, and the EPSS score is very low at 0.05%.
Unauthenticated information disclosure in the Hype WordPress plugin (versions <=1.0.5) arises from a missing authorization check, allowing remote attackers to access restricted data. No active exploitation or public exploit code is reported, and EPSS estimates a very low exploitation likelihood (0.05%), making this a low-priority issue for most organizations unless the exposed information is highly sensitive.
Missing authorization controls in IDonate WordPress plugin through version 2.1.15 allows unauthenticated remote attackers to access sensitive information due to incorrectly configured access control security levels. The vulnerability has a low EPSS score (0.04%, 13th percentile) and no public exploit code or active exploitation is documented, indicating limited real-world attack incentive despite network-accessible attack surface.
WPForms Google Sheet Connector plugin through version 4.0.0 allows unauthenticated remote attackers to modify data by exploiting missing authorization checks on access control mechanisms. The vulnerability enables unauthorized manipulation of form submissions and Google Sheet integrations without proper permission validation, affecting WordPress installations using this plugin.
Media Library Assistant WordPress plugin through version 3.29 allows authenticated users to bypass authorization controls and access or modify content they should not have permission to reach via user-controlled keys in access control mechanisms. The vulnerability requires an authenticated user with limited privileges (PR:L) and affects confidentiality and integrity of stored media library data, though with relatively low exploitation probability (EPSS 0.04%) and no confirmed active exploitation at time of analysis.
Missing authorization in ExpressTech Systems Quiz And Survey Master WordPress plugin through version 10.3.2 allows unauthenticated remote attackers to read sensitive quiz and survey data by exploiting incorrectly configured access control security levels. The vulnerability is assigned CVSS 5.3 (moderate), affects the plugin across multiple versions, and enables unauthorized information disclosure without requiring authentication or user interaction.
Missing authorization in Easy Payment Payment Gateway for PayPal (woo-paypal-gateway) WordPress plugin versions up to 9.0.53 allows unauthenticated remote attackers to access sensitive payment gateway data through improper access control configuration. The vulnerability enables unauthorized information disclosure with low confidentiality impact. EPSS score of 0.04% indicates minimal observed exploitation probability despite network accessibility and no authentication requirement.
Missing authorization in Eupago Gateway For Woocommerce allows unauthenticated remote attackers to modify data via incorrectly configured access control, affecting versions up to 4.7.1. The vulnerability enables integrity compromise without requiring authentication or user interaction, though with low attack complexity. EPSS scoring of 0.04% indicates minimal real-world exploitation probability despite moderate CVSS severity.
Missing authorization controls in Mario Peshev WP-CRM System plugin up to version 3.4.6 allow unauthenticated remote attackers to modify data through incorrectly configured access control security levels. The CVSS 5.3 score reflects low integrity impact with no confidentiality or availability consequences, but the vulnerability exposes the plugin to unauthorized data manipulation attacks without authentication.
Bertha AI WordPress plugin through version 1.13 allows unauthenticated attackers to modify content via incorrectly configured access control, enabling unauthorized changes to website data without authentication. The vulnerability stems from missing authorization checks on sensitive operations, classified as CWE-862 (Missing Authorization). While CVSS scores 5.3 (medium severity), EPSS exploitation probability is minimal at 0.04%, indicating low real-world attack likelihood despite the straightforward attack vector.
Insertion of sensitive information into sent data in auxin-elements WordPress plugin versions up to 2.17.15 allows unauthenticated remote attackers to retrieve embedded sensitive data through network-accessible responses. The vulnerability exposes information with low confidentiality impact and affects the Shortcodes and extra features for Phlox theme plugin across all versions through 2.17.15, with EPSS scoring indicating 0.04% likelihood of exploitation.
Arbitrary shortcode execution in GiveWP plugin for WordPress up to version 4.13.1 allows unauthenticated remote attackers to inject and execute arbitrary shortcodes, potentially leading to information disclosure or full code execution depending on the site's installed shortcodes. The vulnerability is categorized as code injection (CWE-94) with a CVSS base score of 5.3, reflecting only confidentiality impact in the official scoring, though advisory tags suggest RCE capability. No active exploitation or public exploit code is known, and EPSS predicts a very low 0.04% exploitation probability.
Cross-site scripting in Talent Software e-BAP Automation (versions 1.8.96 through pre-v.41815) allows unauthenticated remote attackers to inject arbitrary JavaScript into web pages served by the application. The CVSS vector assigns UI:N (no user interaction required), which is atypical for XSS and may suggest a stored or persistent injection variant that auto-executes rather than a reflected type requiring a victim to click a crafted link. No public exploit identified at time of analysis, and the EPSS score of 0.03% (10th percentile) signals very low current exploitation interest; however, the unauthenticated network exposure warrants patching in internet-facing deployments.
Spoofing via UI misrepresentation in Microsoft Exchange Server 2016 and Exchange Server Subscription Edition allows unauthenticated network attackers to falsify critical sender or authentication information as rendered by the Exchange interface. Rooted in CWE-451 (UI Misrepresentation of Critical Information), the flaw enables an attacker to craft messages or interactions that Exchange presents deceptively, undermining trust signals recipients rely upon to distinguish legitimate from malicious communications. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog; however, the PR:N/AC:L vector means exploitation requires no credentials and minimal attacker sophistication.
Server-Side Request Forgery in ThemesInflow Hercules Core plugin for WordPress allows authenticated, low-privilege attackers to forge server-side requests. Exploitation is complex and yields only limited confidentiality and integrity impact on internal services. No public exploit or active exploitation has been reported.
Open redirect in CRM Perks WP Gravity Forms FreshDesk Plugin up to 1.3.5 allows unauthenticated attackers to craft URLs that redirect users to arbitrary untrusted sites, facilitating phishing attacks. The vulnerability has no known active exploitation or public exploit, and EPSS indicates a very low exploitation probability.
Missing authorization in Elated-Themes The Aisle WordPress theme version 2.9 and below allows authenticated low-privilege users to modify data without proper permission checks. The vulnerability, rated Medium (CVSS 4.3), requires a valid user account but no other preconditions; it has a low EPSS score (0.07%) and is not known to be actively exploited.
Missing authorization in the Powerlift theme for WordPress allows authenticated attackers with low privileges to bypass access controls and perform unauthorized modifications to theme data. The vulnerability affects all versions prior to 3.2.1 and requires only a valid WordPress user account to exploit. No active exploitation or public exploit code has been identified, and the EPSS score suggests low real-world exploitation probability.
Insufficient access controls in Webba Booking plugin for WordPress (versions up to 6.2.1) allow authenticated attackers with low privileges to modify booking data. EPSS score is low, and no active exploitation is reported.
Authorization bypass through user-controlled key in ThimPress Thim Elementor Kit plugin up to version 1.3.3 allows authenticated attackers to modify data via insecure direct object references. The vulnerability has a CVSS base score of 4.3, a low EPSS exploitation probability (0.07%), and no known public exploit or active exploitation.
Missing authorization in Fluent Booking WordPress plugin through version 1.9.11 allows authenticated low-privileged users to modify data without proper access controls. This integrity-only flaw can lead to unauthorized changes in booking information on affected sites.
Missing authorization in the Trinity Audio WordPress plugin up to version 5.23.3 allows authenticated attackers with low privileges to modify plugin data without the required capabilities, leading to potential integrity issues on affected sites. The vulnerability has a medium CVSS score of 4.3 and a very low EPSS exploitation probability (0.05%), with no evidence of active exploitation or public exploit code at this time.
Missing authorization in the WooCommerce Thank You Page Customizer plugin (versions <= 1.1.8) allows authenticated attackers with low privileges to view thank-you page customization data that should be restricted to administrators. The vulnerability, categorized as CWE-862, has a CVSS score of 4.3 (medium) and a very low EPSS exploitation probability (0.05%), with no evidence of active exploitation or public proof-of-concept code.
Improper access control in Metagauss EventPrime (WordPress event calendar plugin) up to version 4.2.4.1 allows authenticated, low-privileged users (e.g., subscriber) to modify limited event data without proper authorization checks. The vulnerability carries a medium CVSS 4.3 severity, with no confidentiality or availability impact, and an EPSS score of 0.05% indicating a very low exploitation probability. No public exploit or active exploitation (CISA KEV) has been observed.
Authenticated information disclosure in ThimPress WP Hotel Booking plugin for WordPress up to version 2.2.7 allows low-privileged users to retrieve embedded sensitive data, such as configuration details. No active exploitation or public exploit code is known at this time, and EPSS indicates a very low probability of widespread exploitation.
Unauthorized data access in the cf7-salesforce WordPress plugin (Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms) up to version 1.4.6 allows low-privileged authenticated users to view sensitive information. The missing authorization vulnerability enables attackers with subscriber-level access to bypass access control security levels and access data they should not see. No active exploitation or public exploit has been identified, and the EPSS probability is very low.
Authenticated low-privilege users can exploit missing authorization in the VanKarWai Lobo WordPress theme through version 2.8.6, resulting in low-availability impact via broken access control. No public exploit or active exploitation has been reported; EPSS probability is very low (0.05%).
An authenticated low-privilege user on WordPress can exploit missing authorization checks in Elastic Email Sender plugin up to version 1.2.20 to cause availability disruption, such as disabling email sending functionality. This vulnerability, reported by Patchstack, carries a medium CVSS 4.3 but extremely low EPSS probability of exploitation, and no evidence of active exploitation exists.
Information disclosure in the My Tickets WordPress plugin through 2.1.0 allows authenticated attackers with low privileges to access sensitive data via a missing authorization check. The vulnerability has a CVSS base score of 4.3, low EPSS exploitation probability (0.05%), and is not listed in CISA KEV nor associated with public exploit code.
Missing authorization vulnerability in Actionwear Products Sync plugin for WordPress up to 2.3.3 allows authenticated attackers with low privileges to disrupt product synchronization operations. The flaw stems from improperly configured access control levels, leading to availability impact. No public exploit or active exploitation is known, and EPSS indicates very low exploitation probability.
Authenticated low-privilege users can modify calendar data in My Calendar WordPress plugin versions <= 3.6.16 due to missing authorization checks, allowing unauthorized integrity impact. The flaw has a CVSS score of 4.3, very low exploitation probability (EPSS 0.05%), and no known active exploitation or public exploit code at time of analysis.