Cross-site request forgery (CSRF) vulnerability in the Simple Link Directory WordPress plugin allows an attacker to perform unauthorized actions on behalf of an authenticated administrator, such as modifying or deleting link directory entries. Affects versions up to and including 8.8.3. No active exploitation or public exploit has been reported, and the EPSS score is low (0.03%).
Cross-site request forgery in the Salon booking system plugin for WordPress (versions up to 10.30.3) allows remote attackers to perform unauthorized actions on behalf of authenticated users, such as modifying settings or deleting bookings. Exploitation requires tricking a logged-in administrator into clicking a malicious link; no public exploit code or active exploitation has been identified at this time. EPSS score is 0.03%, indicating very low probability of widespread exploitation.
Cross-site request forgery in Ays Pro Chartify plugin for WordPress through version 3.6.3 allows an attacker to perform unauthorized actions on behalf of a logged-in administrator by tricking them into clicking a malicious link. No active exploitation or public exploit code has been identified at this time, and the exploitation probability is low (EPSS 0.03%). The vulnerability could lead to modification of chart builder settings but cannot compromise confidentiality or availability.
Cross-Site Request Forgery in PressTigers Simple Folio WordPress plugin up to version 1.1.0 allows an unauthenticated remote attacker to trick an administrator into performing unintended state-changing actions, such as modifying plugin settings, resulting in low integrity impact. User interaction is required to exploit this vulnerability; no confidentiality or availability impact occurs. At the time of analysis, no active exploitation or public exploit code has been identified, and the EPSS score is very low (0.03%), indicating low likelihood of widespread attacks.
Cross-Site Request Forgery in the SMTP Mail WordPress plugin allows unauthenticated attackers to perform state-changing actions on behalf of authenticated administrators if they are tricked into clicking a malicious link. The vulnerability affects versions up to and including 1.3.51 and can lead to unauthorized modification of plugin settings. There is no evidence of active exploitation or publicly available exploit code, and the EPSS probability of exploitation is very low (0.03%).
Cross-Site Request Forgery in PSM Plugins SupportCandy allows remote attackers to perform unintended actions in the WordPress plugin by tricking a logged-in administrator into visiting a malicious link. This vulnerability affects SupportCandy versions up to and including 3.4.1. No exploitation or public proof-of-concept is known, and the EPSS probability is extremely low at 0.03%.
Cross-Site Request Forgery in Strategy11 Team Business Directory plugin allows attackers to perform unauthorized actions on behalf of authenticated administrators. Affecting installations up to version 6.4.19, this flaw can be triggered when a logged-in user visits a malicious website. No active exploitation or public exploit code is known, and EPSS indicates a very low likelihood of widespread attacks.
Cross-Site Request Forgery in the Quiz Maker WordPress plugin by Ays Pro up to version 6.7.0.82 allows unauthenticated attackers to perform unauthorized actions on behalf of authenticated site administrators. No active exploitation or public exploit code has been identified, and a vendor patch is available via a later version.
Cross-Site Request Forgery (CSRF) in the UsersWP WordPress plugin up to 1.2.48 allows unauthenticated attackers to perform low-integrity actions by tricking an authenticated user into clicking a crafted link. Only the integrity of the targeted user’s data is affected, with no risk to confidentiality or availability. No active exploitation or public exploit code has been identified.
Cross-site request forgery (CSRF) in the JNews Paywall WordPress plugin (versions < 12.0.1) allows remote attackers to trick logged-in administrators into performing unintended actions, such as modifying plugin settings, by inducing them to click a malicious link. The vulnerability carries a CVSS base score of 4.3 (Medium) and an EPSS probability of 0.03%, indicating very low anticipated exploitation rates. No public exploit or active exploitation is currently reported.
Cross-site request forgery in the Ultimate FAQ WordPress plugin through version 2.4.3 allows unauthenticated attackers to trick authenticated administrators into performing unintended actions, such as modifying FAQ content. The vulnerability carries a CVSS 4.3 (medium) and a very low EPSS exploitation probability (0.03%), with no evidence of active exploitation or public proof-of-concept at time of analysis.
Cross-Site Request Forgery (CSRF) in the WordPress plugin 'Media Library File Download' (versions <= 1.4) allows an unauthenticated attacker to trick a logged-in administrator into performing actions such as modifying download settings, potentially leading to unauthorized file download access. The vulnerability has a CVSS 3.1 base score of 4.3 (Low) with low integrity impact, and an EPSS score of 0.03% indicating negligible exploitation probability.
Cross-site request forgery in KALLYAS WordPress theme versions before 4.25.0 allows authenticated attackers to perform unauthorized actions on behalf of legitimate users without their knowledge or consent. The vulnerability requires user interaction (UI:N indicates no additional user interaction beyond authentication) and affects only confidentiality with low impact. While CVSS scores 4.3 (medium severity), the EPSS score of 0.02% (5th percentile) indicates minimal real-world exploitation likelihood despite public awareness.
Cross-site request forgery (CSRF) in WordPress Media Library Downloader plugin versions up to 1.4.0 allows unauthenticated attackers to perform unauthorized actions on behalf of logged-in site administrators or users via crafted web requests. The vulnerability requires user interaction (UI:R) and has limited scope-affecting only integrity (I:L) with no confidentiality or availability impact. EPSS exploitation probability is very low at 0.02% (5th percentile), indicating minimal real-world exploitation likelihood despite the public disclosure.
Cross-site request forgery in ThimPress WP Hotel Booking plugin version 2.2.8 and earlier allows unauthenticated remote attackers to perform unauthorized actions on behalf of authenticated users through crafted requests. The vulnerability requires user interaction (clicking a malicious link) and results in limited information disclosure, with a CVSS score of 4.3. Exploitation probability is very low per EPSS (0.02% percentile 5%), suggesting this is a lower-priority vulnerability despite public researcher disclosure.
Custom Field Template WordPress plugin through version 2.7.6 exposes sensitive system information to high-privilege local users via embedded data retrieval, allowing administrators to access confidential data they should not have access to. The vulnerability requires high administrative privileges and local access, limiting real-world exploitation risk despite the complete confidentiality impact. EPSS probability is minimal at 0.02%, indicating low likelihood of opportunistic exploitation.
Broken access control in the Gravitec.net Web Push Notifications WordPress plugin versions 2.9.17 and earlier allows authenticated users to modify push notification settings and content without proper authorization checks, enabling privilege escalation or manipulation of notifications intended for administrator-only configuration. The vulnerability requires valid WordPress user credentials but does not enforce role-based access controls on sensitive endpoints, granting low-privileged users unintended modification capabilities.