Stored cross-site scripting in Real 3D FlipBook plugin up to version 4.11.4 allows authenticated users with low privileges to inject malicious scripts that execute in victim browsers. This can lead to session hijacking or
Unauthenticated file upload vulnerability in code-projects Student File Management System 1.0 allows authenticated remote attackers to bypass file upload restrictions via manipulation of the File parameter in /save_file.php, despite the CVSS v4.0 score of 2.1 reflecting only low confidentiality, integrity, and availability impact with no scope change. The exploit is publicly available and the low EPSS score (0.09%, 25th percentile) suggests limited real-world exploitation attempts despite public disclosure.
Cross-site scripting (XSS) via unsanitized firstname and lastname parameters in /profile.php of code-projects Student Information System 1.0 allows authenticated remote attackers with user interaction to inject malicious scripts affecting confidentiality. The vulnerability carries a low CVSS score (2.0) due to authentication and user interaction requirements, but publicly available exploit code exists and EPSS analysis assigns 0.06% exploitation probability, reflecting limited real-world attack likelihood despite public POC availability.
Cross-site scripting in WPBakery Visual Composer WHMCS Elements plugin for WordPress allows authenticated attackers with high privileges to inject malicious scripts via DOM manipulation. This XSS can lead to limited data disclosure or actions within the victim's session but requires user interaction. No public exploit or active exploitation reported.
Stored cross-site scripting (XSS) in WordPress plugin My auctions allegro (versions up to 3.6.35) allows authenticated users to inject malicious scripts that execute in other users' browsers when viewing auction content. The vulnerability requires user interaction (UI:R) and affects the confidentiality and integrity of affected WordPress installations, though with limited scope within the plugin context. No public exploit code or active exploitation has been identified; real-world risk is moderate given the requirement for authenticated access and user interaction.
Stored Cross-Site Scripting in the pixelgrade Category Icon WordPress plugin through version 1.0.2 enables authenticated administrators to inject malicious scripts that execute in other users' browsers, leading to low-impact compromise of confidentiality and integrity. No active exploitation or public proof-of-concept code is currently known, and EPSS indicates a low exploitation probability (0.04%).
Stored cross-site scripting in Astra Widgets WordPress plugin up to version 1.2.16 allows authenticated attackers with admin access to inject malicious scripts that execute when other users view pages containing affected widgets. No public exploit or active exploitation has been reported, and EPSS probability is low (0.04%).
DOM-based Cross-Site Scripting in the Greenhouse Job Board WordPress plugin versions up to 2.7.3 allows authenticated administrators to inject arbitrary scripts. A victim admin browsing a page where the payload is rendered could have their browser execute the malicious code, leading to session hijacking or data theft. At time of analysis, no active exploitation or public exploit is known.
DOM-based cross-site scripting (XSS) in the GARD AdSense plugin for WordPress versions ≤2.23 allows authenticated administrators to inject malicious scripts that execute in the browser of a victim who interacts with a crafted link. Exploitation requires high-privilege user access and victim user interaction, and no public exploit or active attacks are known (EPSS 0.04%).
Stored cross-site scripting in the WordPress Gift Hunt plugin up to version 2.0.2 allows authenticated attackers with administrator-level privileges to inject arbitrary web scripts that execute when other users view the affected plugin pages. This can lead to session hijacking, credential theft, or unauthorized actions within the site. EPSS indicates very low exploitation probability (0.04%), no active exploitation is known, and no public proof-of-concept has been identified.
Stored cross-site scripting in WordPress WH Tweaks plugin up to version 1.0.2 allows authenticated administrators to inject web scripts that execute in other users' browsers, potentially leading to session hijacking or data theft. The vulnerability requires high privileges (admin) and user interaction (victim must view the poisoned page), with no public exploit or active exploitation confirmed. Its CVSS base score of 5.9 indicates a moderate risk primarily for sites where untrusted individuals may hold administrator roles.
Stored cross-site scripting in the Basticom Framework WordPress plugin up to version 1.5.2 enables authenticated administrators to inject arbitrary web scripts. These scripts execute in the browsers of other users who view the affected page, potentially leading to session hijacking, phishing, or defacement. No active exploitation or public exploit code has been identified at time of analysis, and the EPSS likelihood is very low (0.04%).
Stored cross-site scripting in the WordPress Review Disclaimer plugin versions up to 2.0.3 allows authenticated high-privilege attackers (e.g., admin) to inject arbitrary web scripts that execute in the browsers of other users. While no active exploitation is confirmed and the EPSS likelihood is very low (0.04%), a successful attack could lead to session theft or site defacement when a victim views the injected content.
Stored cross-site scripting in the TouchOfTech Draft Notify WordPress plugin allows authenticated administrators to inject malicious scripts that execute in other users’ browsers when they view affected pages. Versions up to and including 1.5 are vulnerable. The flaw is not actively exploited, and no public exploit code has been identified.
Uninitialized memory use in the Linux kernel NTFS3 filesystem driver (fs/ntfs3) enables a local low-privileged user to trigger a kernel crash, causing a denial of service. The `__getname()` function allocates slab memory via `kmem_cache_alloc()` without zeroing it; `ntfs_read_hdr` and `bcmp` then operate on this indeterminate data, as detected by KMSAN. No active exploitation is confirmed (not in CISA KEV), and the EPSS score of 0.18% at the 7th percentile reflects very low real-world exploitation probability. Upstream patches are available across multiple stable kernel branches.
BPF test infrastructure in the Linux kernel allows a local user with BPF program execution privileges to emit packets with malformed GSO (Generic Segmentation Offload) metadata to the network stack via bpf_clone_redirect(), triggering skb_warn_bad_offload() and disabling GSO-related offload features - a denial-of-service condition. The root cause is convert___skb_to_skb() populating gso_segs and gso_size without a corresponding gso_type, producing an internally inconsistent socket buffer that fails GSO validation in netif_skb_features(). No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified; the issue was originally surfaced through fuzzing by Yinhao et al. Patches across six stable kernel branches have been released.
Missing authorization in WP Adminify plugin for WordPress (<=4.0.6.1) allows authenticated low-privileged users to modify plugin configurations without permission, impacting site integrity and availability. No active exploitation or public exploit code has been reported, and EPSS indicates a low probability of exploitation (0.06%). Exploitation requires a valid user account but no high-level access, making it a moderate risk once authenticated.
Server-Side Request Forgery (SSRF) in 6Storage Rentals WordPress plugin versions ≤2.20.2 allows unauthenticated remote attackers to send crafted requests from the vulnerable server to arbitrary internal or external systems. With CVSS 9.1 (critical) due to network-accessible attack vector requiring no authentication or user interaction, attackers can achieve high confidentiality and integrity impact by potentially accessing internal services, cloud metadata endpoints, or exfiltrating sensitive data. EPSS score of 0.04% (14th percentile) indicates relatively low observed exploitation probability despite the critical severity rating. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis.
Missing authorization in the Editorial Calendar WordPress plugin allows authenticated attackers with low privileges to view and modify editorial calendar data. Versions up to 3.8.8 are affected. While active exploitation is not confirmed and exploit code is not publicly available, patching is advised.
Missing authorization in Simple File List WordPress plugin 6.1.18 and earlier allows authenticated low-privilege users to bypass access controls and gain unauthorized read/write access to file list data. Tagged as an authentication bypass vulnerability with EPSS score of 0.04% (13th percentile), indicating low observed exploitation probability. No active exploitation confirmed (not in CISA KEV), and no public exploit code identified at time of analysis.
Missing authorization in YITH Slider for page builders (WordPress plugin) allows authenticated low-privileged attackers to view and modify slider content without proper permission checks. Patches are implied in versions beyond 1.0.11. No active exploitation or public exploit code is currently known.
Missing authorization in the Tablesome WordPress plugin allows authenticated low-privilege users to modify or disrupt plugin data. Affected versions up to 1.1.35.1; no active exploitation or public exploit identified at this time.
Stored XSS in Specto CM, a call center management platform by Echo Call Center Services Trade and Industry Inc., allows authenticated low-privileged users to inject persistent malicious scripts that execute in other users' browsers. The changed scope (S:C) in the CVSS vector indicates the injected payload can affect sessions or contexts beyond the attacker's own, elevating the practical impact for multi-user environments. No active exploitation is confirmed (not in CISA KEV), and the EPSS score of 0.02% (7th percentile) indicates very low exploitation probability at time of analysis.
Cross-Site Request Forgery (CSRF) in Five Star Restaurant Reservations WordPress plugin versions ≤2.7.8 enables unauthenticated attackers to perform unauthorized administrative actions through social engineering. With CVSS 8.8 (High), the vulnerability requires no privileges and low attack complexity, though user interaction is necessary. EPSS probability is minimal (0.02%, 6th percentile), indicating low observed exploitation likelihood despite the high CVSS score. No confirmed active exploitation (not in CISA KEV) or public exploit code identified at time of analysis.
Cross-site request forgery in Simple Keyword to Link WordPress plugin version 1.5 and below allows unauthenticated attackers to trick authenticated administrators into modifying keyword-to-link associations through crafted requests. No active exploitation or public exploit code has been identified, and the low EPSS score suggests a low probability of widespread attacks.
Cross-Site Request Forgery in WordPress plugin My Auctions Allegro (versions ≤3.6.33) allows unauthenticated remote attackers to perform unauthorized actions on behalf of authenticated users through social engineering. CVSS 8.8 severity stems from potential high confidentiality, integrity, and availability impact if victims are tricked into clicking malicious links while authenticated. EPSS score of 0.02% (6th percentile) indicates very low probability of exploitation in the wild. No active exploitation confirmed (not in CISA KEV), and no public exploit identified at time of analysis, suggesting this remains a theoretical high-severity issue requiring user interaction.
Missing authorization in Twitch Player WordPress plugin (ttv-easy-embed-player) versions up to 2.1.3 allows remote unauthenticated attackers to trigger a denial-of-service condition via exploitation of incorrectly configured access control security levels. This CWE-862 vulnerability impacts only availability and has no confidentiality or integrity impact. No active exploitation or public exploit code is confirmed at this time; EPSS indicates a 0.06% probability of exploitation in the next 30 days.
Unauthenticated information disclosure in the Bit Assist plugin for WordPress (versions up to 1.5.11) allows remote attackers to read potentially sensitive data due to missing authorization checks on certain endpoints. No proof-of-concept exploit code or active exploitation has been publicly reported at this time; the EPSS exploitation probability is 0.06%.
Broken access control in Trustindex Widgets for Social Photo Feed (WordPress plugin) through version 1.8 allows authenticated attackers with low privileges to bypass authorization controls and execute high-impact actions. The vulnerability has low attack complexity (CVSS:3.1 AV:N/AC:L/PR:L) enabling compromise of confidentiality, integrity, and availability. EPSS score of 0.06% (18th percentile) indicates relatively low observed exploitation probability, and no public exploit or CISA KEV listing exists at time of analysis, suggesting this remains a patch-priority issue rather than an active threat.
Broken access control in Cooked WordPress plugin versions ≤1.11.3 allows authenticated attackers with low-level privileges to bypass authorization checks and gain unauthorized access to high-privilege functions. The vulnerability stems from missing authorization validation (CWE-862), enabling privilege escalation and unauthorized data manipulation. With CVSS 8.8 and EPSS probability of 0.06% (18th percentile), real-world exploitation risk is moderate; no public exploit identified at time of analysis.
Missing authorization in the Funnelforms Free plugin for WordPress (versions up to 3.8) allows unauthenticated attackers to modify plugin data due to incorrectly configured access control. The vulnerability (CWE-862) has a CVSS 5.3 rating with low integrity impact only; no confidentiality or availability is affected. At the time of analysis, there is no evidence of active exploitation and the EPSS score is low (0.06%), indicating limited urgency.
Authorization bypass in Wappointment WordPress plugin versions ≤2.7.6 enables low-privileged authenticated attackers to perform unauthorized actions with high impact to confidentiality, integrity, and availability. The vulnerability stems from missing authorization checks (CWE-862), allowing authenticated users to access or modify data beyond their intended permission level. EPSS score of 0.06% (18th percentile) indicates low observed exploitation probability, and no confirmed active exploitation (CISA KEV) or public exploit code is identified at time of analysis.
Unauthenticated missing authorization flaw in the BBP Core WordPress plugin (versions ≤1.4.1) allows attackers to modify certain data with low integrity impact. No confidentiality is exposed. The flaw, assigned CWE-862, has a CVSS base score of 5.3 (Medium) but is not actively exploited.
Broken access control in SALESmanago WordPress plugin allows authenticated attackers with low-level privileges to bypass authorization checks and gain unauthorized access to high-privilege functions. Affects versions up to 3.9.0. The vulnerability enables complete compromise of confidentiality, integrity, and availability within the plugin's scope. EPSS score of 0.06% (18th percentile) suggests low observed exploitation probability, and no public exploit identified at time of analysis.
Low-integrity unauthorized modification in WpStream plugin ≤4.9.5 allows unauthenticated remote attackers to alter plugin functionality via missing authorization checks. The vulnerability, classified as CWE-862 Missing Authorization, enables attackers to exploit incorrectly configured access control levels, potentially changing streaming settings or data without any user interaction. No public exploit or active exploitation has been confirmed, and EPSS score is very low (0.06%).
Unauthenticated information disclosure in the H5P WordPress plugin up to version 1.16.1 allows remote attackers to access sensitive data due to missing authorization checks. No authentication is required, but only low confidentiality impact is expected. No public exploit has been identified, and exploitation is not known to be active.
Sensitive information exposure in WPXPO PostX plugin for WordPress (version 5.0.3 and below) allows remote unauthenticated attackers to retrieve embedded sensitive data via network-based requests. The vulnerability carries a CVSS 5.3 (Medium) score, with low EPSS exploitation probability (0.05%) and no known active exploitation or public exploit code. It involves improper exposure of system information to an unauthorized control sphere.
Sensitive information exposure in Leap13 Premium Addons for Elementor WordPress plugin up to 4.11.53 permits unauthenticated attackers to retrieve embedded sensitive data (e.g., API keys, tokens) via network requests. The flaw has a CVSS base score of 5.3 (Medium) with low confidentiality impact and no known active exploitation or public exploit code at this time.
Missing authorization in the Brave Popup Builder WordPress plugin (version <= 0.8.3) allows unauthenticated attackers to access functionality not properly restricted by access controls. Exploitation could lead to disclosure of sensitive information with no user interaction required. EPSS suggests a very low exploitation probability (0.04%) and no public exploit code has been identified.
Broken access control in Opinion Stage Poll, Survey & Quiz Maker Plugin for WordPress versions through 19.12.0 allows authenticated attackers with low-level privileges to bypass authorization checks and access or modify high-sensitivity data. The vulnerability (CWE-862: Missing Authorization) enables privilege escalation through improperly configured access control mechanisms. EPSS probability is low at 0.04% (13th percentile), and no public exploit identified at time of analysis, though authentication bypass tags indicate established attack patterns exist for this vulnerability class.
Broken access control in WP Telegram Widget and Join Link plugin versions up to 2.2.12 allows authenticated users with low privileges to bypass authorization checks and access high-sensitivity configuration or data. The vulnerability enables unauthorized read and write operations (CVSS C:H/I:H) without requiring user interaction. EPSS score of 0.04% suggests low observed exploitation probability, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Unauthorized modification of data in the WordPress FV Simpler SEO plugin versions up to and including 1.9.6 allows unauthenticated attackers to change plugin settings due to missing authorization checks. This vulnerability, reported by Patchstack, has a low predicted exploitation probability (EPSS 0.04%) and no public exploit or active exploitation identified at time of analysis.
Unauthorized data modification via missing authorization in the Addonify Quick View WordPress plugin (<= 2.0.4) allows remote, unauthenticated attackers to alter plugin settings or content due to missing capability checks on an AJAX endpoint. No active exploitation or public exploit code is known, and EPSS assigns a very low exploitation probability (0.04%).
Missing authorization in Claspo WordPress plugin through version 1.0.7 allows unauthenticated remote attackers to modify data via incorrectly configured access controls. With CVSS 7.5 (High integrity impact) but only 0.04% EPSS probability, this represents elevated exposure in vulnerable installations despite low observed exploitation likelihood. No public exploit identified at time of analysis, though the authentication bypass tag indicates potential for unauthorized actions without credentials.
Sensitive information disclosure in Essekia Tablesome WordPress plugin versions up to 1.1.35.1 allows authenticated attackers to retrieve embedded sensitive data from other users. The flaw, classed as CWE-201, stems from insertion of sensitive information into sent data, and carries a medium CVSS score of 5.0. No active exploitation or public exploit code is known at this time, and EPSS indicates a low (0.05%) probability of exploitation.
Server-Side Request Forgery in WordPress Link Library plugin versions up to 7.8.7 allows unauthenticated remote attackers to make arbitrary HTTP requests from the server, potentially accessing internal resources, cloud metadata endpoints, or conducting reconnaissance of internal network infrastructure. CVSS score of 9.1 indicates high severity, though EPSS of 0.04% (14th percentile) suggests limited observed exploitation attempts. No active exploitation confirmed (not in CISA KEV) and no public exploit identified at time of analysis.
Server-side request forgery (SSRF) in the BdThemes Prime Slider addon for Elementor (up to version 4.0.10)
Availability impact in the Linux kernel's Intel VPU accelerator driver (accel/ivpu) stems from a race condition between Buffer Object (BO) freeing and context teardown. A local, low-privileged user on a system with Intel VPU/NPU hardware can trigger the ivpu_gem_bo_free() path to remove a BO from the list before it is fully unmapped, causing file_priv_unbind() to encounter an unclean memory manager state and trigger a drm_mm_takedown() warning, ultimately resulting in a kernel availability impact. No public exploit exists and EPSS sits at the 1st percentile, indicating negligible real-world exploitation interest at this time.
Privilege escalation via missing authorization in WP Adminify for WordPress allows authenticated low-privilege users to read sensitive information. Remote attackers can exploit this without user interaction, leading to limited confidential data disclosure. No active exploitation has been reported and EPSS indicates low probability of exploitation (0.06%).
Missing authorization in the Virusdie WordPress plugin (≤ 1.1.6) allows authenticated low-privilege users to exploit incorrectly configured access controls, potentially leading to unauthorized changes to plugin settings. The vulnerability is not known to be actively exploited, with a low EPSS score (0.06%), and no public exploit code has been identified at time of analysis.