Stored cross-site scripting in the YMC Filter WordPress plugin (all versions before 3.12.9) allows Author-role users to upload malicious SVG files whose embedded JavaScript executes in the browsers of any site user - including administrators - who views the file. A publicly available proof-of-concept exploit exists via WPScan, lowering the skill bar significantly for attackers who already hold an Author-level account. The EPSS score of 0.15% (5th percentile) indicates negligible automated exploitation activity, placing real-world risk primarily in multi-author WordPress environments where untrusted contributors hold Author-level access.
Unauthorized data exposure in the WP Directory Kit WordPress plugin (all versions before 1.5.5) allows any authenticated user - including low-privilege Subscribers - to retrieve stored contact messages and associated personal data belonging to other users by invoking an unprotected AJAX endpoint. The root cause is the complete absence of WordPress authorization checks and nonce verification on an authenticated AJAX action, meaning the plugin performs no ownership or permission validation before returning sensitive inter-user data. A publicly available proof-of-concept has been published by WPScan; however, EPSS sits at just 0.14% (4th percentile) and no CISA KEV listing exists, indicating low observed exploitation activity at time of analysis despite the public PoC.
WP Directory Kit WordPress plugin before version 1.5.5 exposes sensitive site data to any authenticated user due to missing authorization and nonce validation on an AJAX endpoint. Any subscriber-level account holder can trigger the vulnerable action to enumerate the full WordPress user list and access unpublished directory listings belonging to other users - data that should be restricted to privileged roles. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.14% (4th percentile), suggesting exploitation has not yet become widespread despite the low barrier to abuse.
Visitor analytics data exposure in WP Statistics WordPress plugin versions before 14.16.10 allows any authenticated WordPress user - including those with only Subscriber-level access - to invoke dashboard analytics AJAX handlers and retrieve the site's full visitor metrics without authorization. The plugin's AJAX handlers validate a WordPress nonce but omit the required capability check, and because WordPress issues valid nonces to all authenticated users regardless of role, this effectively grants analytics read access to anyone with a site account. Publicly available exploit code exists per WPScan reporting, though no active exploitation is confirmed in the CISA KEV catalog and EPSS remains at 0.14% (4th percentile), indicating limited observed mass exploitation to date.
Server-side request forgery in Flowise through 3.1.4 allows attackers to reach Oracle Cloud Infrastructure (OCI) and Alibaba Cloud instance metadata services by exploiting an incomplete deny-list in the SSRF guard (`httpSecurity.ts`). The DEFAULT_DENY_LIST omits the OCI metadata IP 192.0.0.192 and the Alibaba Cloud metadata IP 100.100.100.200, enabling credential theft from the cloud metadata layer. No public exploit identified at time of analysis in CISA KEV, but publicly available exploit code exists on GitHub, and the vendor's website now resolves to a sunset page, suggesting no official patch will be issued.
Reflected XSS in the Link Library WordPress plugin before 7.9.4 allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into visiting a crafted URL containing an unsanitized parameter. The CVSS scope is Changed (S:C), meaning attacker-controlled script runs in the victim's browsing context, enabling session theft or privilege escalation against logged-in WordPress users. No public exploit identified at time of analysis is contradicted here - a publicly available exploit code exists per WPScan, though EPSS of 0.17% (7th percentile) indicates limited observed exploitation at time of analysis and no CISA KEV listing exists.
Stored cross-site scripting in the YMC Filter WordPress plugin (versions 3.6.0 through 3.12.7) enables any Contributor-level authenticated user to persistently inject arbitrary JavaScript into layout builder settings, which then executes in every site visitor's browser via an unsanitized public endpoint. The plugin compounds the flaw by failing to verify object ownership when saving layout settings, meaning low-privilege users can overwrite settings they do not control. A public proof-of-concept is available via WPScan; the vulnerability is patched in version 3.12.8.
Dokan's WooCommerce multivendor marketplace WordPress plugin (versions before 5.0.11) exposes a broken object-level authorization flaw in one of its order REST API endpoints, enabling any authenticated vendor to grant their own customers free download access to paid downloadable files belonging to other vendors without the file owner's consent. Publicly available exploit code exists for this issue, reported by WPScan. Despite a CVSS score of 5.4 (Medium) and confirmed POC availability, the EPSS probability of 0.13% (3rd percentile) indicates that widespread automated exploitation is not currently observed, though the business impact - unauthorized file distribution and revenue theft across a multivendor marketplace - is directly harmful to affected platform operators.
Download Monitor WordPress plugin versions before 5.2.6 fails to enforce authorization on an AJAX download-logging endpoint and simultaneously leaks the nonce that would normally gatekeep it to unauthenticated visitors, enabling arbitrary log injection. Any unauthenticated remote attacker can inject fabricated entries into the plugin's download log to artificially inflate a site's download statistics. Publicly available exploit code exists per WPScan reporting; however, with no CISA KEV listing and an EPSS of 0.14% (3rd percentile), real-world exploitation appears limited to opportunistic or targeted campaigns rather than widespread active abuse.
Price manipulation in the Appointment Hour Booking WordPress plugin (all versions before 1.5.88) allows any unauthenticated visitor to submit a crafted booking request with an attacker-controlled price - including zero or negative amounts - that the server accepts without validation and stores as authoritative, corrupting both booking and payment records. A publicly available proof-of-concept has been disclosed via WPScan, though the EPSS score of 0.14% (3rd percentile) indicates minimal observed exploitation at this time. Vendor-released patch version 1.5.88 is available and resolves the missing server-side price validation.
Path traversal in the AI Engine WordPress plugin before 3.6.6 allows server-side file contents to be read and exfiltrated to an external AI service without path sanitization. When the plugin's public API feature is enabled (a non-default setting), subscriber-level users can trigger this; otherwise the same flaw is accessible to WordPress administrators - and on multisite installations, a non-super subsite administrator can exploit it to read network-wide configuration files and extract embedded secrets such as database credentials and API keys. A publicly available proof-of-concept exists per WPScan; EPSS sits at 0.16% (5th percentile), indicating limited opportunistic scanning activity to date but no confirmed mass exploitation.
Authentication bypass in the Newsletters WordPress plugin (all versions before 4.16) allows remote unauthenticated attackers to gain privileged API access via PHP type juggling against a non-strict key comparison. Exploitation is conditional on the plugin's optional API being enabled, but when active, attackers can modify subscriber records and send bulk emails without any credentials. A publicly available proof-of-concept is documented by WPScan; EPSS at 0.19% (9th percentile) suggests limited automated exploitation to date, and no CISA KEV listing has been issued.
Unauthorized file deletion in AI Engine WordPress plugin (before 3.6.4) allows a network attacker who has obtained a guest user's session cookie and file reference to delete that guest's uploaded chatbot files without any server-side ownership check. The plugin authorizes deletion actions solely on a client-supplied session value, making it vulnerable to CWE-639 (Authorization Bypass Through User-Controlled Key). A publicly available proof-of-concept exists per WPScan, though EPSS at 0.14% (3rd percentile) indicates exploitation has not yet been observed at scale.
Command injection in INQUIRELAB mcp-bridge-api's Servers Endpoint allows unauthenticated remote attackers to execute arbitrary OS commands by manipulating the command/args parameters in mcp-bridge.js without sanitization. The product uses a rolling release model and all commits up to b30a82aa1d1d1139e0de846c41c8aadee6e06114 are confirmed affected. No released patch exists - a remediation pull request has been submitted but was awaiting acceptance at time of disclosure. No public exploit or KEV listing identified at time of analysis.
Stored Cross-Site Scripting in the Easy Accordion WordPress plugin (versions ≤ 3.1.8) enables authenticated contributors to persist malicious scripts in page content by supplying a crafted value for the `accordionTitleTag` block attribute. The `accordion_header_renderer()` function incorrectly uses WordPress's `esc_attr()` sanitizer - designed for HTML attribute values - when emitting a user-supplied tag name in an HTML tag-name context, where `tag_escape()` is required; this mismatch permits injection of arbitrary HTML elements and event handlers. No public exploit code or active exploitation has been confirmed at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Command injection in Kirachon context-engine up to version 1.9.0 allows adjacent authenticated attackers to execute arbitrary OS commands through the review-git-diff MCP endpoint. The root cause is the execGitCommand function in src/mcp/utils/gitUtils.ts passing user-supplied git reference arguments - branch names, commit hashes, and path patterns - directly to a shell-invoked subprocess without sanitization, enabling shell metacharacter injection. No public exploit has been independently distributed, though the patch commit itself embeds proof-of-concept test cases confirming the injection vector; version 1.9.1 resolves the issue.