Stored cross-site scripting in Element Pack Addons for Elementor WordPress plugin before 8.7.13 allows contributor-level (or higher) authenticated users to inject persistent JavaScript payloads via unsanitized data attributes, which a bundled front-end library subsequently re-parses and renders in victim browsers. Any site visitor loading the compromised page executes the attacker's script in their browser session, enabling session token theft, credential harvesting, or arbitrary actions on behalf of the victim - including administrators. A public proof-of-concept exists via WPScan, though EPSS at 0.16% and SSVC exploitation status of 'none' indicate no observed widespread exploitation at time of analysis.
PHP object injection in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3.7) allows authenticated contributors to deserialize attacker-controlled PHP objects through event content fields. Exploitation to achieve remote code execution, arbitrary file deletion, or sensitive data retrieval depends entirely on the presence of a usable POP (Property-Oriented Programming) chain from a co-installed plugin or theme - none exists within this plugin itself. A publicly available exploit exists per WPScan (EUVD-2026-51948), and this CVE represents an incomplete remediation of prior object-injection advisories affecting the same plugin.
Unauthenticated REST API access in the webtoffee-cookie-consent WordPress plugin before 3.5.3 allows any network attacker to export or delete stored visitor consent records, create arbitrary WordPress posts, and alter the plugin's licensing state. All versions prior to 3.5.3 are affected with no special configuration required, as the missing permission callbacks expose endpoints to public access by default. A publicly available exploit exists per WPScan, though EPSS sits at 0.22% (12th percentile), indicating exploitation has not yet reached widespread automated abuse; no public exploit identified at time of analysis for active in-the-wild campaigns.
Reflected XSS in King Addons for Elementor (all versions before 51.1.76) permits unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by embedding a malicious payload in an unsanitized grid setting parameter reflected verbatim into an HTML attribute via an unauthenticated AJAX endpoint. The attack requires social engineering to deliver a crafted URL to a target user, with no privilege or authentication prerequisite on the server side. A publicly available exploit exists per WPScan; exploitation is not confirmed in CISA KEV, and EPSS at 0.17% (7th percentile) indicates limited observed exploitation at this time.
Meta Box WordPress plugin before 5.13.1 allows any user holding a Contributor-level role (or equivalent low-privilege account) to permanently delete arbitrary media attachments owned by other users, including administrators, due to a missing authorization check on the deletion endpoint. The root cause is CWE-862: the plugin performs the deletion operation without verifying whether the requesting user has ownership or administrative rights over the target attachment. Publicly available exploit code exists (sourced from WPScan), and while EPSS sits at a low 0.17% (6th percentile), the low attack complexity and wide availability of Contributor accounts on multi-author WordPress sites make this a realistic insider or compromised-account threat.
Stored cross-site scripting in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3.7) permits any authenticated user holding the Author role or higher to permanently inject arbitrary JavaScript into event timeline content. Because the plugin fails to sanitize or escape this input before storing and rendering it on public event pages, every site visitor - including administrators - who loads the affected event page executes the attacker's script in their own browser context. A publicly available proof-of-concept exists; no active exploitation is confirmed in CISA KEV, but the low barrier to entry (any Author-level account) elevates practical risk on sites permitting open or semi-open registration.
Stored XSS in the RT Mega Menu WordPress plugin (versions before 1.5.2) allows any subscriber-level authenticated user to inject persistent JavaScript into the site's public navigation, executing against every visitor who hovers over menu items - including administrators - enabling session theft and full site takeover. The AJAX endpoint that saves mega-menu configuration performs no capability check, relying solely on a nonce that any logged-in user can read from a standard admin page, making the access barrier trivially low. A public exploit is documented by WPScan, and the vendor has released version 1.5.2 as the confirmed fix; no public exploit identified at time of analysis corresponds to active widespread exploitation (no CISA KEV listing), though the public exploit code exists and the low subscriber-level barrier makes this dangerous on sites with open registration.
Stored Cross-Site Scripting in JetEngine WordPress plugin before 3.8.12 allows users holding the Contributor role or higher to inject persistent malicious scripts via unescaped post meta values rendered by plugin shortcodes, with execution occurring in the browser context of higher-privileged users including administrators. A publicly available exploit exists per WPScan, though EPSS remains low at 0.15% (5th percentile), suggesting limited observed mass exploitation at time of analysis. The scope-change characteristic (S:C in CVSS) elevates the real-world impact: successful exploitation can lead to admin session hijacking or unauthorized privileged actions despite the medium base score.
Broken object-level authorization in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3.7) allows any authenticated user with the Contributor role or higher to modify the title and publication status of arbitrary posts and pages sitewide - including content they do not own. The plugin's quick-edit event handler validates only a global WordPress capability (e.g., edit_posts) without confirming whether the requesting user owns the target object, enabling horizontal and vertical privilege escalation over site content. A publicly available proof-of-concept exists; however, no confirmed active exploitation has been identified and the EPSS score sits at 0.13%, indicating limited real-world adversary interest at time of analysis.
Cross-site request forgery in the Frontend File Manager Plugin for WordPress (all versions through 23.6) enables attackers to silently modify file metadata belonging to authenticated users by luring victims to attacker-controlled pages, with the corrupted metadata directly enabling unauthorized download of those files. When the plugin's guest upload feature is active, the vulnerable metadata update endpoint becomes fully unauthenticated, eliminating the need for any victim interaction and exposing every user's uploaded files to arbitrary metadata manipulation. WPScan has published a proof-of-concept, though EPSS at 0.10% (1st percentile) indicates limited observed exploitation activity to date - no public exploit identified at time of analysis reaches CISA KEV status.
Stored Cross-Site Scripting in the Charitable WordPress donation plugin (versions before 1.8.5.3) allows authenticated users holding a high-privilege campaign-management role to inject persistent malicious scripts via an unsanitized campaign image text field that is rendered unescaped inside an HTML attribute on the public-facing campaign page. Any site visitor who loads that page becomes a potential victim, enabling session hijacking, credential theft, or defacement against the site's front-end audience. A publicly available proof-of-concept exploit exists; however, no active exploitation has been confirmed in CISA KEV, and the EPSS score of 0.16% (6th percentile) reflects low broad-exploitation probability consistent with the high-privilege prerequisite.
Stored cross-site scripting in the Narrative Publisher WordPress plugin (≤1.0.7) lets contributor-level authenticated users inject arbitrary JavaScript into a REST-accessible post meta field that is neither access-controlled nor escaped on output. When any higher-privileged user - editor, administrator - views the affected post, the malicious script executes in their browser session, enabling session hijacking or privilege escalation to site administrator. A public proof-of-concept is available via WPScan; no KEV listing is present and the EPSS score (0.15%, 5th percentile) indicates limited opportunistic exploitation at time of analysis.
Clever Mega Menu for Visual Composer (WordPress plugin, versions through 1.0.1) allows any authenticated user with as little as Subscriber-level access to overwrite navigation menu item content and settings through an unprotected AJAX endpoint. The plugin fails to perform either a nonce check or a capability check before processing menu item metadata updates, meaning WordPress role-based access control over menu management is completely bypassed. A publicly available exploit exists via WPScan, though EPSS places exploitation probability at 0.14% (4th percentile) with no CISA KEV listing, indicating limited observed exploitation at time of analysis.
Insecure Direct Object Reference (IDOR) in the ProfileGrid WordPress plugin before 5.9.9.8 allows any authenticated user - including low-privilege Subscribers - to delete arbitrary other users' notifications by enumerating integer notification identifiers. The plugin's notification deletion endpoint fails to verify that the requested notification belongs to the authenticated requester, exposing all users' notifications to deletion by any site member. A publicly available exploit exists per WPScan, though EPSS sits at 0.13% (3rd percentile), indicating low observed exploitation activity at time of analysis.
Cache management actions in the LWS Optimize WordPress plugin before version 3.4 lack authorization checks, permitting any authenticated user - including low-privileged Subscribers - to flush the site's caches and trigger repeated, resource-intensive cache rebuilds. The vulnerability is classified as CWE-862 (Missing Authorization) and carries a CVSS 3.1 score of 4.3 (Medium), with impact limited to availability degradation rather than data exposure or modification. A publicly available proof-of-concept exists per WPScan reporting, though EPSS sits at a very low 0.13% (3rd percentile) and the vulnerability is not listed in CISA KEV, indicating limited observed exploitation interest.
Insecure Direct Object Reference in FluentBoards WordPress plugin before 1.95.3 allows any authenticated user holding member access to at least one board to silently exfiltrate task titles, descriptions, and file attachments from all other boards on the site by supplying arbitrary board item identifiers in an import request. The server performs no authorization check to verify that requested items belong to boards the invoking user is permitted to access, making any board member a potential insider threat against sensitive project data. A public proof-of-concept is available via WPScan; however, EPSS sits at 0.13% (3rd percentile) and no CISA KEV entry exists, indicating limited observed exploitation despite disclosure.
Local HDF5 file content disclosure in keras-team/keras versions 3.14.0 and earlier allows an attacker who can deliver a malicious model file to exfiltrate arbitrary local filesystem data from a victim's machine. Both the `KerasFileEditor` class and `keras.saving.load_weights` function fail to invoke the `safe_get_h5_group` and `safe_get_h5_dataset` helpers before traversing HDF5 group children, causing automatic dereferencing of embedded ExternalLinks and SoftLinks that point to attacker-controlled paths on the victim's filesystem. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the attack mechanism is straightforward and the commit diff makes the vulnerability trivially reproducible.
Client policy enforcement in Red Hat Build of Keycloak can be bypassed by an authenticated user holding client management permissions, allowing non-compliant OAuth clients to persist in a realm despite administrator-configured security hardening. The bypass exploits improper client state evaluation during update operations: an attacker creates a public client - which passes policy validation - and then updates it to a confidential client type, skipping the re-evaluation that would normally reject a non-compliant confidential client. No public exploit code has been identified and this CVE is not listed in CISA KEV; however, the low attack complexity and broad deployment of Keycloak in enterprise IAM infrastructure elevate its practical significance.
Time-based authorization policy bypass in Red Hat Build of Keycloak permits any low-privileged authenticated user to inject a fabricated timestamp into their authorization request, causing Keycloak's Authorization Services engine to evaluate the forged value instead of the actual server clock. This fully defeats time-based access controls - such as business-hours restrictions - across affected Red Hat products including Keycloak, Single Sign-On 7, Data Grid 8, and JBoss EAP Expansion Pack. No public exploit code has been identified and this CVE is not listed in CISA KEV, but the CVSS High integrity impact accurately reflects that time-gated authorization controls are rendered entirely ineffective against any valid account holder.
PSA Crypto key slot exhaustion in Zephyr's Bluetooth Mesh subnet.c permanently leaks one key slot on every subnet key teardown when CONFIG_BT_MESH_PRIV_BEACONS is enabled (the default). Devices running Zephyr 3.6.0 through 4.4.x are affected: a provisioner or network administrator with the node's device key can trigger the leak via Config Server NetKey Delete, Key Refresh Procedure, or reprovisioning over the Bluetooth Mesh network. With the default pool of 16 PSA key slots, roughly a dozen such operations exhaust the pool, preventing subnet creation and potentially starving other on-device PSA consumers until a reboot. No public exploit or CISA KEV listing exists; real-world impact is constrained by the high-privilege and proximity requirements.
Stored cross-site scripting in Exclusive Addons for Elementor (WordPress plugin, all versions through 2.7.9.8) allows any authenticated contributor-level WordPress user to permanently inject arbitrary JavaScript into pages via the `exad_infobox_image` parameter of the infobox widget. The injected payload executes in the browser of any user who subsequently views the compromised page, including administrators, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though Wordfence's changeset reference suggests source-code-level details are publicly accessible.
The full-scope-disabled client-policy executor in Red Hat Build of Keycloak silently skips enforcement when the fullScopeAllowed attribute is absent from a client registration or update request, allowing a delegated user to create OAuth/OIDC clients with unrestricted scope access. Affected platforms span Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat Data Grid 8, and JBoss EAP Expansion Pack. An attacker holding delegated registration privileges (CVSS PR:L) can exploit this to issue tokens containing unauthorized role mappings, effectively escalating their effective permissions within any application trusting those tokens. No public exploit code or CISA KEV entry has been identified at time of analysis.
Stored cross-site scripting in luci-app-adblock-fast before 1.2.4-4 allows a lower-privileged LuCI user to inject malicious JavaScript into the blocklist name field, which executes in an administrator's browser under the LuCI origin when the AdBlock Fast status page is viewed. Because the payload runs within the LuCI same-origin context, a successful attack could enable session hijacking, unauthorized router reconfiguration, or privilege escalation from low-privileged user to effective admin control. No public exploit is identified at time of analysis; a vendor patch is available via the GitHub Security Advisory GHSA-q335-4c83-c88h.