Information disclosure in WpStream plugin for WordPress up to version 4.9.5 allows authenticated low-privileged users to read sensitive configuration data due to a missing authorization check (CWE-862). The vulnerability requires a subscriber-level account and exposes limited confidentiality information without affecting integrity or availability. No active exploitation or public exploit code has been identified at time of analysis.
Sensitive information disclosure in the Virusdie WordPress plugin up to version 1.1.6 allows authenticated, low-privileged attackers to retrieve embedded sensitive data. The vulnerability, classified as CWE-497, enables unauthorized access to system information through the plugin's normal interface. Despite a medium CVSS score (4.3), EPSS indicates very low risk of exploitation, and no active exploitation or public exploit code is reported.
Sensitive data exposure in the Eight Day Week Print Workflow WordPress plugin allows authenticated attackers with subscriber-level access to retrieve embedded sensitive data such as API keys or tokens. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%), indicating minimal current risk.
Unauthorized modification possible in the Sunshine Photo Cart WordPress plugin up to version 3.5.7.1 due to missing authorization checks. Authenticated low-privileged users can exploit misconfigured access controls to alter data they should not have access to. No active exploitation or public exploit is known, and EPSS indicates a 0.04% probability of exploitation in the next 30 days.
Access control bypass in TS Poll WordPress plugin (versions ≤2.5.5) allows low-privileged authenticated users to escalate privileges and gain unauthorized read/write access to poll data. Attackers with basic subscriber accounts can exploit misconfigured authorization checks to access or modify content beyond their intended permission level. EPSS exploitation probability is low (0.04%, 13th percentile), with no public exploit identified at time of analysis, suggesting limited immediate risk despite the 8.1 CVSS score.
Missing authorization check in Watu Quiz plugin for WordPress up to version 3.4.5 permits authenticated low-privilege users to perform unauthorized modifications, such as altering quiz content or settings. The flaw stems from incorrectly configured access control security levels, allowing attackers with subscriber or contributor roles to bypass intended restrictions. No active exploitation has been reported, and EPSS indicates low likelihood of widespread attacks.
Authenticated data modification in the Spiffy Calendar WordPress plugin allows low-privilege attackers to edit calendar events without proper authorization. The vulnerability affects all plugin versions up to and including 5.0.7. No active exploitation or public exploit code has been observed, and EPSS indicates a negligible chance of widespread exploitation.
Missing Authorization vulnerability in bnayawpguy Resoto resoto allows Exploiting Incorrectly Configured Access Control Security Levels.0.8. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) in the Vimeotheque plugin for WordPress (version 2.3.5.2 and earlier) allows unauthenticated attackers to trick authenticated users into performing state-changing actions, resulting in low integrity impact. The flaw carries a CVSS v3.1 score of 4.3 (Medium) but has an EPSS exploitation probability of only 0.02%, indicating very low real-world risk. No active exploitation or public exploit code has been identified at the time of analysis.
Cross-Site Request Forgery in the Fast User Switching WordPress plugin (versions ≤1.4.10) allows tricking an administrator into performing unintended user-switching actions. The flaw poses a medium risk (CVSS 4.3) but requires user interaction and is not currently known to be actively exploited nor publicly weaponized.
Cross-site request forgery in Advanced Classifieds & Directory Pro for WordPress up to version 3.2.9 allows unauthenticated attackers to perform unauthorized actions, such as modifying plugin settings, by tricking an authenticated administrator into clicking a crafted link. No public exploit or active exploitation is known, and EPSS gives a 0.02% probability of exploitation, indicating very low real-world risk.
Unauthorized setting modification in the WP Email Capture WordPress plugin through version 3.12.5 allows an unauthenticated attacker to trick a logged-in administrator into performing actions such as altering email capture settings. The vulnerability requires user interaction and has very low exploitation probability (EPSS 0.02%); no active exploitation or public exploit code is known.
Cross-Site Request Forgery in the Trade Runner WordPress plugin (versions ≤ 3.14) allows a remote attacker to trick a logged-in administrator into submitting a forged request, resulting in unauthorized low-impact data modification. The vulnerability is not listed in CISA KEV and has no known public exploit, with EPSS score indicating very low exploitation likelihood.
Missing authorization in WP Document Revisions plugin ≤3.7.2 allows authenticated high‑privilege users to bypass access controls and modify document data without proper authorization. The vulnerability carries Low severity (CVSS 2.7) due to the high permission level required and limited integrity impact. No active exploitation or public exploit is currently known.
In the Linux kernel, the following vulnerability has been resolved: arm64: mm: fix VA-range sanity check Both create_mapping_noalloc() and update_mapping_prot() sanity-check their 'virt' parameter,. No vendor patch available.
Linux kernel iomap subsystem fails to allocate the s_dio_done_wq workqueue for asynchronous read operations, causing read error completions deferred by commit 222f2c7c6d14 to lack proper execution context and potentially leading to information disclosure or system instability. The vulnerability affects Linux kernel versions where the read error completion deferral was implemented without corresponding workqueue allocation for async reads. With an EPSS score of 0.01% and no evidence of active exploitation, this is a low-probability but correctness-critical issue affecting async I/O error handling on affected kernel versions.
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix invalid prog->stats access when update_effective_progs fails Syzkaller triggers an invalid memory access issue following fault injection in update_effective_progs. The issue can be described as follows: __cgroup_bpf_detach update_effective_progs compute_effective_progs bpf_prog_array_alloc <-- fault inject purge_effective_progs /* change to dummy_bpf_prog */ array->items[index] = &dummy_bpf_prog.prog ---softirq start--- __do_softirq ... __cgroup_bpf_run_filter_skb __bpf_prog_run_save_cb bpf_prog_run stats = this_cpu_ptr(prog->stats) /* invalid memory access */ flags = u64_stats_update_begin_irqsave(&stats->syncp) ---softirq end--- static_branch_dec(&cgroup_bpf_enabled_key[atype]) The reason is that fault injection caused update_effective_progs to fail and then changed the original prog into dummy_bpf_prog.prog in purge_effective_progs. Then a softirq came, and accessing the members of dummy_bpf_prog.prog in the softirq triggers invalid mem access. To fix it, skip updating stats when stats is NULL.
In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Fix device resources accessed after device removal Correct possible race conditions during device removal. Previously, a scheduled work item to reset a LUN could still execute after the device was removed, leading to use-after-free and other resource access issues. This race condition occurs because the abort handler may schedule a LUN reset concurrently with device removal via sdev_destroy(), leading to use-after-free and improper access to freed resources. - Check in the device reset handler if the device is still present in the controller's SCSI device list before running; if not, the reset is skipped. - Cancel any pending TMF work that has not started in sdev_destroy(). - Ensure device freeing in sdev_destroy() is done while holding the LUN reset mutex to avoid races with ongoing resets.
In the Linux kernel, the following vulnerability has been resolved: bpf: Check skb->transport_header is set in bpf_skb_check_mtu The bpf_skb_check_mtu helper needs to use skb->transport_header when the BPF_MTU_CHK_SEGS flag is used: bpf_skb_check_mtu(skb, ifindex, &mtu_len, 0, BPF_MTU_CHK_SEGS) The transport_header is not always set. There is a WARN_ON_ONCE report when CONFIG_DEBUG_NET is enabled + skb->gso_size is set + bpf_prog_test_run is used: WARNING: CPU: 1 PID: 2216 at ./include/linux/skbuff.h:3071 skb_gso_validate_network_len bpf_skb_check_mtu bpf_prog_3920e25740a41171_tc_chk_segs_flag # A test in the next patch bpf_test_run bpf_prog_test_run_skb For a normal ingress skb (not test_run), skb_reset_transport_header is performed but there is plan to avoid setting it as described in commit 2170a1f09148 ("net: no longer reset transport_header in __netif_receive_skb_core()"). This patch fixes the bpf helper by checking skb_transport_header_was_set(). The check is done just before skb->transport_header is used, to avoid breaking the existing bpf prog. The WARN_ON_ONCE is limited to bpf_prog_test_run, so targeting bpf-next.