Stored Cross-Site Scripting in Powerkit plugin for WordPress (versions <= 3.1.0) allows authenticated contributors to inject malicious scripts into content that executes in victims' browsers when viewed. The CVSS vector (PR:L/UI:R/S:C) confirms this is a contributor-tier, stored XSS with changed scope, meaning a low-privileged user can target higher-privileged users such as editors or administrators. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack pattern is well-understood and straightforward to execute within WordPress contributor workflows.
Stored Cross-Site Scripting in MailOptin WordPress plugin (versions ≤ 1.2.78.0) allows Contributor-level authenticated users to inject malicious JavaScript payloads that execute in the browser context of higher-privileged users - typically site administrators - when they view the affected content. The CVSS scope change (S:C) confirms the injected script escapes the contributor's own context, making this an effective privilege escalation vector in multi-author WordPress environments. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in the Ultimate Addons for Elementor WordPress plugin (versions <= 1.45.2) allows authenticated contributors to inject persistent malicious scripts that execute in the browsers of higher-privileged users such as site administrators. The CVSS vector (PR:L/UI:R/S:C) confirms this is a contributor-level stored XSS with scope change - a low-privilege WordPress role can trigger execution in an admin's browsing context, enabling session hijacking or privilege escalation. No public exploit or KEV listing has been identified at time of analysis, but Patchstack has formally reported and documented this vulnerability.
Cross-Site Request Forgery in Plugins Garbage Collector (Database Cleanup) plugin for WordPress version 0.14 and earlier enables an unauthenticated remote attacker to perform unauthorized administrative database operations by tricking an authenticated WordPress administrator into visiting a malicious page. The CVSS vector (PR:N/UI:R/I:H) confirms the attacker requires no privileges but must engineer social interaction with a privileged user, yielding high integrity impact - specifically, the ability to trigger plugin or database cleanup actions on behalf of the victim. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Stored XSS in the MetaSlider WordPress plugin (versions up to and including 3.111.0) allows authenticated Author-level users to inject arbitrary JavaScript via the unprotected 'delay' post meta setting, which executes in the browser of any visitor who loads a page containing the affected slider. The attack path leverages the WordPress XML-RPC API: the ml-slider custom post type is registered without custom capability restrictions and the ml-slider_settings meta key is unprotected, enabling Author-level accounts to plant persistent payloads that bypass normal UI-layer permission checks. This vulnerability is not listed in CISA KEV and no public exploit code has been identified at time of analysis; a patched release (3.111.1) is confirmed by the WordPress plugin SVN changeset.
Stored Cross-Site Scripting in the UsersWP WordPress plugin (all versions through 1.2.69) allows authenticated attackers with subscriber-level access to inject persistent JavaScript payloads via unsanitized variable substitution in the Badge Widget. The vulnerability stems from two distinct unsanitized code paths - the `uwp_get_user_badge()` function's `%%input%%` and `%%profile_url%%` template substitutions, and the `uwp_replace_variables()` function - both of which fail to apply `esc_html()` or `esc_url()` before rendering user-controlled values into page output. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in the LatePoint WordPress appointment booking plugin (all versions through 5.3.2) allows authenticated attackers with contributor-level access to inject persistent malicious scripts via the 'btn_wrapper_classes' attribute of the 'latepoint_resources' shortcode. The injected payload executes in any visitor's browser upon loading the affected page, enabling session hijacking, credential theft, or malicious redirects against site users. No public exploit code or active exploitation has been identified at time of analysis; however, the low privilege requirement expands the attacker pool on multi-contributor WordPress deployments.
Stored XSS in PostX (Post Grid Gutenberg Blocks) up to and including version 5.0.13 allows authenticated contributors to persist malicious JavaScript in WordPress pages via the unescaped 'inputPlaceHolder' parameter. Any site visitor loading an injected page will execute attacker-controlled scripts in their browser, enabling session hijacking, credential harvesting, or malicious redirects. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Out-of-bounds heap read in llama.cpp's recurrent memory state restore path (builds b5702 through b7653) allows an attacker with write access to the slot save directory to craft a malicious slot file that triggers heap data leakage - including pointer values - into server logs, effectively defeating ASLR protections and enabling multi-stage exploitation. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalogue. An upstream fix is available as a commit to the ggml-org/llama.cpp repository, though a tagged released version past the affected build range has not been independently confirmed.
Firmware update integrity bypass in Insta InstaKNXServiceApp 1.2.3.1469 allows a remote network-positioned attacker to serve unauthenticated firmware or file lists to the application's update handler without detection. The vulnerable function CreateWebClientAndDownloadFileList fails to cryptographically verify the authenticity of data retrieved during the firmware update process (CWE-345), enabling substitution of malicious content. No patch has been released and the vendor did not respond to coordinated disclosure; no public exploit has been independently confirmed at time of analysis, though a GitHub gist linked in references may represent researcher-published proof-of-concept material.
Stored XSS in league/commonmark's AttributesExtension allows remote attackers to inject and execute arbitrary JavaScript in victim browsers by embedding WHATWG URL control bytes (TAB, CR, LF, or leading C0 controls) within a javascript: scheme in href or src attribute values. The unsafe-link filter (RegexHelper::isLinkPotentiallyUnsafe()) uses an anchored prefix regex that does not normalize inputs as browsers do, so java<TAB>script: passes the filter but executes as javascript: in every compliant browser. Critically, this bypass defeats the allow_unsafe_links => false configuration - the library's own documented hardening recommendation for untrusted input - meaning even security-conscious deployments running versions 1.5.0 through 2.8.3 remain exploitable. No public exploit confirmed as KEV; however, the advisory provides explicit PoC payloads, substantially lowering attacker effort.
HTML injection via unescaped form submissions in Statamic CMS's automagic email notification template allows unauthenticated attackers to deliver malicious HTML content to site administrators and other configured email recipients. Statamic's Antlers templating engine rendered all user-controlled form field values - including text, select, radio, and checkbox inputs - directly into HTML email bodies without sanitization, enabling payload delivery through a standard public-facing form submission. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vulnerability requires no authentication and is accessible to any user who can submit a Statamic form.
Directory traversal in Anki's local HTTP server (versions prior to 25.09.3) exposes arbitrary local files to scripts embedded in shared decks or to malicious websites exploiting an origin-check bypass. The flaw exists in both the media file endpoint and the built-in data path endpoint within `qt/aqt/mediasrv.py`, where path boundary checks were either absent or bypassable via the missing `os.sep` suffix. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high confidentiality impact (VC:H) and the realistic social-engineering vector through the AnkiWeb shared deck ecosystem make this a credible threat to active Anki users.
Cross-site scripting in FiboSearch (Ajax Search for WooCommerce) versions up to and including 1.33.0 allows authenticated shop managers to inject malicious JavaScript that executes in the browsers of other users visiting the WordPress storefront. The Changed scope in the CVSS vector (S:C) confirms the attack crosses a security boundary, meaning a compromised or malicious shop manager account can target customers or higher-privileged administrators. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the insider-threat and credential-compromise scenarios make this relevant to multi-user WooCommerce deployments.
Stored Cross-Site Scripting in the WordPress Subscribe to Comments plugin (versions up to and including 2.3.1) allows a high-privileged authenticated attacker to inject malicious scripts via author-related fields, which execute in the browsers of other users who view the affected content. The vulnerability carries a CVSS 3.1 score of 5.9 with scope change (S:C), meaning the impact crosses the security boundary from the plugin into victims' browser sessions. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the network-accessible attack surface and scope change elevate practical concern for multi-tenant or high-traffic WordPress deployments.
Payment logic bypass in the Formidable Forms WordPress plugin before 6.32.1 enables unauthenticated remote attackers to complete PayPal subscription flows without being charged. The plugin fails to properly validate PayPal subscription payment status before marking it complete, allowing attackers to trigger all downstream paid-form actions - including digital content delivery, license key issuance, and membership activation - without a valid transaction. No public exploit or KEV listing exists at time of analysis, but the business logic nature of the flaw and its zero-authentication requirement make it accessible to motivated, non-technical attackers once the code path is understood.
Payment fraud via forged Worldpay webhooks affects the GetPaid WordPress plugin before version 2.8.55, allowing unauthenticated remote attackers to mark pending invoices as paid without making any actual payment. The plugin fails to verify the authenticity of incoming Worldpay Instant Payment Notifications (IPNs), meaning any attacker who can reach the webhook endpoint and reconstruct a plausible notification payload can manipulate invoice status. No public exploit has been identified at time of analysis, but the business logic impact - obtaining goods or services without payment - is direct and immediately harmful to affected merchants.
Cross-tenant PIN challenge throttle isolation failure in OpenReception appointment booking software (prior to 1.0.4) allows unauthenticated remote attackers to lock out a patient on any tenant by submitting failed PIN responses against a different tenant on the same platform instance. The root cause is that the `challenge_throttle` table is keyed solely by `emailHash` with no tenant dimension, so throttle state bleeds across tenant boundaries. Lockout escalates from 60 seconds to 60 minutes after repeated failure bursts. No public exploit has been identified at time of analysis, and a vendor patch is available in version 1.0.4.
Stack-based buffer overflow in ELAN Smart-Pad Windows kernel drivers ETD.sys and ETDSMBus.sys allows a local standard-privilege user to crash the entire Windows system via a kernel bugcheck (BSOD 0xF7 DRIVER_OVERRAN_STACK_BUFFER). The vulnerability is rooted in the Intel SMBus recovery code path: ETDSMBus.sys accepts a hardware-derived report count without enforcing an upper bound and forwards it to ETD.sys, where it drives an unbounded stack buffer copy. A proof-of-concept exists (CVSS 4.0 E:P) and no confirmed patch version has been identified from available data; no active exploitation is listed in CISA KEV at time of analysis.
Path traversal in nanocoai NanoClaw through version 2.0.64 allows remote unauthenticated attackers to escape the intended file system boundary via the send_file MCP tool, enabling unauthorized file read and potential file write operations on the host. A public proof-of-concept exploit has been disclosed via GitHub issue #2760, and the vendor has not responded to the responsible disclosure, leaving all deployments through the affected version without an available patch. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms low-complexity remote exploitation with no special prerequisites required.
Authentication bypass in letta-ai LettaBot 0.2.0 exposes the API Status Route in src/api/server.ts to unauthenticated remote access, allowing any network-reachable attacker to interact with the endpoint without credentials. The root cause is missing authentication enforcement (CWE-287) on what should be a protected API handler, with confidentiality, integrity, and availability each assessed at low impact per the CVSS 4.0 vector. A public proof-of-concept exploit exists (GitHub Gist, corroborated by CVSS 4.0 E:P), and the vendor did not respond to responsible disclosure, leaving no patch available at time of analysis.
SQL injection in chiuwingyan's 'house' web application exposes the `/paid/selectall.action` endpoint to remote unauthenticated attackers who can manipulate the `zuname` parameter to execute arbitrary SQL against the backend database. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms low-complexity, unauthenticated remote exploitation, and the E:P supplemental metric confirms a public proof-of-concept has been disclosed via VulDB. No patch exists and the vendor did not respond to responsible disclosure, leaving deployments permanently unmitigated absent operator-side controls.
Command injection in OpenHands versions up to 0.62.0 allows authenticated remote attackers to execute arbitrary OS commands by manipulating inputs processed by the initialize_repo function within the pull request resolver workflow. The vulnerable file OpenHands/resolver/send_pull_request.py was entirely removed in version 1.7.0, suggesting the fix is architectural rather than a targeted patch. No public exploit has been identified at time of analysis, though the vendor's deletion of the original GitHub issue report is a notable transparency concern; no CISA KEV listing exists.
Unauthenticated file upload in Rongzhitong Visual Integrated Command and Dispatch Platform (versions through 20260617) allows remote attackers to upload arbitrary files - including web shells - to the server via the /dm/dispatch/userinfo/upload endpoint without any authentication. The 'Authentication Bypass' tag confirms that access controls on this endpoint are entirely absent, not merely weak. A public proof-of-concept exploit exists and is circulating, and the vendor has not responded to disclosure contact, meaning no patch is forthcoming. No public exploit identified as confirmed actively exploited (CISA KEV), but PoC availability and zero remediation response substantially raise real-world risk.
Stack buffer overrun in SecureAge CatchPulse allows a local low-privileged attacker to crash the application, producing a denial-of-service condition. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only an authenticated local session with no user interaction, making it viable for insider threats or post-compromise lateral DoS. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Out-of-Bounds Read in Autodesk's image handling library crashes Revit and AutoCAD when a user opens a maliciously crafted TIF file during image import. Affected products span Revit 2024, 2026, and 2027 as well as AutoCAD and AutoCAD LT 2027, all below vendor-specified fix versions. The attack is local and requires user interaction, limiting automated mass exploitation, but remains a viable denial-of-service vector in targeted scenarios against AEC professionals who routinely handle externally sourced CAD assets. No public exploit identified at time of analysis.
Address bar spoofing in GNOME Epiphany 49.2 and earlier allows remote unauthenticated attackers to display a trusted domain in the browser UI while actually loading content from an attacker-controlled origin, enabling high-fidelity phishing attacks. Exploitation leverages RFC 3986 userinfo URL syntax - a crafted link such as `https://trusted.com:80@attacker.com/` causes Epiphany to render `trusted.com` in the address bar and security menus while WebKit fetches and renders `attacker.com`. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code is identified at time of analysis, though the technique requires no tooling beyond a crafted URL.
Stored cross-site scripting in Silverstripe CMS's admin page list view allows an authenticated CMS editor to execute arbitrary JavaScript in the browser session of any CMS user who views the page list. The flaw exists in composer/silverstripe/cms prior to 6.2.1, where ancestor page titles were concatenated directly into rendered HTML without HTML-entity escaping in the breadcrumb component. No public standalone exploit code and no CISA KEV listing have been identified; however, the patch diff, GHSA advisory, and test-case payloads are all publicly accessible, making reproduction straightforward for any researcher.
Terminal escape sequence injection in GitHub CLI (gh) prior to version 2.97.0 allows an attacker who controls content on GitHub - gists, pull requests, releases, codespaces, API responses, skills, or agent-task output - to embed ANSI/VT escape sequences that are rendered verbatim by the victim's terminal when they run any of the affected display commands. Impact ranges from cosmetic screen manipulation (title bar spoofing, on-screen content overwrite) to, on certain terminal emulators that interpret shell-integration or hyperlink escape sequences, arbitrary command execution in the user's shell. This issue broadens the same CWE-150 class addressed by CVE-2026-45803, which patched only the `gh run view --log` path, to the full set of content-displaying subcommands. No public exploit or KEV listing is present at time of analysis, though the injection surface is wide and the fix is confirmed in v2.97.0.
Stored XSS in E-Logo Purchasing Portal (all versions before 1.52) by Logo Software Industry and Trade Inc. permits authenticated low-privilege users to inject persistent malicious scripts that execute in the browsers of other portal users. The CVSS scope change (S:C) confirms the payload crosses trust boundaries, enabling session hijacking, credential theft, or unauthorized actions against procurement administrators and reviewers who visit affected pages. No public exploit code or CISA KEV listing has been identified at time of analysis.
CSRF in the WSO2 Carbon console Ajax processor enables an attacker to silently execute unauthorized state-changing operations on behalf of authenticated administrators across more than ten WSO2 products including Identity Server, API Manager, and Enterprise Integrator. The vulnerability combines two compounding weaknesses: state-altering operations are routed over HTTP GET, and the sole CSRF mitigation - SameSite=Lax - is defeated because browsers permit session cookies to accompany cross-origin top-level GET navigations. No public exploit code has been reported and this CVE does not appear in CISA KEV at time of analysis; however, the breadth of affected WSO2 products and the IAM/API management context make misconfigured internet-exposed deployments a meaningful target for targeted social engineering.
CSS injection in the Mermaid JavaScript diagramming library (npm) allows sibling CSS combinators (`~` and `+`) to escape the diagram's SVG container and apply attacker-controlled styles to adjacent DOM elements on the host page. Affected are applications using Mermaid below v11.16.1 or below v10.9.8 that render user-supplied diagram source and where the SVG element has sibling nodes in the DOM - a non-default condition. An attacker supplying malicious diagram content can perform UI redressing, hide legitimate page content, or create phishing-style visual overlays; the vendor explicitly confirms JavaScript execution is not possible via this vector. No public exploit tool is identified at time of analysis, though a working proof-of-concept payload is embedded in the GitHub security advisory.
Authorization bypass in SourceCodester Online Examination & Learning Management System 1.0 allows authenticated low-privilege users to access records belonging to other users by manipulating the `id` parameter in the `/view.php` endpoint without proper ownership verification. The CVSS 4.0 vector (PR:L, AV:N, VC:L) confirms the flaw is remotely reachable but requires prior authentication, and impact is limited to confidentiality disclosure of a single record type. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Uninitialized GPU memory in Google Chrome on Android prior to 151.0.7922.109 exposes sensitive process memory contents to a remote attacker who has already achieved renderer process compromise. The CWE-457 flaw allows the GPU component to read and return uninitialized memory regions when processing attacker-controlled HTML, resulting in confidentiality impact bounded to the compromised process scope. No public exploit code exists and CISA SSVC rates exploitation as none at time of analysis, making this a second-stage information disclosure component rather than a standalone critical threat.
Server-side validation bypass in the Easy Booking WordPress plugin (all versions before 3.5.0) allows unauthenticated remote attackers to circumvent minimum booking duration enforcement during cart addition and price calculation. Malicious users can submit manipulated add-to-cart requests with durations shorter than the merchant-configured minimums, completing orders at underpriced totals that the merchant is then expected to fulfill at a financial loss. No public exploit has been identified at time of analysis, though the unauthenticated, low-complexity attack vector makes this trivially reproducible by any remote attacker with HTTP access to the affected site.
Unauthenticated read access to appointment records in OpenReception appointment-booking-software (versions prior to 1.1.0) exposes scheduling metadata and AES-GCM cryptographic components - including encryptedPayload, iv, authTag, and dataKey - to any caller who possesses a valid appointment UUID. The GET handler at /api/tenants/{id}/appointments/{appointmentId} omits the checkPermission() call that the DELETE handler on the same file correctly enforces, and neither the apiAuthHandle nor authGuard middleware compensates because API paths bypass authGuard entirely and apiAuthHandle does not block unauthenticated requests on non-admin routes. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero-friction remote exploitation against any unpatched instance.
Payment authorization token reuse in Events Made Easy WordPress plugin before 3.1.2 enables unauthenticated financial fraud against event organizers. An attacker exploits an absent binding between payment tokens and booking records to pay minimally for a cheap registration, then apply that valid token to a separate, higher-priced booking - having it marked as fully paid. No public exploit is identified at time of analysis, but CVSS:3.1/AV:N/AC:L/PR:N/UI:N confirms the attack requires no authentication and no user interaction, making it trivially accessible to non-technical threat actors targeting paid event registrations.
Authorization bypass in SourceCodester Online Examination & Learning Management System 1.0 exposes student records to unauthorized authenticated users by failing to validate the `class_group` parameter in `view_students.php`. The CVSS 4.0 vector (PR:L) confirms that at least low-privilege authentication is required, limiting the attack surface but still enabling lateral access to student data across class groups the attacker should not be permitted to view. No public exploit code has been identified and the product is not listed in the CISA KEV catalog at time of analysis.
Unrestricted file upload in SourceCodester Online Examination & Learning Management System 1.0 exposes the server to arbitrary file upload via the upload_files.php endpoint, which lacks adequate file type or extension enforcement. The CVSS 4.0 vector indicates low-privilege authentication is required (PR:L) over a network vector with low complexity, and the 'Authentication Bypass' tag raises the possibility that this authentication gate may itself be circumventable. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the attack class is well-understood and trivially weaponizable against affected deployments.
Apache Polaris incorrectly enforces storage location boundaries during Iceberg table and view registration, enabling an authenticated principal with registration privileges to cause the catalog service to read S3 objects outside the configured allowed storage perimeter. Exploitation depends on a deployment running S3 credential vending where the catalog's underlying credentials can access objects beyond the allowed boundary - a constrained but realistic enterprise configuration. The demonstrated impact is limited to partial confidentiality disclosure of out-of-bounds objects; no unauthorized write or availability impact has been demonstrated, and no public exploit or active exploitation has been identified at time of analysis.
Security Optimizer WordPress plugin versions 1.5.8 through 1.6.4 expose a bypass in its optional IP-based login restriction feature, allowing unauthenticated remote users from non-allowlisted IP addresses to reach the WordPress login form despite administrator-configured access controls. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial network exploitability with no authentication or user interaction required to perform the bypass. No public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV; however, sites relying on the IP restriction as a primary login protection layer face elevated credential attack exposure.
Authorization bypass in the Ad Inserter WordPress plugin (all versions through 2.8.16) allows unauthenticated remote attackers to read ad block contents that administrators have restricted to administrator-only visibility, by invoking the unguarded `ai_ajax` AJAX function. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial unauthenticated network exploitation with no user interaction required. No public exploit has been identified at time of analysis, but two upstream WordPress plugin repository changesets (3583409, 3567905) indicate a fix has been committed.
Unauthenticated information disclosure in OpenReception appointment-booking-software prior to version 1.0.5 exposes private channel metadata through the public `/api/tenants/{id}/schedule` endpoint, bypassing the `isPublic` flag that governs channel visibility in the booking UI. Any caller with a valid tenant ID can retrieve channel names, descriptions, IDs, agent associations, pause status, confirmation requirements, and computed slot availability for channels deliberately configured as internal-only - data that the product's own design intends to hide from public callers. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial unauthenticated reachability requiring no special conditions.
Frontend form upload validation in Statamic CMS fails to enforce administrator-configured file type restrictions, allowing unauthenticated visitors to upload disallowed extensions through public-facing forms containing `assets` or `files` fields. The bypass is constrained: Statamic's global allowlist continues to block truly dangerous executable types such as `.php` and `.html`, meaning direct remote code execution is not achievable through this flaw alone. No public exploit code has been identified at time of analysis; vendor-released patches are available in versions 5.74.3 and 6.24.2.
Unauthenticated sensitive data exposure in the Export Import Menus WordPress plugin (versions up to and including 1.9.2) allows remote, unauthenticated attackers to access sensitive information by invoking the plugin's export functionality without any credentials. Classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), the plugin returns sensitive data in its HTTP responses to unauthenticated requests. No public exploit code has been identified at time of analysis, and this CVE does not appear on the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated sensitive data exposure in the Custom CSS and JavaScript WordPress plugin (by WP Zone) versions up to and including 2.0.16 allows remote unauthenticated attackers to read sensitive information via network-accessible endpoints. Classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), the flaw permits retrieval of data that the plugin transmits without requiring any authentication, with a CVSS 3.1 score of 5.3 (Medium). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated sensitive data exposure in the YITH WooCommerce Zoom Magnifier WordPress plugin (versions ≤ 2.52.0) permits remote, unauthenticated attackers to retrieve sensitive information without any credentials. Classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), the plugin exposes data through a network-accessible endpoint that lacks proper authorization controls. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low attack complexity makes opportunistic discovery straightforward.
CAPTCHA bypass in Element Pack Elementor Addons (WordPress plugin by BDThemes) versions up to and including 8.7.13 allows unauthenticated remote attackers to circumvent CAPTCHA verification on protected forms. Classified under CWE-290 (Authentication Bypass by Spoofing), the flaw enables automated or scripted clients to submit forms without completing the CAPTCHA challenge, undermining bot-protection controls. No public exploit code or active exploitation has been identified at time of analysis; CVSS rates this Medium (5.3) with integrity-only impact.
CAPTCHA 4WP WordPress plugin (versions up to and including 7.6.0) allows unauthenticated remote attackers to bypass CAPTCHA verification entirely, undermining bot-protection controls on any form the plugin secures. Classified under CWE-290 (Authentication Bypass by Spoofing), the flaw suggests the verification logic can be defeated without completing the human challenge - enabling automated abuse of protected endpoints. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector confirms trivially exploitable, zero-prerequisite network access; no public exploit code and no CISA KEV listing are identified at time of analysis.
Price manipulation via client-supplied ticket values in Event Booking Manager for WooCommerce (Pro) before 5.0.3 allows unauthenticated attackers to book paid event tickets at arbitrary prices, including free. The plugin's native (non-WooCommerce) checkout flow trusts the per-ticket price submitted by the client rather than re-deriving it from the server-side event configuration - a classic business logic failure. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack requires no authentication and no special preconditions beyond the affected checkout mode being in use.