Authenticated SQL injection in the Persian Woocommerce SMS WordPress plugin (versions 7.2.2 and earlier) lets a user holding the Shop Manager role inject arbitrary SQL into backend queries, enabling extraction of sensitive database contents such as customer PII, order data, and WordPress credential hashes. Reported by Patchstack and classified CWE-89, the flaw carries a CVSS 7.6 score driven by network reach and high confidentiality impact but gated behind privileged access. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
SQL injection in the Uncanny Automator WordPress plugin (versions 7.3.2 and earlier) lets an authenticated administrator inject arbitrary SQL into backend database queries. Reported by Patchstack and scored CVSS 7.6, the flaw carries a confidentiality-heavy impact (C:H) but requires high privileges (PR:H), so the realistic threat is a compromised or rogue admin account rather than an anonymous internet attacker. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
SQL injection in the Lumise Product Designer for WooCommerce WordPress plugin (versions up to and including 2.1.1) allows unauthenticated attackers to extract sensitive database contents by manipulating the 'id' and 'table' parameters inside an uploaded cart JSON file processed by the checkout AJAX action. The flaw stems from unescaped interpolation into a raw SQL query in the find_resource() function, letting attackers append their own SELECT logic. No public exploit is identified at time of analysis, and the CVSS 7.5 rating reflects high confidentiality impact with no integrity or availability effect.
Remote denial of service in find-my-way (the HTTP router underneath Fastify) affects all versions up to and including 9.6.0 when the router serves requests from a Node.js HTTP/2 server. Because the internal method-to-tree map is a plain JavaScript object, an unauthenticated attacker can send a request whose HTTP method is an inherited Object property name such as constructor, toString, or __proto__, causing find() to treat a prototype value as a router node and crash the process on currentNode.prefix.length. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the trigger is trivial and a fixed release (9.7.0) is available.
Remote memory-exhaustion denial of service in the Quinn Rust QUIC library (quinn-proto 0.1.0 through 0.11.14) lets an unauthenticated peer flood a connection with many small, non-contiguous stream fragments that leave gaps at the start of the stream. Because the in-order Assembler cannot defragment these gapped chunks, buffer overhead grows unbounded and the receiving process can be driven to exhaust memory. CVSS 7.5 (availability-only); no public exploit identified at time of analysis, but the fix and root cause are fully documented in the upstream advisory and PR.
Denial of service in OpenPrinting libcupsfilters (as shipped in Red Hat Enterprise Linux 7 through 10) allows a network-adjacent attacker to pin a CPU at 100% by broadcasting a crafted printer advertisement. The flaw lies in cfIEEE1284NormalizeMakeModel(), which enters an infinite loop (CWE-835) when parsing an IEEE-1284 device ID whose model field is empty. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; impact is limited to availability with no data compromise.
Denial of service in Apple's swift-crypto (all versions before 4.5.1) allows remote attackers to crash a process by supplying malformed RSA public key bytes. When BoringSSL fails to decode a DER- or PEM-encoded RSA public key, the underlying EVP_PKEY* is freed twice - once in the error catch block and again during deinitialization - corrupting the allocator and causing a crash on subsequent memory allocations. No public exploit identified at time of analysis; the flaw is memory-safety corruption limited to availability impact (CVSS 7.5).
Unauthenticated remote file disclosure in ReReplacer Pro extension for Joomla allows attackers to read arbitrary files outside the site directory via path traversal in XML include paths. The vulnerability affects versions 1.0.0 through 15.0.3 and has a CVSS 3.1 score of 7.5 (high confidentiality impact). No public exploit code or active exploitation has been reported, and EPSS indicates a very low probability of widespread exploitation.
Server-side request forgery in Regular Labs' Articles Anywhere Pro and Users Anywhere Pro extensions for Joomla allows unauthenticated attackers to access internal network services and write arbitrary files to web-accessible directories. The vulnerability stems from improper validation of content-controlled image URLs, which fetch and save remote responses without checking that they are images. No active exploitation or public exploit code has been reported, and EPSS indicates low exploitation probability.
Information disclosure in Regular Labs Articles Anywhere and Users Anywhere extensions for Joomla allows unauthenticated remote attackers to view content that should be expired or unpublished. Date-sensitive query caching generates cache keys lacking a bounded time component, so results cached during a valid period persist and can be served after content becomes unavailable. No active exploitation or public proof-of-concept has been identified, and EPSS indicates a low probability of widespread exploitation.
Information disclosure in the GeoIP extension for Joomla 1.0.0 through 6.3.8 exposes MaxMind API credentials directly in request URLs. Unauthenticated remote attackers can intercept these credentials from network traffic or server logs, gaining unauthorized access to the victim’s MaxMind geolocation service. No active exploitation or public exploit code is known, and EPSS probability of exploitation is very low (0.19%).
Session replay in Logto IdP-initiated SAML sessions allows unauthenticated remote attackers to reuse captured session tokens, leading to unauthorized account access. Affected versions 1.21.0 through 1.37.1 silently fail to delete sessions, enabling replay within the session's validity window. No active exploitation confirmed but the attack requires no user interaction, and EPSS indicates very low exploitation likelihood.
Remote attackers can bypass SAML assertion time and audience restrictions in Logto versions 1.12.0 through 1.37.1, enabling indefinite replay of modified assertions and unauthorized persistent access. No active exploitation or public exploit code has been identified, and EPSS indicates a low exploitation probability (0.13%).
Sensitive information disclosure in the pixelacehq "Manual" WordPress theme (versions 7.5.4 and earlier) lets remote unauthenticated attackers reach functionality or data that should be access-restricted, due to a missing authorization check (CWE-862). Rated CVSS 7.5 with a confidentiality-only impact, the flaw was reported by Patchstack; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Broken access control in Dokan Pro (the premium extension of the Dokan multivendor marketplace plugin for WordPress) through version 5.0.3 lets unauthenticated remote attackers reach functionality that should be authorization-gated, per Patchstack's advisory. The published CVSS vector scores only an availability impact (C:N/I:N/A:H), indicating the missing authorization check can be abused to disrupt or degrade marketplace operations rather than to read or alter data. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
PHP Object Injection in the Dokan Pro WordPress plugin (versions 5.0.2 and earlier) allows an authenticated user holding only subscriber-level privileges to inject a crafted serialized PHP object, which - if a suitable gadget chain exists in the plugin or its dependencies - can lead to high-impact compromise of confidentiality, integrity, and availability. Reported by Patchstack and tracked as CVE-2026-65493 (CWE-502), it carries a CVSS 3.1 score of 7.5 with high attack complexity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local File Inclusion in the Vino WordPress theme (elated-themes) affects all versions up to and including 1.9, letting an attacker holding a low-privileged Contributor account cause the theme to include and disclose arbitrary local files (e.g. wp-config.php) on the server. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the flaw was reported through Patchstack's WordPress vulnerability program. Because it requires a valid Contributor login and Patchstack rated attack complexity as high, real-world exploitation is gated behind account access rather than being fully open to the internet.
Local File Inclusion in the Tonda Core WordPress plugin (versions 2.1.2 and earlier by Select Themes) allows an authenticated user with only Contributor-level privileges to force the PHP application to include arbitrary local files, exposing sensitive server-side content and potentially escalating to code execution. The flaw was reported by Patchstack and is classified as CWE-98 (PHP file inclusion). No public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 3.1 base score is 7.5 with high attack complexity.
Integrity compromise in the PayU India WordPress plugin (versions 3.8.9 and earlier) allows remote unauthenticated attackers to abuse functionality protected only by a missing authorization check. Reported by Patchstack, the flaw lets attackers reach privileged plugin actions without credentials, enabling manipulation of payment-related state or configuration. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data disclosure in the WordPress WPDM - Premium Packages plugin (versions 6.2.0 and earlier) allows remote unauthenticated attackers to reach functionality or data that should require authorization, due to a missing access-control check. Reported by Patchstack and rated CVSS 7.5 (confidentiality-only impact), the flaw needs no credentials or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Broken authentication in the Ziina WordPress payment plugin (versions <= 1.2.21) lets remote unauthenticated attackers bypass authentication controls, with the CVSS integrity-high rating indicating attackers can manipulate protected state or actions they should not be able to reach. Reported by Patchstack and classified under CWE-1390 (Weak Authentication), the issue is network-reachable with low complexity and no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Broken access control in the Payment Gateway for PayPal on WooCommerce WordPress plugin (versions <= 9.1.4) lets remote unauthenticated attackers tamper with integrity-sensitive data due to a missing authorization check. Reported by Patchstack and tagged as an authentication bypass, the flaw exposes protected plugin functionality without any login. No public exploit code and no CISA KEV listing were identified at time of analysis.
Out-of-bounds heap write in FFmpeg's vf_floodfill video filter (versions 3.4 through 8.1.2) lets an attacker corrupt heap memory by feeding a specially crafted, dynamically sized video stream to a filtergraph where reinitialization is disabled via -reinit_filter 0. Reported by VulnCheck with a vendor patch available and no public exploit identified at time of analysis, the flaw reliably crashes the process and carries potential for code execution depending on heap layout and process hardening. Exploitation is local and requires the victim to process attacker-supplied media through the specific floodfill configuration.
Out-of-bounds heap write in FFmpeg through 8.1.2 lets an attacker who supplies a crafted ffconcat file - processed with the -safe 0 flag - corrupt heap memory and potentially achieve code execution. The flaw chains the TY demuxer's demux_audio() (which decrements packet size without bounds checking) into the Shorten decoder's memcpy(), where a negative size wraps to near SIZE_MAX. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis.
Stored cross-site scripting in the FormCraft WordPress plugin (all versions through 3.9.14) lets unauthenticated attackers persist malicious JavaScript that executes in any user's browser when an affected page is rendered. The flaw stems from a two-sided sanitization gap: composite matrix sub-field keys (e.g. field2_0) are written raw via $wpdb->insert(), and the client-side DOMPurify guard is skipped because matrix values arrive as arrays rather than strings. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but its unauthenticated, network-reachable nature (CVSS 7.2) makes it a meaningful patch priority for exposed sites.
Stored cross-site scripting in the ARforms WordPress form-builder plugin (all versions through 7.2.1) lets unauthenticated attackers persist arbitrary JavaScript through submitted 'password' field values, which later executes in the browser of any user who loads the affected page. Because the injection point is a public-facing form and no authentication is required, the flaw is well-suited to opportunistic, automated abuse against WordPress sites running the plugin. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 7.2 (scope-changed) rating and unauthenticated vector make it a meaningful patch priority.
Unauthenticated stored cross-site scripting in the SUMO Reward Points for WooCommerce WordPress plugin (versions up to and including 32.7.0) lets any anonymous visitor inject persistent JavaScript through the `/wp-json/wc-srp/v1/earning` REST endpoint. A broken `user_has_cap` filter hands the `rs_earning_read` capability to everyone, so an attacker can write an unsanitized `reason` value that later executes in an administrator's browser when the Master Log or User Reward Points pages are viewed. There is no public exploit identified at time of analysis and the plugin is not on CISA KEV, but the flaw is trivially reachable and Wordfence-confirmed.
Cross-tenant backup tampering in CyberPanel (through 1.9.1) lets an authenticated low-privileged tenant terminate, delete, and corrupt other tenants' backups via the cancelBackupCreation handler. Because the privileged worker acted purely on attacker-supplied backupCancellationDomain and fileName parameters without an ownership check, any logged-in user could send crafted POST requests to kill backup processes, remove backup archives, rewrite status files, and delete database records belonging to other tenants. No public exploit identified at time of analysis, and the flaw is not in CISA KEV.
Server-Side Request Forgery in the PeproDev Ultimate Invoice WordPress plugin (versions 2.2.6 and earlier) lets unauthenticated remote attackers coerce the WordPress server into issuing HTTP requests to attacker-chosen destinations. Because the CVSS vector marks a scope change (S:C), the forged requests can reach systems beyond the vulnerable plugin - notably internal network hosts and cloud metadata endpoints - with only low confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-facing nature keeps it a meaningful patch priority for exposed WordPress sites.
PHP Object Injection in the Complianz WordPress plugin (all versions up to and including 7.5.0) allows an authenticated user with Administrator privileges to inject serialized PHP objects that the plugin later deserializes, enabling arbitrary object instantiation and potential remote code execution or data manipulation. The flaw stems from unsafe deserialization (CWE-502) and carries a CVSS 7.2 (High). No public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was privately disclosed by Patchstack.
Arbitrary file read in SiYuan (an open-source personal knowledge-management / note-taking application) before v3.7.2 allows an authenticated attacker to retrieve files anywhere on the host by abusing the /export/temp/ short-circuit branch of the serveExport handler. Because this branch joins the raw, percent-decoded request path to the temp directory without the IsSubPath or IsSensitivePath guards used elsewhere, percent-encoded '..' sequences escape TempDir and expose /etc/passwd, SSH private keys, and SiYuan's own workspace *.db and *.log files. No public exploit identified at time of analysis, though the advisory documents a concrete payload; EPSS and CISA KEV data are not provided in the input.
Path traversal in the Grav API Plugin (getgrav/grav-plugin-api) before 1.0.10 lets an authenticated caller holding the api.pages.write permission relocate an entire page directory outside user/pages/ and even outside the Grav installation. The flaw sits in the POST /pages/{route}/move endpoint, where PagesController::move() only strips leading periods from the slug and never neutralizes '/' or '..' segments. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but an upstream fix and a GHSA advisory are published.
Cross-site request forgery in the MailPoet WordPress plugin (versions 5.30.0 through 5.33.0) allows a remote attacker to trick an authenticated victim into submitting forged state-changing requests, producing limited confidentiality, integrity, and availability impact with a scope change per the CVSS vector. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. Exploitation requires user interaction (UI:R), so a logged-in administrator or user must be lured into visiting an attacker-controlled page.
Cross-Site Request Forgery in the WordPress plugin 'Popup for CF7 with Sweet Alert' (by Metin Saraç) through version 1.6.5 allows a remote unauthenticated attacker to trick an authenticated site user or administrator into unknowingly submitting state-changing plugin requests. Reported by Patchstack and rated CVSS 7.1, the flaw carries a scope-change impact but requires victim interaction (clicking an attacker-controlled link/page). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Cross-site request forgery in the Kwayy HTML Sitemap WordPress plugin (versions <= 4.0) lets a remote attacker forge state-changing requests that, per the Patchstack advisory, chain into stored cross-site scripting (CSRF-to-Stored-XSS). By tricking a logged-in administrator into loading a crafted page, an attacker can inject persistent script into the site. No public exploit is identified at time of analysis, and it is not listed in CISA KEV.
Reflected/stored Cross-Site Scripting in the Manual - Documentation, Knowledge Base & Education WordPress theme (pixelacehq) affects all versions up to and including 7.5.4, allowing unauthenticated attackers to inject malicious script that executes in a victim's browser when they interact with a crafted link or page. Because the CVSS scope is changed (S:C), successful exploitation can impact resources beyond the theme itself, such as the WordPress admin session context. This is a Patchstack-reported issue with no public exploit identified at time of analysis and no evidence of active exploitation.
Reflected/unauthenticated Cross-Site Scripting in the PeproDev Ultimate Invoice WordPress plugin (versions 2.2.6 and earlier) allows a remote attacker to inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link or load a malicious request. No authentication is required (PR:N) but user interaction is (UI:R), and the scope-changed CVSS 7.1 reflects that injected script runs in the security context of the WordPress site rather than the plugin alone. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Authenticated SQL injection in the Dokan Pro WordPress multivendor marketplace plugin (versions <= 5.0.2) allows a low-privileged Subscriber-level user to inject malicious SQL into backend database queries, enabling extraction of sensitive data across the WordPress store. Reported by Patchstack and rated CVSS 7.1, the scope-changed vector reflects that a compromised low-tier account can reach data beyond its own authorization boundary. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Stored/reflected Cross-Site Scripting in the Dokan Pro WordPress multivendor marketplace plugin (versions up to and including 5.0.0) lets remote unauthenticated attackers inject JavaScript that executes in a victim's browser session, with no public exploit identified at time of analysis. Because the CVSS scope is marked Changed (S:C), successful execution can affect resources beyond the vulnerable component - e.g. hijacking an authenticated admin or vendor session in the surrounding WordPress site. The flaw was reported by Patchstack and requires victim user interaction (UI:R) to trigger.
Cross-Site Request Forgery in the LA-Studio Element Kit for Elementor WordPress plugin (versions <= 1.6.2) lets a remote unauthenticated attacker forge state-changing requests that, per the Patchstack advisory, chain into a Stored Cross-Site Scripting condition. By luring a logged-in user (typically an administrator) into visiting a crafted page, the attacker persists malicious script into the site. No public exploit has been identified at time of analysis and the flaw is not in CISA KEV; exploitation hinges on victim interaction rather than any authentication of the attacker.
Reflected/unauthenticated Cross-Site Scripting in the Form Vibes - Database Manager for Forms WordPress plugin (versions <= 1.5.2) lets a remote attacker inject script that executes in a victim's browser after they follow a crafted link or interact with attacker-controlled input. Because the CVSS scope is changed (S:C), successful execution can affect the wider WordPress session/DOM context, and with PR:N no authentication is required to launch the attack. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; risk hinges on user interaction (UI:R).
Reflected/stored Cross-Site Scripting in the Bookly WordPress appointment-booking plugin (versions 27.7 and earlier) lets unauthenticated remote attackers inject browser-executable script that runs in a victim's session after they interact with a crafted link or booking element. Because the CVSS scope is changed (S:C), the injected payload escapes the plugin's context to impact the wider WordPress site, though impact is bounded (C:L/I:L/A:L) rather than full site takeover. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw is unauthenticated and network-reachable, making it a practical phishing/session-abuse vector on high-traffic booking sites.
Stored/reflected Cross-Site Scripting in the Easy Form Builder WordPress plugin (versions 4.0.12 and earlier) allows remote unauthenticated attackers to inject malicious scripts that execute in a victim's browser when they view an affected page. Because PR:N and no authentication is required, an attacker only needs to lure a user (UI:R) into triggering the payload, and the scope-changed vector (S:C) means the injected script can affect the broader WordPress session context. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Unauthenticated cross-site scripting in the Product Enquiry for WooCommerce WordPress plugin (versions <= 2.2.34.43) lets a remote attacker inject arbitrary JavaScript that executes in a victim's browser when they view attacker-influenced content. The flaw is exploitable without authentication but requires the victim to interact (e.g., visit a crafted link or page), and the CVSS scope-change metric reflects that injected script runs in the trusted site context. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the issue was reported through Patchstack.
Reflected cross-site scripting in the AffiliateWP WordPress plugin (versions 2.34.0 and earlier) lets unauthenticated remote attackers inject browser-executed script by luring a victim to a crafted link, with the CVSS 3.1 scope-change flag indicating the payload can affect resources beyond the vulnerable component. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; risk is driven by the plugin's affiliate-marketing footprint on WordPress sites and the low bar for triggering reflected XSS. EPSS data was not provided in the source intelligence.
Reflected Cross-Site Scripting in the ThemeGoods 'Grand Photography' WordPress theme (versions 5.7.8 and earlier) lets remote unauthenticated attackers inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. The CVSS 3.1 score is 7.1 (scope-changed) and the flaw was disclosed by Patchstack under CWE-79. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Stored/reflected Cross-Site Scripting in the WP Google Maps Pro WordPress plugin (all versions up to and including 10.1.02) lets an unauthenticated attacker inject browser-executed script that runs in the context of any user who views the affected page. Rated CVSS 7.1 with a scope-changed vector, the flaw requires victim interaction (UI:R) but no authentication (PR:N), meaning a crafted link or poisoned map component is enough to fire the payload. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Cross-site scripting in the Breakdance WordPress page-builder plugin (soflyy) affects all versions up to and including 2.7.1, letting a remote unauthenticated attacker inject script that executes in a victim's browser after they interact with a crafted request or link. The CVSS 3.1 base score is 7.1 (scope change) and the flaw carries no authentication requirement (PR:N), though it does require user interaction (UI:R). There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Stored/reflected Cross-Site Scripting in the Smart Manager (smart-manager-for-wp-e-commerce) WordPress plugin by StoreApps affects all versions up to and including 8.90.0, allowing unauthenticated attackers to inject browser-executed script that runs in the context of a victim who follows a crafted link or triggers the vulnerable flow. Because the CVSS scope is changed (S:C), successful exploitation can impact the broader WordPress site beyond the plugin's own boundary, potentially leading to admin session theft or actions performed as a logged-in operator. Reported by Patchstack; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Reflected Cross-Site Scripting in the WebCodingPlace 'Real Estate Manager Pro' WordPress plugin (all versions through 12.8.5) lets an unauthenticated remote attacker inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. Because CVSS marks a scope change (S:C), successful exploitation can affect resources beyond the plugin - typically hijacking the authenticated WordPress session/admin context of whoever clicks. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS base score is 7.1 (High).