SQL injection in the Tickera - Sell Tickets & Manage Events WordPress plugin (all versions through 3.6.0.1) enables authenticated attackers with staff-level access to append arbitrary SQL clauses via the unescaped `tc_order_status_filter` parameter, exposing the full contents of the WordPress database to read access. The flaw originates in the Better Attendees and Tickets addon, with three vulnerable call sites identified in source at lines 238, 252, and 260 of the addon index. No public exploit code and no CISA KEV listing are present at time of analysis, but the straightforward nature of the injection and the staff-level authentication bar make this a realistic internal threat.
SQL injection in the Registrations For The Events Calendar WordPress plugin (versions up to and including 3.2) enables authenticated Contributors with event-edit access to extract sensitive database content by embedding malicious SQL subqueries within JSON object keys sent to the rtec_records_edit AJAX handler. The root flaw is improper use of esc_sql() - which wraps mysqli_real_escape_string - to sanitize column identifiers in a dynamically constructed UPDATE statement; this escaping function only handles quote and backslash characters, leaving spaces, parentheses, equals signs, and hyphens unescaped, which are precisely the characters needed to break out of the SQL identifier context. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and accessible privilege tier (Contributor) make this a concrete extraction risk on multi-user WordPress sites.
SQL Injection in the AI Copilot - Content Generator WordPress plugin (versions up to and including 1.5.4) exposes WordPress database contents to authenticated attackers with as little as subscriber-level access. The vulnerability resides in the unsanitized `order[0][dir]` parameter passed to an AJAX handler that lacks both input escaping and prepared statements, allowing appended SQL queries to extract sensitive information. No public exploit code or CISA KEV listing is identified at time of analysis, but the nonce exposure mechanism - which emits the required `waic-nonce` in front-end HTML whenever a `[waic_form]` or `[aiwu-form]` shortcode is rendered - lowers the practical exploitation bar for contributor-level users who can publish shortcodes.
Stored Cross-Site Scripting in the Equalize Digital Accessibility Checker WordPress plugin (all versions through 1.46.0) permits authenticated contributors to inject persistent malicious scripts via the 'html' parameter of the plugin's REST API endpoint, which executes in the browser of any subsequent visitor to the affected post. The attack surface is the unguarded `/accessibility-checker/v1/post-scan-results/{id}` endpoint, protected only by the low-privilege `edit_post` WordPress capability, making exploitation trivial for any contributor-level account on multi-author sites. No public exploit has been identified and the plugin is absent from CISA KEV, but the low authentication bar and persistent payload nature elevate real-world risk beyond the medium CVSS score suggests for sites with multiple editors.
Stored Cross-Site Scripting in the Grid/List View for WooCommerce WordPress plugin (versions ≤ 3.0.9) enables authenticated contributors to inject persistent malicious scripts via the unsanitized 'position' shortcode attribute, executing against every visitor who loads an affected page. The plugin's all_page="1" shortcode attribute compounds severity by forcing the widget to render site-wide, meaning a single injected post can target all visitors rather than only those on shop or category pages. No public exploit or CISA KEV listing identified at time of analysis; a patch has been committed to the WordPress plugin repository.
Stored Cross-Site Scripting in the Brands for WooCommerce WordPress plugin (versions through 3.8.8) allows authenticated contributors to permanently embed arbitrary JavaScript into pages via the unsanitized 'style' shortcode attribute, executing in any visitor's browser upon page load. The scope change (S:C) in the CVSS vector confirms cross-boundary impact: the attacker operates at contributor privilege level but the payload compromises site visitors' browser sessions. A plugin trac changeset (revision 3608899) indicates an upstream fix has been committed. No public exploit or CISA KEV listing identified at time of analysis.
Stored cross-site scripting in the Lpagery (Bulk Page Generator) WordPress plugin, versions up to and including 2.5.7, allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript via crafted post titles. The vulnerability stems from the lpagery_add_filter_text_template_post() function echoing a raw post_title directly into an inline JavaScript single-quoted string literal on every admin page load, with no encoding applied. When an administrator accesses an admin page bearing the ?lpagery_template parameter pointing to the attacker's post, the injected payload executes in the admin's browser context, enabling session hijacking or unauthorized privileged actions. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the Webpushr Push Notifications WordPress plugin (versions ≤4.39.0) allows authenticated contributors to permanently inject arbitrary JavaScript into WordPress pages via the notification title and body parameters. The injected payload persists in post meta storage and executes in any victim's browser - including administrators - upon visiting an affected page, enabling session hijacking, credential theft, or privilege escalation to admin-level access. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Stored Cross-Site Scripting in the WP Shortcode by MyThemeShop WordPress plugin (versions up to and including 1.4.17) allows authenticated contributors to permanently embed malicious JavaScript into WordPress pages via the unsanitized 'title' parameter of the [tab] shortcode. The mts_tabs() function in wp-shortcode.php renders this attribute verbatim between HTML anchor tags, causing any visitor who loads an injected page to execute attacker-controlled script in their browser. No active exploitation is confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis; however, the contributor-level access requirement meaningfully lowers the bar on multi-author WordPress deployments.
Stored Cross-Site Scripting in the Header Footer Script Adder WordPress plugin (all versions through 2.1) allows any authenticated user holding author-level access or above to persistently inject arbitrary JavaScript via the 'asm_code' Snippet Meta field. The injected payload executes automatically in the browsers of any user who visits an affected page, enabling session hijacking, credential theft, or malicious redirects across the site's visitor base. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Authorization bypass in AgentGPT through 1.0.0 allows authenticated attackers to hijack other users' agent runs by supplying an arbitrary run_id in the request body, exploiting missing ownership validation in the AgentCRUD.create_task and validate_task_count functions. Successful exploitation enables task history corruption, exhaustion of per-run LLM loop budgets, and financial damage by driving API costs against the victim's account. A public proof-of-concept exists per VulnCheck reporting; no CISA KEV listing is present, and the low CVSS 4.0 score of 2.3 reflects the high attack complexity and constrained integrity/availability impact.
Broken Access Control in the Style Kits WordPress plugin (versions <= 2.6.5) permits authenticated users holding Contributor-level roles to execute privileged actions without proper authorization checks, as classified under CWE-862 (Missing Authorization). Reported by Patchstack and tracked as EUVD-2026-48095, the flaw is remotely exploitable with low attack complexity and no user interaction, exposing partial confidentiality, integrity, and availability of affected WordPress installations. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in Sunshine Photo Cart WordPress plugin (versions <= 3.6.10.1) enables subscriber-level authenticated users to perform actions or access resources beyond their intended permissions. The flaw is classified under CWE-862 (Missing Authorization), meaning the plugin fails to enforce proper authorization checks on certain endpoints accessible to low-privileged accounts. With partial confidentiality, integrity, and availability impact confirmed by the CVSS C:L/I:L/A:L metrics, affected photography business sites with open subscriber registration face meaningful risk of data exposure or unauthorized functional access. No public exploit has been identified at time of analysis.
Authentication bypass in the Premium Packages - Sell Digital Products Securely WordPress plugin (wpdm-premium-packages) through version 7.0.4 allows remote unauthenticated attackers to obtain valid WordPress session cookies for any non-administrator user who owns an order. The root flaw is the `download()` function accepting an attacker-controlled `wpdmppdl` parameter decoded with only base64 and JSON - no HMAC, nonce, or cryptographic signature - and then issuing authentication cookies after a domain check that is entirely attacker-supplied on both sides, making it trivially bypassed. No public exploit has been identified at time of analysis and the vulnerability is not confirmed as actively exploited in CISA KEV.
Path traversal in the CDN for Joomla Pro extension for Joomla allows an attacker to check file paths outside the intended site directory via the versioning feature, exposing whether arbitrary files exist and their modification timestamps. The vulnerability has a local attack vector per its CVSS score of 6.2, indicating exploitation likely requires local access or specific configuration, and no active exploitation or public exploit code has been identified.
Arbitrary constructor injection in React Router's SSR hydration deserializer (deserializeErrors()) affects npm/react-router versions 6.4.0 through 7.17.x when used in Framework Mode or Data Mode with manual SSR/hydration. When application code permits attacker-supplied input to overwrite the __type or __subType fields embedded in server-side serialized error objects, the client-side hydration process can be manipulated into instantiating arbitrary constructors available on the global window object, triggering unintended outbound network requests from the victim's browser. No public exploit code or CISA KEV listing exists at time of analysis; a vendor-released patch is available in version 7.18.0.
Cross-site scripting in React Router's unstable RSC (React Server Components) error handling path allows network-based attackers to execute arbitrary JavaScript in a victim's browser via attacker-controlled redirect targets. Affected are React Router npm versions 7.11.0 through 7.17.x when the unstable RSC APIs are explicitly enabled; the vulnerability arises because the RSCErrorHandler component failed to validate the protocol of redirect URLs before assigning them to window.location.href or injecting them into a meta http-equiv='refresh' tag. This is a follow-up to GHSA-8646-j5j9-6r62, indicating the prior fix left a residual code path unvalidated. No public exploit code or CISA KEV listing is identified at time of analysis.
Cross-site scripting in the Keyboard Shortcuts extension for Joomla (versions 1.0.0-3.2.5) by Regular Labs allows injection of arbitrary JavaScript via the shortcut configuration interface, executing in the browser context of any user who subsequently triggers the affected shortcut. The Changed Scope (S:C) in the CVSS vector confirms script execution crosses into the victim's session context, enabling session hijacking, credential theft, or unauthorized site actions. No public exploit identified at time of analysis; EPSS at 0.21% (11th percentile) and SSVC exploitation status of 'none' both indicate low-probability opportunistic targeting.
HTML injection in JetBrains IntelliJ IDEA before version 2026.2 enables silent user activity tracking through maliciously crafted IDE notifications. A remote attacker who can influence notification content - such as through a malicious plugin, crafted project file, or server response reflected as a notification - can inject arbitrary HTML payloads that silently load remote resources, beaconing user activity without any visible indication to the developer. No public exploit has been identified at time of analysis, and the CVSS 4.3 Medium score reflects a limited confidentiality-only impact with no integrity or availability consequence.
OS command injection in localstack serverless-localstack up to version 1.4.0 allows a local low-privileged attacker to execute arbitrary operating system commands by manipulating the `custom.localstack.docker.compose_file` configuration argument processed by the Configuration Handler in `src/index.js`. A publicly available proof-of-concept exploit exists via GitHub issue #303, elevating practical risk beyond the moderate CVSS 4.0 base score of 4.8. No vendor patch has been released, as the project maintainer has not responded to the responsible disclosure reported through an issue report.
Stored Cross-Site Scripting in the WPShopmart Tabs WordPress plugin (versions 2.5 and below) allows an authenticated Shop Manager to inject persistent malicious JavaScript into tab content fields, which then executes in the browsers of any user who visits the affected page - including administrators. The scope change (S:C in the CVSS vector) confirms the payload crosses trust boundaries from the attacker's session into victims' browser contexts. No public exploit code and no CISA KEV listing have been identified at time of analysis, limiting immediate urgency, though the high-privilege requirement provides meaningful friction against opportunistic exploitation.
Stored Cross-Site Scripting in the Machete WordPress plugin (versions <= 5.2) allows authenticated users with Author-level privileges to inject malicious scripts into content that executes in victims' browsers when viewed. The vulnerability is classified as CWE-79 and carries a CVSS 5.9 score reflecting the scope change (S:C) typical of stored XSS, where payload execution occurs in a separate security context from where it was injected. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the attack vector is network-accessible with low complexity once attacker-controlled credentials are obtained.
Stored Cross-Site Scripting in the Custom Links in Elementor Image Carousel WordPress plugin (versions <= 1.1.1) enables authenticated attackers holding at least Author-level privileges to inject arbitrary JavaScript into carousel image link fields. The injected payload executes in any visitor's browser when they load a page containing the affected Elementor widget, crossing a scope boundary into the victim's session. No public exploit is identified at time of analysis, and the plugin's niche footprint limits widespread impact despite the network-accessible attack vector.
Cross-site scripting in the HashThemes Demo Importer WordPress plugin (versions up to and including 1.4.2) allows a high-privileged attacker to inject malicious scripts into author-related fields that execute in other users' browsers when the affected content is viewed. The vulnerability carries a scope change (S:C), meaning a compromised author context can impact administrative sessions, potentially enabling session hijacking or unauthorized actions on behalf of a victim admin. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Cross-site scripting in the Photo Gallery by Supsystic WordPress plugin (versions ≤ 1.16.3) allows a high-privileged administrator to inject malicious scripts that execute in the browser context of other users visiting affected gallery pages. The CVSS scope-changed flag (S:C) indicates the injected payload escapes the administrative context and impacts the browsers of non-admin visitors or editors. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS signal was not provided in source data.
Cross-site scripting in WP-Polls WordPress plugin versions 2.77.3 and earlier allows authenticated administrators to inject persistent malicious JavaScript into poll configurations, which then executes in the browsers of site visitors who encounter the affected polls. The vulnerability requires administrator-level access to trigger, but the scope change (S:C in CVSS) means the impact crosses from the privileged admin context into the front-end visitor context, enabling session hijacking or content manipulation against unprivileged users. No public exploit code and no CISA KEV listing have been identified at time of analysis.
JetBrains GoLand before version 2026.2 writes sensitive configuration values to log files by default, exposing credentials and secrets to anyone with read access to IDE log output. The CWE-532 flaw affects Go developers whose project configurations contain API keys, VCS credentials, or cloud tokens - values the IDE silently captures in plaintext log entries during normal use. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept exists; the low CVSS score of 3.5 reflects the limited impact and the requirement for low privilege and user interaction.
Improper input validation in facil.io's WebSocket Frame Parser (versions up to 0.7.4) allows remote unauthenticated attackers to send crafted WebSocket frames that trigger a flaw in the `websocket_on_protocol_error` function, yielding limited confidentiality, integrity, and availability impact. A proof-of-concept exploit has been publicly published, lowering the technical barrier for exploitation. The project maintainer was notified via GitHub issue but has not responded, leaving the vulnerability unpatched at time of analysis.
Credential extraction in OpenStack Ironic Python Agent (IPA) allows a tenant with bootc deploy_interface access to steal operator-level OCI registry pull secrets by exploiting a Linux PID namespace escape. Affected deployments running IPA >=10.2.0 <10.2.3, >=11.0.0 <11.2.1, or >=11.3.0 <11.5.1 are at risk when the bootc deploy_interface is enabled and operator-side registry credentials are configured. The attack violates the tenant-to-operator trust boundary by reading host authentication material through /proc/1/root inside a privileged container, with no public exploit identified at time of analysis.
Stored/reflected cross-site scripting in Progress MOVEit Transfer (versions before 2025.1.5, and the 2026 branch from 2026.0.0 before 2026.0.3) allows an authenticated low-privilege user to inject script that executes in another user's browser session when the victim views the crafted content. Because MOVEit Transfer is an internet-facing managed file transfer platform, successful exploitation can hijack privileged sessions and manipulate transferred data. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Cross-site request forgery in the Cache Cleaner extension for Joomla allows an authenticated administrator with cache-management permission to be tricked into performing unauthorized URL purges due to inconsistent token validation. Affected versions 1.0.0 through 9.7.6 may experience limited confidentiality and integrity compromise. No public exploit or active exploitation has been identified, and the EPSS score is low (0.13%).
Cross-Site Request Forgery in WP Activity Log (WordPress plugin by Melapress, versions ≤ 5.6.4) enables unauthenticated remote attackers to perform unauthorized state-changing actions against the plugin by tricking an authenticated administrator into visiting a crafted page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) confirms network-reachable exploitation with no attacker privileges required, resulting in limited integrity and availability impact - notably, an attacker could forge requests to disable or clear activity logs, undermining the plugin's core security audit function. No public exploit or active exploitation has been identified at time of analysis.
GutenKit Blocks for WordPress exposes a site's stored Mailchimp API key and full audience configuration to any unauthenticated HTTP caller via two REST API endpoints registered without authorization checks in versions up to and including 2.4.12. Both /wp-json/gutenkit/v1/mailchimp/get/lists and /wp-json/gutenkit/v1/mailchimp/get/interests use permission_callback => '__return_true', stripping all access control and returning Mailchimp audience IDs, merge fields, interest categories, and subscriber counts alongside the raw API key. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but exploitation requires only a single unauthenticated HTTP GET request, making mass automated scanning trivially feasible on any site with the Mailchimp integration configured.
Broken access control in the Reviewer WordPress plugin (versions ≤ 3.14.2) allows subscriber-level authenticated users to perform actions beyond their intended authorization scope, resulting in limited integrity and availability impact on affected installations. Reported by Patchstack and tracked under EUVD-2026-48090, the flaw stems from missing authorization checks (CWE-862) on one or more plugin endpoints. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Broken Access Control in the ListingPro WordPress plugin (versions up to and including 2.9.10) allows authenticated subscriber-level users to perform actions or access resources restricted to higher-privileged roles. The CVSS vector (PR:L/AV:N/AC:L) confirms network-reachable exploitation by any user holding a low-privilege WordPress account, with partial confidentiality and integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this in the category of a real but moderately constrained risk.
Cross-Site Request Forgery in GiveWP WordPress donation plugin versions up to and including 4.16.3 enables unauthenticated remote attackers to forge requests on behalf of authenticated administrators, resulting in limited integrity and availability impact on the affected installation. The CVSS vector (PR:N/UI:R) confirms the attacker requires no server-side credentials but must social-engineer a logged-in victim into triggering the forged request. No active exploitation is confirmed - this CVE is absent from the CISA KEV catalog and no public exploit code has been identified at time of analysis.
Insecure Direct Object Reference in the Masteriyo LMS WordPress plugin (versions ≤ 2.3.1) allows authenticated subscriber-level users to bypass object-level authorization checks, enabling unauthorized manipulation of LMS objects such as courses, enrollments, or student records beyond their permitted scope. Reported by Patchstack and catalogued as EUVD-2026-48075, the flaw requires only the lowest registered WordPress user role to exploit. No public exploit code or CISA KEV listing exists at time of analysis, placing this in the category of a credible but not actively-weaponized medium-severity risk.
Cross-Site Request Forgery in Simple Link Directory Pro WordPress plugin (≤15.0.8) enables a remote unauthenticated attacker to execute unauthorized state-changing actions on a victim's WordPress installation by tricking an authenticated administrator into clicking a crafted malicious link. The CVSS vector (PR:N/UI:R) confirms the attacker requires no credentials of their own, but must socially engineer an authenticated administrator to trigger the forged request. No public exploit code or active exploitation has been identified at time of analysis, and CVSS impact signals are limited to low integrity and availability degradation with no confidentiality loss.
Broken access control in the uListing WordPress plugin (versions <= 2.2.0) by Stylemix permits subscriber-level authenticated users to invoke plugin functionality reserved for higher-privileged roles. The root cause (CWE-862, Missing Authorization) means the plugin does not enforce role checks before executing sensitive operations, allowing low-privilege accounts to impact integrity and availability of listing data. No public exploit code or active exploitation has been identified at the time of analysis.
Broken access control in the eRoom WordPress plugin (versions ≤ 1.7.1) allows subscriber-level authenticated users to perform privileged actions beyond their intended scope, resulting in limited integrity and availability impact. Reported by Patchstack against CPE cpe:2.3:a:digitalme:eroom, the flaw stems from missing authorization checks (CWE-862) on one or more plugin endpoints accessible to the lowest default WordPress user role. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Path-based access control in @fastify/static is defeated by non-canonical URL paths, allowing unauthenticated attackers to retrieve files that the allowedPath callback was configured to deny. Affected are all versions through 10.1.1 of the plugin for the Fastify Node.js framework. Because the allowedPath callback receives the raw, un-normalized pathname - before dot segments and duplicate separators are resolved - an attacker can craft equivalent paths (e.g., using './' sequences or '//' separators) that bypass the callback's deny logic while the underlying file resolver still serves the intended file. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed.
Grafana OSS exposes an unauthenticated or low-privilege denial-of-service path through its alertmanager templates test endpoint, which executes Go templates with no memory limits. Mass-execution of requests to `/api/alertmanager/grafana/config/api/v1/templates/test` in a short window exhausts heap memory, crashing the Grafana process entirely. No public exploit has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, but the anonymous-access exploitation path and low privilege bar make this a realistic availability risk for internet-exposed Grafana instances.
Red Hat Certificate System (RHCS) 9 is susceptible to a resource exhaustion denial-of-service condition triggered by unauthenticated remote attackers flooding its TLS-exposed HTTP endpoint. Repeated requests cause the underlying Java process to exhaust available heap memory, resulting in an Out of Memory crash that takes the certificate authority service offline. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and absence of authentication requirements make this a realistic threat to any internet- or intranet-exposed RHCS deployment.
Unauthenticated sensitive data exposure in the Complianz WordPress plugin (versions up to and including 7.5.0) allows any remote, unauthenticated attacker to retrieve sensitive information from affected WordPress installations. Classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), the flaw is particularly notable because Complianz handles GDPR and cookie consent compliance data - meaning exposed information may carry regulatory implications beyond what the CVSS score alone conveys. No public exploit has been identified at time of analysis, and the vulnerability has not been listed in CISA KEV.
Out-of-bounds heap read in gdk-pixbuf's ICO parser exposes heap memory content through rendered image output, affecting Red Hat Enterprise Linux 6 through 10. When processing a crafted ICO file whose pixel indices exceed the defined palette size, the library reads beyond the palette array boundary - heap bytes are treated as palette entries and rendered as RGB pixel values in the output image, enabling an attacker to extract heap content by analyzing the rendered result. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but server-side image processing pipelines that return rendered output to untrusted callers represent a realistic exposure path.
HTTP request smuggling in SwiftNIO HTTP/2 allows unauthenticated remote attackers to inject headers or split responses via crafted HTTP/2 HEADERS frames that pass control characters through the HTTP/2-to-HTTP/1.1 codec. The vulnerability, caused by missing CR/LF/NUL/SP validation in regular header values and pseudo-headers, can be exploited when outbound validation is disabled or headers are forwarded without rechecking. Fixed in version 1.45.0; no public exploit identified at time of analysis and EPSS score is 0.14% (low).
Unauthenticated webhook injection in APIFold corrupts trusted MCP server state by allowing any network client to POST arbitrary JSON payloads to the `/webhooks/:serverSlug/:eventName` endpoint, which are stored in Redis and the `webhook_events` PostgreSQL table without any signature check. All deployments prior to commit 7f19b52280f414f57af2b79a95333d1c8fbeece5 are affected; the flaw is architectural rather than misconfiguration-dependent, as signature validation was never wired into the webhook router. No public exploit code has been identified at time of analysis and CISA KEV listing is absent, but the attack requires only a valid server slug, making exploitation straightforward for targeted actors.
Broken Access Control in the Graphina Elementor Charts and Graphs WordPress plugin (versions up to and including 3.1.12) allows unauthenticated remote attackers to access restricted functionality or data without proper authorization. The flaw stems from missing authorization checks (CWE-862), meaning certain plugin endpoints or AJAX actions fail to verify whether the requesting user holds the necessary permissions before serving a response. Impact is limited to partial confidentiality loss with no integrity or availability consequence. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in the Civi Framework WordPress plugin (versions <= 2.2.0) allows unauthenticated remote attackers to bypass authorization checks and perform restricted actions, resulting in unauthorized integrity impact against the host WordPress site. Reported by Patchstack, this is a CWE-862 (Missing Authorization) flaw where protected endpoints fail to validate whether the requesting party has the necessary permissions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated sensitive data exposure in WP Social Ninja WordPress plugin versions 4.3.0 and earlier allows remote attackers to access sensitive information without any credentials or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial network-level exploitation with no barriers to access, though impact is bounded to low-severity confidentiality loss. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.