Unauthenticated stored or reflected Cross-Site Scripting in the Houzez Property Feed WordPress plugin (versions <= 2.5.48) allows remote unauthenticated attackers to inject arbitrary JavaScript into pages served to victims. The CVSS scope change (S:C) confirms the malicious script executes in the victim's browser context beyond the plugin's own trust boundary, enabling session hijacking, credential theft, or administrative account takeover if a privileged user is targeted. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Cross-site scripting in the AI Engine WordPress plugin (versions up to and including 3.6.8) allows remote unauthenticated attackers to inject arbitrary JavaScript into a victim's browser session when the victim interacts with a crafted payload. The CVSS scope change (S:C) confirms execution occurs outside the plugin's security context, enabling session hijacking, credential theft, or unauthorized administrative actions against authenticated WordPress users. No public exploit code has been confirmed and this vulnerability does not appear in the CISA KEV catalog at time of analysis.
Unauthenticated XSS in the Super Socializer WordPress plugin (versions 7.14.5 and earlier) allows remote attackers to inject arbitrary JavaScript into pages viewed by other users without any prior authentication. The scope change (S:C in the CVSS vector) confirms the payload executes outside the plugin's own origin, enabling session theft, credential harvesting, or malicious redirects against site visitors. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero authentication requirement lower the bar for opportunistic exploitation.
Unauthenticated XSS in the AffiliateWP WordPress plugin (versions ≤ 2.35.0) allows remote attackers to inject malicious scripts that execute in victims' browsers, with scope change (S:C) indicating the injected code crosses the plugin's security boundary into the broader browser session. Exploitation requires a victim to interact with a crafted link (UI:R), meaning fully automated drive-by attacks are not possible, but a phishing or malicious-link delivery campaign could enable session hijacking or administrative action abuse against authenticated WordPress users. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated stored or reflected cross-site scripting in the Simply Schedule Appointments WordPress plugin (versions up to and including 1.6.12.10) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages viewed by victims. The CVSS scope-changed vector (S:C) indicates the injected script executes in the victim's browser context, enabling session hijacking, credential theft, or malicious redirects against authenticated users - including WordPress administrators. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated attack path lowers the barrier for opportunistic exploitation significantly.
Unauthenticated cross-site scripting in wpDataTables WordPress plugin (versions up to and including 7.5.1) allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser without any authentication. The CVSS vector (PR:N, S:C) confirms the attacker requires no login to submit a malicious payload, while the scope change indicates script execution crosses into the victim's authenticated browser session - enabling session hijacking, credential theft, or admin-level actions on behalf of a logged-in WordPress user. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the unauthenticated and low-complexity nature of the attack makes it a practical risk for any site running the affected plugin with public-facing table inputs.
Unauthenticated cross-site scripting in SiteGuard WP Plugin versions up to and including 1.8.6 allows a remote, unauthenticated attacker to inject arbitrary JavaScript that executes in the browser of a user who interacts with the crafted content. The changed scope (S:C in CVSS) indicates the injected script runs in the victim's browser security context rather than the server's, enabling session hijacking, credential theft, or unauthorized administrative actions on the WordPress site. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated cross-site scripting in the Ninja Tables WordPress plugin (versions up to and including 5.2.9) enables remote attackers to inject arbitrary JavaScript into victim browsers without any prior authentication. The CVSS vector (PR:N, UI:R, S:C) confirms the attack crosses scope boundaries into the victim's browser session, making session hijacking, credential theft, or admin-context exploitation realistic outcomes. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the zero-privilege requirement significantly lowers the bar for opportunistic targeting of WordPress installations running this plugin.
Unauthenticated Cross-Site Scripting (XSS) in the Media Library Assistant WordPress plugin affects all versions up to and including 3.38, allowing remote attackers without any authentication to inject malicious scripts into pages viewed by victims. The scope change indicated by the CVSS vector (S:C) suggests the injected script executes in a security context beyond the plugin itself, potentially enabling session hijacking, credential theft, or malicious redirects against authenticated WordPress users including administrators. No public exploit code or active exploitation has been confirmed at time of analysis, but the unauthenticated nature and low attack complexity elevate practical risk on exposed WordPress installations.
Unauthenticated reflected Cross-Site Scripting (XSS) in the EmbedPress WordPress plugin affects all versions up to and including 4.5.6, allowing a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms the attack requires no authentication and succeeds on default configurations, though a victim must be socially engineered into clicking a crafted link. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated nature and low attack complexity make this accessible to opportunistic threat actors targeting WordPress-based sites.
Unauthenticated Cross-Site Scripting in the Popup Maker WordPress plugin (versions up to and including 1.23.0) allows any remote, unauthenticated attacker to inject malicious JavaScript that executes in the browser of any user who views the affected popup content. The CVSS vector S:C (scope change) confirms the injected script crosses a security boundary, enabling session hijacking, credential theft, or admin-level actions performed on behalf of the victim. No public exploit has been identified at time of analysis, and no CISA KEV listing is present, but the unauthenticated trigger surface (PR:N) makes this a tangible risk for any WordPress site running the affected plugin.
Cross-site scripting in Forminator WordPress plugin (WPMU DEV) versions up to and including 1.56.0 enables unauthenticated remote attackers to inject arbitrary JavaScript into pages rendered by affected WordPress installations. The CVSS vector (PR:N, S:C) confirms no authentication is required to plant the payload, while victim interaction (UI:R) is necessary for execution - consistent with a stored or reflected XSS pattern where a privileged user (e.g., site administrator) must view attacker-controlled content. No public exploit code or active exploitation has been identified at time of analysis; this is a researcher-reported disclosure via Patchstack.
Unauthenticated Cross-Site Scripting in JetEngine WordPress plugin (versions 3.8.13.1 and below) allows a remote, unauthenticated attacker to inject malicious JavaScript that executes in a victim's browser after social-engineering them into visiting a crafted URL or interacting with attacker-controlled content. The vulnerability carries a CVSS 7.1 score with a changed scope (S:C), meaning successful exploitation can breach the security context of the victim's browsing session - enabling session hijacking, credential theft, or administrative action execution when the victim is a logged-in WordPress user. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-authentication requirement lowers the barrier for opportunistic targeting of WordPress sites running this plugin.
Unauthenticated cross-site scripting in the Facebook for WooCommerce WordPress plugin version 3.7.5 and earlier allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser without any prior authentication. The scope change (S:C) in the CVSS vector confirms the script executes in the victim's browser context, enabling session hijacking, credential theft, or malicious redirects against WooCommerce store visitors or administrators. No public exploit code has been identified at time of analysis, and this vulnerability has not been added to the CISA KEV catalog.
Unauthenticated Cross-Site Scripting in the Rank Math SEO WordPress plugin (versions up to and including 1.0.274.1) allows remote attackers to inject arbitrary scripts into pages rendered in the browsers of site visitors or administrators without holding any authenticated session. The CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C) reflects changed scope - meaning a successful attack can affect browser contexts beyond the plugin itself, enabling session hijacking against logged-in WordPress administrators. No public exploit code and no CISA KEV listing are confirmed at time of analysis, but the unauthenticated attack surface on one of the most widely deployed WordPress SEO plugins elevates practical urgency.
Unauthenticated cross-site scripting in the Thrive Architect WordPress page builder plugin (versions up to and including 10.9.3.1) allows remote attackers to inject and execute arbitrary JavaScript in victims' browsers without any authentication. The CVSS vector confirms a scope change (S:C), meaning injected scripts run in a browser security context separate from the plugin itself - enabling session hijacking, credential theft, or unauthorized actions on behalf of authenticated users such as administrators. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS data was not provided in the source intelligence.
Unauthenticated cross-site scripting in GiveWP WordPress plugin versions 4.16.5 and earlier allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by tricking them into interacting with a crafted request or link. The changed scope (S:C) indicates the injected script executes in the browser context outside the plugin's own origin, enabling session hijacking, credential theft, or malicious redirects targeting authenticated site administrators or donors. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis.
Cross-site scripting in the Facebook for WordPress plugin (versions up to and including 5.2.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL or page. The CVSS vector confirms no authentication is required (PR:N) and that the attack crosses into the victim's browser security context (S:C), enabling session hijacking, credential harvesting, or page defacement against any user who interacts with the malicious content. No public exploit code or CISA KEV listing has been identified at time of analysis, but the plugin's broad commercial deployment on WordPress sites significantly amplifies real-world exposure.
Cross-Site Request Forgery in the Tracking Code Manager WordPress plugin (versions up to and including 2.6.0) enables remote unauthenticated attackers to inject persistent malicious scripts via a CSRF-to-Stored-XSS attack chain. The Patchstack advisory explicitly frames this as 'CSRF to Stored XSS,' meaning a forged request submitted through a logged-in administrator's session can permanently inject arbitrary JavaScript into the plugin's tracking code settings, subsequently executing in the browsers of all site visitors. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack requires only tricking an admin into visiting a crafted page - a low barrier for a capable attacker.
Race condition in the Linux kernel's ARC EMAC Ethernet driver exposes a use-after-free window during driver probe teardown on ARC processor-based embedded systems. When probe unwinds after devm_request_irq() installs the interrupt handler, stale or firmware-latched EMAC interrupt status bits can fire arc_emac_intr() concurrently with net_device deallocation, potentially corrupting kernel memory. Patched versions are available across all active stable branches (5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.19, 6.19.9, 7.0); no public exploit or CISA KEV entry exists at time of analysis.
Denial of service (and possibly information disclosure) in the Apache Portable Runtime Utility (APR-util) library through version 1.6.3 lets remote attackers crash any consumer that parses attacker-supplied XML via apr_xml_quote_elem(). The flaw is an uncontrolled stack recursion (CWE-674) triggered by deeply nested or malicious XML; no authentication or user interaction is required. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CISA SSVC framework rates it automatable, so scanning-driven abuse is plausible.
Incomplete session cleanup in poco-ai/poco-agent up to version 0.5.4 can permanently destroy the host user's ~/.claude directory - including all Claude Code chat history stored under ~/.claude/projects - when the agent runs outside a container environment. The WorkspaceManager._setup_session_persistence method performs an unconditional rmtree followed by a symlink swap on ~/.claude without verifying a container context, and the corresponding cleanup phase can additionally unlink pre-existing ~/.claude symlinks unrelated to poco-agent. A publicly available exploit exists via GitHub issue #131 and PR #132, though the CVSS 4.0 base score of 2.9 reflects high attack complexity and impact limited to low integrity and availability loss with no confidentiality breach.
Stored XSS in AIL Framework's crawler domain view (versions ≤ 7.0.0) lets a low-privileged attacker embed executable JavaScript inside crawled URL values that persist in the AIL datastore. The payload triggers within an authenticated analyst's browser session the moment they click the screenshot icon for the malicious crawler entry, granting the attacker access to session data and the ability to perform application actions as that analyst. No CISA KEV listing or public exploit code has been identified at time of analysis; the CVSS 4.0 score of 6.9 reflects high confidentiality impact tempered by required user interaction and low-privilege preconditions.
Stored cross-site scripting in AIL Framework's Chat Explorer and Forum Explorer views allows an attacker who can influence indexed dark-web content to inject arbitrary JavaScript into translation button onclick handlers, executing in the analyst's browser under the AIL security origin. Versions up to and including 7.0.0 are affected; the vulnerability stems from Jinja2 templates passing message and post identifiers through HTML escaping rather than JavaScript-safe encoding, leaving single-quote and escape-sequence injection paths open. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified; exploitation requires the victim analyst to click the 'Translate to preferred language' button, limiting automated attack surface.
Information disclosure and tampering in Dell RVTools collector versions prior to 4.8.1 stems from improper certificate validation (CWE-295), letting a remote unauthenticated attacker in a machine-in-the-middle position intercept or alter data exchanged between the collector and its target. Rated CVSS 9.1 (C:H/I:H) but with A:N, the flaw affects the popular VMware vSphere inventory-reporting utility. No public exploit is identified at time of analysis; EPSS is low at 0.14% and SSVC lists exploitation as none.
Authorization scope escalation in Apache CXF's OAuth2 Dynamic Client Registration endpoint allows any registering client to self-assign privileged scopes by supplying arbitrary `scope` values in the registration request, which the authorization server stores verbatim without validating against a server-defined allowlist. Affected versions span the 3.x, 4.1.x, and 4.2.x release lines; patched releases 3.6.12, 4.1.8, and 4.2.3 are available per the Apache advisory. No public exploit or active exploitation has been identified at time of analysis, but the straightforward exploitation path - crafting a single registration request - makes this a meaningful authorization bypass risk for any deployment exposing CXF's OAuth2 AS with Dynamic Client Registration enabled.
Session cookie theft in the DataPress (Dataverse Integration) WordPress plugin before 2.91 allows any Contributor-level user to steal session credentials from higher-privileged users such as Editors or Administrators. The plugin's template rendering feature improperly exposes the session data of users who view affected content, enabling privilege escalation via session hijacking. No public exploit code has been identified at time of analysis, but the low barrier to entry (Contributor role) makes this a realistic insider or compromised-low-privilege-account threat against WordPress sites using this plugin.
Uninitialized heap memory disclosure in FFmpeg's native TIFF decoder (libavcodec/tiff.c) exposes stale heap contents to any party able to retrieve decoded image output. Affected versions span 0.5 through 8.x; FFmpeg 9.0 carries the upstream fix. In server-side media pipelines that accept and return processed TIFF files - transcoding APIs, thumbnail generators, upload handlers - an attacker can craft a structurally valid Deflate-compressed TIFF strip that inflates short, causing the decoder to embed prior heap allocation remnants into the decoded output, potentially leaking sensitive in-process data. No active exploitation is confirmed (not in CISA KEV) and no standalone public exploit code was identified at time of analysis.
Uninitialized heap memory read in FFmpeg's native Screenpresso decoder (libavcodec/screenpresso.c) allows an attacker who can supply crafted SPV1-encoded video to recover stale heap contents - including userspace addresses and prior-frame data - from the process decoding the media. Affected versions span FFmpeg 3.0 through 8.x; version 9.0 resolves the issue via upstream commits and PR #23896. No active exploitation is confirmed in CISA KEV, and no public exploit code has been identified at time of analysis, but the information-disclosure primitive is particularly dangerous in persistent server-side decoding pipelines where heap residue from earlier operations may include sensitive material.
Heap memory disclosure in FFmpeg's native RSCC decoder (libavcodec/rscc.c) allows an attacker who can supply a crafted video file to expose residual heap contents - including data from prior heap allocations or previously decoded frames - to any downstream consumer of the decoded output. The flaw stems from rscc_decode_frame() calling av_image_copy_plane() without verifying that the number of decompressed bytes matches the declared tile geometry, allowing the unwritten suffix of the persistent ctx->inflated_buf to propagate silently into the output frame. All FFmpeg builds from 3.0 through 8.x are affected; no public exploit has been identified at time of analysis, and no KEV listing exists.
Null pointer dereference in the llama.cpp LLaMA-Android JNI wrapper's bench_1model() function allows denial of service via a crafted model file. Builds b1886 through b7445 (packaged releases 0.9.0-0.17.1) are affected; the function skips null validation on the model context pointer before dereferencing it, so supplying a malformed or truncated GGUF model file triggers a SIGSEGV that terminates the Android application process. No public exploit has been identified at time of analysis and this is not listed in CISA KEV, but the attack path is mechanically simple for anyone able to deliver a crafted model to the device.
Unauthenticated appointment injection in OpenReception appointment-booking-software prior to version 1.0.5 allows any remote caller to insert CONFIRMED appointments into arbitrary client tunnels by exploiting a missing authorization gate on the `add-to-tunnel` endpoint. The endpoint accepted any POST supplying a valid `emailHash` - used only as a tenant existence check - alongside an unrelated valid `tunnelId`, writing attacker-controlled appointment fields (ciphertext content, date, duration, agent) without a session, Authorization header, booking access token, or proof-of-work. No CISA KEV listing or public POC is identified at time of analysis, but the exploit pattern is structurally straightforward once valid identifiers are obtained.
Log injection and unauthenticated denial-of-service in OpenReception appointment-booking-software prior to version 1.0.2 expose security operations teams to forged log events indistinguishable from legitimate application output. Any unauthenticated network attacker can POST arbitrary content to the `/api/log` endpoint, inject newline-delimited fake log lines into stdout and downstream SIEM pipelines, mask malicious activity behind crafted noise, or saturate the logging pipeline at 100+ requests per second. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the trivial exploitation bar (no authentication, no special conditions, default configuration) warrants prompt patching.
Arbitrary file download via path traversal in the Unlimited Elements For Elementor WordPress plugin (versions ≤ 2.0.14) allows authenticated Contributor-level users to retrieve arbitrary files from the server filesystem. Exploitation requires only low-privilege WordPress credentials and no user interaction, with high confidentiality impact - sensitive files such as wp-config.php containing database credentials are directly at risk. No public exploit or active exploitation has been confirmed at time of analysis, but the low attack complexity and broad deployment of Elementor-based WordPress sites elevates the practical urgency of patching.
Unauthorized entry disclosure in Statamic CMS exposes restricted content to any authenticated Control Panel user, regardless of their assigned role permissions. Any CP account - even one holding only the 'access cp' permission - can read entry content, custom field values, and unpublished drafts from any collection by querying the navigation pages endpoint. No data can be modified. Vendor-released patches exist for both active branches (5.74.1 and 6.24.0); no public exploit or active exploitation has been identified at time of analysis.
Unsafe method invocation via Antlers template resolution in Statamic CMS enables unauthenticated remote attackers to destroy content and stored assets on affected installations. Sites running statamic/cms below 5.74.1 or in the 6.x line below 6.24.0 are vulnerable when their templates incorporate user-supplied input into Antlers template resolution - a deployment pattern present on developer-facing or dynamic sites. No public exploit or CISA KEV listing is identified at time of analysis; the CVSS AC:H rating reflects the required site-configuration precondition, tempering real-world exposure despite the destructive impact.
Broken Authentication in Gutena Forms WordPress plugin (versions <= 1.9.0) allows unauthenticated remote attackers to bypass authentication controls, resulting in limited integrity and availability impacts against form configurations or submissions. The vulnerability is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and was reported by Patchstack. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and lack of authentication requirements make it straightforward to attempt against any exposed WordPress installation running the affected plugin.
Prototype pollution in Mermaid's architecture-beta diagram renderer (mermaid@11.5.0 through 11.16.0) allows an untrusted diagram author to write the string 'horizontal' or 'vertical' directly onto Object.prototype by supplying '__proto__' as a valid group parent identifier. All JavaScript code sharing the same runtime realm that reads or enumerates the injected property name may observe corrupted option defaults, bypassed truthiness checks, or denial-of-service conditions in the embedding application. A public proof-of-concept is included in the advisory; direct remote code execution is not achievable because the injectable value is constrained to those two strings, ruling out function or object injection.
The billing controller in Postiz (postiz-app) before v2.21.10 allows exploitation of an unauthenticated or lightly authenticated API endpoint to activate permanent top-tier paid subscriptions without financial transaction, by forging or replaying lifetime-deal redemption codes against a backend that performs no cryptographic validation or single-use enforcement. The vulnerable `/lifetime` POST endpoint passed user-supplied codes directly into the Stripe-integrated `lifetimeDeal` service with no server-side state verification, a textbook CWE-345 (Insufficient Verification of Data Authenticity) failure. No public exploit has been identified and this CVE is not listed in CISA KEV; the fix in v2.21.10 was complete endpoint removal, confirmed via the upstream GitHub commit.
Path traversal in W3 Total Cache WordPress plugin (versions ≤ 2.10.2) enables remote unauthenticated attackers to manipulate files outside the intended cache directory without any credentials or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero-barrier network exploitation; the C:N/I:L/A:L impact profile indicates this traversal affects file integrity and availability rather than exposing arbitrary file reads, suggesting a write- or delete-capable traversal rather than a classic information-disclosure variant. No public exploit code and no CISA KEV listing are identified at time of analysis.
Unauthorized booking injection into private channels affects OpenReception appointment-booking-software ≤ 1.0.1 via a missing isPublic authorization check in the new-client booking path. An unauthenticated remote attacker solves a trivial 16-bit proof-of-work challenge, obtains a valid bearer token, and then supplies any private channelId in the create-new-client payload - bypassing the access control that protects the standard appointment path. When chained with companion finding V-10 (unauthenticated schedule endpoint leaking all private channel IDs), the entire attack requires only two unauthenticated HTTP sequences, no public exploit code identified at time of analysis.
Broken access control in the IT-Recht Kanzlei Legal Text Connector WordPress plugin (versions <= 1.0.13) allows unauthenticated remote attackers to perform unauthorized actions against the plugin's endpoints, resulting in low-severity integrity and availability impact. The root cause is CWE-862 (Missing Authorization), meaning the plugin fails to verify that a requestor has permission before executing sensitive operations. No public exploit has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.
Authorization bypass in eScriptorium through version 26.04.1 enables any authenticated remote user to overwrite other users' document parts by supplying arbitrary part primary keys to misconfigured serializer endpoints. The flaw is a Django REST Framework IDOR (CWE-639): queryset access restrictions were applied to the ManyRelatedField wrapper instead of its child_relation, rendering them completely inoperative. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the integrity impact is high in collaborative archival workflows where document content corruption is irreversible without backup.
Broken authentication in WP Event Solution WordPress plugin (versions ≤4.1.9) permits unauthenticated remote attackers to bypass authentication controls via an alternate path or channel (CWE-288), resulting in limited information disclosure and partial integrity impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable over the network with no credentials and no user interaction required against any WordPress installation running the affected plugin. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Stored Cross-Site Scripting in the Business Directory WordPress plugin (versions up to and including 6.4.24) allows authenticated subscribers to inject malicious scripts into directory listings or plugin-managed fields, which execute in the browsers of higher-privileged users - typically administrators - who subsequently view the affected content. The Scope change (S:C) in the CVSS vector confirms the injected payload escapes the attacker's privilege context and affects other users' browser sessions. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and minimal privilege requirement (subscriber account) make this straightforward to weaponize in any WordPress deployment where user registration is open.
Broken access control in Ultimate Store Kit Elementor Addons versions up to and including 3.0.5 allows unauthenticated remote attackers to perform unauthorized read and write operations against WordPress store functionality. The vulnerability stems from missing authorization checks (CWE-862) on one or more plugin endpoints or AJAX actions, enabling bypass of intended access restrictions without any credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-barrier entry (PR:N, AC:L) makes opportunistic exploitation straightforward once the specific vulnerable endpoint is identified.
Stored Cross-Site Scripting in Powerkit plugin for WordPress (versions <= 3.1.0) allows authenticated contributors to inject malicious scripts into content that executes in victims' browsers when viewed. The CVSS vector (PR:L/UI:R/S:C) confirms this is a contributor-tier, stored XSS with changed scope, meaning a low-privileged user can target higher-privileged users such as editors or administrators. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack pattern is well-understood and straightforward to execute within WordPress contributor workflows.
Stored Cross-Site Scripting in MailOptin WordPress plugin (versions ≤ 1.2.78.0) allows Contributor-level authenticated users to inject malicious JavaScript payloads that execute in the browser context of higher-privileged users - typically site administrators - when they view the affected content. The CVSS scope change (S:C) confirms the injected script escapes the contributor's own context, making this an effective privilege escalation vector in multi-author WordPress environments. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in the Ultimate Addons for Elementor WordPress plugin (versions <= 1.45.2) allows authenticated contributors to inject persistent malicious scripts that execute in the browsers of higher-privileged users such as site administrators. The CVSS vector (PR:L/UI:R/S:C) confirms this is a contributor-level stored XSS with scope change - a low-privilege WordPress role can trigger execution in an admin's browsing context, enabling session hijacking or privilege escalation. No public exploit or KEV listing has been identified at time of analysis, but Patchstack has formally reported and documented this vulnerability.
Cross-Site Request Forgery in Plugins Garbage Collector (Database Cleanup) plugin for WordPress version 0.14 and earlier enables an unauthenticated remote attacker to perform unauthorized administrative database operations by tricking an authenticated WordPress administrator into visiting a malicious page. The CVSS vector (PR:N/UI:R/I:H) confirms the attacker requires no privileges but must engineer social interaction with a privileged user, yielding high integrity impact - specifically, the ability to trigger plugin or database cleanup actions on behalf of the victim. No public exploit code and no CISA KEV listing have been identified at time of analysis.