Stored/reflected Cross-Site Scripting in the bqworks Slider Pro WordPress plugin (versions 4.8.13 and earlier) allows a low-privileged Subscriber-level user to inject malicious script that executes in another user's browser. The flaw was reported by Patchstack and carries a CVSS 7.1 driven by a scope change (S:C). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is unproven in the wild.
Arbitrary file deletion in the VideoWhisper Picture Gallery WordPress plugin (versions <= 1.6.5) allows an authenticated user holding the low-privilege Contributor role to delete arbitrary files on the server via path traversal (CWE-22). Rated CVSS 7.1, the flaw carries no confidentiality impact but high availability impact, since deleting critical files (e.g. wp-config.php) can break or hijack the site. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Cross-Site Scripting in the BoldGrid Sprout Clients WordPress plugin (versions 3.2.3 and earlier) lets an unauthenticated attacker inject browser-executed script that runs in the context of a user who loads a crafted request or page. Because the CVSS vector shows PR:N with UI:R and a scope change (S:C), no account is needed but a victim must interact with a malicious link or page, after which script executes across a trust boundary into the victim's session. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Reflected/unauthenticated Cross-Site Scripting in the Download Monitor - WPForms Lock add-on for WordPress (versions ≤ 1.0.4) allows an attacker to inject arbitrary JavaScript that executes in a victim's browser session. Exploitation requires no authentication but does require the victim to interact with an attacker-supplied link or request (UI:R), and the changed scope (S:C) reflects that script runs in the browser security context rather than the plugin itself. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, so this is a disclosed-but-not-yet-weaponized web flaw rather than an active-exploitation emergency.
Cross-site scripting in the ThimPress "Coaching" WordPress theme (versions <= 3.9.2) lets remote unauthenticated attackers inject arbitrary script that executes in a victim's browser after they interact with a crafted link or page. Reported by Patchstack under CWE-79, the flaw carries a CVSS 3.1 score of 7.1 with a scope change, but there is no public exploit identified at time of analysis and no active-exploitation (KEV) or EPSS signal in the provided data. Impact is primarily session/account compromise of users who view attacker-controlled content within a site running the theme.
Reflected/unauthenticated cross-site scripting affects Funnel Kit Funnel Builder PRO (WordPress plugin by Wisetr Inc.) in all versions up to and including 3.15.0.7, letting a remote attacker inject arbitrary JavaScript that executes in a victim's browser after they follow a crafted link or interact with malicious input. No authentication is required (PR:N), but victim interaction is (UI:R), and the CVSS scope change (S:C) reflects that injected script runs in the site's security context. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was provided.
Reflected cross-site scripting in the Visitor Traffic Real Time Statistics Pro WordPress plugin (versions 11.9.1 and earlier) allows an unauthenticated attacker to inject arbitrary JavaScript that executes in a victim's browser when a crafted link is opened. Disclosed by Patchstack, the flaw carries a CVSS 7.1 due to a scope change (S:C) into the browser context; there is no public exploit identified at time of analysis and it is not on the CISA KEV list. Impact is limited by the requirement for victim interaction (clicking a malicious link).
Improper authorization in the WP Booking System WordPress plugin (all versions before 5.12.8.1) lets low-privileged, authenticated Subscriber-level accounts perform actions or modify data they should not be able to reach, reflecting an integrity-focused broken access control weakness. Because self-registration is common on WordPress sites, any user able to obtain a Subscriber account can abuse the flaw; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The CVSS 3.1 base score is 7.1 (high), driven by high integrity impact with only low privilege requirements over the network.
Unrestricted SSH port forwarding on Ricoh printers and Multifunction Printers (MFPs) allows network-accessible devices to be used as pivot points into the local area network. When SSH is enabled on an affected device, any party able to establish an SSH connection can forward TCP traffic to arbitrary hosts and ports on the internal LAN, effectively bypassing network segmentation. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the network scope change (S:C in CVSS) reflects that impact extends beyond the printer itself to other internal hosts.
Open redirect in React Router's `resolvePath` utility allows attackers to craft navigation URLs using protocol-relative paths (`//external.com`) or colon-containing relative paths that the library fails to normalize, resulting in external redirects or XSS execution in the victim's browser. Affected packages are `react-router` (npm) 7.9.6-7.12.0 and `react-router-dom` (npm) 6.30.2-6.30.4; only `react-router` has a confirmed fix (7.13.0). No public exploit code and no CISA KEV listing have been identified at time of analysis, though the CVSS scope-change and high confidentiality impact reflect cross-origin session theft potential via XSS.
Format string vulnerability in GNU nano's multi-buffer error message handling allows a local low-privileged attacker to cause stack information disclosure, denial of service via crash, or potentially achieve arbitrary memory writes. The flaw (CWE-134) is triggered when a user opens multiple files at startup, one of which carries a specially crafted name containing printf format specifiers and another triggers an ALERT-level error - causing nano to misinterpret the filename as a format string. Reported by Red Hat and scoped to RHEL 6 through 10 and OpenShift Container Platform 4, no public exploit or CISA KEV listing exists at time of analysis.
Missing authorization in the seunshare utility (policycoreutils through 3.10) permits a low-privileged local user running in an unconfined SELinux domain to send kill signals to root-owned processes also running in unconfined context - effectively enabling unprivileged denial-of-service against privileged system processes. The root cause (CWE-862) is the absence of ownership validation before allowing signal delivery, bypassing the expectation that non-root users cannot terminate root-owned processes. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Broken access control in the QuickCal Appointment Booking Calendar WordPress plugin (versions ≤ 1.0.16) allows authenticated users holding the Booking Agent role to bypass authorization checks and access functionality or data outside their intended privilege scope. The flaw, rooted in CWE-862 Missing Authorization, enables high-confidentiality and high-availability impact - suggesting attackers can both read sensitive booking/customer data and disrupt the scheduling service. No public exploit or CISA KEV listing is identified at time of analysis, though the Patchstack advisory confirms the issue.
Directory traversal in the WCPOS - Point of Sale plugin for WooCommerce (all versions through 1.9.8) allows authenticated shop managers to read arbitrary files from the server filesystem via the REST API. The vulnerability is exploited through the 'type' parameter in template-related API endpoints, with the critical bypass condition being the inclusion of 'context=edit' in the request, which suppresses the response sanitization layer and returns raw file contents. No public exploit code has been identified at time of analysis, and exploitation requires shop manager-level credentials, limiting opportunistic attack surface.
SQL Injection in the Premium Packages - Sell Digital Products Securely WordPress plugin (all versions through 7.0.4) allows authenticated administrators to append arbitrary SQL to existing queries by manipulating the unsanitized 'orderby' parameter in the order renewal management view. Successful exploitation enables full read access to the WordPress database, exposing potentially sensitive records such as customer data, license keys, and payment history. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog; however, Wordfence has published source-level references pinpointing the exact vulnerable lines, and a fix commit (changeset 3611573) appears in the plugin's SVN repository.
SQL injection in the Tickera - Sell Tickets & Manage Events WordPress plugin (all versions through 3.6.0.1) allows authenticated attackers holding the plugin's Staff role to append arbitrary SQL to existing queries via the unescaped 'tc_event_filter' parameter, extracting sensitive data from the WordPress database. The exposure is enabled by the plugin's own add_required_capabilities() function, which grants the custom Staff role the edit_tc_tickets_instances capability - meaning any staff-level account can reach the vulnerable tc_tickets_instances admin list screen and trigger the injection. No public exploit or CISA KEV listing has been identified at time of analysis, but the low authentication bar (staff role, not admin) and high confidentiality impact make this a meaningful risk for multi-tenant event-ticketing deployments.
Insecure Direct Object Reference (IDOR) in ITFlow allows a low-privileged authenticated agent to exfiltrate plaintext credentials and TOTP secrets belonging to any client by supplying an arbitrary `credential_id` to the credential edit modal endpoint. The affected endpoint performs no client-scoping or object-level authorization check before loading and decrypting the stored credential record, making cross-client data access trivially achievable with any valid agent account. No active exploitation is confirmed (not in CISA KEV), but the high confidentiality impact (CVSS C:H) reflects the severity of exposing decrypted secrets and multi-factor authentication seeds across MSP client boundaries.
Directory enumeration via path traversal in the Modals Pro extension for Joomla 1.0.0–15.0.0 allows unauthenticated remote attackers to list unintended directories. Successful exploitation may expose directory structures and potentially manipulate gallery paths, though only low confidentiality and integrity impacts are reported. EPSS indicates a 0.20% exploitation probability, and no active exploitation or public exploit code is known.
Path traversal in the Cache Cleaner Pro extension for Joomla allows unauthenticated remote attackers to read and write arbitrary files outside the webroot through
GeoIP rule bypass in Joomla Geo
Stored Cross-Site Scripting in TheGem WordPress theme versions up to and including 5.11.1 allows low-privileged Contributor-role users to inject malicious JavaScript into site content, which then executes in the browsers of higher-privileged users - such as administrators - who view or manage that content. The CVSS scope-changed attribute (S:C) confirms the injected payload crosses security boundaries, extending impact beyond the contributor session into an admin or editor context. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was reported by Patchstack with a CVSS 6.5 Medium rating.
Incorrect NSEC owner computation in the mod-onlinesign module of Knot DNS can cause overly broad authenticated denial intervals, allowing downstream validating resolvers that use aggressive negative caching to synthesize negative answers for legitimate names, resulting in resolver-side denial of service. This issue affects versions before 3.4.10 and 3.5.x before 3.5.4, and is exploitable by a low-privileged authenticated user. No active exploitation or public proof-of-concept code is currently known.
Stored Cross-Site Scripting in Modula Image Gallery WordPress plugin versions 2.14.25 through 2.14.30 allows an authenticated low-privileged user to inject persistent malicious scripts into gallery content, which execute in the browser of any higher-privileged user who views the affected page. The Scope:Changed CVSS metric confirms cross-context script execution, enabling session hijacking, credential theft, or administrator account takeover on vulnerable WordPress sites. No public exploit code and no CISA KEV listing exist at time of analysis.
Sensitive system information disclosure in the MultiVendorX WooCommerce Product Stock Alert WordPress plugin (versions through 3.0.6) allows low-privileged authenticated users to retrieve embedded sensitive data via a network-accessible endpoint. The CVSS vector (AV:N/AC:L/PR:L/UI:N/C:H) confirms that any authenticated WordPress user - such as a registered shop customer - can exploit this with low complexity and no user interaction, yielding high confidentiality impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, network-accessible nature of the flaw lowers the bar for abuse significantly.
Cross-Site Request Forgery (CSRF) in the WooCommerce Persian Shipping plugin (افزونه حمل و نقل ووکامرس) allows unauthenticated remote attackers to perform unauthorized state-changing actions by tricking an authenticated WordPress administrator into visiting a malicious page. Versions 4.4.5 and below are affected, with integrity impact rated High due to the potential for unauthorized modification of shipping configurations, order data, or plugin settings. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation requires victim interaction, moderating real-world risk despite the network-accessible attack vector.
Stored Cross-Site Scripting in the Smart SEO Tool WordPress plugin (versions <= 4.1.2) allows an authenticated Contributor-level user to inject malicious JavaScript into SEO-related fields, which then executes in the browsers of higher-privileged users - such as administrators - who view the affected content. Successful exploitation could enable session hijacking and subsequent full site takeover if an admin account is compromised. No public exploit code or confirmed active exploitation has been identified at time of analysis; the vulnerability was reported by Patchstack.
Stored Cross-Site Scripting in the BSK PDF Manager WordPress plugin version 3.8 and earlier allows authenticated contributors to inject persistent malicious JavaScript into plugin-managed content. Because the CVSS vector reflects a scope change (S:C), the injected script executes in the security context of higher-privileged users - most critically WordPress administrators - who later view the affected page. No public exploit code or CISA KEV listing has been identified at time of analysis, but the contributor-to-admin privilege escalation path makes this a meaningful risk for multi-author WordPress installations.
Stored Cross-Site Scripting in the Liquid Speech Balloon WordPress plugin (versions <= 1.2.5) allows authenticated contributors to inject malicious scripts into speech balloon elements that execute in the browser context of higher-privileged users who view the affected content. The CVSS vector confirms PR:L and S:C, meaning a low-privileged contributor account is sufficient to plant the payload, and the scope change indicates impact extends to victim sessions. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the Manual - Documentation, Knowledge Base & Education WordPress Theme (versions 7.5.4 and earlier) allows authenticated Contributor-level users to inject persistent malicious scripts into theme-managed content. When a higher-privileged user such as an editor or administrator views the affected content, the script executes within their browser session, enabling session hijacking, credential theft, or unauthorized administrative actions. No active exploitation is confirmed (not listed in CISA KEV) and no public proof-of-concept code has been identified at time of analysis.
Stored Cross-Site Scripting in the GT3 Themes Photo Gallery WordPress plugin (versions <= 2.7.7.29) allows authenticated users holding at minimum the Author role to inject persistent malicious JavaScript into gallery content. When a privileged user such as an administrator subsequently views the affected gallery, the injected script executes in their browser context, enabling session hijacking or unauthorized administrative actions. No public exploit code exists and no CISA KEV listing is present at time of analysis, but the scope change (S:C) elevates practical risk by enabling privilege escalation from Author to Administrator.
Stored Cross-Site Scripting in the WordPress plugin Accept Donations with PayPal & Stripe (versions <= 1.5.5) allows contributor-level authenticated users to inject malicious JavaScript that executes in the browser of higher-privileged users, including site administrators. The scope change in the CVSS vector (S:C) confirms that a low-privileged contributor can affect sessions and actions of users outside their own security context. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Stored Cross-Site Scripting in the Appointment Hour Booking WordPress plugin (versions <= 1.5.86) allows authenticated contributors to inject and persist malicious JavaScript payloads that execute in the browsers of higher-privileged users, such as site administrators, who view the affected content. The CVSS vector (PR:L/UI:R/S:C) confirms this is a contributor-tier stored XSS with scope change, meaning the impact propagates beyond the attacker's own session into the administrative context. No active exploitation has been confirmed via CISA KEV, and no public exploit code has been identified at time of analysis.
Stored Cross-Site Scripting in the Ultimate Store Kit Elementor Addons WordPress plugin (versions <= 3.0.5) allows authenticated Contributor-level users to inject persistent malicious scripts into page content rendered for other users, including administrators. The Changed scope (S:C) in the CVSS vector confirms the injected payload executes in victims' browser sessions, enabling session hijacking, credential theft, or admin account takeover via crafted Elementor widget output. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and widespread use of Elementor-based WooCommerce stores make this a meaningful risk for multi-author WordPress deployments.
Unauthenticated broken access control in PeproDev Ultimate Invoice WordPress plugin versions 2.2.6 and below allows remote attackers to bypass authorization checks without any credentials, resulting in limited confidentiality and integrity impact against invoice data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial remote exploitation requiring no authentication or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity lowers the barrier for opportunistic exploitation.
Stored Cross-Site Scripting in LA-Studio Element Kit for Elementor versions up to and including 1.6.2 allows contributor-level WordPress users to inject and persist malicious JavaScript payloads within Elementor elements. When a privileged user such as a site administrator views the affected content, the script executes in their browser session, enabling potential session hijacking or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis, though the contributor-level access bar and scope-change impact make this a meaningful internal threat for multi-author WordPress deployments.
Cross-site scripting in the Nexcess Virtue/Ascend/Pinnacle Toolkit WordPress plugin (versions up to and including 4.9.12) allows authenticated contributors to inject malicious scripts that execute in the browser sessions of higher-privileged users such as administrators. The CVSS vector (PR:L/UI:R/S:C) confirms the attack requires WordPress Contributor-level access and victim interaction, but achieves a scope change - meaning the payload runs in the victim's browser context outside the plugin's own trust boundary. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, though the Patchstack disclosure provides an actionable reference for affected site operators.
Stored Cross-Site Scripting in Fluent Support (WordPress plugin by WPManageNinja) versions up to and including 2.3.0 allows a Contributor-level authenticated attacker to inject persistent malicious JavaScript into support-related content. Because the CVSS vector carries S:C (scope change), the payload executes in the browser context of higher-privileged users - such as administrators - who subsequently view the injected content, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Stored cross-site scripting in JetElements For Elementor (≤2.9.1.1) allows authenticated WordPress Contributors to inject malicious JavaScript into widget fields that later executes in the browsers of higher-privileged users such as Administrators or Editors. The Changed scope in the CVSS vector (S:C) confirms the payload crosses the contributor's own trust boundary, enabling session hijacking, credential theft, or privileged WordPress API actions on behalf of the victim. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Cross-site scripting in the MapSVG WordPress plugin (versions 8.14.0 and earlier) allows authenticated Contributor-level users to inject malicious JavaScript that executes in the browsers of higher-privileged users who view the affected content. The scope change in the CVSS vector confirms the injected script escapes the plugin's context and can compromise the victim's browser session, enabling session hijacking or unauthorized administrative actions. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated IDOR in the Easy Appointments WordPress plugin (versions ≤ 3.12.27) lets remote, unauthenticated attackers manipulate appointment records belonging to other users by substituting predictable object identifiers in plugin endpoints. The CWE-639 root cause - Authorization Bypass Through User-Controlled Key - means ownership checks are entirely absent at the pre-authentication layer, consistent with the 'Authentication Bypass' tag in the Patchstack report. No public exploit code or CISA KEV listing was identified at time of analysis; no public exploit identified at time of analysis.
Broken authentication in Easy Digital Downloads WordPress plugin (versions ≤ 3.6.7) by Sandhills Development LLC allows unauthenticated remote attackers to bypass authentication controls via an alternate path or channel (CWE-288), producing limited integrity and availability impact. The attack requires no credentials or user interaction over the network, earning a CVSS 6.5 Medium score - though Patchstack's 'Information Disclosure' tag introduces a potential confidentiality dimension not reflected in the base CVSS C:N designation, suggesting real impact may be slightly higher than the score implies. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Broken access control in WP ERP plugin (versions 1.17.5 and below) allows subscriber-level WordPress users to access sensitive ERP data they are not authorized to view. The CVSS vector confirms PR:L - a valid authenticated session at the subscriber tier is sufficient - and C:H indicates the exposed data carries high confidentiality value, consistent with ERP payloads such as HR records, financial data, and customer information. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in Masteriyo LMS WordPress plugin versions up to and including 2.3.0 allows authenticated subscriber-level users to inject malicious scripts that execute in the browsers of higher-privileged users such as administrators. The scope change (S:C in CVSS) indicates that a low-privilege attacker can impact users outside their own session, making this a privilege escalation vector in practice - a subscriber could steal admin session cookies or trigger unauthorized actions on behalf of administrators. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
WP EasyPay WordPress plugin versions 4.5.0 and earlier permit any subscriber-level authenticated user to delete arbitrary site content due to a missing authorization check (CWE-862). The plugin fails to enforce capability verification before processing deletion requests, meaning any user holding the lowest standard WordPress role can permanently destroy posts, pages, or other content objects outside their normal permissions. No public exploit has been identified at time of analysis, but the low attack complexity and minimal privilege requirement make this straightforward to abuse on any site where user registration is open.
Unauthenticated broken access control in the Knit Pay WordPress payment plugin (versions <= 9.6.0.0) allows remote, unauthenticated attackers to perform unauthorized actions resulting in limited integrity and availability impact against affected WordPress installations. The CVSS vector (PR:N, AV:N, AC:L, UI:N) confirms no authentication or user interaction is required, lowering the exploitation barrier significantly. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, unauthenticated attack surface warrants prompt remediation on any publicly accessible WordPress deployment running this plugin.
Broken access control in the Autopay dla WooCommerce WordPress plugin (versions <= 2.2.27) permits unauthenticated remote attackers to invoke restricted plugin functionality without authorization. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials and no user interaction against any default-configured WordPress site running the affected plugin. The resulting impact spans limited integrity and availability degradation - consistent with unauthorized manipulation of payment or order-related plugin endpoints - with no public exploit identified at time of analysis and no CISA KEV listing.
Stored Cross-Site Scripting in WishList Member X WordPress plugin (versions 3.32.0 and below) allows authenticated subscribers to inject persistent malicious scripts into content rendered in other users' browsers, including administrators. The CVSS Scope Changed (S:C) designation confirms the attack crosses the trust boundary from the subscriber's session into victims' browsing contexts. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low privilege requirement (subscriber-level account) widens the realistic attacker pool on membership-gated sites.
Stored Cross-Site Scripting in FunnelKit Funnel Builder PRO (WordPress plugin by WiseTR Inc.) versions 3.15.0.4 and earlier allows low-privileged authenticated users - likely customer-tier accounts - to inject malicious JavaScript payloads that execute in other users' browsers upon viewing affected content. The scope-changed CVSS vector (S:C) confirms the injected script breaks out of the vulnerable component's security boundary to affect other browser sessions, enabling session hijacking, credential theft, or unauthorized admin actions. No public exploit code and no CISA KEV listing have been identified at time of analysis, but Patchstack reported this vulnerability and the attack complexity is low.
Contributor-level stored Cross-Site Scripting in the Hubbub Lite WordPress plugin (versions <= 1.36.3) allows an authenticated attacker with Contributor role to inject persistent malicious JavaScript that executes in the browsers of higher-privileged users - including administrators - who subsequently view the affected content. The changed scope in the CVSS vector (S:C) confirms the payload escapes the contributor's own session context and can be used to hijack administrator sessions or perform unauthorized actions on their behalf. No public exploit code or active exploitation has been identified at time of analysis.
Sensitive data exposure in PeproDev Ultimate Invoice (WordPress plugin, versions ≤ 2.2.6) allows unauthenticated remote attackers to access confidential invoice data - including likely customer PII and financial records - without authentication, contingent on some user interaction (CVSS UI:R). The root cause (CWE-201) is the inclusion of sensitive information in plugin-generated output or endpoint responses that lack proper access control. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.