Deserialization-before-authentication in aiosend's WebhookHandler exposes all webhook integrations prior to version 3.0.7 to pre-authentication denial-of-service. An unauthenticated remote attacker can submit arbitrarily large or complex JSON payloads to any reachable aiosend webhook endpoint, forcing a full Pydantic model deserialization pass - including retention of attacker-supplied extra fields in memory due to CryptoPayObject's extra='allow' configuration - before the HMAC signature is checked and the request is rejected. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the attack requires no credentials and minimal skill.
Quadratic-time denial of service in league/commonmark versions 0.6.0 through 2.8.3 allows remote unauthenticated attackers to exhaust PHP worker processes by submitting a single specially crafted Markdown line. The root cause is a character-vs-byte position mismatch in the UTF-8-aware parser: lines containing non-ASCII characters trigger repeated full-line rescans that scale as O(n²) with line length, and a second independent quadratic path exists in the AutolinkExtension. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the attack fits within a single HTTP request and requires no authentication, making it operationally straightforward once the pattern is known.
Use-after-free in the Views UI rendering component of Google Chrome (all versions prior to 151.0.7922.109) enables a remote attacker to corrupt heap memory via a crafted HTML page, requiring the victim to perform specific UI gestures. The CVSS:3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a fully network-delivered attack with no authentication barrier, though high attack complexity and mandatory user interaction substantially reduce opportunistic exploitation likelihood. No public exploit code or CISA KEV listing has been identified at time of analysis; Google rated this High severity internally and shipped a patch in the stable channel update.
Use-after-free in Google Chrome's Views UI framework on Windows, fixed in version 151.0.7922.109, exposes users to heap corruption with full confidentiality, integrity, and availability impact. Exploitation requires convincing a target to perform specific UI gestures while visiting a crafted HTML page, making this a social-engineering-dependent but high-consequence flaw. No public exploit code or CISA KEV listing has been identified at the time of analysis; however, the severity and platform breadth make patching urgent for Windows enterprise fleets.
Heap corruption via use-after-free in Google Chrome's Views UI framework (prior to 151.0.7922.109) can be triggered by a remote attacker who delivers a crafted HTML page and induces a user to perform specific UI gestures. Successful exploitation may lead to arbitrary code execution or denial of service within the browser process. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS AC:H rating signals non-trivial exploitation conditions that reduce real-world risk compared to the high severity label.
Unauthenticated IDOR in the Formidable Forms Signature Online Contract Automation WordPress plugin (≤2.0.1) exposes contract documents and signature records to any remote, unauthenticated attacker who can enumerate object reference identifiers. The CVSS 7.5 (High) rating reflects network-accessible exploitation with no authentication, no user interaction, and high confidentiality impact - consistent with unrestricted read access to potentially sensitive legal and personal contract data. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity makes this trivially scriptable.
Broken access control in the BOX NOW Delivery Croatia WordPress plugin (versions <= 3.3.0) allows unauthenticated remote attackers to access restricted plugin functionality due to missing authorization checks, exposing sensitive data with high confidentiality impact. Reported by Patchstack and tracked under EUVD-2026-53962, this flaw is exploitable over the network with no credentials or user interaction required, making it trivially accessible to any attacker who can reach a vulnerable WordPress installation. No public exploit code or active exploitation has been identified at time of analysis.
Payment bypass in the Payment Plugins for PayPal WooCommerce WordPress plugin (versions before 2.0.20) allows unauthenticated attackers to complete purchases without initiating an actual PayPal payment transaction. A missing authorization check on a REST endpoint means any unauthenticated HTTP client can trigger order completion, resulting in goods or services being fulfilled with no payment collected. No public exploit has been identified at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack is trivially automatable against any internet-facing WooCommerce store running the affected plugin.
Price manipulation in the CoCart WordPress plugin before 4.9.0 allows unauthenticated remote attackers to purchase WooCommerce products at arbitrarily low prices by supplying a manipulated price value through the plugin's public REST API cart endpoint. The server accepts the attacker-controlled price without comparing it to the canonical product price, enabling completed orders at near-zero cost and direct financial loss to store operators. No public exploit code or CISA KEV listing has been identified, but the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector indicates this is trivially exploitable against any default-configured CoCart deployment.
Use-after-free in the Chrome Extensions subsystem allows sandboxed arbitrary code execution in Google Chrome prior to 151.0.7922.109, requiring a victim to install a crafted malicious extension. The UAF (CWE-416) memory corruption condition is exploitable remotely but demands high attack complexity and active user interaction, resulting in code execution confined within Chrome's sandbox. No public exploit code or CISA KEV listing has been identified at time of analysis; Google has released a fix in the stable channel update of 01 August 2026.
Price allowlist bypass in WPC Name Your Price for WooCommerce (WordPress plugin before 2.2.5) permits unauthenticated visitors to submit arbitrary below-minimum prices for products configured in "Select" mode, resulting in real completed orders at merchant-disadvantageous amounts and direct revenue loss. The flaw is a distinct business logic failure left unaddressed by the CVE-2025-12115 patch (v2.2.0), which only corrected a related but separate vector involving products with Name Your Price disabled. No public exploit identified at time of analysis, though the attack requires no authentication and is trivially executable against any vulnerable storefront with a Select-mode product.
Broken access control in the JetFormBuilder WordPress plugin (versions ≤ 3.6.4.1) allows unauthenticated remote attackers to perform privileged actions due to missing authorization checks (CWE-862), resulting in high integrity impact. Reported by Patchstack, the CVSS vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires no authentication, no user interaction, and no special configuration beyond having the plugin installed and active. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unlimited OTP brute-force in the miniOrange 2FA WordPress plugin before 6.2.8 allows a network attacker who already possesses a target user's password to bypass two-factor authentication entirely and achieve full account takeover. The flaw lies in rate-limit tracking being anchored to a client-supplied identifier that is reissued on every login attempt, meaning the attempt counter resets on demand and never accumulates. No public exploit has been identified at time of analysis, and the plugin is not listed in CISA KEV; however, the impact is total authentication bypass for any account protected by the plugin.
Missing authorization checks in the Breakdance WordPress page builder plugin (all versions before 2.7) allow unauthenticated remote attackers to access protected functionality due to improperly configured access control levels. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms network-reachable exploitation with no credentials required and high confidentiality impact, meaning sensitive data accessible only to authenticated users can be read by anonymous attackers. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Remote attackers without any authentication can bypass authorization checks in the Simple Membership WordPress plugin (versions ≤ 4.7.8), enabling unauthorized write operations against membership-protected resources. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) confirms exploitation requires no credentials, no user interaction, and low complexity, making this trivially scriptable at scale against any WordPress site running the affected plugin. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Patchstack disclosure provides sufficient detail for independent exploit development.
Payment bypass in Payment Gateway for Redsys & WooCommerce Lite before version 7.0.2 allows unauthenticated remote attackers to complete WooCommerce orders without actual payment by forging payment-provider callback notifications. The plugin fails to cryptographically verify the authenticity of inbound payment confirmations for at least one of its payment methods, meaning any actor who can reach the callback endpoint can submit a fabricated notification and have orders marked as paid. No public exploit code or CISA KEV listing has been identified at time of analysis, though the attack requires only network access and minimal technical skill.
Heap buffer overflow in Google Chrome's Base component (versions prior to 151.0.7922.109) enables potential heap corruption and arbitrary code execution when a user installs a malicious Chrome Extension crafted by an attacker. Exploitation requires social engineering to achieve extension installation, reflected in the AC:H/UI:R CVSS metrics, which meaningfully constrains real-world attack scale compared to the raw 7.5 score. No public exploit identified at time of analysis, and a vendor-released patch is available in 151.0.7922.109.
Payment bypass in the 'Integrate PhonePe with WooCommerce' WordPress plugin (through version 1.2.1) allows unauthenticated remote attackers to mark arbitrary WooCommerce orders as paid without making actual payment. The plugin fails on two independent validation layers: it does not bind a verified PhonePe transaction ID to the specific order being settled, and it does not authenticate the origin of payment-completion requests. An attacker with one valid transaction ID - obtained from any legitimate purchase, even a minimal-value one - can replay it against any other order on the same store. No public exploit identified at time of analysis, and the vulnerability is not in the CISA KEV catalog.
XML External Entity injection in Apache CXF's WSDL import processing allows attackers who can influence imported WSDL or XSD documents to bypass XXE protections applied to the top-level WSDL. CXF correctly hardens top-level WSDL parsing via StaxUtils, but delegates all <wsdl:import> and <xsd:import> resolution to WSDL4J, which lacks equivalent DOCTYPE and external entity restrictions - creating a security boundary mismatch that nullifies the top-level protections. No public exploit has been identified at time of analysis, but CWE-611 is a well-understood attack class with established tooling; successful exploitation against vulnerable deployments can yield arbitrary server-side file reads and SSRF. Vendor-released patches are available across three active release branches.
Denial of service persists in Apache CXF due to an incomplete remediation of CVE-2026-50645, allowing unauthenticated network attackers to exhaust server resources by submitting messages containing an excessive number of MIME attachment headers. All Apache CXF deployments running versions prior to 4.2.3, 4.1.8, or 3.6.12 remain vulnerable despite having applied the prior patch. No public exploit code or active exploitation has been identified at time of analysis, but the bypass-of-fix nature of this vulnerability means any organization that patched CVE-2026-50645 and considered itself remediated must re-patch.
OpenReception's appointment booking platform (prior to v1.0.2) leaves server-side sessions active for up to one week after a user explicitly logs out, due to an operation-ordering bug in the SvelteKit logout route. An attacker who has already obtained a copy of the victim's access token - through network interception, browser storage access on a shared device, or another independent theft vector - can continue making fully authenticated API calls against the platform even after the victim believes their session has ended. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the C:H/I:H impact reflects unrestricted access to the victim's appointment API surface for the duration of the unexpired session.
Unlimited passphrase brute-force is possible against any known account in OpenReception's appointment booking platform prior to version 1.0.2, because the `/api/auth/login` endpoint's passphrase branch never invokes the existing `challengeThrottleService` that correctly rate-limits the WebAuthn path. The asymmetry - confirmed by the fix commit wiring the same throttle infrastructure into the passphrase branch - means an unauthenticated remote attacker can sustain roughly 10 passphrase guesses per second per account, bounded only by Argon2 verification cost. Combined with a 12-character minimum policy that enforces no entropy or dictionary checks, accounts using common base patterns are realistically compromised in days on a single CPU or hours on a small GPU cluster. No public exploit code or CISA KEV listing has been identified at time of analysis.
OS-level privilege escalation in Google Chrome's Windows CredentialProvider component allows a local attacker to gain elevated system privileges by winning a race condition triggered via a malicious file. Affected are all Chrome for Windows builds prior to 151.0.7922.109. No public exploit code has been identified and CISA has not added this to the Known Exploited Vulnerabilities catalog, but the SSVC assessment rates technical impact as total, meaning successful exploitation yields full system compromise.
Broken access control in the Staff Training WordPress plugin (versions ≤ 1.0.7, by Solutioned) exposes protected plugin functionality to unauthenticated remote attackers, enabling unauthorized read, write, and limited availability impacts against affected WordPress installations. The root cause is CWE-862 (Missing Authorization) - one or more plugin-registered endpoints fail to verify caller capabilities before executing privileged operations. No public exploit code or active exploitation has been confirmed at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates extremely low exploitation complexity against any reachable WordPress site running the affected plugin.
Remote code execution is achievable in llama.cpp's LLaMA-Android JNI wrapper (builds b1886 through b7445) by exploiting a race condition use-after-free between `bench_1model()` and `free_1context()`, which share the `llama_context` heap object without any synchronization primitive. An attacker who wins the race can perform a heap spray with a crafted fake vtable, overwriting the vtable pointer at offset +0x30 in `llama_batch_allocr` so that `clear()` dispatches to attacker-controlled memory, achieving code execution within the Android application process. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis, though the fully documented vtable offset and exploitation technique substantially lower the development barrier for capable researchers.
Out-of-bounds read in TimescaleDB's Dictionary compression reverse row iterator (versions through 2.29.1) allows an authenticated database user with DML privileges on a compressed hypertable to exfiltrate backend process memory-including the PostgreSQL shared buffer pool-as ordinary column values that bypass SQL access controls. The vulnerability arises because the forward decompression path validates the Simple8b-encoded dictionary index while the reverse path relied solely on a debug assertion stripped from release builds, leaving the read offset fully attacker-controlled. No public exploit has been identified at time of analysis, and a fix is available upstream via commit 517c13e and PR #10360, though a tagged release version has not been independently confirmed from the available data.
PHP Object Injection in Jeg Kit for Elementor (WordPress plugin, versions <= 3.2.10) allows authenticated attackers holding Author-level WordPress privileges to pass unsanitized input through PHP's deserialization mechanism, potentially triggering a Property-Oriented Programming (POP) chain present in the environment. If a suitable POP chain exists - contributed by the plugin itself, Elementor, or any co-installed dependency - the attacker can achieve remote code execution, arbitrary file manipulation, or full data disclosure on the WordPress host. No public exploit or CISA KEV listing has been identified at time of analysis, though Patchstack has formally catalogued the issue.
Privilege escalation in Order Delivery Date for WooCommerce (versions ≤ 4.6.0) allows authenticated shop managers to exceed their intended role boundaries and gain elevated administrative access to the WordPress installation. Exploitation requires an existing shop manager account, confirmed by the CVSS:3.1 PR:H metric, limiting the attack surface to environments where untrusted or compromised accounts hold that role. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Stored XSS in FluentSMTP (WordPress plugin) versions up to and including 2.2.95 allows unauthenticated attackers to persist malicious scripts inside the plugin's Email Log detail view by controlling the recipient display name (to.name) field in any wp_mail() invocation. The payload bypasses the escapeHtml sanitization applied by the log list view and fires exclusively in the detail view when an administrator uses the Prev/Next navigation controls, meaning the attack surface is narrower than the CVSS UI:N vector implies. No public exploit code or CISA KEV listing has been identified; a patched version (2.3.0) is confirmed available via the WordPress plugin repository.
Stored XSS in the Forminator Forms WordPress plugin (≤1.56.1) permits unauthenticated attackers to permanently inject arbitrary JavaScript into pages by exploiting two compounding logic flaws: sanitize_array() silently skips all filtering for keys prefixed with 'select-', and set_field_data() treats a user-supplied 'return' member as a trusted internal flag, allowing a forged upload record with a malicious file_url to be persisted in the database. Because the payload is stored rather than reflected, a single unauthenticated HTTP request creates a persistent script that executes in every subsequent visitor's browser on the affected page. No public exploit code or CISA KEV listing is confirmed at time of analysis, though Wordfence's disclosure provides sufficient technical specificity to reconstruct the attack.
Stored XSS in the TranslatePress WordPress plugin (all versions ≤3.2.6) enables unauthenticated attackers to inject persistent malicious scripts via comment content containing URL-encoded gettext markers. The bypass technique is noteworthy: the payload exclusively uses WordPress-permitted HTML tags and attributes with percent-encoded characters, causing it to pass the platform's built-in wp_kses sanitization untouched before TranslatePress's translation rendering engine processes and outputs it unescaped. The injected script executes in every visitor's browser on any page displaying the poisoned comment. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; vendor-released patch is version 3.3.
Flowise through version 3.1.4 exposes document store mutation endpoints without enforcing authorization, allowing authenticated workspace members holding only view-level permissions to directly invoke upsert and refresh routes that should be restricted to higher-privileged roles. The missing server-side authorization check (CWE-862) enables a malicious insider or compromised view-only account to inject or overwrite vector database contents, trigger costly embedding API credit consumption, and corrupt knowledge bases that power downstream AI chatflows - without any UI-layer interaction. No public exploit has been identified at time of analysis, though the exploitation path is low-complexity given direct HTTP access suffices, and a disclosure advisory is publicly available on GitHub.
Stored Cross-Site Scripting in the FormGent WordPress plugin (all versions through 1.9.2) allows unauthenticated remote attackers to inject persistent malicious scripts via form submission fields, which execute in the browsers of any user - including administrators - who subsequently view pages containing the injected content. The vulnerability stems from insufficient input sanitization and output escaping in form submission handling, carrying a CVSS 7.2 with scope change (S:C), reflecting that injected scripts break out of the plugin's security context into the broader browser session. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated nature and scope change elevate real-world risk for sites with publicly accessible forms.
Editor-level privilege escalation in the PublishPress Capabilities WordPress plugin (versions ≤ 2.45.0) enables authenticated users holding an Editor role to exceed their intended permission boundary and gain unauthorized elevated capabilities. The root cause is incorrect privilege assignment (CWE-266) within the plugin's capability management logic, and with a CVSS base score of 7.2 (High) reflecting high impact across confidentiality, integrity, and availability, the flaw is most dangerous on multi-tenant or agency WordPress sites where Editor accounts are distributed to semi-trusted users. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized document restoration in Frappe Framework exposes a missing authorization flaw where any authenticated user can invoke the restore and bulk_restore API endpoints to recover soft-deleted documents without possessing the required document-level permissions. Affected releases span all versions prior to 15.110.0 (v15 branch) and 16.20.0 (v16 branch). No public exploit or CISA KEV listing is present, but the low attack complexity and broad authenticated-user scope make this a credible insider or compromised-account threat with high integrity impact per the CVSS 4.0 signal.
Denial of service in TimescaleDB through 2.29.1 allows authenticated database users holding DML privileges on a compressed hypertable to permanently crash the PostgreSQL backend on any reverse-order scan. The root cause is an unsigned integer underflow in the Gorilla compression reverse row iterator's bucket index computation when decompressing a crafted BitArray with zero elements, triggering a SIGSEGV that recurs on every subsequent reverse scan of the affected chunk until the malicious datum is removed or the database is patched. No public exploit has been identified at time of analysis and CISA KEV listing is absent, but the persistence of the malicious datum and low attack complexity make this a high-priority patch for any TimescaleDB deployment exposing DML access to untrusted users.
Broken access control in diboot-core's POST /common/load-related-data endpoint allows any authenticated user - including accounts with zero roles - to exfiltrate @JsonIgnore-annotated secret fields (authSecret, secretSalt) for every account in the system. The sole security guard, relatedDataSecurityCheck(), returns true unconditionally, making authorization enforcement completely absent. Because diboot uses Apache Shiro's two-iteration MD5 with an 8-character salt for password storage, disclosed hashes are trivially cracked offline, converting this confidentiality flaw into a full administrative takeover path. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the low exploitation complexity and the fact that the endpoint is required by the official diboot-admin-ui frontend means the attack surface is present in any standard deployment.
Broken Access Control in the AnsPress WordPress plugin version 4.4.4 allows authenticated subscriber-level users to perform high-integrity write operations that should be restricted to higher-privileged roles. The CVSS vector (PR:L, I:H) confirms low-privilege network exploitation with no user interaction required, making any WordPress site with open user registration a viable target. No active exploitation has been confirmed (not in CISA KEV), and no public POC is referenced in available data.
Broken access control in Frontend Admin by DynamiApps (WordPress plugin, versions ≤ 3.29.10) allows subscriber-level authenticated users to perform unauthorized privileged operations, resulting in high availability impact and limited integrity compromise on affected WordPress installations. The flaw stems from missing authorization checks (CWE-862), permitting low-privilege users to invoke restricted plugin functionality without proper capability verification. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds read in TimescaleDB's bulk text dictionary decompressor allows authenticated database users with DML access to crash PostgreSQL backends or produce corrupt aggregation results by injecting a crafted Simple8b selector-11 value into a compressed hypertable. The defect bypasses Arrow dictionary-index validation and is reached through the VectorAgg single-text hashing aggregation path, making it exploitable via ordinary SQL DML and SELECT operations against an affected compressed chunk. No public exploit code has been identified at time of analysis, and the fix is available as upstream commit 517c13e (PR #10360) but has not been confirmed in a tagged release.
Out-of-bounds memory read in Contiki-NG's DNS/mDNS resolver exposes adjacent device memory and can crash the resolver on constrained IoT hardware. The root defect is in `skip_name()` within `os/services/resolv/resolv.c`, which traverses DNS wire-format name labels with no packet-boundary guard; the caller `newdata()` drives iteration using an attacker-controlled `nquestions` field from the DNS header before the transaction ID is validated, enabling an attacker to force the function past the end of `uip_buf`. On mDNS-enabled builds, any local-segment peer can trigger this unauthenticated with a single multicast UDP packet to port 5353 and no outstanding query required; on standard DNS builds, an attacker able to inject a spoofed DNS response during an active query achieves the same effect. No public exploit has been identified at time of analysis.
Missing authorization in eScriptorium through version 26.04.1 allows any authenticated remote user to hijack access rights to another user's private OCR model or revoke any user's model access via direct POST requests. The ownership check is implemented exclusively in get_context_data(), a Django method that executes only during GET-based template rendering, leaving the POST-based create and delete operations for OcrModelRight views entirely unguarded. This is a privilege escalation affecting multi-tenant institutional instances where researchers share the platform; no public exploit has been identified at time of analysis and the CVE is not in CISA KEV.
Cross-site scripting in WooCommerce Multilingual & Multicurrency plugin for WordPress (all versions through 5.5.6) allows subscriber-level users to inject and store malicious JavaScript payloads that execute in the context of other users' browsers, including site administrators. The scope-changed CVSS vector (S:C) indicates the script runs outside the plugin's own security context, enabling session hijacking, credential theft, or administrative account takeover. Reported by Patchstack as EUVD-2026-53914; no public exploit code or CISA KEV listing identified at time of analysis.
Reflected Cross-Site Scripting in SEO Plugin by Squirrly SEO versions up to and including 14.2.0 allows unauthenticated network attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into visiting a crafted URL. The scope change in the CVSS vector (S:C) indicates the injected script can access resources beyond the plugin's immediate context, enabling session hijacking, credential theft, or malicious redirects against WordPress site visitors and administrators alike. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the unauthenticated attack vector with low complexity makes this straightforward to weaponize once a target is identified.
Unauthenticated reflected cross-site scripting in WP Data Access WordPress plugin (versions up to and including 5.5.79) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into a victim's browser session by tricking them into clicking a crafted URL. The CVSS scope change (S:C) indicates the malicious script executes outside the plugin's direct security context - within the victim's browser - enabling session hijacking, credential theft, or unauthorized administrative actions against authenticated WordPress users. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated entry point and low attack complexity make this accessible to low-skilled attackers.
Unauthenticated cross-site scripting (XSS) in the Events Manager WordPress plugin versions 7.4.1 and earlier enables remote attackers without credentials to inject arbitrary JavaScript into pages rendered for other users. The CVSS 7.1 score is driven by a scope change (S:C), meaning injected scripts execute in victims' browsers outside the plugin's security context - enabling session hijacking, credential theft, or unauthorized actions performed on behalf of authenticated users including administrators. No public exploit code or active exploitation has been confirmed at time of analysis, but the unauthenticated network-accessible attack vector significantly lowers the bar for opportunistic targeting of any WordPress site running this plugin.
Cross-site scripting in WPIDE - File Manager & Code Editor (WordPress plugin by xplodedthemes, versions ≤ 3.5.7) permits unauthenticated remote attackers to inject and execute arbitrary JavaScript in the browsers of users who visit a page containing the malicious payload. The CVSS scope change (S:C) indicates the injected script executes beyond the plugin's own security context, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim user - particularly damaging if the victim is an authenticated WordPress administrator with access to file management and code editing features. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Reflected Cross-Site Scripting in the Advanced AJAX Product Filters WordPress plugin (versions ≤ 3.2.0.3 by BeRocket) allows unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by inducing them to click a crafted URL targeting the plugin's AJAX filter endpoints. With a Changed scope (S:C), successful exploitation breaks the browser security boundary, enabling session hijacking, credential theft, or malicious redirect attacks against WooCommerce store visitors. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-authentication requirement lowers the barrier for opportunistic targeting of WooCommerce deployments.
Unauthenticated cross-site scripting in the Easy PayPal Buy Now Button WordPress plugin (versions ≤ 2.0.4) allows remote, unauthenticated attackers to inject arbitrary JavaScript that executes in the browsers of users who load the affected page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) reflects low-complexity network exploitation requiring no credentials, with a scope change that impacts the victim's browser context across confidentiality, integrity, and availability dimensions, yielding a score of 7.1. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Unauthenticated Cross-Site Scripting in the Survey Maker WordPress plugin (versions <= 5.2.3.3) permits remote attackers without any credentials to inject arbitrary JavaScript that executes in a victim's browser when they interact with an affected survey page. The CVSS Changed scope (S:C) confirms the payload crosses from the plugin context into the victim's browser session, enabling session cookie theft, credential harvesting, or unauthorized actions performed on behalf of the victim. No public exploit code or CISA KEV listing has been identified at time of analysis.