Command injection in the Edimax BR-6208AC V2 web-based configuration interface exposes unauthenticated remote attackers to arbitrary OS command execution by manipulating the `rootAPmac` parameter submitted to the `/goform/formStaDrvSetup` handler. Firmware versions 1.02 and 1.03 are confirmed affected, and Edimax has explicitly stated the device has reached End of Life with no firmware patch forthcoming - making this a permanent, unmitigable vulnerability for any unit still in service. A public proof-of-concept is available, and no public exploit identified at time of analysis in CISA KEV, though the 67th-percentile EPSS score suggests elevated risk relative to the broader CVE population.
Command injection in the Edimax BR-6208AC V2 web-based configuration interface (firmware 1.02 and 1.03) allows remote attackers to execute arbitrary OS commands by manipulating routing parameters in the formRoute handler, with no authentication or user interaction indicated as required per the CVSS 4.0 vector. The vendor has confirmed the device is End of Life and has explicitly declined to release any remediation, making hardware replacement the only definitive fix. A public proof-of-concept exploit exists; no CISA KEV listing was identified at time of analysis, and the EPSS score of 0.39% at the 60th percentile suggests limited observed exploitation to date despite PoC availability.
SQL injection in itsourcecode Society Management System 1.0 exposes the /admin/add_admin.php endpoint to unauthenticated remote attackers who can manipulate the Username parameter to execute arbitrary SQL queries against the backend database. The vulnerability is classified under CWE-74 (Injection) and a publicly available proof-of-concept has been published on GitHub, though EPSS sits at a low 0.04% (11th percentile) and it is not listed in CISA KEV, indicating no confirmed widespread exploitation. Given the product's hobbyist/academic PHP codebase and limited deployment footprint, real-world impact is likely narrow but trivially exploitable wherever the system is running.
SQL injection in itsourcecode Society Management System 1.0 allows remote attackers to manipulate database queries via the Username parameter in the edit_admin_query function at /admin/edit_admin_query.php. The affected product is a free PHP-based web application distributed by itsourcecode.com, pinned at version 1.0 with no patch released. Publicly available exploit code exists per the GitHub PoC reference, though EPSS sits at 0.04% (11th percentile), indicating limited observed exploitation activity in the wild despite disclosure.
SQL injection in BiggiDroid Simple PHP CMS 1.0 exposes the admin login endpoint to remote, unauthenticated database manipulation via the Username parameter at /admin/login.php. A public proof-of-concept exploit is available on Gitee, enabling authentication bypass or database exfiltration with no prior credentials required. No vendor patch has been released, and the product is not listed in CISA KEV; however, the public PoC materially lowers the bar for opportunistic exploitation against any internet-exposed installation.
SQL injection in Simple Stock System 1.0’s login page allows unauthenticated remote attackers to manipulate database queries via the Username field. Exploit code is publicly available, but the vulnerability has not been reported as actively exploited (EPSS 0.04%). Successful exploitation could enable limited data exposure, tampering, or disruption, as reflected by low impact scores in the CVSS vector.
Stored HTML injection (CWE-79) in TrueConf Server 5.5.2.10813 on Windows enables an authenticated attacker to embed arbitrary HTML into a conference's description field, which executes in the browser of any user who visits the Conference Info page at [conference_url]/info. The CVSS Scope Change (S:C) reflects cross-context impact - payloads escape the originating session and execute within victims' browser contexts, enabling session hijacking or phishing. A public proof-of-concept is confirmed on GitHub; however, EPSS at 0.17% (7th percentile) and absence from CISA KEV indicate no known widespread exploitation at time of analysis.
Local file inclusion in miniOrange Social Login and Register plugin for WordPress allows authenticated attackers with administrative privileges to read arbitrary files on the server, potentially leading to full site compromise. The vulnerability affects all plugin versions up to 7.7.0, and while no active exploitation or public exploit has been identified, EPSS data indicates a low probability of exploitation. High attack complexity and the requirement for administrative access limit immediate urgency but still pose a risk in environments where admin credentials could be abused.
WP Project Manager plugin through version 3.0.1 exposes sensitive information in sent data due to improper information handling, allowing attackers to retrieve embedded sensitive data without authentication. The vulnerability affects all installations of the weDevs plugin and has been identified with an extremely low EPSS score (0.05%, 14th percentile), suggesting minimal practical exploitation likelihood despite the information disclosure classification.
DOM-based cross-site scripting (XSS) in WPCal.io WordPress plugin versions 0.9.5.9 and earlier allows attackers to inject malicious scripts into web pages viewed by users. The vulnerability stems from improper neutralization of user input during web page generation, enabling attackers to execute arbitrary JavaScript in the context of affected websites. No CVSS score is available, but the EPSS score of 0.04% (14th percentile) indicates low practical exploitation likelihood despite the XSS vector being a common attack class.
Stored cross-site scripting (XSS) in Yada Wiki WordPress plugin through version 3.5 allows authenticated users to inject malicious scripts that execute in the browsers of other site visitors. The vulnerability stems from improper input sanitization during web page generation, enabling persistent XSS attacks that could compromise site integrity, steal credentials, or perform actions on behalf of administrators. EPSS exploitation probability is very low at 0.04%, but the stored nature of the vulnerability means injected payloads persist across sessions.
DOM-based cross-site scripting (XSS) in 8theme XStore Core plugin (et-core-plugin) versions below 5.6 allows attackers to inject malicious scripts that execute in users' browsers during web page generation. The vulnerability affects WordPress installations using the vulnerable plugin, and while no CVSS score was assigned, the extremely low EPSS score (0.04%) suggests minimal real-world exploitation likelihood despite the XSS classification.
Stored cross-site scripting (XSS) in webcreations907 WBC907 Core WordPress plugin versions up to 3.4.1 allows attackers to inject and execute malicious JavaScript that persists in the application, potentially compromising users who view affected pages. The vulnerability stems from improper input neutralization during web page generation. No public exploit code or active exploitation has been identified at the time of analysis, though the attack vector and complexity depend on the specific injection point within the plugin.
Stored cross-site scripting (XSS) in CodeFlavors Featured Video for WordPress (VideographyWP) plugin version 1.0.18 and earlier allows authenticated attackers to inject malicious scripts that execute in the browsers of other site users, potentially compromising administrator accounts and site integrity. The vulnerability stems from improper input sanitization during web page generation, and no public exploit code has been identified at the time of analysis.
Stored Cross-Site Scripting (XSS) in Magnigenie RestroPress WordPress plugin through version 3.2.8.4 allows authenticated users with low privileges to inject malicious scripts that execute in the browsers of other site visitors, potentially compromising session tokens, stealing sensitive data, or defacing content. The vulnerability requires user interaction (UI:R) and affects only authenticated attackers (PR:L), limiting immediate exploitation risk despite the moderate CVSS score of 6.5. No public exploit code or active exploitation has been confirmed at time of analysis.
DOM-based cross-site scripting (XSS) in Crocoblock JetTabs WordPress plugin versions up to 2.2.12 allows attackers to inject malicious scripts that execute in users' browsers when viewing affected pages. The vulnerability stems from improper input neutralization during web page generation, enabling stored or reflected XSS attacks without requiring authentication. With an EPSS score of 0.04% (14th percentile), exploitation likelihood is very low despite the publicly documented vulnerability.
Missing authorization in Crocoblock JetTabs WordPress plugin version 2.2.12 and earlier allows unauthenticated or low-privileged attackers to bypass access control restrictions and exploit misconfigured security levels. The vulnerability stems from improper validation of user permissions before executing sensitive operations, potentially enabling unauthorized access to restricted plugin functionality or data.
Unauthorized information disclosure in BizPrint plugin for WooCommerce allows authenticated attackers with low privileges to read sensitive data via a network request. The vulnerability stems from a missing authorization check (CWE-862) in versions up to and including 4.6.7, exposing data such as order or customer information. No active exploitation or public exploit code has been identified, and EPSS indicates a very low probability (0.04%) of widespread exploitation.
Cross-site scripting (DOM-based) in BWL Pro Voting Manager WordPress plugin allows authenticated users with low privileges to inject malicious scripts that execute in administrators' browsers when viewing voting results. Affected versions through 1.4.9. No active exploitation known (not in CISA KEV) and EPSS score is very low (0.04%), indicating minimal current exploitation risk.
DOM-based cross-site scripting in the DesignThemes Core WordPress plugin (≤1.6) enables authenticated attackers with low privileges to inject arbitrary web scripts. When a higher-privileged victim interacts with the malicious content, the injected script executes in their browser, potentially leading to session hijacking or unauthorized actions. No public exploit or active exploitation has been reported at the time of analysis, and EPSS indicates a low exploitation probability.
Cross-site scripting (XSS) vulnerability in the DesignThemes Portfolio Addon WordPress plugin through version 1.5 allows authenticated users with contributor-level privileges to inject and execute arbitrary web scripts via DOM manipulation. An attacker can craft malicious portfolio content that triggers script execution when another user (such as an admin) views the affected page, potentially leading to session hijacking, credential theft, or site defacement. No active exploitation or public exploit code has been identified at this time.
Remote code execution is possible through a heap-based buffer overflow in the S7Client::download function of the gmg137 snap7-rs library. The flaw affects all builds up to git commit 153d3e8c, as the project uses a rolling release model and has not issued a patch. A publicly available exploit allows an attacker who can manipulate PLC responses to potentially execute arbitrary code on the client system.
Server-side request forgery in FeehiCMS 2.1.1 and earlier exposes the bundled TimThumb image-processing script to unauthenticated remote exploitation via a crafted src parameter. An attacker can coerce the application server to issue arbitrary HTTP requests, enabling enumeration of internal network services and cloud metadata endpoints. Exploit code has been publicly disclosed per VulDB submission 718278; EPSS remains very low at 0.04% (14th percentile) and no CISA KEV entry exists, suggesting limited opportunistic exploitation at time of analysis.
Vulnerability in CodexThemes TheGem (Elementor), CodexThemes TheGem (WPBakery).8.1.1; TheGem (WPBakery): from n/a before 5.8.1.1. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing authorization in Eagle Booking plugin for WordPress (≤1.3.4.3) allows authenticated attackers to alter booking-related settings or data without proper access controls. This can lead to malicious changes in booking configurations, impacting the integrity and availability of the booking system.
Insecure Direct Object Reference (IDOR) in the FiveStar WordPress theme allows authenticated low-privilege users to modify or delete arbitrary data due to missing authorization checks on user-controlled keys. Versions up to and including 1.7 are affected, and exploitation can lead to integrity and availability impacts without confidentiality loss. No active exploitation or public exploit is currently identified.
Insecure direct object references in the Backpack Traveler WordPress theme (versions <= 2.10.3) allow authenticated attackers with low privileges to modify or disrupt resources belonging to other users by manipulating access control keys. The vulnerability does not permit reading of data, only partial integrity and availability impact. EPSS exploitation probability is very low (0.04%) and no active exploitation or public exploit code is confirmed.
Authorization bypass in the Struktur WordPress theme allows authenticated low-privileged users to circumvent intended access controls by manipulating user-controlled keys. Attackers can modify data or cause availability impacts through IDOR on AJAX endpoints, without needing elevated privileges. No active exploitation or public exploit code is confirmed, and the EPSS score suggests very low wild exploitation likelihood.
HR Management Lite WordPress plugin versions 3.6 and earlier contain a missing authorization vulnerability allowing authenticated users to access or modify resources without proper access control checks. An attacker with low-privilege user credentials can exploit incorrectly configured access control to read or modify sensitive data within the plugin's functionality, though the vulnerability requires prior authentication and does not enable privilege escalation or system-wide impact.
Cross-site request forgery in Ays Pro Popup Box plugin for WordPress up to version 6.0.7 allows an unauthenticated attacker to trick an authenticated administrator into performing unintended actions, such as modifying popup settings, leading to limited integrity and availability impact. EPSS indicates extremely low exploitation probability (0.02%), and no active exploitation or public proof-of-concept is currently identified.
Cross-site request forgery in Heateor Social Login WordPress plugin up to 1.1.39 allows unauthenticated attackers to perform unauthorized actions on authenticated administrators' behalf via crafted links. Exploitation can result in low-impact integrity and availability changes, such as modifying plugin settings. No known public exploit or active exploitation reported.
Missing authorization controls in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin (versions up to 4.0.3) allow unauthenticated attackers to exploit incorrectly configured access control security levels, potentially enabling unauthorized modification of cookie consent settings and GDPR compliance configurations. No public exploit code has been identified at time of analysis, though the vulnerability carries a low EPSS score (0.06%, 19th percentile) suggesting minimal real-world exploitation likelihood despite the authorization flaw.
Unauthorized data modification in the HomeFix Elementor Portfolio WordPress plugin (versions ≤1.0.1) allows remote attackers to manipulate portfolio content without authentication. The EPSS score is low (0.06%), indicating minimal exploitation likelihood, and no active exploitation is currently reported. A fix is available in a version beyond 1.0.1; users should upgrade immediately.
Unauthorized remote attackers can retrieve embedded sensitive system information from o2oe E-Invoice App Malaysia plugin versions 1.3.0 and earlier without authentication (CVSS:3.1 AV:N/AC:L/PR:N). The vulnerability exposes confidential data through information disclosure, with EPSS exploitation probability at 0.05% (14th percentile). No public exploit identified at time of analysis, though the low attack complexity and unauthenticated attack vector make exploitation straightforward for adversaries with network access to vulnerable WordPress installations.
Missing authorization in the Skywarrior Arcane WordPress theme through version 3.6.6 allows unauthenticated remote attackers to exploit improperly configured access controls, resulting in low availability impact. The vulnerability has a CVSS 3.1 base score of 5.3, an EPSS exploitation probability of only 0.04%, and no evidence of active exploitation or public proof-of-concept code.
Unauthorized information disclosure in the Medicalequipment WordPress theme through version 1.0.9 allows unauthenticated remote attackers to access sensitive data due to a missing authorization check. The EPSS exploitation probability is very low (0.04%) and no active exploitation or public proof-of-concept is known, reducing real-world urgency despite a Medium CVSS score.
Authorization bypass in wpDiscuz WordPress plugin through version 7.6.43 allows unauthenticated remote attackers to access user-controlled data via improperly configured access controls, resulting in limited information disclosure with a CVSS score of 5.3. The vulnerability exploits insecure direct object references (IDOR) where access control checks fail to properly validate object ownership, enabling attackers to enumerate or retrieve comment data they should not access. No public exploit code or active exploitation has been confirmed at this time, though the EPSS score of 0.04% suggests minimal real-world exploitation likelihood despite the relatively accessible attack vector.
Unauthorized information disclosure in XforWooCommerce Product Loops for WooCommerce versions up to 2.1.2 allows remote unauthenticated attackers to access restricted product loop data due to missing authorization checks. No active exploitation or public exploit is known, and EPSS indicates a very low probability of exploitation (0.04%). The vulnerability is classified as a missing authorization issue (CWE-862) with a CVSS 3.1 base score of 5.3 (Medium).
Unauthenticated information disclosure in the Share Print PDF for WooCommerce plugin ≤ 3.1.2 allows remote attackers to access restricted product data via a missing authorization check (CWE-862). The vulnerability carries a CVSS 5.3 (medium) score but has an extremely low EPSS (0.04%), suggesting minimal exploitation likelihood. No active exploitation or public exploit code is known at this time.
Unauthorized data modification in DesignThemes LMS Addon for WordPress up to version 2.6 allows unauthenticated attackers to change LMS content via missing authorization checks. The vulnerability has a Medium CVSS score of 5.3 with low integrity impact and no confidentiality impact. No active exploitation or public exploit code has been identified, and EPSS exploitation probability is low (0.04%).
Missing authorization in WeDesignTech Portfolio plugin for WordPress allows unauthenticated attackers to modify certain data through improperly protected endpoints. All versions up to and including 1.0.2 are affected. There is no evidence of active exploitation or public proof-of-concept, and the low EPSS score indicates a low probability of widespread exploitation.
Information disclosure in SimpleCalendar Google Calendar Events plugin through 3.5.9 allows unauthenticated attackers to read unauthorized calendar event data by exploiting a user-controlled key parameter. The vulnerability arises from a failure to properly verify object ownership, enabling simple direct reference manipulation. No active exploitation or public exploit code has been reported at this time, and EPSS likelihood remains very low (0.04%).
Unauthenticated attackers can modify product delivery date settings in the Product Delivery Date for WooCommerce - Lite plugin up to version 3.2.0 due to missing authorization checks, resulting in low-impact integrity tampering. EPSS indicates a very low exploitation probability (0.04%) and no active exploitation or public exploit code is known at this time.
Server-Side Request Forgery (SSRF) in Youzify WordPress plugin through version 1.3.7 allows authenticated high-privilege users to make arbitrary network requests from the server, exposing internal resources and services. The vulnerability requires administrative credentials (PR:H) but carries high confidentiality impact with EPSS score of 0.04% indicating minimal real-world exploitation likelihood despite the moderate CVSS score of 4.9.
Missing authorization in SiteLock Security WordPress plugin versions through 5.0.1 allows attackers to exploit incorrectly configured access control to bypass security restrictions. Unauthenticated remote attackers can leverage this CWE-862 vulnerability to gain unauthorized access to protected functionality or resources without proper privilege validation. The issue is tagged as an authentication bypass with low EPSS exploitation probability (0.05%, 17th percentile), indicating limited real-world attack likelihood despite the authorization flaw.
Sensitive data exposure in Contact Form 7 Mailchimp Extension plugin for WordPress (versions ≤0.9.68) allows unauthenticated remote attackers to retrieve embedded sensitive information through network-accessible endpoints. The vulnerability enables unauthorized access to confidential data with low attack complexity and no user interaction required. EPSS score of 0.05% (14th percentile) indicates low observed exploitation probability, and no public exploit identified at time of analysis.
Insecure direct object reference (IDOR) in the Eagle Booking WordPress plugin (≤1.3.4.3) enables authenticated users with low privileges to manipulate booking parameters and cancel or disrupt bookings of other users, causing a low availability impact. No active exploitation or public exploit is reported, and EPSS probability is very low (0.04%).
Roxnor PopupKit popup-builder-block plugin through version 2.2.4 exposes sensitive system information to authenticated users via an information disclosure vulnerability. An authenticated attacker can retrieve embedded sensitive data that should not be accessible, potentially gaining insight into system configuration or other restricted information. The CVSS 4.3 score reflects low real-world impact (confidentiality only, low privileges required), and EPSS exploitation probability is minimal at 0.04%, indicating this is a lower-priority vulnerability despite affecting a WordPress plugin.
Aethonic Poptics WordPress plugin through version 1.0.20 exposes sensitive system information to authenticated users through an information disclosure vulnerability. Authenticated attackers with low-level privileges can retrieve embedded sensitive data without user interaction, though exploitation requires valid login credentials. The issue carries a modest CVSS score of 4.3 and extremely low EPSS probability (0.04th percentile), indicating real-world exploitation risk is minimal despite the confirmed vulnerability.
Authenticated users without proper authorization can modify content in the auxin-elements WordPress plugin (versions up to 2.17.15) due to missing access control checks on shortcode functionality. The vulnerability requires an authenticated account with low privileges and allows integrity compromise through shortcode manipulation, with an EPSS score of 0.04% indicating low real-world exploitation likelihood despite confirmed access control weakness.