SQL injection in code-projects Student Information System 1.0's search functionality enables remote, unauthenticated attackers to execute malicious SQL statements via the searchbox parameter. Successful exploitation could compromise the confidentiality, integrity, or availability of the underlying database. While a public proof-of-concept exists, the EPSS exploitation probability is low (0.06%).
Unauthenticated SQL injection in Online Frozen Foods Ordering System 1.0 via the Name field in /contact_us.php enables remote attackers to exfiltrate or manipulate the underlying database. A public exploit is available but no active exploitation has been reported; EPSS indicates very low exploitation probability.
Open redirect vulnerability in Scott Paterson Accept Donations with PayPal & Stripe WordPress plugin (versions <= 1.5.2) enables attackers to craft malicious URLs that redirect users to untrusted sites, facilitating phishing attacks. The vulnerability requires user interaction (UI:R) but affects the plugin's core donation handling, allowing an unauthenticated attacker to chain this with social engineering to compromise user credentials or distribute malware through redirects to fraudulent payment pages.
An open redirect vulnerability in Jeff Starr's User Submitted Posts WordPress plugin allows attackers to craft malicious URLs that redirect victims to untrusted websites for phishing. All plugin versions up to and including 20251121 are affected, requiring user interaction to trigger. Public exploit code is available
Broken access control in WP Time Slots Booking Form plugin (≤1.2.39) allows authenticated attackers with low-level privileges to escalate permissions and execute unauthorized administrative actions. The vulnerability stems from missing authorization checks (CWE-862), enabling privilege escalation to access, modify, or delete sensitive booking data and configuration settings. While CVSS scores 8.8 (High), real-world risk appears moderate with EPSS at 0.06% (18th percentile) and no public exploit identified at time of analysis.
Missing authorization in Gutenverse Form plugin for WordPress allows authenticated attackers with low privileges to bypass access controls and perform unauthorized actions, resulting in a high availability impact. Versions up to and including 2.3.1 are affected, and no active exploitation has been reported.
Stored XSS in PickPlugins Post Grid and Gutenberg Blocks WordPress plugin (versions <= 2.3.23) allows authenticated users with limited privileges to inject malicious scripts that execute in the browsers of site visitors, potentially compromising site integrity and user data. The vulnerability requires user interaction (viewing a page with the injected content) and affects the site's security context (SameSite:Changed per CVSS:3.1/S:C). EPSS score of 0.04% indicates low real-world exploitation probability despite CVE publication.
Stored cross-site scripting vulnerability in the WordPress YouTube Embed plugin through version 5.4 allows authenticated low-privileged users (e.g., subscribers) to inject arbitrary web scripts via a malicious YouTube embed. When a victim (such as an administrator) views a page containing the injected embed, the script executes in their browser, potentially enabling session hijacking, defacement, or other client-side attacks. No public exploit or active exploitation has been reported, and EPSS indicates very low exploitation likelihood.
Stored cross-site scripting (XSS) in Live Composer page builder plugin for WordPress (versions through 2.1.11) allows authenticated users with low privileges to inject malicious scripts that execute in the browsers of other users viewing affected pages. An attacker with contributor or editor access can store XSS payloads that persist in the database and execute when administrators or other site visitors interact with the affected content, potentially leading to session hijacking, credential theft, or malware distribution.
Stored cross-site scripting (XSS) in BlueGlass Interactive AG Jobs for WordPress plugin versions 2.8.1 and earlier allows authenticated users with low privileges to inject malicious scripts into job postings that execute in the browsers of other site visitors. The vulnerability requires user interaction (clicking a crafted link) and affects website visitors with cross-site request forgery capabilities, resulting in limited confidentiality and integrity impact but no availability impact. The issue has a low exploitation probability (EPSS 0.04%) despite publicly disclosed details.
Stored cross-site scripting in HasThemes WC Builder WordPress plugin up to version 1.2.0 allows authenticated attackers with low privileges to inject arbitrary web scripts into pages created with the plugin. When victims view the crafted page, the script executes in their browser, leading to potential data theft or session hijacking.
Stored cross-site scripting in ModelTheme Addons for WPBakery and Elementor plugin for WordPress through version 1.5.5 allows authenticated attackers with contributor-level or higher privileges to inject arbitrary web scripts. When a victim, such as an administrator, views the affected page, the injected script executes in their browser, leading to potential session hijacking, credential theft, or site defacement. No active exploitation or public exploit code is known at this time, and EPSS probability is very low (0.04%).
Stored cross-site scripting in the WPFactory Free Shipping Bar plugin for WooCommerce version 2.4.9 and earlier allows authenticated attackers to inject malicious scripts into pages viewed by other users, potentially leading to data theft or session hijacking. The vulnerability requires contributor-level or higher privileges and user interaction to trigger. No active exploitation or public exploit is known at this time.
Stored cross-site scripting in the Academy LMS WordPress plugin up to version 3.4.0 allows authenticated attackers with low privileges to inject JavaScript into web pages viewed by other users. No evidence of active exploitation or public exploit code exists; EPSS indicates a very low exploitation probability (0.04%).
Stored cross-site scripting in the Bold Timeline Lite plugin for WordPress allows authenticated attackers to inject arbitrary web scripts. Versions up to and including 1.2.7 are affected, enabling an attacker with low privileges to store a payload that executes when a victim views an infected timeline page. The CVSS 6.5 rating reflects medium severity, but the very low EPSS exploitation probability (0.04%) suggests minimal real-world threat; no public exploit or active exploitation is known.
Stored cross-site scripting in Real 3D FlipBook plugin up to version 4.11.4 allows authenticated users with low privileges to inject malicious scripts that execute in victim browsers. This can lead to session hijacking or
Cross-site scripting in WPBakery Visual Composer WHMCS Elements plugin for WordPress allows authenticated attackers with high privileges to inject malicious scripts via DOM manipulation. This XSS can lead to limited data disclosure or actions within the victim's session but requires user interaction. No public exploit or active exploitation reported.
Stored cross-site scripting (XSS) in WordPress plugin My auctions allegro (versions up to 3.6.35) allows authenticated users to inject malicious scripts that execute in other users' browsers when viewing auction content. The vulnerability requires user interaction (UI:R) and affects the confidentiality and integrity of affected WordPress installations, though with limited scope within the plugin context. No public exploit code or active exploitation has been identified; real-world risk is moderate given the requirement for authenticated access and user interaction.
Stored Cross-Site Scripting in the pixelgrade Category Icon WordPress plugin through version 1.0.2 enables authenticated administrators to inject malicious scripts that execute in other users' browsers, leading to low-impact compromise of confidentiality and integrity. No active exploitation or public proof-of-concept code is currently known, and EPSS indicates a low exploitation probability (0.04%).
Stored cross-site scripting in Astra Widgets WordPress plugin up to version 1.2.16 allows authenticated attackers with admin access to inject malicious scripts that execute when other users view pages containing affected widgets. No public exploit or active exploitation has been reported, and EPSS probability is low (0.04%).
DOM-based Cross-Site Scripting in the Greenhouse Job Board WordPress plugin versions up to 2.7.3 allows authenticated administrators to inject arbitrary scripts. A victim admin browsing a page where the payload is rendered could have their browser execute the malicious code, leading to session hijacking or data theft. At time of analysis, no active exploitation or public exploit is known.
DOM-based cross-site scripting (XSS) in the GARD AdSense plugin for WordPress versions ≤2.23 allows authenticated administrators to inject malicious scripts that execute in the browser of a victim who interacts with a crafted link. Exploitation requires high-privilege user access and victim user interaction, and no public exploit or active attacks are known (EPSS 0.04%).
Stored cross-site scripting in the WordPress Gift Hunt plugin up to version 2.0.2 allows authenticated attackers with administrator-level privileges to inject arbitrary web scripts that execute when other users view the affected plugin pages. This can lead to session hijacking, credential theft, or unauthorized actions within the site. EPSS indicates very low exploitation probability (0.04%), no active exploitation is known, and no public proof-of-concept has been identified.
Stored cross-site scripting in WordPress WH Tweaks plugin up to version 1.0.2 allows authenticated administrators to inject web scripts that execute in other users' browsers, potentially leading to session hijacking or data theft. The vulnerability requires high privileges (admin) and user interaction (victim must view the poisoned page), with no public exploit or active exploitation confirmed. Its CVSS base score of 5.9 indicates a moderate risk primarily for sites where untrusted individuals may hold administrator roles.
Stored cross-site scripting in the Basticom Framework WordPress plugin up to version 1.5.2 enables authenticated administrators to inject arbitrary web scripts. These scripts execute in the browsers of other users who view the affected page, potentially leading to session hijacking, phishing, or defacement. No active exploitation or public exploit code has been identified at time of analysis, and the EPSS likelihood is very low (0.04%).
Stored cross-site scripting in the WordPress Review Disclaimer plugin versions up to 2.0.3 allows authenticated high-privilege attackers (e.g., admin) to inject arbitrary web scripts that execute in the browsers of other users. While no active exploitation is confirmed and the EPSS likelihood is very low (0.04%), a successful attack could lead to session theft or site defacement when a victim views the injected content.
Stored cross-site scripting in the TouchOfTech Draft Notify WordPress plugin allows authenticated administrators to inject malicious scripts that execute in other users’ browsers when they view affected pages. Versions up to and including 1.5 are vulnerable. The flaw is not actively exploited, and no public exploit code has been identified.
Uninitialized memory use in the Linux kernel NTFS3 filesystem driver (fs/ntfs3) enables a local low-privileged user to trigger a kernel crash, causing a denial of service. The `__getname()` function allocates slab memory via `kmem_cache_alloc()` without zeroing it; `ntfs_read_hdr` and `bcmp` then operate on this indeterminate data, as detected by KMSAN. No active exploitation is confirmed (not in CISA KEV), and the EPSS score of 0.18% at the 7th percentile reflects very low real-world exploitation probability. Upstream patches are available across multiple stable kernel branches.
BPF test infrastructure in the Linux kernel allows a local user with BPF program execution privileges to emit packets with malformed GSO (Generic Segmentation Offload) metadata to the network stack via bpf_clone_redirect(), triggering skb_warn_bad_offload() and disabling GSO-related offload features - a denial-of-service condition. The root cause is convert___skb_to_skb() populating gso_segs and gso_size without a corresponding gso_type, producing an internally inconsistent socket buffer that fails GSO validation in netif_skb_features(). No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified; the issue was originally surfaced through fuzzing by Yinhao et al. Patches across six stable kernel branches have been released.
Missing authorization in WP Adminify plugin for WordPress (<=4.0.6.1) allows authenticated low-privileged users to modify plugin configurations without permission, impacting site integrity and availability. No active exploitation or public exploit code has been reported, and EPSS indicates a low probability of exploitation (0.06%). Exploitation requires a valid user account but no high-level access, making it a moderate risk once authenticated.
Server-Side Request Forgery (SSRF) in 6Storage Rentals WordPress plugin versions ≤2.20.2 allows unauthenticated remote attackers to send crafted requests from the vulnerable server to arbitrary internal or external systems. With CVSS 9.1 (critical) due to network-accessible attack vector requiring no authentication or user interaction, attackers can achieve high confidentiality and integrity impact by potentially accessing internal services, cloud metadata endpoints, or exfiltrating sensitive data. EPSS score of 0.04% (14th percentile) indicates relatively low observed exploitation probability despite the critical severity rating. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis.
Missing authorization in the Editorial Calendar WordPress plugin allows authenticated attackers with low privileges to view and modify editorial calendar data. Versions up to 3.8.8 are affected. While active exploitation is not confirmed and exploit code is not publicly available, patching is advised.
Missing authorization in Simple File List WordPress plugin 6.1.18 and earlier allows authenticated low-privilege users to bypass access controls and gain unauthorized read/write access to file list data. Tagged as an authentication bypass vulnerability with EPSS score of 0.04% (13th percentile), indicating low observed exploitation probability. No active exploitation confirmed (not in CISA KEV), and no public exploit code identified at time of analysis.
Missing authorization in YITH Slider for page builders (WordPress plugin) allows authenticated low-privileged attackers to view and modify slider content without proper permission checks. Patches are implied in versions beyond 1.0.11. No active exploitation or public exploit code is currently known.
Missing authorization in the Tablesome WordPress plugin allows authenticated low-privilege users to modify or disrupt plugin data. Affected versions up to 1.1.35.1; no active exploitation or public exploit identified at this time.
Stored XSS in Specto CM, a call center management platform by Echo Call Center Services Trade and Industry Inc., allows authenticated low-privileged users to inject persistent malicious scripts that execute in other users' browsers. The changed scope (S:C) in the CVSS vector indicates the injected payload can affect sessions or contexts beyond the attacker's own, elevating the practical impact for multi-user environments. No active exploitation is confirmed (not in CISA KEV), and the EPSS score of 0.02% (7th percentile) indicates very low exploitation probability at time of analysis.
Cross-Site Request Forgery (CSRF) in Five Star Restaurant Reservations WordPress plugin versions ≤2.7.8 enables unauthenticated attackers to perform unauthorized administrative actions through social engineering. With CVSS 8.8 (High), the vulnerability requires no privileges and low attack complexity, though user interaction is necessary. EPSS probability is minimal (0.02%, 6th percentile), indicating low observed exploitation likelihood despite the high CVSS score. No confirmed active exploitation (not in CISA KEV) or public exploit code identified at time of analysis.
Cross-site request forgery in Simple Keyword to Link WordPress plugin version 1.5 and below allows unauthenticated attackers to trick authenticated administrators into modifying keyword-to-link associations through crafted requests. No active exploitation or public exploit code has been identified, and the low EPSS score suggests a low probability of widespread attacks.
Cross-Site Request Forgery in WordPress plugin My Auctions Allegro (versions ≤3.6.33) allows unauthenticated remote attackers to perform unauthorized actions on behalf of authenticated users through social engineering. CVSS 8.8 severity stems from potential high confidentiality, integrity, and availability impact if victims are tricked into clicking malicious links while authenticated. EPSS score of 0.02% (6th percentile) indicates very low probability of exploitation in the wild. No active exploitation confirmed (not in CISA KEV), and no public exploit identified at time of analysis, suggesting this remains a theoretical high-severity issue requiring user interaction.
Missing authorization in Twitch Player WordPress plugin (ttv-easy-embed-player) versions up to 2.1.3 allows remote unauthenticated attackers to trigger a denial-of-service condition via exploitation of incorrectly configured access control security levels. This CWE-862 vulnerability impacts only availability and has no confidentiality or integrity impact. No active exploitation or public exploit code is confirmed at this time; EPSS indicates a 0.06% probability of exploitation in the next 30 days.
Unauthenticated information disclosure in the Bit Assist plugin for WordPress (versions up to 1.5.11) allows remote attackers to read potentially sensitive data due to missing authorization checks on certain endpoints. No proof-of-concept exploit code or active exploitation has been publicly reported at this time; the EPSS exploitation probability is 0.06%.
Broken access control in Trustindex Widgets for Social Photo Feed (WordPress plugin) through version 1.8 allows authenticated attackers with low privileges to bypass authorization controls and execute high-impact actions. The vulnerability has low attack complexity (CVSS:3.1 AV:N/AC:L/PR:L) enabling compromise of confidentiality, integrity, and availability. EPSS score of 0.06% (18th percentile) indicates relatively low observed exploitation probability, and no public exploit or CISA KEV listing exists at time of analysis, suggesting this remains a patch-priority issue rather than an active threat.
Broken access control in Cooked WordPress plugin versions ≤1.11.3 allows authenticated attackers with low-level privileges to bypass authorization checks and gain unauthorized access to high-privilege functions. The vulnerability stems from missing authorization validation (CWE-862), enabling privilege escalation and unauthorized data manipulation. With CVSS 8.8 and EPSS probability of 0.06% (18th percentile), real-world exploitation risk is moderate; no public exploit identified at time of analysis.
Missing authorization in the Funnelforms Free plugin for WordPress (versions up to 3.8) allows unauthenticated attackers to modify plugin data due to incorrectly configured access control. The vulnerability (CWE-862) has a CVSS 5.3 rating with low integrity impact only; no confidentiality or availability is affected. At the time of analysis, there is no evidence of active exploitation and the EPSS score is low (0.06%), indicating limited urgency.
Authorization bypass in Wappointment WordPress plugin versions ≤2.7.6 enables low-privileged authenticated attackers to perform unauthorized actions with high impact to confidentiality, integrity, and availability. The vulnerability stems from missing authorization checks (CWE-862), allowing authenticated users to access or modify data beyond their intended permission level. EPSS score of 0.06% (18th percentile) indicates low observed exploitation probability, and no confirmed active exploitation (CISA KEV) or public exploit code is identified at time of analysis.
Unauthenticated missing authorization flaw in the BBP Core WordPress plugin (versions ≤1.4.1) allows attackers to modify certain data with low integrity impact. No confidentiality is exposed. The flaw, assigned CWE-862, has a CVSS base score of 5.3 (Medium) but is not actively exploited.
Broken access control in SALESmanago WordPress plugin allows authenticated attackers with low-level privileges to bypass authorization checks and gain unauthorized access to high-privilege functions. Affects versions up to 3.9.0. The vulnerability enables complete compromise of confidentiality, integrity, and availability within the plugin's scope. EPSS score of 0.06% (18th percentile) suggests low observed exploitation probability, and no public exploit identified at time of analysis.
Low-integrity unauthorized modification in WpStream plugin ≤4.9.5 allows unauthenticated remote attackers to alter plugin functionality via missing authorization checks. The vulnerability, classified as CWE-862 Missing Authorization, enables attackers to exploit incorrectly configured access control levels, potentially changing streaming settings or data without any user interaction. No public exploit or active exploitation has been confirmed, and EPSS score is very low (0.06%).
Unauthenticated information disclosure in the H5P WordPress plugin up to version 1.16.1 allows remote attackers to access sensitive data due to missing authorization checks. No authentication is required, but only low confidentiality impact is expected. No public exploit has been identified, and exploitation is not known to be active.
Sensitive information exposure in WPXPO PostX plugin for WordPress (version 5.0.3 and below) allows remote unauthenticated attackers to retrieve embedded sensitive data via network-based requests. The vulnerability carries a CVSS 5.3 (Medium) score, with low EPSS exploitation probability (0.05%) and no known active exploitation or public exploit code. It involves improper exposure of system information to an unauthorized control sphere.