Broken object-level authorization in Fluent Support WordPress plugin before 2.3.1 allows restricted support agents to reassign the customer field on any ticket system-wide, bypassing per-ticket scope enforcement. Affected are WordPress installations running Fluent Support versions prior to 2.3.1 where restricted support agent accounts exist. An authenticated agent can manipulate ticket ownership across the entire helpdesk, exposing customer metadata and corrupting ticket assignment integrity. A publicly available proof-of-concept exists; EPSS probability is very low (0.13%, 3rd percentile) and no CISA KEV listing indicates no confirmed mass exploitation.
Unauthenticated OAuth state hijacking in Builderall for WordPress (versions before 3.0.2) enables remote attackers to overwrite the plugin's stored third-party integration access token by completing an OAuth authorization flow that is never bound to the initiating user session. Practical impact is constrained to sites already connected to a paid Builderall account - without that precondition, the overwrite is transient rather than durable. No confirmed active exploitation exists in CISA KEV, but WPScan has published a public proof-of-concept, making this accessible beyond sophisticated attackers despite an EPSS of 0.18% (7th percentile).
CSS injection in the Spectra Legacy WordPress plugin before version 2.20.0 allows authenticated Contributors to embed arbitrary CSS via unvalidated block style attributes that are output verbatim to page front-ends. Anonymous visitors loading affected pages are exposed to attacker-controlled styles enabling page defacement, UI redressing, external resource loading, and side-channel data exfiltration through CSS attribute selectors. JavaScript execution is explicitly blocked by WordPress KSES filtering, constraining the worst-case impact; a publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.12% (2nd percentile), indicating low observed exploitation probability and no CISA KEV listing.
Unrestricted mass assignment in the Booking for Appointments and Events Calendar WordPress plugin (before 2.4.4) permits any user holding the Amelia Manager role to overwrite arbitrary database columns on stored user records by injecting unsanitized fields into customer import requests. This can enable data tampering or privilege manipulation within the booking system's user table. No public exploitation is confirmed via CISA KEV, but a POC is publicly available through WPScan; EPSS remains at 0.13% (3rd percentile), consistent with limited real-world exploitation probability given the high-privilege prerequisite.
Improper authorization in the Brizy WordPress plugin before 2.8.18 allows any authenticated user holding the Contributor role or above to read the full content of arbitrary posts, bypassing WordPress's native visibility controls for private, pending, and draft posts. The flaw resides in a specific request handler that returns post content without verifying whether the requesting user is entitled to view it (CWE-639, IDOR). A publicly available proof-of-concept exploit has been published by WPScan; however, no confirmed active exploitation appears in CISA KEV, and the EPSS score of 0.13% (3rd percentile) reflects limited observed exploitation activity at time of analysis.
Broken object-level authorization in the Event Tickets and Registration WordPress plugin before 5.29.0.1 allows any contributor-level (or higher) WordPress user to overwrite the seating layout, ticket inventory, and attendee seat assignments for events they do not own. The flaw stems from insufficient ownership verification on seating-related actions, meaning a low-privileged authenticated user can manipulate another author's event data without restriction. No public exploitation in the wild has been confirmed by CISA KEV, but a public proof-of-concept exists per WPScan reporting, and the EPSS score of 0.13% (3rd percentile) reflects minimal observed scanning or exploitation activity at time of analysis.
Out-of-bounds heap read in FreeRDP's UVC H.264 extension-unit parser affects all versions prior to 3.29.0, allowing an attacker with physical USB access to trigger denial of service during camera stream setup. The parser fails to validate descriptor length before accessing the GUID field, enabling a read beyond allocated heap bounds when a malicious USB video camera is connected. No public exploit has been identified, KEV listing is absent, and the CVSS 4.0 score of 2.4 accurately reflects the constrained physical-access attack surface.
Session revocation via forged cookies in better-auth's multi-session plugin (npm, versions 1.3.34 through <1.4.0) allows any authenticated attacker to arbitrarily delete session tokens belonging to other users by supplying a crafted `_multi-*` cookie to the /sign-out after-hook, which forwards cookie values to `internalAdapter.deleteSessions()` without verifying the cryptographic signature. The flaw is not listed in the CISA KEV catalog and no public exploit code has been identified, but the low attack complexity makes unauthorized targeted session termination straightforward once an attacker holds any valid application session. Version 1.4.0 resolves the issue via patch commit cfc453a2a6eb02951f9a0a7c944064936e73eee8.