SQL injection in itsourcecode Student Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the grade parameter in /new_grade.php. Publicly available exploit code exists, but the EPSS score is low (0.05%) and no active exploitation has been reported via CISA KEV, suggesting limited interest or targeting.
SQL injection in itsourcecode Student Management System 1.0's promote.php endpoint allows remote attackers to manipulate the 'sy' parameter to execute arbitrary SQL queries, leading to potential data exposure or modification. A public proof-of-concept exploit exists, but there is no indication of active exploitation. The EPSS score
SQL injection vulnerability in itsourcecode Student Management System version 1.0 allows remote attackers to manipulate database queries via the sy parameter in /new_school_year.php. Exploit code is publicly available, though no active exploitation has been confirmed by CISA KEV. The low EPSS score (0.05%) suggests limited exploitability in practice.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate the Name parameter in /new_adviser.php to execute arbitrary SQL commands. An exploit is publicly available, though no active exploitation is confirmed (not in CISA KEV); EPSS score is low (0.05%).
SQL injection vulnerability in code-projects Employee Profile Management System 1.0 allows remote attackers to modify or retrieve database contents via the per_id parameter in edit_personnel.php. Exploit code is publicly available, but no active exploitation has been confirmed.
The Highlight and Share WordPress plugin up to version 5.2.0 contains a missing authorization vulnerability that allows unauthenticated attackers to bypass access controls. Exploitation requires user interaction and can lead to unauthorized modification of plugin settings or limited information disclosure. Publicly available exploit code exists, but the vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog.
Deserialization of untrusted data in WP Maps WordPress plugin versions up to 4.8.6 allows high-privileged authenticated users to inject and instantiate arbitrary PHP objects, potentially leading to code execution or privilege escalation. While the CVSS score of 6.5 reflects high confidentiality and integrity impact, the requirement for administrator-level privileges (PR:H) and user interaction (UI:R) significantly constrains real-world exploitability. EPSS score of 0.04% indicates minimal observed exploitation likelihood despite the vulnerability's technical severity.
Stored cross-site scripting vulnerability in the WP-ShowHide WordPress plugin (versions through 1.05) allows authenticated attackers with contributor-level access to inject arbitrary web scripts. When a
Stored cross-site scripting in the REHub Framework WordPress plugin versions below 19.9.9.7 permits authenticated attackers to inject malicious scripts. When a victim, such as an administrator, views the tainted content, the script executes in their browser, potentially stealing session data or performing actions on their behalf. The vulnerability has a low EPSS score (0.06%) and no public exploit or reported active exploitation.
DOM-based Cross-Site Scripting in the CridioStudio ListingPro Lead Form plugin for WordPress allows authenticated attackers with low privileges to inject arbitrary JavaScript into pages viewed by other users. Exploitation requires the attacker to submit crafted input via the vulnerable lead form and convince a victim to visit a page where the tainted data is rendered unsafely, enabling session hijacking, phishing, or browser-based attacks. No active exploitation or public exploit code has been identified.
Missing authorization in WP Delicious plugin versions up to 1.9.1 enables authenticated attackers with low privileges (e.g., subscriber) to modify data with high integrity impact. This WordPress plugin vulnerability (CWE-862) has a CVSS base score of 6.5, no confidentiality impact, and requires no user interaction. At this time, no public exploit code or active exploitation has been reported.
DOM-based cross-site scripting (XSS) in muffingroup Betheme WordPress theme versions up to 28.2 allows authenticated attackers with low privileges to inject malicious scripts that execute in the context of other users' browsers. The vulnerability requires user interaction (UI:R) and affects the confidentiality, integrity, and availability of affected installations; EPSS exploitation probability is low at 0.04%, and no public exploit code or active exploitation has been confirmed.
DOM-based cross-site scripting in Dream-Theme The7 WordPress theme versions before 12.9.0 allows authenticated users to inject malicious scripts that execute in the context of other users' browsers via improperly sanitized input during web page generation. The vulnerability requires user interaction (UI:R) and authenticated access (PR:L), limiting real-world exploitability despite a moderate CVSS score of 6.5. EPSS exploitation probability is low at 0.04th percentile, and no public exploit code or active exploitation has been reported.
Stored cross-site scripting (XSS) in Master Addons for Elementor through version 2.0.9.9.4 allows authenticated users with limited privileges to inject malicious scripts that execute in the browsers of other site visitors, potentially compromising administrator accounts or stealing sensitive data. The vulnerability requires user interaction (UI:R) and affects the plugin's input sanitization during web page generation. With an EPSS score of 0.04% and no confirmed active exploitation, this represents a lower real-world risk despite the moderate CVSS base score of 6.5.
Stored cross-site scripting (XSS) in SimpLy Gallery WordPress plugin (versions up to 3.3.2.1) allows authenticated users with low privileges to inject malicious scripts that execute in the browsers of other site visitors, potentially leading to session hijacking, credential theft, or site defacement. The vulnerability requires user interaction (UI:R) and affects confidentiality, integrity, and availability. No public exploit code or active exploitation has been confirmed; EPSS score of 0.04% indicates low real-world exploitation probability despite the moderate CVSS rating.
Stored cross-site scripting (XSS) in Generic Elements for Elementor plugin versions 1.2.9 and earlier allows authenticated users with limited privileges to inject malicious scripts that execute in the context of other users' browsers, potentially leading to session hijacking, credential theft, or malware distribution. The vulnerability requires user interaction (clicking a malicious link) and affects WordPress installations using this plugin. EPSS exploitation probability is low at 0.04%, and no public exploit code or active exploitation has been identified.
Same-origin policy bypass in Firefox and Thunderbird request handling allows unauthenticated remote attackers to access sensitive information from cross-origin resources with low attack complexity and no user interaction required. The vulnerability affects Firefox versions below 146, Firefox ESR below 115.31 and 140.6, Thunderbird below 146, and Thunderbird ESR below 140.6. No public exploit code has been identified at time of analysis, and the EPSS score of 0.04% indicates low real-world exploitation probability despite the moderate CVSS rating.
DOM-based cross-site scripting in WordPress plugin WP Ultimate Review versions ≤2.3.7 allows remote attackers to execute malicious JavaScript in victims' browsers via crafted input that is improperly sanitized during client-side page rendering. The vulnerability requires user interaction (CVSS UI:R) but no authentication (PR:N), enabling attacks via social engineering or malicious links. Exploitation probability is low (EPSS 0.04%, 14th percentile), with no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV).
A Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Add Custom Codes (versions through 4.80) allows unauthenticated attackers, with no privileges, to trick a site administrator into executing unintended requests. Successful exploitation leads to high integrity impact—attackers can modify plugin settings, potentially injecting malicious content. No evidence of active exploitation or public exploit code exists, and the EPSS probability is extremely low (0.03%).
Stored cross-site scripting (XSS) in Porto Theme - Functionality plugin for WordPress allows authenticated users with low privileges to inject malicious scripts into web pages that execute in the browsers of other site visitors. The vulnerability affects Porto Theme - Functionality versions below 3.7.3 and has a low exploitation probability (EPSS 0.01%), but requires user interaction and authenticated access to exploit, limiting immediate risk to well-managed WordPress installations with access controls.
DOM-Based Cross-Site Scripting (XSS) in KALLYAS WordPress theme versions below 4.25.0 allows authenticated users with low privileges to inject malicious scripts that execute in the browsers of other users, potentially stealing session cookies, credentials, or performing unauthorized actions on their behalf. The vulnerability requires user interaction (clicking a malicious link) and affects the theme's web page generation routines. EPSS probability is 0.01% (very low), suggesting minimal real-world exploitation likelihood despite the moderate CVSS score of 6.5.
Stored or reflected cross-site scripting in phpIPAM v1.7.3 enables remote unauthenticated attackers to inject malicious JavaScript into the Request IP form via the `instructions` parameter, which is subsequently rendered in the admin-facing `/app/admin/instructions/edit-result.php` endpoint. When an authenticated administrator views the affected page, the injected script executes in their browser session, potentially enabling session token theft, credential harvesting, or unauthorized administrative actions. No public exploit identified at time of analysis, though a technical disclosure post exists at glitch0ne.com; EPSS of 0.22% at the 13th percentile confirms low opportunistic exploitation pressure.
Stored cross-site scripting in the Rencontre WordPress plugin up to version 3.13.7 allows authenticated attackers with high privileges to inject malicious scripts into fields rendered on pages accessed by other users. Successful exploitation could lead to session hijacking, data exfiltration, or defacement when victims view the affected content. No active exploitation or public exploit code has been confirmed at this time.
Stored cross-site scripting (XSS) in the WP eBay Product Feeds WordPress plugin (≤3.4.9) allows authenticated attackers with high privileges to inject malicious scripts into pages viewed by other users. The vulnerability affects all versions up to and including 3.4.9. Public exploit availability is unknown and EPSS indicates very low exploitation probability (0.06%).
Stored cross-site scripting (XSS) in the Calendly Embedder WordPress plugin (versions ≤ 1.1.7.2) allows authenticated administrators to inject malicious scripts that execute in other users' browsers when viewing affected pages. The vulnerability requires high privileges and user interaction, resulting in low confidentiality, integrity, and availability impact. No active exploitation or public exploit code is known, and EPSS indicates a 0.06% probability of exploitation.
Stored XSS in Make Section & Column Clickable For Elementor WordPress plugin (versions through 2.4) allows authenticated users with high privileges to inject malicious scripts that execute in other users' browsers. The vulnerability requires user interaction (UI:R) and affects site confidentiality, integrity, and availability with limited scope. EPSS score of 0.04% indicates low exploitation probability despite the presence of a public vulnerability disclosure.
DOM-based cross-site scripting (XSS) in ThimPress WP Hotel Booking plugin versions up to 2.2.8 allows authenticated users with high privileges to inject malicious scripts that execute in the context of other users' browsers. The vulnerability requires user interaction (UI:R) and high administrator privileges (PR:H), limiting its real-world impact despite a moderate CVSS score of 5.9. EPSS exploitation probability is very low at 0.04%, indicating minimal practical attack likelihood.
Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.3.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Incorrectly configured access control in WebCodingPlace Image Caption Hover Pro allows authenticated attackers with low privileges to modify plugin data and disrupt service. The vulnerability affects all plugin versions prior to 20.0 and requires only a low-privilege account on the WordPress site. Exploitation probability is very low (EPSS 0.05%) and no active attacks are reported.
Broken access control in the Listdom WordPress plugin up to version 5.0.1 allows authenticated low-privileged attackers to modify data and potentially disrupt service, as missing authorization checks can be exploited without user interaction. No active exploitation or public exploit has been reported at the time of analysis, and EPSS indicates a very low probability (0.05%) of exploitation.
This WordPress plugin (versions ≤4.3.1) misses authorization checks on its order delivery date update functionality, allowing unauthenticated attackers to modify delivery dates and cause limited disruption after tricking a user into clicking a crafted link. The vulnerability requires targeted user interaction but no privileges, and while no active exploitation or public exploit is known at this time, the low EPSS score (0.05%) indicates minimal immediate risk.
Low-privilege WordPress users can modify booking data and disrupt scheduling in vcita Meeting Scheduler plugin versions up to 4.5.5 due to missing authorization checks. Exploitation requires an authenticated subscriber-level account but has no user interaction, allowing unauthorized integrity and availability impact. No active exploitation or public exploit code has been identified.
A missing authorization check in the Steve Truman Page View Count WordPress plugin (≤ 2.9.0) allows authenticated attackers with low privileges to modify plugin settings without appropriate access controls. This can lead to limited integrity and availability impacts, such as disrupting plugin functionality or altering its behavior. The vulnerability has a low EPSS exploitation probability (0.05%) and is not known to be actively exploited in the wild.
Missing authorization in themezaa Litho Addons for WordPress (versions through 3.5) allows authenticated users to bypass access controls and gain unauthorized read/write access to sensitive data. The vulnerability stems from incorrectly configured access control security levels that fail to properly validate user permissions before exposing functionality. With an EPSS score of 0.04% and CVSS 5.4, exploitation requires valid authentication but no advanced attack complexity; this represents a moderate privilege escalation risk for multi-user WordPress installations.
Missing authorization in Яндекс Доставка (Boxberry) WordPress plugin version 2.34 and earlier allows authenticated users to access or modify resources they should not be permitted to via incorrectly configured access control. An attacker with valid credentials can exploit broken access control mechanisms to view or modify sensitive data without proper privilege validation, though the CVSS 5.4 score reflects limited direct impact (confidentiality and integrity), and the 0.04% EPSS score indicates low real-world exploitation probability.
Privilege escalation through missing authorization in the WordPress Debug Log Viewer plugin (≤2.0.3) allows authenticated low-privilege users to view and modify debug logs, exposing sensitive data such as database credentials or error details. No active exploitation or public PoC is currently known, and the EPSS score is extremely low (0.03%).
Reflected XSS in Talent Software's e-BAP Automation platform (versions before build 42957) allows unauthenticated remote attackers to inject and execute malicious scripts in a victim's browser by tricking them into clicking a crafted URL. The CVSS vector (PR:N/UI:R) confirms no attacker authentication is needed, but successful exploitation depends on social-engineering a valid application user. No active exploitation has been confirmed (not in CISA KEV) and EPSS sits at 0.02% (7th percentile), indicating low near-term exploitation probability.
Reflected cross-site scripting in Talent Software UNIS allows unauthenticated remote attackers to inject and execute malicious JavaScript in a victim's browser session. All UNIS versions prior to build 42957 are affected, as disclosed by Turkey's national CERT (USOM). No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.02% (7th percentile) indicates very low observed exploitation probability.
Cross-site request forgery in GiveWP plugin through version 4.13.1 allows remote attackers to trick authenticated administrators into performing unauthorized actions, such as tampering with donation settings. The vulnerability requires user interaction and has a medium CVSS score of 5.4, with no active exploitation or public proof-of-concept identified. EPSS probability is very low at 0.02%.
Missing authorization in the Quick Interest Slider WordPress plugin (≤ 3.1.7) allows unauthenticated attackers to modify slider configuration data over the network. No active exploitation or public exploit code has been identified, and EPSS indicates a low exploitation probability (0.07%).
Unauthorized modification of plugin settings in Virtuaria PagSeguro for WooCommerce up to version 3.6.3 allows unauthenticated, remote attackers to alter sensitive data such as payment gateway configurations. This missing authorization vulnerability (CWE-862) has a low integrity impact with no confidentiality or availability impact. No active exploitation or public exploit code has been identified at time of analysis, and EPSS indicates a low probability of exploitation.
Improper HTML tag neutralization in sevenspark Contact Form 7 - Dynamic Text Extension through version 5.0.5 allows unauthenticated remote attackers to inject malicious scripts via a network-based attack with no user interaction required, resulting in confidentiality compromise through information disclosure. The vulnerability is classified as cross-site scripting (XSS) with low exploitability probability (EPSS 0.06%, percentile 18%), suggesting limited real-world attack incentive despite the network-accessible attack vector.
Missing access control in ConveyThis WordPress plugin through version 269.2 allows authenticated users with low-level privileges to execute unauthorized actions with high confidentiality, integrity, and availability impact. The vulnerability stems from improper enforcement of authorization checks (CWE-862), enabling privilege escalation by exploiting misconfigured access control security levels. No public exploit identified at time of analysis, with EPSS score of 0.06% indicating low predicted exploitation probability.
Sensitive data exposure in the INFINITUM FORM Geo Controller (cf-geoplugin) WordPress plugin through version 8.9.4 allows unauthenticated remote attackers to retrieve embedded sensitive data via network requests. The vulnerability, categorized as CWE-201, has low detection complexity without user interaction. While no active exploitation (CISA KEV) or public proof-of-concept is reported, the EPSS probability is low at 0.06%, and the publicly disclosed Patchstack advisory indicates a fix is available.
Permission bypass in Wbcom Designs lock-my-bp WordPress plugin through 2.1.1 allows unauthenticated attackers to modify plugin settings or data due to missing authorization checks. This vulnerability, classified as CWE-862 Missing Authorization, enables unauthorized integrity impact with no confidentiality or availability consequences. The low EPSS score (0.05%) indicates limited exploitation likelihood, and no active exploitation or public exploit code has been reported.
Missing authorization in the TrueBooker WordPress plugin allows unauthenticated attackers to remotely modify appointment booking data. The vulnerability affects versions up to and including 1.1.0 and is classified as CWE-862. No active exploitation or public exploit is known, and EPSS estimates a very low exploitation probability (0.05%).
Unauthorized data modification in the Constant Contact + WooCommerce WordPress plugin through version 2.4.1 allows unauthenticated attackers to alter integration settings, potentially disrupting email marketing synchronisation. No public exploit code or active exploitation reported, and EPSS indicates very low exploitation probability.
Unauthorized data modification in the WP Email Capture plugin for WordPress up to version 3.12.4 allows unauthenticated attackers to alter email capture settings or data through missing authorization checks. The vulnerability has a CVSS base score of 5.3 with low integrity impact and no confidentiality or availability impact. No active exploitation or public proof-of-concept has been identified, and the vulnerability is considered low risk.
Unauthenticated integrity impact in Easy Form Builder plugin up to 3.8.20 allows remote attackers to modify form settings or data due to missing authorization checks. The vulnerability, classified as CWE-862 (Missing Authorization), poses a medium severity risk (CVSS 5.3) with low integrity impact. No active exploitation or public exploit code has been identified at this time.
Unauthenticated access to a restricted endpoint in the Sitewide Notice WP WordPress plugin (versions up to 2.4.1) allows attackers to exploit a missing authorization check, resulting in low-impact availability disruption. The vulnerability requires no credentials or user interaction, but the impact is limited to minor service degradation (e.g., toggling notice state). No public exploit code or active exploitation has been identified; EPSS indicates very low exploitation probability.