Unauthenticated modification of invoice data in the WooCommerce PDF Invoices & Packing Slips plugin version 4.9.1 and below allows authenticated low-privilege users (e.g., Shop Managers) to alter invoice or packing slip contents without proper authorization. This missing authorization vulnerability stems from a broken access control check, leading to integrity compromise of PDF documents. No exploitation in the wild or public proof-of-concept are known, and EPSS indicates very low likelihood (0.05%).
Missing authorization checks in Elementor Website Builder (WordPress plugin) through version 3.33.0 allow authenticated low-privilege users to perform actions beyond their intended access level. Exploitation requires a valid WordPress account with low privileges (PR:L per CVSS vector), and the impact is limited to partial integrity modification with no confidentiality or availability consequences. No public exploit code or active exploitation has been identified; EPSS places this at the 14th percentile, reflecting low real-world exploitation probability.
Xagio SEO WordPress plugin through version 7.1.0.35 contains a missing authorization vulnerability that allows authenticated users to perform unauthorized actions due to incorrectly configured access control security levels. The vulnerability has a CVSS score of 4.3 with low real-world exploitation probability (EPSS 0.04%), affecting authenticated users who can bypass intended access restrictions to modify plugin functionality or settings.
Missing authorization controls in the Notification for Telegram WordPress plugin through version 3.5 allow authenticated users to modify notification settings they should not have access to, resulting in limited integrity impact. The vulnerability requires valid user credentials (PR:L in CVSS vector) and affects the plugin's access control enforcement rather than authentication bypass. With an EPSS score of 0.04% and no confirmed active exploitation, this represents a low-probability real-world risk despite the authentication bypass tag.
Ergonet Cache plugin versions up to 1.0.13 allows authenticated users to bypass access control checks and modify unauthorized data due to missing authorization validation. The vulnerability requires user authentication (PR:L) but has low real-world risk per EPSS (0.04%), though it can lead to unauthorized content modification in affected WordPress installations.
Happy Addons for Elementor through version 3.20.3 allows authenticated users to access functionality they should not have permission to use due to missing authorization checks on API endpoints or admin functions. The vulnerability requires valid user authentication and results in information disclosure, with a CVSS score of 4.3 and an extremely low EPSS exploitation probability of 0.04%, suggesting minimal real-world attack incentive despite the access control flaw.
Porto Theme - Functionality plugin for WordPress (versions before 3.7.3) allows authenticated users to access sensitive information through broken access control, enabling privilege escalation or information disclosure without proper authorization checks. While the vulnerability requires valid WordPress credentials and has low CVSS severity (4.3), the confirmed patch availability and authentication requirement reduce immediate risk. No public exploit code or active exploitation has been identified at the time of analysis.
Authenticated users can access sensitive contact form data and functionality they should not have permission to view or modify due to missing authorization checks in Contact Form by BestWebSoft plugin versions up to 4.3.6. The vulnerability allows logged-in attackers with low-level privileges to bypass access controls and view contact information or modify form settings with only network access and no additional user interaction required. This is not actively exploited according to available intelligence, though the access control bypass pattern is a common attack vector.
Paysera WooCommerce Payment Gateway plugin through version 3.10.0 contains a missing authorization flaw allowing authenticated users with lower privilege levels to access or perform actions intended for higher-privilege roles, resulting in limited information disclosure. The vulnerability stems from incorrectly configured access control checks and has an EPSS score of 0.04% (11th percentile), indicating low real-world exploitation probability despite the CVSS 4.3 rating and authenticated attack vector.
A cross-site request forgery vulnerability in the CWW Companion WordPress plugin up to version 1.3.2 allows unauthenticated attackers to trick admin users into performing unintended actions, such as modifying plugin
Cross-site request forgery in vcita Online Booking & Scheduling Calendar plugin for WordPress versions <=4.5.5 enables an unauthenticated attacker to trick a logged-in administrator into performing unintended actions, such as modifying calendar settings, due to missing CSRF token validation. No known active exploitation or public exploit code exists; EPSS predicts very low exploitation likelihood (0.03%).
Cross-Site Request Forgery in the Quick Contact Form WordPress plugin through version 8.2.5 allows unauthenticated attackers to trick authenticated administrators into performing unintended actions, such as modifying form settings. No active exploitation or public exploit code is known, and EPSS indicates a very low probability of real-world exploitation.
Cross-site request forgery (CSRF) in the kubiq PDF Thumbnail Generator WordPress plugin (versions through 1.4) allows remote attackers to perform unauthorized actions on behalf of authenticated administrators via crafted requests. Successful exploitation requires user interaction, such as tricking an admin to click a link, and could result in limited integrity impact, like altering plugin settings. No public exploit code or active exploitation has been reported; EPSS indicates a very low exploitation probability.
Cross-site request forgery (CSRF) vulnerability in the Simple Link Directory WordPress plugin allows an attacker to perform unauthorized actions on behalf of an authenticated administrator, such as modifying or deleting link directory entries. Affects versions up to and including 8.8.3. No active exploitation or public exploit has been reported, and the EPSS score is low (0.03%).
Cross-site request forgery in the Salon booking system plugin for WordPress (versions up to 10.30.3) allows remote attackers to perform unauthorized actions on behalf of authenticated users, such as modifying settings or deleting bookings. Exploitation requires tricking a logged-in administrator into clicking a malicious link; no public exploit code or active exploitation has been identified at this time. EPSS score is 0.03%, indicating very low probability of widespread exploitation.
Cross-site request forgery in Ays Pro Chartify plugin for WordPress through version 3.6.3 allows an attacker to perform unauthorized actions on behalf of a logged-in administrator by tricking them into clicking a malicious link. No active exploitation or public exploit code has been identified at this time, and the exploitation probability is low (EPSS 0.03%). The vulnerability could lead to modification of chart builder settings but cannot compromise confidentiality or availability.
Cross-Site Request Forgery in PressTigers Simple Folio WordPress plugin up to version 1.1.0 allows an unauthenticated remote attacker to trick an administrator into performing unintended state-changing actions, such as modifying plugin settings, resulting in low integrity impact. User interaction is required to exploit this vulnerability; no confidentiality or availability impact occurs. At the time of analysis, no active exploitation or public exploit code has been identified, and the EPSS score is very low (0.03%), indicating low likelihood of widespread attacks.
Cross-Site Request Forgery in the SMTP Mail WordPress plugin allows unauthenticated attackers to perform state-changing actions on behalf of authenticated administrators if they are tricked into clicking a malicious link. The vulnerability affects versions up to and including 1.3.51 and can lead to unauthorized modification of plugin settings. There is no evidence of active exploitation or publicly available exploit code, and the EPSS probability of exploitation is very low (0.03%).
Cross-Site Request Forgery in PSM Plugins SupportCandy allows remote attackers to perform unintended actions in the WordPress plugin by tricking a logged-in administrator into visiting a malicious link. This vulnerability affects SupportCandy versions up to and including 3.4.1. No exploitation or public proof-of-concept is known, and the EPSS probability is extremely low at 0.03%.
Cross-Site Request Forgery in Strategy11 Team Business Directory plugin allows attackers to perform unauthorized actions on behalf of authenticated administrators. Affecting installations up to version 6.4.19, this flaw can be triggered when a logged-in user visits a malicious website. No active exploitation or public exploit code is known, and EPSS indicates a very low likelihood of widespread attacks.
Cross-Site Request Forgery in the Quiz Maker WordPress plugin by Ays Pro up to version 6.7.0.82 allows unauthenticated attackers to perform unauthorized actions on behalf of authenticated site administrators. No active exploitation or public exploit code has been identified, and a vendor patch is available via a later version.
Cross-Site Request Forgery (CSRF) in the UsersWP WordPress plugin up to 1.2.48 allows unauthenticated attackers to perform low-integrity actions by tricking an authenticated user into clicking a crafted link. Only the integrity of the targeted user’s data is affected, with no risk to confidentiality or availability. No active exploitation or public exploit code has been identified.
Cross-site request forgery (CSRF) in the JNews Paywall WordPress plugin (versions < 12.0.1) allows remote attackers to trick logged-in administrators into performing unintended actions, such as modifying plugin settings, by inducing them to click a malicious link. The vulnerability carries a CVSS base score of 4.3 (Medium) and an EPSS probability of 0.03%, indicating very low anticipated exploitation rates. No public exploit or active exploitation is currently reported.
Cross-site request forgery in the Ultimate FAQ WordPress plugin through version 2.4.3 allows unauthenticated attackers to trick authenticated administrators into performing unintended actions, such as modifying FAQ content. The vulnerability carries a CVSS 4.3 (medium) and a very low EPSS exploitation probability (0.03%), with no evidence of active exploitation or public proof-of-concept at time of analysis.
Cross-Site Request Forgery (CSRF) in the WordPress plugin 'Media Library File Download' (versions <= 1.4) allows an unauthenticated attacker to trick a logged-in administrator into performing actions such as modifying download settings, potentially leading to unauthorized file download access. The vulnerability has a CVSS 3.1 base score of 4.3 (Low) with low integrity impact, and an EPSS score of 0.03% indicating negligible exploitation probability.
Cross-site request forgery in KALLYAS WordPress theme versions before 4.25.0 allows authenticated attackers to perform unauthorized actions on behalf of legitimate users without their knowledge or consent. The vulnerability requires user interaction (UI:N indicates no additional user interaction beyond authentication) and affects only confidentiality with low impact. While CVSS scores 4.3 (medium severity), the EPSS score of 0.02% (5th percentile) indicates minimal real-world exploitation likelihood despite public awareness.
Cross-site request forgery (CSRF) in WordPress Media Library Downloader plugin versions up to 1.4.0 allows unauthenticated attackers to perform unauthorized actions on behalf of logged-in site administrators or users via crafted web requests. The vulnerability requires user interaction (UI:R) and has limited scope-affecting only integrity (I:L) with no confidentiality or availability impact. EPSS exploitation probability is very low at 0.02% (5th percentile), indicating minimal real-world exploitation likelihood despite the public disclosure.
Cross-site request forgery in ThimPress WP Hotel Booking plugin version 2.2.8 and earlier allows unauthenticated remote attackers to perform unauthorized actions on behalf of authenticated users through crafted requests. The vulnerability requires user interaction (clicking a malicious link) and results in limited information disclosure, with a CVSS score of 4.3. Exploitation probability is very low per EPSS (0.02% percentile 5%), suggesting this is a lower-priority vulnerability despite public researcher disclosure.
Custom Field Template WordPress plugin through version 2.7.6 exposes sensitive system information to high-privilege local users via embedded data retrieval, allowing administrators to access confidential data they should not have access to. The vulnerability requires high administrative privileges and local access, limiting real-world exploitation risk despite the complete confidentiality impact. EPSS probability is minimal at 0.02%, indicating low likelihood of opportunistic exploitation.
Broken access control in the Gravitec.net Web Push Notifications WordPress plugin versions 2.9.17 and earlier allows authenticated users to modify push notification settings and content without proper authorization checks, enabling privilege escalation or manipulation of notifications intended for administrator-only configuration. The vulnerability requires valid WordPress user credentials but does not enforce role-based access controls on sensitive endpoints, granting low-privileged users unintended modification capabilities.
Improper verification of cryptographic signatures in Adobe Acrobat Reader versions up to 24.001.30264, 20.005.30803, and 25.001.20982 allows local attackers to bypass cryptographic protections and gain limited unauthorized write access to PDF documents. The vulnerability requires user interaction with a malicious or crafted PDF containing an improperly signed element. With a CVSS score of 3.3 and local attack vector, this represents a low-severity security feature bypass affecting document integrity verification.
Improper verification of cryptographic signatures in Adobe Acrobat Reader and Acrobat DC versions up to 24.001.30273, 25.001.20982, and 20.005.30803 allows local attackers to bypass security features and gain limited unauthorized write access to PDF documents. Exploitation requires user interaction with a malicious or specially crafted cryptographic signature embedded in a PDF file. No active exploitation has been confirmed at the time of analysis.
Missing authorization in the Photo Block WordPress plugin allows authenticated users with high privileges (administrator) to exploit improperly configured access control to modify data they should not have access to, resulting in a low integrity impact. The vulnerability affects all plugin versions up to and including 1.5.1, with no confidentiality or availability compromise. No active exploitation or public exploit code is known at the time of analysis, and EPSS assigns a minimal exploitation probability of 0.07%.
Missing authorization in the Admin and Site Enhancements (ASE) WordPress plugin up to version 8.0.8 allows authenticated high-privilege attackers to make low-impact modifications without proper access controls. With a CVSS score of 2.7, EPSS 0.07%, and no known active exploitation or public exploit, the risk is low for most environments.
OS command injection in the NETGEAR Nighthawk R7000P router firmware (through version 1.3.3.154) allows an authenticated administrator with local network access to execute arbitrary OS commands and make unauthorized modifications to router software and functionality. The impact is limited strictly to integrity - confidentiality and availability are unaffected. The device is end-of-service, meaning ongoing support is limited, and NETGEAR has released a patch via its December 2025 security advisory. No public exploit or active exploitation has been identified at time of analysis.