Stored cross-site scripting in the BeRocket Brands for WooCommerce WordPress plugin (all versions through 3.8.8) enables authenticated Shop Manager-level users to inject persistent JavaScript via the br_brand_tooltip term meta field, executing against any visitor who loads an affected page. A notable architectural bypass is central to this flaw: because the payload is stored in WordPress term meta rather than post content, the platform's unfiltered_html capability gate - which normally prevents Shop Managers from injecting raw HTML - does not apply, granting that role unexpectedly full exploitation capability. No public exploit code and no CISA KEV listing exist at time of analysis.
Server-Side Request Forgery in the Complianz WordPress GDPR compliance plugin (versions 7.5.0 and below) allows authenticated attackers with Author-level privileges or higher to forge requests from the server, enabling internal network probing and limited confidentiality and integrity impact. The Scope:Changed CVSS metric confirms the vulnerability crosses the server's trust boundary, a characteristic consistent with SSRF enabling access to internal resources unreachable by the attacker directly. No public exploit code has been identified at time of analysis, and the high privilege requirement (PR:H) substantially limits opportunistic exploitation.
Server-Side Request Forgery in the Photo Block WordPress plugin (versions 1.7.1 and earlier) allows authenticated administrators to cause the hosting WordPress server to issue arbitrary HTTP requests to attacker-controlled destinations, including internal network services. The CVSS scope-change flag (S:C) indicates impact extends beyond WordPress itself to back-end infrastructure reachable from the server. No public exploit code and no CISA KEV listing exist at time of analysis, and the high-privilege requirement substantially limits the realistic attacker pool to compromised admin accounts or rogue administrators.
Sensitive data exposure in Polylang WordPress plugin (versions <= 3.8.5) allows authenticated Contributors to access information beyond their authorization scope. The vulnerability, classified under CWE-497, enables low-privileged authenticated users - specifically those holding the WordPress Contributor role - to read sensitive data they should not be permitted to view. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis.
Unthrottled resource allocation in BizimHesap Online Pre-Accounting Software allows authenticated low-privileged network attackers to exhaust system resources, causing a denial of service condition. All versions through 17072026 are confirmed affected. Reported by Turkey's National Cyber Incident Response Center (USOM), no public exploit code or active exploitation has been identified at time of analysis. The vulnerability carries a CVSS 4.3 score, reflecting a low-availability-impact DoS limited to authenticated users.
Broken access control in Cyr to Lat Reloaded (WordPress plugin by Themeisle) allows low-privileged authenticated users at the subscriber role to invoke restricted plugin actions on affected WordPress installations running version 1.3.3 and below. The flaw stems from missing authorization checks (CWE-862), permitting subscribers to perform operations intended for higher-privileged users such as editors or administrators. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and network accessibility via standard WordPress HTTP endpoints make it straightforward to abuse given subscriber-level access.
Sensitive data exposure in the TinyMCE Templates WordPress plugin (versions <= 4.8.1) allows authenticated users holding the Contributor role to access information beyond their authorization boundary. The flaw is classified under CWE-497, indicating that system or application internals are being surfaced to an unauthorized control sphere - in this case, low-privileged WordPress users. No active exploitation or public proof-of-concept has been identified at time of analysis, and the CVSS score of 4.3 (Medium) reflects the limited scope: confidentiality-only impact with no integrity or availability consequences.
TemplateSpare WordPress plugin versions up to and including 4.2.2 exposes restricted functionality to subscriber-level authenticated users via a Broken Access Control flaw (CWE-862: Missing Authorization). Authenticated users holding the WordPress subscriber role - the lowest privilege tier - can bypass intended authorization gates and read data or invoke actions not intended for their role. No public exploit code and no CISA KEV listing are present at time of analysis, but the low attack complexity and network accessibility make this a realistic threat on sites that permit open registration or have untrusted subscriber accounts.
Broken Access Control in the Avada Custom Branding WordPress plugin (versions <= 1.2) allows authenticated users with contributor-level roles to access functionality or data restricted to higher-privileged roles, resulting in unauthorized information disclosure. The CVSS vector confirms network-exploitable, low-privilege exploitation with a limited confidentiality impact (C:L) and no integrity or availability consequences. No public exploit code or active exploitation has been identified at time of analysis, keeping real-world risk constrained despite the medium CVSS score.
Broken access control in Query Wrangler WordPress plugin version 1.5.57 and earlier allows authenticated subscriber-level users to access restricted functionality beyond their intended permissions. The CWE-862 (Missing Authorization) root cause indicates the plugin fails to verify whether the requesting user holds sufficient privileges before executing sensitive operations. No active exploitation is confirmed in CISA KEV, and CVSS rates this a medium-severity (4.3) network-exploitable issue with limited confidentiality impact and no integrity or availability consequence.
Cross-Site Request Forgery in the Zarinpal Gateway WordPress/WooCommerce plugin (versions ≤5.1.0) enables unauthenticated remote attackers to forge HTTP requests on behalf of authenticated site users or administrators, resulting in unauthorized state changes within the plugin. The CVSS vector (PR:N/UI:R/S:U/I:L) confirms exploitation requires no attacker authentication but depends on luring an authenticated victim to a malicious page. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, placing it in a moderate-priority remediation tier.
Broken access control in YooKassa для WooCommerce plugin (versions up to and including 2.16.1) permits authenticated WordPress subscribers to perform privileged actions beyond their intended role boundary. The CVSS vector (PR:L, AV:N, I:L) confirms that any low-privileged authenticated user - specifically a WordPress subscriber, the lowest default role - can exploit missing authorization checks over the network without additional interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though Patchstack, which specializes in WordPress vulnerability disclosure, reported this finding.
Product Slider for WooCommerce plugin (versions ≤1.13.62) exposes an Insecure Direct Object Reference flaw that allows authenticated contributors to access WooCommerce objects beyond their authorization scope. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) confirms network-reachable exploitation requiring only a low-privilege contributor account, resulting in limited confidentiality disclosure with no integrity or availability impact. No public exploit code and no CISA KEV listing are present at time of analysis, placing this in the 'monitor and patch' category rather than emergency response.
Broken access control in ShopLentor Pro (WordPress WooCommerce page builder plugin) versions up to and including 2.8.5 allows authenticated subscriber-level users to perform privileged actions beyond their intended authorization scope, resulting in unauthorized data or configuration modification. The flaw is network-accessible with low attack complexity and requires only a low-privilege WordPress account. No public exploit code has been identified at time of analysis and this vulnerability does not appear in the CISA KEV catalog.
Broken Access Control in the Participants Database WordPress plugin (versions <= 2.7.8.4) permits authenticated subscriber-level users to perform privileged write operations that should be restricted to higher roles such as editors or administrators. The CVSS vector (PR:L/I:L/C:N/A:N) confirms low-privileged network exploitation resulting in unauthorized integrity impact with no confidentiality or availability consequences. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Broken access control in the uListing WordPress plugin (versions <= 2.2.0) allows authenticated users holding the Contributor role to perform privileged actions beyond their authorization level, resulting in unauthorized data modification. The flaw stems from missing authorization checks (CWE-862), confirmed by Patchstack, with a CVSS 3.1 score of 4.3. No active exploitation has been identified, but the low attack complexity and network accessibility make this a realistic lateral-privilege risk on affected WordPress installations running the plugin.
Broken Access Control in the Mediavine Control Panel WordPress plugin (versions <= 2.10.10) permits Contributor-level authenticated users to invoke restricted plugin functionality that should require higher privileges, resulting in unauthorized integrity impacts. Rooted in CWE-862 (Missing Authorization), the plugin fails to enforce WordPress capability checks before executing sensitive actions via network-accessible endpoints. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Cross-Site Request Forgery in WP Accessibility Helper (WAH) plugin versions 0.6.6 and below enables remote unauthenticated attackers to perform unauthorized state-changing actions against the plugin by tricking an authenticated WordPress administrator into visiting a crafted malicious page. The vulnerability arises from missing or unvalidated nonce checks on sensitive plugin endpoints, allowing forged cross-origin requests to execute in the victim's authenticated session context. No public exploit has been identified at time of analysis, and the vulnerability has not been listed in the CISA KEV catalog.