SQL injection in Campcodes Supplier Management System 1.0 allows remote attackers to query, modify, or delete database records via the cmbAreaCode parameter in /admin/add_retailer.php. Public exploit code is available, but the vulnerability is not known to be actively exploited (CISA KEV). The EPSS exploitation probability is very low (0.05%), indicating limited real-world targeting.
Adjacent network attackers can exploit an uninitialized pointer vulnerability in TP-Link WR940N and WR941ND routers to cause denial of service and potentially execute arbitrary code as root. Affected firmware versions are WR940N
Super Blank WordPress plugin versions up to 1.2.0 are vulnerable to missing authorization, allowing authenticated attackers with low privileges to delete arbitrary content. This can result in complete loss of site content availability; no active exploitation has been detected, and the EPSS likelihood is very low.
Arbitrary file download in WordPress Tuturn plugin before version 3.6 allows authenticated users to read sensitive server files. No active exploitation or public exploit code has been reported; EPSS exploitation probability is low (0.07%).
Remote code injection in Molla WordPress theme versions ≤1.5.13 allows unauthenticated attackers to inject and execute arbitrary code via unsanitized input in dynamic code contexts. Exploitation has high complexity (CVSS AC:H) and can impact other components due to scope change. No public exploit or active exploitation reported; EPSS 0.07% indicates low real-world risk.
Code injection in Javo Core WordPress plugin versions ≤3.0.0.266 allows an unauthenticated remote attacker to execute arbitrary code with high attack complexity, leading to limited confidentiality, integrity, and availability impact on the host system. No public exploit or active exploitation is confirmed, and EPSS score is very low (0.07%).
Content injection in the Stockie Extra WordPress plugin allows
Missing authorization in InstaWP Connect for WordPress up to version 0.1.1.9 allows unauthenticated attackers to modify and disrupt site content (low integrity and availability impact). The vulnerability stems from an incorrectly configured access control security level, leaving sensitive plugin functions exposed without proper capability checks. At the time of analysis, no evidence of active exploitation or public proof-of-concept exists, and EPSS indicates a low probability of widespread exploitation.
Authenticated attackers with low-level privileges can bypass access controls in GetResponse Official plugin for WordPress (versions <=1.5.3) to modify sensitive data, resulting in a high integrity impact. The vulnerability arises from missing authorization checks in the plugin’s endpoint handling, permitting unauthorized alteration of settings or subscription data. The risk is moderate; the issue is not listed in CISA KEV and has a low exploitation prediction score, with no public exploit confirmed.
Unauthenticated modification of login page design in the Login Page Customizer WordPress plugin (<=2.1.1) allows remote attackers to alter the site's login and admin page customizations due to missing authorization checks. The vulnerability has low integrity and availability impact, and EPSS indicates very low exploitation probability with no known active exploitation or public exploit code.
Unauthenticated missing authorization in The African Boss Get Cash WordPress plugin up to 3.2.3 allows remote attackers to modify plugin data and potentially disrupt cash-related functionality without any prior access. The vulnerability carries a Medium severity with low EPSS exploitation likelihood, and no active exploitation or public PoC has been reported.
Unauthorized data modification in WP Social Ninja WordPress plugin ≤ 3.20.1 allows remote unauthenticated attackers to alter plugin data or partially disrupt availability due to missing authorization checks on certain endpoints. The vulnerability carries a CVSS base score of 6.5 with low integrity and availability impact, and EPSS data predicts a very low exploitation probability (0.05%). No public exploit code or active exploitation has been identified at time of analysis.
Authorization bypass in the Contact Form Email plugin for WordPress (versions <= 1.3.60) enables unauthenticated attackers to modify or remove contact form entries by manipulating user-controlled key values, with no confidentiality impact. No user interaction required, and the vulnerability is exploitable remotely, though EPSS indicates a low probability of widespread exploitation.
Denial of service in the WordPress Offload, AI & Optimize with Cloudflare Images (cf-images) plugin up to version 1.9.5 allows low-privilege authenticated users to disrupt service availability through missing authorization checks. Any authenticated subscriber or similar low-level role can trigger the flaw to degrade or crash the service. No active exploitation or public PoC is known, and EPSS indicates a very low probability of real-world attacks.
Sensitive information disclosure in Magnigenie RestroPress WordPress plugin versions up to 3.2.3.5 allows authenticated attackers with low privileges to access restricted data via a missing authorization check. This vulnerability, tracked as CVE-2025-66100, has no known public exploit or active exploitation, and EPSS estimates a low probability of exploitation.
Missing authorization checks in the ListingPro WordPress theme (<=2.9.9) enable authenticated users with low privileges to modify data without proper access validation. This broken access control flaw (CWE-862) has a CVSS 6.5 (High integrity impact) and currently no public exploit or active exploitation evidence.
DOM-based cross-site scripting (XSS) in Crocoblock JetElements For Elementor plugin versions up to 2.7.12 allows attackers to inject malicious scripts into web pages through improper input neutralization during page generation. The vulnerability affects WordPress sites using this Elementor page builder extension and can enable session hijacking, credential theft, or malware distribution against site visitors. EPSS exploitation probability is low at 0.04%, but the attack vector is likely network-based requiring no authentication.
Missing authorization in PickPlugins Post Grid and Gutenberg Blocks WordPress plugin (versions through 2.3.17) allows attackers to bypass access control restrictions and exploit incorrectly configured security levels, potentially enabling unauthorized access to protected content or administrative functions. The vulnerability stems from broken access control (CWE-862) with no public exploit code confirmed at time of analysis, though EPSS scoring of 0.04% suggests minimal real-world exploitation probability despite the authorization flaw.
Unicode right-to-left override (RTLO) characters in malicious websites can spoof filenames displayed in Firefox for iOS downloads UI, potentially tricking users into saving files with misleading extensions and types. Affects Firefox for iOS versions prior to 144.0; requires user interaction to download a file. The vulnerability has low real-world exploitation probability (EPSS 0.04%) despite the moderate CVSS score, as it relies on social engineering and user inattention rather than automatic code execution.
Information disclosure in VikBooking Hotel Booking Engine & PMS plugin for WordPress (versions n/a through 1.8.2) allows unauthenticated remote attackers to retrieve embedded sensitive data from HTTP responses. The insertion of sensitive information into sent data (CWE-201) can expose credentials, API keys, or other secrets, with a CVSS base score of 5.9 (AV:N/AC:H/PR:N/UI:N). No active exploitation or public exploit code is known at this time.
Missing authorization in the Download After Email WordPress plugin versions 2.1.5 through 2.1.6 allows unauthenticated attackers to bypass access controls and access protected downloads intended for users who submit their email. The vulnerability has a CVSS base score of 5.8 (medium) but EPSS exploitation probability is very low (0.08%), and no public exploit or active exploitation has been reported.
DigitalME eRoom eroom-zoom-meetings-webinar plugin through version 1.5.6 exposes sensitive data in sent communications due to improper data handling, allowing unauthenticated remote attackers with user interaction to retrieve embedded sensitive information across site boundaries. EPSS exploitation probability is low at 0.04%, but the vulnerability affects confidentiality, integrity, and availability through information disclosure mechanisms that may be chained with other flaws.
Missing authorization controls in Sparkle FSE WordPress theme versions 1.0.9 and earlier allow unauthenticated attackers to bypass access control restrictions and perform unauthorized actions through exploitable endpoint misconfigurations. This authentication bypass vulnerability, reported by Patchstack security researchers, affects all instances of the Sparkle FSE theme up to version 1.0.9 with low exploit probability (EPSS 0.05%) but represents a direct authorization failure (CWE-862) that could enable unauthorized data access or modification depending on endpoint exposure.
Missing authorization controls in sparklewpthemes Construction Light WordPress theme versions 1.6.7 and earlier allow unauthenticated attackers to bypass access restrictions and access resources that should be protected by role-based access control. The vulnerability stems from incorrectly configured access control security levels, potentially exposing sensitive functionality or data to unauthorized users.
Authorization bypass in PickPlugins Post Grid and Gutenberg Blocks WordPress plugin through version 2.3.23 allows attackers to exploit incorrectly configured access control via user-controlled keys, potentially enabling unauthorized access to post content or plugin functionality. The vulnerability is classified as CWE-639 (Authorization Through User-Controlled Key) and presents a low exploitation probability (EPSS 0.04%, 13th percentile) with no public exploit code or active exploitation confirmed at time of analysis.
Sermon Manager for WordPress plugin through version 2.30.0 allows unauthenticated attackers to exploit missing authorization checks to access or modify sermon data due to incorrectly configured access control security levels. The vulnerability stems from CWE-862 (Missing Authorization) and affects all installations running the vulnerable version range. With an EPSS score of 0.04% (13th percentile), real-world exploitation probability is minimal despite the permission-based nature of the flaw.
Stored HTML injection in Nozomi Networks CMC and Guardian Asset List functionality allows unauthenticated remote attackers to inject malicious HTML tags into asset attributes via crafted network packets, enabling phishing and open redirect attacks when victims view affected assets. CVSS 5.3 (medium severity) with user interaction required; exploitation is bounded by existing Content Security Policy and input validation that prevent full XSS and direct information disclosure.
WP AI CoPilot plugin for WordPress versions through 1.2.7 exposes sensitive information embedded within sent data, allowing attackers to retrieve confidential details without proper access controls. The vulnerability stems from inadequate handling of sensitive data in communications, classified as information disclosure with an EPSS score of 0.04% indicating low real-world exploitation probability. No public exploit code has been identified at time of analysis.
Biopython's Bio.Entrez module through version 1.86 is vulnerable to XML external entity (XXE) injection in doctype parsing, allowing authenticated remote attackers to read arbitrary files or cause denial of service. The vulnerability requires authenticated access and high attack complexity, resulting in a CVSS score of 4.9 with low confidentiality and availability impact across trust boundaries. Exploitation is not currently tracked in CISA KEV and has extremely low EPSS probability (0.07%, 20th percentile), indicating limited real-world risk despite the XXE vector.
Authorization bypass in RadiusTheme Radius Blocks WordPress plugin through version 2.2.1 allows attackers to exploit incorrectly configured access control security levels via user-controlled keys, enabling unauthorized access to restricted functionality. The vulnerability is classified as an insecure direct object reference (IDOR) issue affecting the plugin's access control implementation. While no CVSS score is available and EPSS indicates low exploitation probability (0.04%), the vulnerability demonstrates a fundamental authentication design flaw that could permit escalation of privileges within WordPress installations using this plugin.
Missing authorization controls in the SoliClub Android application (all versions before 5.3.7) allow authenticated low-privilege users to abuse their access and read data beyond their authorization level. The vulnerability, classified as CWE-862, exposes the application to privilege abuse where role or resource-level access checks are absent on one or more network-accessible functions. No public exploit code exists and EPSS stands at 0.03% (10th percentile), indicating no meaningful observed exploitation activity; this is not listed in CISA KEV.