Sensitive information exposure in Leap13 Premium Addons for Elementor WordPress plugin up to 4.11.53 permits unauthenticated attackers to retrieve embedded sensitive data (e.g., API keys, tokens) via network requests. The flaw has a CVSS base score of 5.3 (Medium) with low confidentiality impact and no known active exploitation or public exploit code at this time.
Missing authorization in the Brave Popup Builder WordPress plugin (version <= 0.8.3) allows unauthenticated attackers to access functionality not properly restricted by access controls. Exploitation could lead to disclosure of sensitive information with no user interaction required. EPSS suggests a very low exploitation probability (0.04%) and no public exploit code has been identified.
Broken access control in Opinion Stage Poll, Survey & Quiz Maker Plugin for WordPress versions through 19.12.0 allows authenticated attackers with low-level privileges to bypass authorization checks and access or modify high-sensitivity data. The vulnerability (CWE-862: Missing Authorization) enables privilege escalation through improperly configured access control mechanisms. EPSS probability is low at 0.04% (13th percentile), and no public exploit identified at time of analysis, though authentication bypass tags indicate established attack patterns exist for this vulnerability class.
Broken access control in WP Telegram Widget and Join Link plugin versions up to 2.2.12 allows authenticated users with low privileges to bypass authorization checks and access high-sensitivity configuration or data. The vulnerability enables unauthorized read and write operations (CVSS C:H/I:H) without requiring user interaction. EPSS score of 0.04% suggests low observed exploitation probability, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Unauthorized modification of data in the WordPress FV Simpler SEO plugin versions up to and including 1.9.6 allows unauthenticated attackers to change plugin settings due to missing authorization checks. This vulnerability, reported by Patchstack, has a low predicted exploitation probability (EPSS 0.04%) and no public exploit or active exploitation identified at time of analysis.
Unauthorized data modification via missing authorization in the Addonify Quick View WordPress plugin (<= 2.0.4) allows remote, unauthenticated attackers to alter plugin settings or content due to missing capability checks on an AJAX endpoint. No active exploitation or public exploit code is known, and EPSS assigns a very low exploitation probability (0.04%).
Missing authorization in Claspo WordPress plugin through version 1.0.7 allows unauthenticated remote attackers to modify data via incorrectly configured access controls. With CVSS 7.5 (High integrity impact) but only 0.04% EPSS probability, this represents elevated exposure in vulnerable installations despite low observed exploitation likelihood. No public exploit identified at time of analysis, though the authentication bypass tag indicates potential for unauthorized actions without credentials.
Sensitive information disclosure in Essekia Tablesome WordPress plugin versions up to 1.1.35.1 allows authenticated attackers to retrieve embedded sensitive data from other users. The flaw, classed as CWE-201, stems from insertion of sensitive information into sent data, and carries a medium CVSS score of 5.0. No active exploitation or public exploit code is known at this time, and EPSS indicates a low (0.05%) probability of exploitation.
Server-Side Request Forgery in WordPress Link Library plugin versions up to 7.8.7 allows unauthenticated remote attackers to make arbitrary HTTP requests from the server, potentially accessing internal resources, cloud metadata endpoints, or conducting reconnaissance of internal network infrastructure. CVSS score of 9.1 indicates high severity, though EPSS of 0.04% (14th percentile) suggests limited observed exploitation attempts. No active exploitation confirmed (not in CISA KEV) and no public exploit identified at time of analysis.
Server-side request forgery (SSRF) in the BdThemes Prime Slider addon for Elementor (up to version 4.0.10)
Availability impact in the Linux kernel's Intel VPU accelerator driver (accel/ivpu) stems from a race condition between Buffer Object (BO) freeing and context teardown. A local, low-privileged user on a system with Intel VPU/NPU hardware can trigger the ivpu_gem_bo_free() path to remove a BO from the list before it is fully unmapped, causing file_priv_unbind() to encounter an unclean memory manager state and trigger a drm_mm_takedown() warning, ultimately resulting in a kernel availability impact. No public exploit exists and EPSS sits at the 1st percentile, indicating negligible real-world exploitation interest at this time.
Privilege escalation via missing authorization in WP Adminify for WordPress allows authenticated low-privilege users to read sensitive information. Remote attackers can exploit this without user interaction, leading to limited confidential data disclosure. No active exploitation has been reported and EPSS indicates low probability of exploitation (0.06%).
Missing authorization in the Virusdie WordPress plugin (≤ 1.1.6) allows authenticated low-privilege users to exploit incorrectly configured access controls, potentially leading to unauthorized changes to plugin settings. The vulnerability is not known to be actively exploited, with a low EPSS score (0.06%), and no public exploit code has been identified at time of analysis.
Information disclosure in WpStream plugin for WordPress up to version 4.9.5 allows authenticated low-privileged users to read sensitive configuration data due to a missing authorization check (CWE-862). The vulnerability requires a subscriber-level account and exposes limited confidentiality information without affecting integrity or availability. No active exploitation or public exploit code has been identified at time of analysis.
Sensitive information disclosure in the Virusdie WordPress plugin up to version 1.1.6 allows authenticated, low-privileged attackers to retrieve embedded sensitive data. The vulnerability, classified as CWE-497, enables unauthorized access to system information through the plugin's normal interface. Despite a medium CVSS score (4.3), EPSS indicates very low risk of exploitation, and no active exploitation or public exploit code is reported.
Sensitive data exposure in the Eight Day Week Print Workflow WordPress plugin allows authenticated attackers with subscriber-level access to retrieve embedded sensitive data such as API keys or tokens. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%), indicating minimal current risk.
Unauthorized modification possible in the Sunshine Photo Cart WordPress plugin up to version 3.5.7.1 due to missing authorization checks. Authenticated low-privileged users can exploit misconfigured access controls to alter data they should not have access to. No active exploitation or public exploit is known, and EPSS indicates a 0.04% probability of exploitation in the next 30 days.
Access control bypass in TS Poll WordPress plugin (versions ≤2.5.5) allows low-privileged authenticated users to escalate privileges and gain unauthorized read/write access to poll data. Attackers with basic subscriber accounts can exploit misconfigured authorization checks to access or modify content beyond their intended permission level. EPSS exploitation probability is low (0.04%, 13th percentile), with no public exploit identified at time of analysis, suggesting limited immediate risk despite the 8.1 CVSS score.
Missing authorization check in Watu Quiz plugin for WordPress up to version 3.4.5 permits authenticated low-privilege users to perform unauthorized modifications, such as altering quiz content or settings. The flaw stems from incorrectly configured access control security levels, allowing attackers with subscriber or contributor roles to bypass intended restrictions. No active exploitation has been reported, and EPSS indicates low likelihood of widespread attacks.
Authenticated data modification in the Spiffy Calendar WordPress plugin allows low-privilege attackers to edit calendar events without proper authorization. The vulnerability affects all plugin versions up to and including 5.0.7. No active exploitation or public exploit code has been observed, and EPSS indicates a negligible chance of widespread exploitation.
Missing Authorization vulnerability in bnayawpguy Resoto resoto allows Exploiting Incorrectly Configured Access Control Security Levels.0.8. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) in the Vimeotheque plugin for WordPress (version 2.3.5.2 and earlier) allows unauthenticated attackers to trick authenticated users into performing state-changing actions, resulting in low integrity impact. The flaw carries a CVSS v3.1 score of 4.3 (Medium) but has an EPSS exploitation probability of only 0.02%, indicating very low real-world risk. No active exploitation or public exploit code has been identified at the time of analysis.
Cross-Site Request Forgery in the Fast User Switching WordPress plugin (versions ≤1.4.10) allows tricking an administrator into performing unintended user-switching actions. The flaw poses a medium risk (CVSS 4.3) but requires user interaction and is not currently known to be actively exploited nor publicly weaponized.
Cross-site request forgery in Advanced Classifieds & Directory Pro for WordPress up to version 3.2.9 allows unauthenticated attackers to perform unauthorized actions, such as modifying plugin settings, by tricking an authenticated administrator into clicking a crafted link. No public exploit or active exploitation is known, and EPSS gives a 0.02% probability of exploitation, indicating very low real-world risk.
Unauthorized setting modification in the WP Email Capture WordPress plugin through version 3.12.5 allows an unauthenticated attacker to trick a logged-in administrator into performing actions such as altering email capture settings. The vulnerability requires user interaction and has very low exploitation probability (EPSS 0.02%); no active exploitation or public exploit code is known.
Cross-Site Request Forgery in the Trade Runner WordPress plugin (versions ≤ 3.14) allows a remote attacker to trick a logged-in administrator into submitting a forged request, resulting in unauthorized low-impact data modification. The vulnerability is not listed in CISA KEV and has no known public exploit, with EPSS score indicating very low exploitation likelihood.