Cross-tenant backup tampering in CyberPanel (through 1.9.1) lets an authenticated low-privileged tenant terminate, delete, and corrupt other tenants' backups via the cancelBackupCreation handler. Because the privileged worker acted purely on attacker-supplied backupCancellationDomain and fileName parameters without an ownership check, any logged-in user could send crafted POST requests to kill backup processes, remove backup archives, rewrite status files, and delete database records belonging to other tenants. No public exploit identified at time of analysis, and the flaw is not in CISA KEV.
Server-Side Request Forgery in the PeproDev Ultimate Invoice WordPress plugin (versions 2.2.6 and earlier) lets unauthenticated remote attackers coerce the WordPress server into issuing HTTP requests to attacker-chosen destinations. Because the CVSS vector marks a scope change (S:C), the forged requests can reach systems beyond the vulnerable plugin - notably internal network hosts and cloud metadata endpoints - with only low confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-facing nature keeps it a meaningful patch priority for exposed WordPress sites.
PHP Object Injection in the Complianz WordPress plugin (all versions up to and including 7.5.0) allows an authenticated user with Administrator privileges to inject serialized PHP objects that the plugin later deserializes, enabling arbitrary object instantiation and potential remote code execution or data manipulation. The flaw stems from unsafe deserialization (CWE-502) and carries a CVSS 7.2 (High). No public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was privately disclosed by Patchstack.
Arbitrary file read in SiYuan (an open-source personal knowledge-management / note-taking application) before v3.7.2 allows an authenticated attacker to retrieve files anywhere on the host by abusing the /export/temp/ short-circuit branch of the serveExport handler. Because this branch joins the raw, percent-decoded request path to the temp directory without the IsSubPath or IsSensitivePath guards used elsewhere, percent-encoded '..' sequences escape TempDir and expose /etc/passwd, SSH private keys, and SiYuan's own workspace *.db and *.log files. No public exploit identified at time of analysis, though the advisory documents a concrete payload; EPSS and CISA KEV data are not provided in the input.
Path traversal in the Grav API Plugin (getgrav/grav-plugin-api) before 1.0.10 lets an authenticated caller holding the api.pages.write permission relocate an entire page directory outside user/pages/ and even outside the Grav installation. The flaw sits in the POST /pages/{route}/move endpoint, where PagesController::move() only strips leading periods from the slug and never neutralizes '/' or '..' segments. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but an upstream fix and a GHSA advisory are published.
Cross-site request forgery in the MailPoet WordPress plugin (versions 5.30.0 through 5.33.0) allows a remote attacker to trick an authenticated victim into submitting forged state-changing requests, producing limited confidentiality, integrity, and availability impact with a scope change per the CVSS vector. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. Exploitation requires user interaction (UI:R), so a logged-in administrator or user must be lured into visiting an attacker-controlled page.
Cross-Site Request Forgery in the WordPress plugin 'Popup for CF7 with Sweet Alert' (by Metin Saraç) through version 1.6.5 allows a remote unauthenticated attacker to trick an authenticated site user or administrator into unknowingly submitting state-changing plugin requests. Reported by Patchstack and rated CVSS 7.1, the flaw carries a scope-change impact but requires victim interaction (clicking an attacker-controlled link/page). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Cross-site request forgery in the Kwayy HTML Sitemap WordPress plugin (versions <= 4.0) lets a remote attacker forge state-changing requests that, per the Patchstack advisory, chain into stored cross-site scripting (CSRF-to-Stored-XSS). By tricking a logged-in administrator into loading a crafted page, an attacker can inject persistent script into the site. No public exploit is identified at time of analysis, and it is not listed in CISA KEV.
Reflected/stored Cross-Site Scripting in the Manual - Documentation, Knowledge Base & Education WordPress theme (pixelacehq) affects all versions up to and including 7.5.4, allowing unauthenticated attackers to inject malicious script that executes in a victim's browser when they interact with a crafted link or page. Because the CVSS scope is changed (S:C), successful exploitation can impact resources beyond the theme itself, such as the WordPress admin session context. This is a Patchstack-reported issue with no public exploit identified at time of analysis and no evidence of active exploitation.
Reflected/unauthenticated Cross-Site Scripting in the PeproDev Ultimate Invoice WordPress plugin (versions 2.2.6 and earlier) allows a remote attacker to inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link or load a malicious request. No authentication is required (PR:N) but user interaction is (UI:R), and the scope-changed CVSS 7.1 reflects that injected script runs in the security context of the WordPress site rather than the plugin alone. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Authenticated SQL injection in the Dokan Pro WordPress multivendor marketplace plugin (versions <= 5.0.2) allows a low-privileged Subscriber-level user to inject malicious SQL into backend database queries, enabling extraction of sensitive data across the WordPress store. Reported by Patchstack and rated CVSS 7.1, the scope-changed vector reflects that a compromised low-tier account can reach data beyond its own authorization boundary. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Stored/reflected Cross-Site Scripting in the Dokan Pro WordPress multivendor marketplace plugin (versions up to and including 5.0.0) lets remote unauthenticated attackers inject JavaScript that executes in a victim's browser session, with no public exploit identified at time of analysis. Because the CVSS scope is marked Changed (S:C), successful execution can affect resources beyond the vulnerable component - e.g. hijacking an authenticated admin or vendor session in the surrounding WordPress site. The flaw was reported by Patchstack and requires victim user interaction (UI:R) to trigger.
Cross-Site Request Forgery in the LA-Studio Element Kit for Elementor WordPress plugin (versions <= 1.6.2) lets a remote unauthenticated attacker forge state-changing requests that, per the Patchstack advisory, chain into a Stored Cross-Site Scripting condition. By luring a logged-in user (typically an administrator) into visiting a crafted page, the attacker persists malicious script into the site. No public exploit has been identified at time of analysis and the flaw is not in CISA KEV; exploitation hinges on victim interaction rather than any authentication of the attacker.
Reflected/unauthenticated Cross-Site Scripting in the Form Vibes - Database Manager for Forms WordPress plugin (versions <= 1.5.2) lets a remote attacker inject script that executes in a victim's browser after they follow a crafted link or interact with attacker-controlled input. Because the CVSS scope is changed (S:C), successful execution can affect the wider WordPress session/DOM context, and with PR:N no authentication is required to launch the attack. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; risk hinges on user interaction (UI:R).
Reflected/stored Cross-Site Scripting in the Bookly WordPress appointment-booking plugin (versions 27.7 and earlier) lets unauthenticated remote attackers inject browser-executable script that runs in a victim's session after they interact with a crafted link or booking element. Because the CVSS scope is changed (S:C), the injected payload escapes the plugin's context to impact the wider WordPress site, though impact is bounded (C:L/I:L/A:L) rather than full site takeover. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw is unauthenticated and network-reachable, making it a practical phishing/session-abuse vector on high-traffic booking sites.
Stored/reflected Cross-Site Scripting in the Easy Form Builder WordPress plugin (versions 4.0.12 and earlier) allows remote unauthenticated attackers to inject malicious scripts that execute in a victim's browser when they view an affected page. Because PR:N and no authentication is required, an attacker only needs to lure a user (UI:R) into triggering the payload, and the scope-changed vector (S:C) means the injected script can affect the broader WordPress session context. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Unauthenticated cross-site scripting in the Product Enquiry for WooCommerce WordPress plugin (versions <= 2.2.34.43) lets a remote attacker inject arbitrary JavaScript that executes in a victim's browser when they view attacker-influenced content. The flaw is exploitable without authentication but requires the victim to interact (e.g., visit a crafted link or page), and the CVSS scope-change metric reflects that injected script runs in the trusted site context. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the issue was reported through Patchstack.
Reflected cross-site scripting in the AffiliateWP WordPress plugin (versions 2.34.0 and earlier) lets unauthenticated remote attackers inject browser-executed script by luring a victim to a crafted link, with the CVSS 3.1 scope-change flag indicating the payload can affect resources beyond the vulnerable component. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; risk is driven by the plugin's affiliate-marketing footprint on WordPress sites and the low bar for triggering reflected XSS. EPSS data was not provided in the source intelligence.
Reflected Cross-Site Scripting in the ThemeGoods 'Grand Photography' WordPress theme (versions 5.7.8 and earlier) lets remote unauthenticated attackers inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. The CVSS 3.1 score is 7.1 (scope-changed) and the flaw was disclosed by Patchstack under CWE-79. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Stored/reflected Cross-Site Scripting in the WP Google Maps Pro WordPress plugin (all versions up to and including 10.1.02) lets an unauthenticated attacker inject browser-executed script that runs in the context of any user who views the affected page. Rated CVSS 7.1 with a scope-changed vector, the flaw requires victim interaction (UI:R) but no authentication (PR:N), meaning a crafted link or poisoned map component is enough to fire the payload. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Cross-site scripting in the Breakdance WordPress page-builder plugin (soflyy) affects all versions up to and including 2.7.1, letting a remote unauthenticated attacker inject script that executes in a victim's browser after they interact with a crafted request or link. The CVSS 3.1 base score is 7.1 (scope change) and the flaw carries no authentication requirement (PR:N), though it does require user interaction (UI:R). There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Stored/reflected Cross-Site Scripting in the Smart Manager (smart-manager-for-wp-e-commerce) WordPress plugin by StoreApps affects all versions up to and including 8.90.0, allowing unauthenticated attackers to inject browser-executed script that runs in the context of a victim who follows a crafted link or triggers the vulnerable flow. Because the CVSS scope is changed (S:C), successful exploitation can impact the broader WordPress site beyond the plugin's own boundary, potentially leading to admin session theft or actions performed as a logged-in operator. Reported by Patchstack; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Reflected Cross-Site Scripting in the WebCodingPlace 'Real Estate Manager Pro' WordPress plugin (all versions through 12.8.5) lets an unauthenticated remote attacker inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. Because CVSS marks a scope change (S:C), successful exploitation can affect resources beyond the plugin - typically hijacking the authenticated WordPress session/admin context of whoever clicks. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS base score is 7.1 (High).
Stored/reflected Cross-Site Scripting in the bqworks Slider Pro WordPress plugin (versions 4.8.13 and earlier) allows a low-privileged Subscriber-level user to inject malicious script that executes in another user's browser. The flaw was reported by Patchstack and carries a CVSS 7.1 driven by a scope change (S:C). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is unproven in the wild.
Arbitrary file deletion in the VideoWhisper Picture Gallery WordPress plugin (versions <= 1.6.5) allows an authenticated user holding the low-privilege Contributor role to delete arbitrary files on the server via path traversal (CWE-22). Rated CVSS 7.1, the flaw carries no confidentiality impact but high availability impact, since deleting critical files (e.g. wp-config.php) can break or hijack the site. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Cross-Site Scripting in the BoldGrid Sprout Clients WordPress plugin (versions 3.2.3 and earlier) lets an unauthenticated attacker inject browser-executed script that runs in the context of a user who loads a crafted request or page. Because the CVSS vector shows PR:N with UI:R and a scope change (S:C), no account is needed but a victim must interact with a malicious link or page, after which script executes across a trust boundary into the victim's session. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Reflected/unauthenticated Cross-Site Scripting in the Download Monitor - WPForms Lock add-on for WordPress (versions ≤ 1.0.4) allows an attacker to inject arbitrary JavaScript that executes in a victim's browser session. Exploitation requires no authentication but does require the victim to interact with an attacker-supplied link or request (UI:R), and the changed scope (S:C) reflects that script runs in the browser security context rather than the plugin itself. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, so this is a disclosed-but-not-yet-weaponized web flaw rather than an active-exploitation emergency.
Cross-site scripting in the ThimPress "Coaching" WordPress theme (versions <= 3.9.2) lets remote unauthenticated attackers inject arbitrary script that executes in a victim's browser after they interact with a crafted link or page. Reported by Patchstack under CWE-79, the flaw carries a CVSS 3.1 score of 7.1 with a scope change, but there is no public exploit identified at time of analysis and no active-exploitation (KEV) or EPSS signal in the provided data. Impact is primarily session/account compromise of users who view attacker-controlled content within a site running the theme.
Reflected/unauthenticated cross-site scripting affects Funnel Kit Funnel Builder PRO (WordPress plugin by Wisetr Inc.) in all versions up to and including 3.15.0.7, letting a remote attacker inject arbitrary JavaScript that executes in a victim's browser after they follow a crafted link or interact with malicious input. No authentication is required (PR:N), but victim interaction is (UI:R), and the CVSS scope change (S:C) reflects that injected script runs in the site's security context. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was provided.
Reflected cross-site scripting in the Visitor Traffic Real Time Statistics Pro WordPress plugin (versions 11.9.1 and earlier) allows an unauthenticated attacker to inject arbitrary JavaScript that executes in a victim's browser when a crafted link is opened. Disclosed by Patchstack, the flaw carries a CVSS 7.1 due to a scope change (S:C) into the browser context; there is no public exploit identified at time of analysis and it is not on the CISA KEV list. Impact is limited by the requirement for victim interaction (clicking a malicious link).
Improper authorization in the WP Booking System WordPress plugin (all versions before 5.12.8.1) lets low-privileged, authenticated Subscriber-level accounts perform actions or modify data they should not be able to reach, reflecting an integrity-focused broken access control weakness. Because self-registration is common on WordPress sites, any user able to obtain a Subscriber account can abuse the flaw; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The CVSS 3.1 base score is 7.1 (high), driven by high integrity impact with only low privilege requirements over the network.