Cross-site request forgery in the RTL Tester WordPress plugin through version 1.2 allows unauthenticated attackers to trick administrative users into toggling the RTL test mode, causing temporary site layout changes. This low-severity issue (CVSS 4.3) has a very low exploitation probability (EPSS 0.03%) and no known active exploitation or public exploit code.
Cross-site request forgery in the Quick Interest Slider WordPress plugin (versions up to 3.1.5) allows unauthenticated attackers to deceive authenticated administrators into executing unauthorized actions, such as modifying plugin settings. No public exploit code or active exploitation has been identified, and EPSS predicts a very low exploitation probability.
Authenticated attackers with Contributor-level access or above can delete or generate featured images on posts they do not own in the Auto Featured Image (Auto Post Thumbnail) WordPress plugin through version 4.2.1, due to a missing capability check in the bulk_action_generate_handler function. The vulnerability requires user authentication and has a CVSS score of 4.3; no public exploit code or active exploitation has been confirmed at the time of analysis.