Null byte injection in the free5GC Authentication Server Function (AUSF) v4.2.1 and earlier allows unauthenticated remote attackers to crash Go's URL parser and force HTTP 500 responses on the authentication endpoint, denying authentication service to all legitimate 5G subscribers sharing that AUSF instance. A publicly available Python PoC is included in the vendor's own security advisory, and fuzzing demonstrated a 4.1% trigger rate across nearly 100,000 requests - confirming reliable, scalable exploitation against the default deployment with no special configuration required. No public exploit or CISA KEV listing is confirmed at time of analysis, but the trivially automatable nature of the attack makes it a material risk for 5G core operators.
User enumeration and profile disclosure in WPGraphQL 2.x through 2.14.1 completely undermines the plugin's own anti-enumeration design via a deprecated GraphQL field that was never removed. An unauthenticated attacker can invoke the `sendPasswordResetEmail` mutation and include the deprecated `user` sub-field: a null response indicates the email or username does not exist, while a populated User object confirms existence and additionally leaks databaseId, full name, slug, bio, and profile URI for author-class users. A detailed proof-of-concept GraphQL mutation is published in advisory GHSA-jhh7-832h-f8hv, and no rate limiting exists at the WPGraphQL layer. No active exploitation has been confirmed by CISA KEV, though the barrier to exploitation is trivially low.
Stored XSS in the Lightbox with PhotoSwipe WordPress plugin before 5.9.0 allows author-level users (lacking unfiltered_html) to inject arbitrary JavaScript into image lightbox captions via an unsanitized link data attribute. The payload executes in the browser of any visitor or administrator who opens the affected lightbox, enabling session hijacking or privilege escalation against site administrators. A publicly available exploit documents the technique; no active exploitation is confirmed via CISA KEV, though the author-level entry bar is low on sites with multiple contributors.
SQL injection in the Check & Log Email WordPress plugin (all versions before 2.0.15) allows authenticated WordPress administrators to execute arbitrary SQL queries against the underlying database via unsanitized parameters. With PR:H per the CVSS vector, exploitation is constrained to admin-level accounts, making the primary threat a rogue insider or a follow-on attack after admin credential compromise. A public proof-of-concept is available through WPScan; however, EPSS at 0.16% (6th percentile) and absence from CISA KEV indicate no confirmed widespread exploitation campaign at time of analysis.
Server-Side Request Forgery in xxl-job v3.4.0's job trigger endpoint enables authenticated low-privilege users to weaponize the admin server as a proxy to scan and probe internal network resources. The CVSS vector (PR:L, C:H) confirms that any credentialed xxl-job-admin user can exfiltrate data from internal services reachable by the server, including cloud metadata endpoints and private APIs. A public proof-of-concept exploit exists on GitHub; however, EPSS at 0.16% (6th percentile) indicates minimal observed exploitation activity, and no CISA KEV listing has been issued.
User email enumeration in the JS Help Desk WordPress plugin (versions before 3.1.4) allows any Contributor-level site user to harvest the email addresses of all registered WordPress users. Two design flaws compound: the plugin unconditionally grants a support-agent capability to the built-in Contributor role at activation time, and the user-listing handler omits any capability check entirely, making the Contributor elevation the effective attack precondition. A public proof-of-concept is documented by WPScan; however, EPSS places exploitation probability at 0.14% (4th percentile), indicating no public exploit is currently being run at scale. No CISA KEV listing is present.
JS Help Desk WordPress plugin before 3.1.4 exposes all support ticket content to any authenticated WordPress user due to missing authorization and ownership checks in its search handler. Any account at Subscriber level or above can enumerate and read the subject and full message body of every other user's support ticket by interacting with the plugin's nonce-gated AJAX endpoint, bypassing the intended per-user data isolation. A publicly available proof-of-concept exploit exists per WPScan; EPSS is low at 0.14% (4th percentile), suggesting opportunistic rather than widespread automated exploitation, but the low authentication bar makes this a meaningful data exposure risk on multi-user WordPress sites.
Unauthenticated mailing list subscription abuse in the Mailgun for WordPress plugin before 2.2.1 allows any remote attacker to enroll arbitrary email addresses into the site owner's Mailgun mailing lists by exploiting an unprotected AJAX endpoint. The plugin's stored API credentials are silently invoked on the attacker's behalf, effectively weaponizing the site owner's Mailgun account against third-party email addresses. A public exploit is available via WPScan, though the EPSS score of 0.14% (4th percentile) and absence from CISA KEV indicate limited observed exploitation to date.
Insecure Direct Object Reference (IDOR) in JS Help Desk WordPress plugin before 3.1.5 exposes support ticket data to any low-privileged authenticated user who supplies an arbitrary ticket ID. The plugin performs no ownership check when loading ticket contents, meaning a registered user can enumerate ticket IDs and read PII, message bodies, and reporter identity belonging to other users. A publicly available proof-of-concept exists per WPScan; no confirmed active exploitation (CISA KEV) has been identified, and EPSS remains very low at 0.13%.
Arbitrary local file read in gemini-bridge (versions 1.0.0-1.3.0) exposes any file accessible to the server process - SSH keys, cloud credentials, `.env` files, source code - through the `consult_gemini_with_files` tool when operating in inline mode. Compounding the local disclosure, file contents are simultaneously exfiltrated to Google's infrastructure via the Gemini CLI round-trip, extending blast radius beyond the local host. No public exploit identified at time of analysis, but the CVSS vector (AV:L/AC:L/PR:N/UI:N) indicates trivially low exploitation complexity, and the GHSA advisory explicitly calls out prompt-injection as a realistic delivery vector for AI agent pipelines. Vendor-released patch available in version 1.3.1.
Stored XSS in the NewStatPress WordPress plugin (all versions before 1.4.5) allows unauthenticated remote attackers to inject persistent malicious scripts by supplying crafted HTTP request data that the plugin logs without sanitization and later renders in its statistics widgets. Any authenticated user - including administrators - who views the affected widget triggers the stored payload in their browser, enabling session hijacking, credential theft, or unauthorized administrative actions. A public exploit exists via WPScan, though EPSS at 0.17% (7th percentile) indicates exploitation has not yet become widespread.
Stored XSS in WP Photo Album Plus (all versions up to 9.2.03.001) allows unauthenticated remote attackers to inject persistent malicious scripts into photo comments by exploiting a decode-after-sanitize flaw in the plugin's comment pipeline. The sanitization sequence in `wppa-functions.php` applies `wp_kses` then `wp_strip_all_tags()` on write, but neither function decodes HTML entities before inspecting markup - a double-encoded payload such as `<script>` passes both filters as harmless text, is stored one entity-decode level down, and renders as executable HTML when a victim's browser processes the page. A public proof-of-concept is available via WPScan; however, the vulnerability is not in CISA KEV and EPSS sits at 0.15% (5th percentile), indicating no observed mass exploitation at time of analysis.
Reflected cross-site scripting in the Ultimate Addons for WPBakery Page Builder WordPress plugin (all versions before 3.21.5) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted URL processed by the plugin's shared link-rendering function, uavc_link_init(). A publicly available proof-of-concept exploit was reported by WPScan, though EPSS places exploitation probability at just 0.15% (5th percentile), suggesting opportunistic rather than widespread active exploitation. No CISA KEV listing was identified at the time of analysis.
Stored click-XSS in Jodit WYSIWYG editor (all versions through 4.12.30) allows a low-privileged content author to persist obfuscated `javascript:` hrefs that bypass the editor's sanitizer and execute attacker-controlled JavaScript in the victim's browser on click. The bypass exists because `sanitizeHTMLElement` uses a case-sensitive `href.trim().indexOf('javascript') === 0` check—without lowercasing or stripping control bytes—while every other URL attribute already routes through the stricter `isDangerousUrl()` normalizer. No public exploit is listed in CISA KEV, but a working proof-of-concept is confirmed in the GitHub Security Advisory (GHSA-j839-gqq4-gf9j) against the shipped 4.12.30 build.
Insecure Direct Object Reference (IDOR) in the wpForo Forum WordPress plugin before 3.1.2 allows any subscriber-level authenticated user to permanently delete the AI chat message history of arbitrary other users by submitting deletion requests without ownership verification. The plugin's AI chat message deletion endpoint does not validate that the targeted conversation belongs to the requesting user, enabling low-privilege account holders to cause irreversible data loss across the platform. A publicly available proof-of-concept exists per WPScan reporting; however, EPSS is extremely low at 0.13% (3rd percentile) and the vulnerability has not been added to the CISA KEV catalog, indicating limited observed exploitation.
Broken object-level authorization (IDOR) in the BuddyPress WordPress plugin, all versions before 14.5.0, permits any authenticated user at the Subscriber level or above to read, modify, or delete private messages belonging to other users via the plugin's messaging endpoints. A publicly available proof-of-concept exists per WPScan reporting, though EPSS data places exploitation probability at just 0.13% (3rd percentile) and SSVC classification marks it as not automatable, indicating exploitation is currently opportunistic and targeted rather than widespread. No CISA KEV listing is present, but the low privilege bar combined with network accessibility makes this a meaningful privacy and integrity risk on any community-facing or multi-tenant WordPress deployment running BuddyPress.
Panic-triggered remote denial of service in pion/stun (Go STUN library) versions through 3.1.4 (v3), 2.0.0 (v2), and 1.23.1 (v1) allows an unauthenticated network attacker to crash any application embedding this library by sending a single malformed STUN or ICE Binding-response packet containing a zero-length XOR-MAPPED-ADDRESS attribute. The root cause is a misplaced bounds check in XORMappedAddress.GetFromAs that attempts to index into the value slice before validating minimum length, causing an unrecovered Go runtime panic that terminates the process. No public exploit identified at time of analysis, though the patch PR and test case publicly detail the exact malformed packet structure.
Stored and DOM cross-site scripting in the Jodit WYSIWYG editor (npm, all versions before 4.13.6) allows attacker-supplied JavaScript to survive the clean-html sanitizer by exploiting a case-sensitivity flaw in the deny/allow tag filter. SVG- and MathML-namespaced elements return lowercase nodeName values, while the denyTags hash is keyed by uppercase strings, so a `<script>` nested inside `<svg>` reports 'script' instead of 'SCRIPT' and passes the filter unblocked. A publicly disclosed proof-of-concept exists; the vulnerability is not listed in CISA KEV.
GiveWP WordPress donation plugin before version 4.16.3 allows unauthenticated users to route donations through payment gateways the administrator has explicitly disabled, by supplying a gateway identifier via request input that the plugin fails to validate against the admin-configured allowlist. Rooted in CWE-862 (Missing Authorization), this bypasses financial controls that site operators may have disabled for compliance, fraud prevention, or contractual reasons - making the practical business risk higher than the CVSS Medium score suggests. A publicly available proof-of-concept exists via WPScan; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Unauthenticated data overwrite in the Events Made Easy WordPress plugin (all versions before 3.1.4) allows any remote, unauthenticated attacker to overwrite personal data stored in any person record by exploiting a missing authorization check on data-change endpoints. The plugin's nonce mechanism is public and shared, providing no per-record token or ownership binding, making it trivially bypassable under CWE-639. A publicly available exploit exists per WPScan research; no active exploitation has been confirmed in CISA KEV at time of analysis.
Post-login redirect validation in GeoNetwork's OAuth2/OIDC and Keycloak SSO authentication filters can be bypassed to redirect authenticated users to attacker-controlled external sites, enabling phishing attacks. Versions 3.12.0 through 4.2.15 and 4.4.0 through 4.4.10 are affected across both supported and archived release lines. The bypass exploits the filter's failure to reject protocol-relative URLs (e.g., //evil.example.com) that Java treats as relative paths but browsers resolve as absolute external destinations; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
HTTP security header spoofing in CodeIgniter4 prior to 4.7.4 allows remote unauthenticated attackers to trick the framework into treating plain HTTP requests as HTTPS by injecting forged X-Forwarded-Proto or Front-End-Https headers. The root cause is that IncomingRequest::isSecure() unconditionally trusted these headers from any source rather than restricting trust to configured trusted proxies, undermining isSecure(), force_https(), and forceGlobalSecureRequests enforcement logic. No public exploit or CISA KEV listing exists; real-world impact is conditioned on deployment topology and CVSS AC:H reflects this complexity.
Broken Object Level Authorization in the Academy LMS WordPress plugin through 3.8.2 exposes every user's quiz attempt records - including IP addresses, full names, registration dates, and quiz results - to any authenticated subscriber-level user who is enrolled in at least one course. The flaw stems from missing ownership checks on quiz attempt record retrieval endpoints (CWE-639), enabling horizontal privilege escalation across the entire site's student population. A publicly available proof-of-concept exists per WPScan; exploitation probability remains low (EPSS 0.13%, 3rd percentile) with no confirmed active exploitation in CISA KEV.
Broken authorization in the JS Help Desk WordPress plugin (versions prior to 3.1.4) allows any authenticated user at Subscriber level or above to overwrite the content of any support-ticket reply site-wide, regardless of ownership. The plugin's reply-update endpoint fails to validate that the requesting user owns the targeted reply, enabling unauthorized content manipulation across all tickets. A publicly available proof-of-concept exploit exists; no active exploitation has been confirmed in CISA KEV at time of analysis.
Insecure Direct Object Reference in the Paid Membership Subscriptions WordPress plugin (before 3.0.7) allows any authenticated subscriber-level user to enumerate and retrieve payment records belonging to other members. The AJAX handler responsible for payment data retrieval performs neither a WordPress capability check nor a nonce validation, meaning horizontal privilege escalation requires only a valid low-privilege account on the target site. A publicly available proof-of-concept exists per WPScan, though no CISA KEV listing confirms active widespread exploitation at time of analysis.
Remote unauthenticated access to an undocumented HTTP endpoint in ANDRITZ HIPASE-250 (formerly 250 SCALA) allows attackers to silently modify the system's audit logging level and destination without credentials. Rooted in CWE-306 (Missing Authentication for Critical Function), this flaw is particularly dangerous in industrial control system contexts where log integrity underpins incident detection and forensic capability - suppressing logs is a classic defense-evasion precursor enabling follow-on attacks to go unrecorded. No active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis, but the trivial attack complexity (AV:N/AC:L/PR:N/UI:N) means any attacker with network reachability can exploit this without tooling.
Credential exfiltration in AWS Strands Agents Tools before 0.8.2 exposes HTTP_REQUEST_TOKEN_CONFIG bearer tokens to attacker-controlled proxy infrastructure by exploiting the LLM's ability to set proxy parameters within the http_request tool's input schema. The root cause (CWE-863: Incorrect Authorization) is that proxy configuration was included as an LLM-controllable field, enabling prompt injection attacks to redirect credentialed HTTP requests through adversary infrastructure. No public exploit code or CISA KEV listing has been identified at time of analysis; however, any deployment combining token-authenticated HTTP requests with externally influenced agent inputs is at material risk.
Authentication bypass in pgAdmin 4 SERVER mode exposes multiple routes to unauthenticated network access due to missing @pga_login_required decorators, a defect class previously identified in CVE-2026-12046 but incompletely remediated. Unauthenticated remote clients can enumerate table constraint metadata, delete table constraints (a state-mutating operation), read all CLI-settable preference values, and force-close active debugger or schema-diff sessions belonging to other authenticated users. The CVSS 4.0 vector (PR:N, AV:N, AC:L) confirms no authentication or special conditions are required in SERVER mode deployments; no public exploit or CISA KEV listing has been identified at time of analysis.
Cross-site request forgery in multiple PHP Jabbers commercial PHP scripts allows a network-based attacker to trigger unauthorized administrative actions - including creating new admin accounts - by tricking an authenticated administrator into visiting a malicious page. The root cause is the complete absence of CSRF tokens and missing SameSite cookie attributes in state-changing requests, meaning the browser silently attaches session cookies to forged cross-origin requests. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, successful exploitation grants persistent backdoor access via rogue admin accounts.
Denial of service in the Advantech ECU-1251D industrial communication gateway allows a network-adjacent, high-privilege attacker to send a crafted DNP3 signal to the device's Digital Output address, forcing the DNP3Daemon into an indefinite restart loop and severing SCADA TelWin operator connectivity until a manual restart is performed. The device remains partially reachable via its web panel during the loop, which may create a false impression of operational continuity while SCADA control is lost. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; the disclosure source is Singapore's Cyber Security Agency (CSA).
Stored or reflected cross-site scripting in Johnson Controls FM Systems Employee (versions before 2025.3.1) allows a high-privileged authenticated attacker to inject script-related HTML tags into web pages that are subsequently rendered in other users' browsers. The attack requires passive user interaction from a victim and yields low-confidentiality impact, consistent with session token or cookie theft scoped to the vulnerable application. No public exploit code and no CISA KEV listing have been identified at time of analysis; CVSS 4.0 score of 4.8 reflects the constrained, privilege-gated nature of the vulnerability.
Stored cross-site scripting in Johnson Controls FM Systems Employee (versions before 2025.3.1) enables a high-privileged authenticated attacker to inject persistent malicious scripts into the application that execute in victims' browsers when they view the affected content. The CVSS 4.0 vector (PR:H/UI:P) confirms exploitation requires an administrative-level account for payload injection and passive user interaction from a second victim. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Unrestricted file upload in Johnson Controls FM Systems Employee (versions before 2025.3.1) allows a high-privileged authenticated user to upload files of dangerous types, enabling potential stored cross-site scripting or server-side file execution. The CVSS 4.0 vector (PR:H/UI:P) indicates exploitation requires an authenticated administrator or similarly privileged account plus passive victim interaction, substantially constraining real-world risk. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cleartext storage of sensitive information in Johnson Controls XAAP Application on Android (versions before 1.53) exposes sensitive data to retrieval by attackers who already have access to a jailbroken or otherwise compromised device. The flaw stems from insufficient data-at-rest protection (CWE-312), meaning credentials, tokens, or configuration data are stored without encryption in the app's local storage. No public exploit code exists and this vulnerability is not listed in CISA KEV; real-world risk is constrained by the requirement for prior device compromise.
Unbounded memory consumption in Google mcp-toolbox versions through 1.4.0 allows unauthenticated remote attackers to crash the service via a single oversized HTTP request. The /mcp endpoint's toolInvokeHandler uses Go's io.ReadAll without any body-size guard - no http.MaxBytesReader, no Content-Length pre-check - so a sufficiently large POST body linearly exhausts host RAM until the OS OOM killer terminates the process. No active exploitation is confirmed (CVSS 4.0 E:U), but the attack requires no authentication and trivial complexity, making any internet-exposed deployment an easy target for denial of service.
Keycloak's OIDC token introspection endpoint incorrectly discloses the full set of JWT claims to confidential clients inspecting tokens that were not issued for them. Any confidential client configured to receive signed JWT introspection responses can submit a foreign token, receive an 'inactive' status confirmation, and simultaneously receive the complete signed JWT payload containing sensitive user attributes and claims - effectively bypassing the audience isolation that OIDC introspection is designed to enforce. No active exploitation has been confirmed (not listed in CISA KEV), and no public proof-of-concept code has been identified at time of analysis, but the low attack complexity and network accessibility via a standard API endpoint make this a meaningful confidentiality risk in multi-tenant or multi-client Keycloak deployments.
Incorrect authorization in Keycloak's group policy evaluation allows a low-privileged authenticated user to bypass group membership checks and gain unauthorized access to administrative functions or protected resources. The root cause is a string prefix comparison used to verify child-group membership under an 'extend to child groups' policy: a user in a group whose name shares a leading prefix with a privileged group (e.g., '/admins-external' matching a policy scoped to '/admins') is incorrectly treated as a legitimate child-group member. The CVSS vector (PR:L, I:H) confirms this is an authenticated integrity-bypass with high impact. No public exploit code and no CISA KEV listing have been identified at time of analysis.
IP spoofing via X-Forwarded-For header manipulation in Ghost CLI before 1.30.1 enables unauthenticated remote attackers to defeat rate-limiting controls on self-hosted Ghost instances. The vulnerability arises when Nginx is configured with the $proxy_add_x_forwarded_for directive, which appends attacker-supplied IP values to the header chain, causing Ghost's rate-limiter to treat each crafted request as originating from a distinct, unseen IP address. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the low attack complexity makes this straightforward to abuse once a vulnerable instance is identified.
Stored cross-site scripting in AWS Ops Wheel's participant URL handling allows an authenticated user to inject persistent malicious JavaScript via a crafted participant_url containing a dangerous URI scheme (e.g., javascript:). When a higher-privileged user - most critically an administrator - views the affected participant entry, the payload executes in their browser, enabling session token theft and full administrative takeover of the deployed instance. No public exploit or active exploitation has been identified at time of analysis; remediation requires redeployment from the latest source incorporating PR #168.
Reflected cross-site scripting in the FS Inc S3150-8T2F Switch web management interface allows remote unauthenticated attackers to execute arbitrary JavaScript in an authenticated administrator's browser by tricking them into clicking a crafted URL targeting the /logo.asp endpoint. The vulnerability carries a CVSS 6.1 score with changed scope, enabling session hijacking, credential theft, or unauthorized device reconfiguration through the victim's browser session. No public exploit code has been confirmed and EPSS sits at 0.14% (4th percentile), indicating negligible observed exploitation probability at time of analysis.
Authorization bypass in Google mcp-toolbox's bigquery-execute-sql tool (versions 0.16.1-1.4.0) allows authenticated low-privileged users to exfiltrate DDL schemas from explicitly restricted datasets and query federated external data via EXTERNAL_QUERY connections. The fail-open logic flaw stems from the tool treating an empty tableIDSet returned by the BigQuery dry-run API - which occurs for INFORMATION_SCHEMA and EXTERNAL_QUERY constructs - as a signal to skip allowedDatasets enforcement entirely. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the bypass mechanism is straightforward for any authenticated toolbox user.
HTTP request smuggling in cPanel and WP Squared (by WebPros) enables leakage of credentials from other users sharing the same hosting infrastructure. The CVSS 4.0 vector confirms network-reachable exploitation with no authentication required but with passive user interaction and attack-specific prerequisites; critically, the subsequent-system impact is rated High for both confidentiality and integrity (SC:H/SI:H), indicating that successful exploitation crosses trust boundaries to affect other users or backend components beyond the attacker's own session. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, but the scope-change impact makes it a meaningful risk in shared hosting environments where cPanel serves multiple tenants.
Memory exhaustion via unbounded configuration file parsing in Pterodactyl Wings prior to v1.13.0 allows a low-privileged game server tenant to crash the Wings daemon. The parsers for JSON, YAML, XML, INI, and text configuration files in parser.go perform no size validation, enabling a malicious or oversized config file to buffer unlimited data into the Wings process heap and trigger an OOM kill. No public exploit is identified at time of analysis, and the vendor-released patch is available in v1.13.0.
Redirect URI policy bypass in Keycloak's secure-client-uris executor enables interception of OAuth authorization codes over unencrypted HTTP connections. The flaw exists because the executor performs only a prefix-string comparison on the redirect URI rather than properly parsing and validating the host component, allowing a specially crafted domain name to satisfy the HTTPS enforcement check while pointing to an attacker-controlled HTTP endpoint. Affected deployments include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, and related Red Hat middleware products. No public exploit code or CISA KEV listing has been identified at time of analysis.
Token revocation bypass in Keycloak's TokenManager component allows sessions and user data access to persist after administrative invalidation. The flaw (CWE-862: Missing Authorization) causes client-level 'not-before' revocation policies to be silently skipped when a realm-level revocation policy with an older, non-zero timestamp is already in place - causing the revocation to produce no effect. Authenticated token holders (PR:L) can continue refreshing sessions and querying user information APIs despite explicit administrative revocation. No public exploit identified at time of analysis; KEV status is not confirmed.
Unauthenticated campaign content tampering in the MailerPress - Newsletter, Email Marketing & AI Automation WordPress plugin (versions ≤ 1.5.0) allows any remote actor to overwrite active email campaign HTML by invoking the revision-restore REST endpoint without credentials. The campaign revision-restore route (POST /wp-json/mailpress/v1/campaign/<id>/restore-revision/<revision_id>) was registered in the WordPress REST API without a permissionCallback, bypassing the authorization layer entirely. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, though the attack is trivially executable against any reachable WordPress instance running the affected plugin.
Insecure Direct Object Reference in Fluent Forms for WordPress (versions up to and including 6.2.8) exposes other users' payment receipt data to unauthenticated remote attackers via a brute-forceable 'transaction' parameter. Because the transaction hash is constructed from observable or guessable inputs - submission ID, form ID, and creation timestamp - the effective brute-force space is bounded to approximately 900 candidates per second per (submission, form) pair, making unauthenticated enumeration of victim receipts containing name, email, billing address, order items, payment method, and payment status practically feasible. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; however, a patch is available in version 6.2.9.
Stored cross-site scripting in Roskus Prospero Flow CRM before v5.5.3 allows authenticated users holding the 'create lead' or 'update lead' permission to inject persistent JavaScript payloads via the lead name field. The application renders lead names through Blade's unescaped output directive and embeds them unsanitized inside a JavaScript string literal in an onclick attribute, providing two distinct injection sinks. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthorized contact data modification in MailerPress (WordPress plugin, versions up to and including 1.5.0) is achievable by any unauthenticated remote attacker via a missing capability check on the REST API endpoint `mailerpress/v1/contact`. The root cause (CWE-862) means WordPress's permission framework is entirely bypassed for this endpoint, exposing the contact database to arbitrary writes without credentials. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and zero authentication requirement make this trivially exploitable by automated scanners.
Server-Side Request Forgery in Pentestify's PDF export pipeline allows authenticated users to induce the server-side headless browser to issue outbound HTTP GET requests to arbitrary attacker-specified destinations by storing remote URLs in the finding images field or the report client_logo field. All Pentestify installations prior to version 1.1.0 are affected (CPE: cpe:2.3:a:ccyl13:pentestify). No active exploitation has been confirmed (not in CISA KEV, no public POC identified), but the vulnerability enables internal network reconnaissance and cloud metadata endpoint access from the Pentestify server's network context, posing meaningful risk in cloud-hosted or internally-networked deployments.