Stored Cross-Site Scripting in the Splide Carousel Block WordPress plugin (all versions ≤ 1.7.1) allows authenticated attackers with contributor-level access to inject persistent JavaScript via the 'url' block attribute, executing against any visitor of the affected page. The attack requires the malicious post to be published by an editor or administrator before the payload fires, adding a social-engineering or workflow-abuse dependency. With an EPSS of 0.03% (9th percentile) and no current CISA KEV listing, real-world exploitation risk is low but non-negligible on sites permitting untrusted contributors to submit content.
Stored Cross-Site Scripting in the Github Shortcode plugin for WordPress (all versions through 0.1) allows authenticated attackers with Contributor-level access to inject persistent malicious scripts via the 'repo' attribute of the 'github' shortcode. Any user who subsequently visits the injected page triggers execution of the attacker-controlled script in their browser context. No public exploit has been identified at time of analysis and EPSS places exploitation probability at 0.03% (9th percentile), though the low barrier to exploitation for any site permitting contributor accounts warrants attention.
Stored XSS in WPBakery Page Builder Addons by Livemesh (all versions through 3.9.4) allows authenticated WordPress contributors to inject persistent JavaScript into site pages via malformed shortcode attributes on the `[lvca_carousel]` and `[lvca_posts_carousel]` shortcodes. The flaw arises from using `wp_json_encode()` instead of `esc_attr()` when embedding shortcode attributes into single-quoted HTML `data-settings` attributes, enabling an attacker to inject a literal single quote and escape the attribute boundary. No public exploit identified at time of analysis; EPSS of 0.03% (9th percentile) reflects low current exploitation interest, and the practical attack surface is constrained to WordPress sites where untrusted users hold Contributor-level access.
Stored Cross-Site Scripting in the Auto Thumbnail WordPress plugin (all versions up to and including 1.0) enables authenticated contributors to permanently inject arbitrary JavaScript into WordPress pages via the 'width' and 'height' attributes of the 'thumbnails' shortcode. The injected payload executes in the browser of any subsequent visitor who loads the affected page, crossing trust boundaries from the WordPress server context into victims' sessions (CVSS S:C). No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog; EPSS of 0.03% (9th percentile) reflects low predicted exploitation probability, though the stored nature of the flaw amplifies impact relative to reflected XSS.
Stored Cross-Site Scripting in the Events In City WordPress plugin (versions ≤3.0) allows contributor-level authenticated users to inject persistent JavaScript payloads via unsanitized 'org-events' shortcode attributes handled by the org_event_scode() function. The CVSS scope is Changed (S:C), meaning injected scripts execute in victims' browsers outside the plugin's own context, enabling session hijacking, credential theft, or unauthorized actions against any user who views an affected page. No public exploit identified at time of analysis; EPSS score of 0.03% (9th percentile) reflects low current exploitation likelihood, though the contributor-level access requirement is a realistic attack surface on multi-author WordPress sites.
Stored Cross-Site Scripting in the Shortcode Buddy WordPress plugin (all versions ≤ 0.1.9.5) allows authenticated attackers with contributor-level access to permanently embed arbitrary JavaScript into pages via unsanitized shortcode attributes, executing in any visitor's browser upon page load. The Changed scope (S:C) in the CVSS vector confirms the injected payload escapes the plugin's context and affects users browsing the site, including administrators whose sessions could be hijacked. No public exploit code has been identified at time of analysis, and EPSS sits at 0.03% (9th percentile), indicating low observed exploitation probability, though the contributor-level entry bar makes this a realistic risk on sites with multiple editors.
Stored Cross-Site Scripting in the iWR Tooltip WordPress plugin (versions up to and including 1.0) permits authenticated attackers holding contributor-level accounts or higher to plant persistent malicious scripts via the plugin's `iwrtooltip` shortcode. The root cause is direct string concatenation of the user-supplied `title` attribute into an HTML attribute inside the `iwr_tooltip()` handler at lines 37 and 41 of iwr-tooltip.php, with no call to `esc_attr()` or equivalent escaping. Any site visitor who subsequently loads a page containing the poisoned shortcode will execute the injected script in their browser, with scope-changed impact that can target session tokens, credentials, or site administrative functions. EPSS is 0.03% (9th percentile), and no public exploit or CISA KEV listing exists at time of analysis.
Stored Cross-Site Scripting in the Listen Shortcode WordPress plugin (versions ≤ 1.0) allows authenticated attackers with contributor-level access to inject persistent malicious scripts into pages via unsanitized shortcode attributes. The vulnerability exists in the listenEmbedJS() function, which echoes user-supplied src, start, and end attributes directly into a single-quoted HTML attribute context without escaping, enabling script injection that executes in the browsers of any user who later visits the affected page. EPSS is low (0.03%, 9th percentile) and no public exploit or CISA KEV listing has been identified at time of analysis, suggesting limited current exploitation activity.
Stored Cross-Site Scripting in the hk_shortcode WordPress plugin (versions ≤1.0) enables authenticated contributors to inject persistent malicious scripts via the unsanitized 'title' attribute of the 'title-plane' shortcode. The vulnerability stems from direct HTML concatenation of unescaped user input inside the huankong_post_short_title_plane() function - once a crafted post is saved, the payload executes in the browsers of all users who visit the affected page, crossing into their sessions (CVSS S:C). No public exploit code has been identified at time of analysis, and with an EPSS of 0.03% (9th percentile), mass automated exploitation is unlikely; however, multi-author WordPress sites with open contributor registration carry meaningful exposure.
Stored Cross-Site Scripting in the Responsive Video Embedder WordPress plugin (versions ≤ 0.1) allows authenticated attackers with contributor-level access or above to persistently inject arbitrary JavaScript into WordPress pages via unsanitized shortcode attributes. The root cause is direct, unescaped concatenation of user-supplied 'id' and 'list' attributes into an HTML iframe src attribute inside the video_shortcode() function. Because the CVSS scope is Changed (S:C), injected scripts execute in the browsers of any user who subsequently visits an affected page, enabling session hijacking, credential theft, or malicious redirects against site visitors. No active exploitation has been confirmed and EPSS is very low (0.03%, 9th percentile), but the contributor-level entry bar makes this relevant on multi-author WordPress sites.
Stored Cross-Site Scripting in the Easy Prism Syntax Highlighter WordPress plugin (versions ≤1.0.2) enables authenticated attackers with Contributor-level access to inject persistent JavaScript into WordPress pages via the 'code' or 'c' shortcode. The flaw resides in the shortcode() function, which concatenates the first positional shortcode attribute directly into the class attribute of generated <pre> and <code> HTML elements without invoking esc_attr() or any equivalent escaping - enabling HTML attribute breakout and arbitrary script injection. No public exploit has been identified and EPSS is very low (0.03%, 9th percentile), but the Contributor-level authentication threshold makes this accessible on any multi-author WordPress site without additional barrier.
Stored Cross-Site Scripting in the Content Slideshow WordPress plugin (all versions through 2.4.1) allows authenticated attackers with contributor-level access to inject persistent malicious scripts via shortcode attributes. The vulnerability resides in slideshow-widget-shortcode.php at multiple points (lines 14 and 143) where shortcode attribute values are passed without adequate sanitization or output escaping. The CVSS scope is Changed (S:C), meaning injected scripts execute in the victim's browser context and can affect resources beyond the plugin itself, such as stealing session tokens or performing actions as the visiting user. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS sits at a very low 0.03%.
Stored Cross-Site Scripting in the Formidable Kinetic WordPress plugin (versions ≤1.1.01) allows authenticated attackers with contributor-level access to permanently inject malicious scripts into pages via the 'kinetic_link' shortcode. The FrmKinetic::link() function concatenates user-supplied shortcode attributes ('window', 'class', 'label') directly into anchor tag HTML attributes without sanitization or output escaping, meaning any visitor who loads an injected page triggers execution of the attacker's payload in their browser. No active exploitation is confirmed in CISA KEV, and the EPSS score of 0.03% (9th percentile) reflects low automated exploitation probability, but the Changed scope (S:C) in the CVSS vector indicates the impact crosses the plugin's security boundary into the broader WordPress page context.
Stored Cross-Site Scripting in the Team Master WordPress plugin (all versions ≤ 1.1.2) allows authenticated attackers with contributor-level access to inject persistent malicious scripts via shortcode attributes into WordPress pages, executing against any visitor who subsequently loads the affected page. The scope change (S:C in CVSS) reflects cross-session impact - a low-privileged contributor can compromise higher-privileged users including administrators. No public exploit identified at time of analysis, and EPSS of 0.03% (9th percentile) indicates low current exploitation probability.
Stored Cross-Site Scripting in the Mutual Funds Data WordPress plugin (versions ≤ 1.2.1) allows authenticated attackers with Contributor-level access to inject persistent malicious scripts into any page using the affected shortcode. The unsanitized 'title' attribute in the mfd_shortcode() function is written directly into a HTML caption element without escaping, meaning injected payloads execute in the browsers of any user who subsequently views the affected page. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.03% (9th percentile) reflects a low current probability of widespread exploitation.
Stored Cross-Site Scripting in the Single Mailchimp WordPress plugin (all versions through 1.4) allows authenticated attackers with contributor-level access to inject persistent JavaScript into WordPress pages via unsanitized shortcode attributes. The six affected attributes - autocomplete, label, placeholder, btn_text, success_msg, and error_msg - are concatenated directly into HTML output by the single_mailchimp() function in shortcodes.php without sanitization or output escaping. No public exploit code exists and EPSS places exploitation probability at 0.03% (9th percentile), indicating low real-world exploitation pressure at this time.
Stored Cross-Site Scripting in the Post Category Gallery WordPress plugin (versions ≤1.0.0) allows authenticated attackers holding contributor-level access or above to inject persistent malicious scripts via unsanitized shortcode attributes. The injected payload executes in the browsers of any user who visits the affected page, enabling session hijacking, credential theft, or privilege escalation against higher-privileged users such as administrators. No public exploit has been identified at time of analysis, and the EPSS score of 0.03% (9th percentile) indicates very low automated exploitation probability.
Stored Cross-Site Scripting in the jQuery googleslides WordPress plugin (all versions through 1.3) allows authenticated attackers holding contributor-level access or higher to inject persistent malicious scripts via the 'googleslides' shortcode. The vulnerability is confirmed by Wordfence (ENISA EUVD-2026-32069) and traces to the `googleslides_handler()` function directly interpolating ten shortcode attribute values into HTML without the WordPress-standard `esc_attr()` sanitization. The CVSS Changed Scope (S:C) reflects that injected scripts execute in victims' browsers outside the plugin's own domain; EPSS at 0.03% (9th percentile) and absence from CISA KEV indicate no public exploit or confirmed active exploitation at time of analysis.
Stored Cross-Site Scripting in the Dideo plugin for WordPress version 1.0 allows authenticated contributors to inject persistent malicious scripts into any page using the 'dideo' shortcode. The 'id' shortcode attribute is interpolated directly into an HTML iframe 'src' attribute without sanitization or output escaping in the dideo() handler, meaning injected payloads execute automatically in the browser of any user who visits the affected page. No public exploit has been identified at time of analysis, and the EPSS score of 0.03% (9th percentile) reflects low current exploitation interest, but the stored nature and scope-changed CVSS vector (S:C) elevate concern for multi-author WordPress deployments.
Stored Cross-Site Scripting in the Tuxquote WordPress plugin (versions up to and including 1.3) enables authenticated attackers holding Contributor-level access or above to inject persistent malicious scripts into WordPress pages via unsanitized shortcode attributes. The `tuxquote_build_format()` function concatenates user-supplied `title`, `align`, and `width` attributes from the TUXQUOTE shortcode directly into rendered HTML without passing them through WordPress's built-in `esc_attr()` or `esc_html()` escaping functions, allowing the payload to persist and execute in any visitor's browser. No public exploit has been identified at time of analysis, and the EPSS score of 0.03% (9th percentile) reflects minimal real-world exploitation activity to date.
Stored Cross-Site Scripting in the Islamic Database WordPress plugin (versions ≤ 1.0) allows authenticated contributors to persistently inject arbitrary JavaScript into WordPress pages via the 'islamicDB-roqya' shortcode's 'width' and 'height' attributes. The flaw originates in the islamicDB_sc_quran_qari_roqya() function, which concatenates these shortcode attribute values directly into HTML iframe attribute values without sanitization or output escaping. No public exploit has been identified and EPSS sits at 0.03% (9th percentile), reflecting low current exploitation probability, though the contributor-level access requirement is a realistic barrier given how many WordPress sites grant that role to content editors.
Stored Cross-Site Scripting in the Google+ Link Name WordPress plugin (versions up to and including 1.0) allows authenticated attackers with contributor-level access to inject persistent malicious scripts via the 'gplusnamelink' shortcode's 'id' and 'name' attributes. The root cause is the absence of WordPress output-escaping functions (esc_attr() or esc_html()) in the gplusnamelink_generate() function, permitting raw attribute values to be concatenated directly into rendered HTML. Scope is Changed (S:C) per CVSS, meaning the injected script executes in victims' browser sessions outside the plugin's own security context. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS score of 0.03% (9th percentile) reflects low observed exploitation probability.
Stored Cross-Site Scripting in the WP Iframe Geo Style for Amazon affiliates WordPress plugin (all versions ≤1.1) allows authenticated attackers holding contributor-level roles to persist malicious JavaScript in page content via the unsanitized 'adid' shortcode attribute. The injected script executes automatically in any visitor's browser upon page load, with changed scope (S:C) confirming the payload crosses the attacker's own security boundary to impact other users. No public exploit identified at time of analysis, and an EPSS score of 0.03% (9th percentile) reflects low current exploitation probability, though the contributor-level access requirement is achievable on many open-registration WordPress sites.
Stored Cross-Site Scripting in the Endless Scroll WordPress plugin (all versions ≤1.0.0) allows authenticated attackers holding contributor-level access or above to inject persistent malicious scripts via shortcode attributes, which execute in any visitor's browser upon page load. The CVSS scope change (S:C) confirms the payload crosses security boundaries - executing outside the WordPress application context - enabling session theft, credential harvesting, or malicious redirects against site visitors. No public exploit has been identified at time of analysis, and EPSS at 0.03% (9th percentile) reflects very low current exploitation probability, though the low privilege bar (contributor role) elevates risk on sites with open or loosely managed user registration.
Stored Cross-Site Scripting in the GBI To Print WordPress plugin version 1.0 allows authenticated attackers with contributor-level access to inject persistent malicious scripts into WordPress pages via the unsanitized 'div' attribute of the 'gbitoprint' shortcode. The root cause is a direct concatenation of raw shortcode attribute input into HTML output inside gbi_toprint_shortcode() at gbitoprint.php line 86, with no call to esc_attr() or equivalent WordPress sanitization. Any site visitor loading a page containing the injected shortcode will execute the attacker-controlled script in their browser, enabling session theft, credential harvesting, or malicious redirects. No public exploit code has been identified at time of analysis, and EPSS signals low near-term mass exploitation probability.
Stored cross-site scripting in the GNTT Post Title Ticker WordPress plugin version 1.0 allows authenticated contributors to inject persistent malicious JavaScript via unsanitized shortcode attributes across three display functions. The vulnerability arises from direct HTML concatenation of user-controlled values - including border, width, height, header_background, header_text_color, and id - without any escaping in gntt_title_ticker_slide(), gntt_title_ticker_fade(), and gntt_title_ticker_typing(). No public exploit has been identified at time of analysis, and the EPSS exploitation probability stands at a low 0.03%, suggesting limited real-world interest despite an accessible contributor-level attack surface on multi-author WordPress sites.
Stored Cross-Site Scripting in the Cryptocurrency Prijsvergelijking Widget WordPress plugin (version 1.0) allows authenticated attackers holding contributor-level access to inject persistent JavaScript into any page where the plugin shortcode is placed, executing silently in the browsers of all subsequent visitors including administrators. The root cause is the as_get_coin_shortcode() function writing user-controlled 'width' and 'height' shortcode attributes directly into an iframe's HTML style attribute without calling esc_attr(), enabling style-context breakout via crafted attribute-termination payloads. No public exploit has been independently listed at time of analysis and EPSS stands at 0.03% (9th percentile), indicating low observed exploitation probability, though the CVSS Changed Scope designation means a single injected payload can compromise sessions of any user - including site administrators - who loads the affected page.
Stored Cross-Site Scripting in the My Email Shortcode WordPress plugin (versions up to and including 0.91) allows authenticated attackers with Contributor-level access to inject persistent malicious scripts via the 'subject' attribute of the 'my-email' shortcode. The Changed scope in the CVSS vector (S:C) confirms that successful exploitation crosses security boundaries, affecting visiting users' browser sessions regardless of their own privilege level. No active exploitation has been identified (not in CISA KEV), and the EPSS score of 0.03% at the 9th percentile indicates low observed exploitation probability at time of analysis.
Stored Cross-Site Scripting in the faq shortcode WordPress plugin (all versions up to and including 1.0) permits authenticated contributors to persist arbitrary JavaScript into site pages via the unsanitized 'color' attribute of the [faq] shortcode, with the payload executing in any visitor's browser upon page load. The vulnerability stems from missing input sanitization and output escaping in faq.php at line 65, and the changed scope (S:C in CVSS) confirms cross-user impact beyond the attacker's own session. No public exploit has been identified and EPSS sits at 0.03% (9th percentile), reflecting low current exploitation activity.
Stored Cross-Site Scripting in Style Kits for Elementor (analogwp-templates) WordPress plugin versions up to and including 2.5.0 allows authenticated attackers with contributor-level access to inject persistent JavaScript payloads via the kit title parameter at the /wp-json/agwp/v1/tokens/save REST API endpoint. The injected script executes in the browser of any user who subsequently visits an affected page, with a Changed scope (S:C) indicating cross-user impact that can reach administrators. No public exploit identified at time of analysis; EPSS of 0.03% (9th percentile) signals low observed exploitation probability, though the contributor-level barrier is low on multi-author WordPress sites.
Stored Cross-Site Scripting in the Livemesh Addons for Beaver Builder WordPress plugin (all versions ≤3.9.2) allows authenticated attackers with Subscriber-level access or above to inject persistent malicious scripts via the `labb_admin_ajax` AJAX endpoint. The root flaw is a missing capability check - the handler validates a WordPress nonce (confirming form origin) but never verifies whether the requesting user holds privileges to modify plugin settings, effectively granting any registered user write access to plugin configuration. Injected scripts execute in the browser of administrators who visit the settings page or against any frontend visitor, enabling session hijacking or privilege escalation against admins. No public exploit code or active exploitation has been identified at time of analysis; EPSS is very low at 0.03% (8th percentile).
Stored Cross-Site Scripting in the Livemesh SiteOrigin Widgets WordPress plugin (all versions through 3.9.2) allows any authenticated subscriber-level user to permanently inject malicious scripts into plugin settings via the unprotected `lsow_admin_ajax` AJAX endpoint. The injected payload executes against administrators when they access the plugin settings page, and against any site visitor on the frontend - enabling session hijacking, credential theft, or unauthorized admin actions. No public exploit has been identified at time of analysis and CISA has not added this to the KEV catalog, but the low privilege bar (subscriber) makes it an attractive target on sites with open registration.
Stored Cross-Site Scripting in the WPBakery Page Builder Addons by Livemesh WordPress plugin (all versions through 3.9.4) allows authenticated attackers with as little as Subscriber-level access to permanently inject malicious JavaScript into plugin settings via the unprotected lvca_admin_ajax AJAX endpoint. The injected payload executes both when administrators access the plugin settings page and when any frontend visitor loads affected pages, achieving Changed Scope impact beyond the attacker's own session. No public exploit code has been identified at time of analysis, and CISA KEV does not list this CVE, though the low authentication bar makes it a realistic risk on WordPress sites with open user registration.
WordExportBundle in Pimcore CMS enforces only feature-level permission (`word_export`) at export initiation but performs no object-level authorization check against the target document element, constituting a broken object-level authorization (BOLA) flaw. Authenticated low-privileged backend users holding the `word_export` permission can supply arbitrary `type/id` parameters to `wordExportAction()` to export full content - including titles, descriptions, and body - from pages, snippets, emails, or objects they are explicitly denied `view` access to. A publicly available proof-of-concept script is included in the GitHub security advisory GHSA-332x-r494-54fq confirming practical exploitability; the vulnerability is not currently listed in CISA KEV.
SQL injection in Symfony's PdoAdapter cache component allows any caller who can influence the `$prefix` argument to `AbstractAdapterTrait::clear()` to inject arbitrary SQL into a DELETE statement, potentially deleting unintended rows from the cache table or reshaping query semantics. Affected versions span symfony/cache across four maintained branches: below 5.4.52, 6.x below 6.4.40, 7.x below 7.4.12, and 8.x below 8.0.12. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, but vendor-released patches are available across all affected branches.
Email-header and SMTP command injection (CWE-93) in Symfony's Mime component (symfony/mime, also shipped in the symfony/symfony monolith) lets an attacker who controls any address value smuggle CRLF sequences past a trusted validation boundary. The Address value-object - used for every Mailer to/cc/bcc/from/reply-to address - accepts an RFC-5322 quoted-string local-part containing raw carriage-return/line-feed bytes, which is later emitted verbatim into rendered message headers and into SmtpTransport's MAIL FROM/RCPT TO lines, allowing injection of new headers (e.g. an unauthorized Bcc) or new SMTP commands. It affects symfony/mime before 5.4.52, 6.4.40, and 7.4.12; there is no public exploit identified at time of analysis and the issue is not in CISA KEV.
OCSP responder certificate validity bypass in Erlang OTP's public_key library allows forged OCSP responses-signed with the private key of an expired responder certificate-to be accepted as valid, defeating TLS certificate revocation checks. Affected deployments include TLS clients using OCSP stapling via the ssl application, and any application calling public_key:pkix_ocsp_validate/5 directly for server-side client certificate validation. An attacker who has obtained the private key of an expired CA-designated OCSP responder can present a revoked TLS certificate alongside a forged OCSP response and achieve authentication bypass. No public exploit code exists and CISA KEV does not list this vulnerability; SSVC rates exploitation as none at time of analysis.
Header injection in Symfony's Mime component (symfony/mime) enables attackers to inject arbitrary MIME headers into serialized email messages when an application passes untrusted input as a parameter name to ParameterizedHeader. The component correctly encodes parameter values per RFC 2045/5322 but emits parameter names verbatim, meaning CRLF sequences in a user-influenced parameter name terminate the current header line and allow arbitrary new headers to be appended. No active exploitation is confirmed (not in CISA KEV), no public exploit code has been identified, and vendor-released patches are available across all supported Symfony branches.
Cross-connection response leakage in Microsoft UFO's WebSocket layer allows an authenticated low-privileged user to receive protocol responses intended for a different authenticated session. The flaw stems from a singleton UFOWebSocketHandler design where per-connection state is stored in shared mutable instance fields, causing each new connection to overwrite the previous connection's protocol object reference. No public exploit or CISA KEV listing exists at time of analysis, but the attack complexity is low and exploitation requires only standard authenticated access to the same UFO instance.
Missing ACL enforcement on Hitachi Vantara Pentaho Data Integration & Analytics API endpoints allows authenticated low-privileged users to interact with platform mail notification resources without authorization. Affected versions span the 8.3.x, 9.3.x, and pre-10.2.0.6/11.0.0.0 release lines. An attacker with a valid low-privilege account can read, modify, or disrupt mail notification configurations, resulting in limited confidentiality, integrity, and availability impact. No public exploit code exists and no active exploitation has been identified at time of analysis.
Insecure file upload in DFIR-IRIS before version 2.4.28 allows a low-privileged remote attacker to upload files of dangerous types, resulting in high confidentiality impact and limited integrity compromise when a victim user interacts with the uploaded content. Disclosed by SBA Research in advisory SBA-ADV-20260126-03, this is one of three CVEs (CVE-2026-42329, CVE-2026-42538, CVE-2026-42539) patched simultaneously in the 2.4.28 release. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
PATH hijacking in pam_usb helper tools prior to version 0.9.0 allows a local low-privileged attacker who can manipulate the process environment to substitute malicious binaries for those called by pamusb-check, pamusb-conf, and pamusb-keyring-unlock-gnome, resulting in high confidentiality and integrity impact. The root cause is CWE-427 (Uncontrolled Search Path Element): all three tools resolved external binaries - including id, whoami, pidof, gnome-keyring-daemon, and pamusb-check itself - through the attacker-controllable PATH variable rather than hardcoded absolute paths. No public exploit code exists and this vulnerability is not listed in CISA KEV at time of analysis.
Thread-safety flaws in pam_usb's deny_remote feature allow incorrect remote-session authentication decisions in display managers like GDM that run concurrent authentication threads. Three functions use the non-reentrant strtok(), whose single global state pointer can be overwritten mid-parse by a racing thread, corrupting tmux session data or /proc environ analysis used to classify sessions as local or remote. Compounding this, strtok() is called directly on the raw pointer returned by getenv(TMUX), inserting NUL bytes directly into the live process environment block and permanently corrupting the TMUX variable for all subsequent authentications in that long-lived process. An attacker with local low-privileged access on an affected system running GDM could exploit thread interleaving to cause deny_remote=true to pass a remote session as local. No public exploit identified at time of analysis; CVSS 6.3 with local, high-complexity attack vector.
Cross-Site Request Forgery in Jason2605 AdminPanel 4.0 exposes the delete.php endpoint to forged requests, allowing an unauthenticated remote attacker to perform unauthorized deletion operations by tricking an authenticated administrator into triggering the request. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-reachable with no required attacker privileges, though victim interaction is mandatory. A publicly available proof-of-concept exists per SSVC classification, though no active exploitation (CISA KEV) has been confirmed at time of analysis.
Volume encryption in Synology Storage Manager before version 1.0.1-1100 transmits sensitive data via HTTP GET query strings, exposing encryption-related secrets to local attackers who can access web server logs, browser history, or other locally readable URL artifacts. The flaw (CWE-598) requires no privileges or user interaction beyond local system presence, and carries a High confidentiality impact rating because credentials or passphrases associated with volume encryption may be recoverable from logged GET requests. No public exploit exists and EPSS sits at the 1st percentile, indicating no widespread exploitation activity at time of analysis.
Reflected Cross-Site Scripting in the NS Product icon badge WordPress plugin (all versions through 1.2.4) enables unauthenticated remote attackers to inject arbitrary JavaScript via the PHP_SELF superglobal, which is reflected into page output without sanitization or escaping across at least four code locations in ns_addNewOptionsPage.php. Exploitation requires convincing a victim (typically an authenticated WordPress admin) to click a crafted link, limiting mass exploitation but enabling targeted session hijacking or credential theft against site administrators. No active exploitation is confirmed (not in CISA KEV), and EPSS at 0.09% (26th percentile) indicates low current exploitation probability.
Reflected Cross-Site Scripting in the Gutenverse plugin for WordPress (all versions through 3.4.6) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by crafting a malicious search URL. The vulnerability arises from the plugin's search-result-title block outputting the raw search query string directly into page HTML without sanitization. Exploitation requires user interaction (victim must click a crafted link) and the gutenverse/search-result-title block must be present on the site's search results template. No public exploit code has been identified at time of analysis, and CISA KEV confirmation of active exploitation is absent.
Reflected Cross-Site Scripting in the MinhNhut Link Gateway WordPress plugin (all versions ≤ 3.6.1) allows unauthenticated remote attackers to inject arbitrary JavaScript via the unsanitized 'url' parameter on the plugin's redirect page. Successful exploitation requires tricking a WordPress user into clicking a specially crafted link, after which the malicious script executes in the victim's browser within the scope of the WordPress site - enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit has been identified at time of analysis; EPSS stands at 0.06% (19th percentile) and CISA SSVC rates exploitation status as none, indicating minimal real-world exploitation activity at this time.
XSS sanitizer bypass in LiquidJS's strip_html filter (all versions through 10.25.7) allows stored or reflected cross-site scripting via newline-embedded HTML tags. The filter's catch-all regex branch uses JavaScript's dot operator without the dotAll flag, causing tags containing literal newline or carriage-return characters (e.g., <img\nsrc=x\nonerror=alert(1)>) to pass through unmodified - while browsers parse such tags as fully valid HTML elements and execute embedded event handlers. Publicly available exploit code exists; no vendor-released patch has been identified at time of analysis.
CarrierWave's `content_type_denylist` silently fails to block MIME types containing regex metacharacters - most critically `image/svg+xml` - because string entries are interpolated directly into a regex without `Regexp.quote` or anchoring, causing the `+` character to be treated as a quantifier rather than a literal. Any Ruby application relying on this denylist to prevent SVG uploads for stored XSS protection is completely unprotected despite believing the control is active. A publicly available proof-of-concept exploit demonstrates successful SVG bypass; no public exploit identified at time of analysis for active KEV-level exploitation.