Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER handler, causing a denial of service. The vulnerability exists in diam_log_func within lib/diameter/common/init.c, where a call to ogs_assert_if_reached() could be triggered by a crafted Capabilities Exchange Request message over the Diameter protocol. A public exploit exists and a patched release (v2.7.7) is available; no active exploitation has been confirmed via CISA KEV.
JFrog Artifactory exposes an internal anonymous-user token to unauthenticated callers even when anonymous access is explicitly disabled. Any network-reachable attacker can obtain this token and use it to access resources that should be protected behind authentication controls. No public exploit has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this a straightforward information-disclosure path against misconfigured or unpatched Artifactory instances.
Remote code execution in the Fabrik application-builder extension for Joomla (all versions before 4.6.8) lets an unauthenticated attacker run arbitrary code on the server via the frontend listfilter model. The flaw is a CWE-94 code injection reachable over the network with no authentication or user interaction, and the vendor rates it maximum severity (CVSS 4.0 base 10.0). No public exploit code has been identified at the time of analysis, and it is not listed in CISA KEV, but the combination of unauthenticated access and full code execution makes it a top-priority patch.
Remote code execution and denial-of-service in Phoenix Contact PLCnext-family industrial controllers (AXC F 1152/1252/2152/3152, RFC 4072R/S, BPC 9102S/9202S, VPLCnext Control, EPC 15xx and others) arise from a buffer overflow in the PROFINET service that is reachable in the default configuration. An unauthenticated remote attacker on the network can crash/reboot the device or execute arbitrary code, per the vendor CVSS 4.0 rating of 9.3 (critical). This is a CWE-120 classic buffer overflow reported by CERT@VDE; no public exploit identified at time of analysis and it is not on CISA KEV.
PHP Object Injection escalating to unauthenticated remote code execution affects the WooCommerce Subscriptions WordPress plugin from version 4.7.0 up to (but not including) 9.1.0, but only on stores running WooCommerce's High-Performance Order Storage (HPOS). The plugin unserializes attacker-controlled input without validation, and a gadget chain in bundled dependencies turns that into arbitrary code execution. Publicly available exploit code exists and a vendor patch (9.1.0) is available, but this is not listed in CISA KEV; the EPSS score of 28% is elevated, indicating meaningful exploitation probability.
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the intended Docker cache directory when specific remote-repository conditions are present. The CVSS 3.1 vector scores 5.3 Medium, reflecting a real but constrained integrity risk - arbitrary filesystem writes are possible, but high attack complexity and required authentication limit opportunistic abuse. No active exploitation or public exploit code has been identified at time of analysis.
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer access to crash the Session Management Function (SMF) by sending a malformed Credit-Control-Answer (CCA) message to the smf_gx_cca_cb handler. A publicly available proof-of-concept crash sample (SMF.crashes.zip) confirms exploitability; the absence of a CISA KEV listing indicates no confirmed widespread threat-actor exploitation has been reported. In 5G/4G core network deployments, an SMF crash disrupts session management for all connected user equipment, making this a higher operational risk than the CVSS medium score alone suggests.
Remote code execution in the WPMU DEV Dashboard (wpmudev-updates) WordPress plugin before 5.0.1 allows an attacker who can obtain or replay a single valid signed management request to push and execute arbitrary code on the site. The plugin's remote management interface installs packages without verifying their integrity and without replay protection, so a captured legitimate management call can be reused to install an attacker-controlled package. WPScan reports publicly available exploit code and the plugin scores CVSS 9.8; EPSS is elevated at 22%, but there is no public exploit identified as actively exploited in the wild (not in CISA KEV).
Unauthenticated arbitrary file upload in the Giftware WordPress plugin before 4.2.10 allows remote attackers to upload PHP files through an upload path that fails to validate file type (CWE-434), leading to remote code execution on the underlying web server. The flaw carries a CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N) and publicly available exploit code exists per WPScan, though it is not currently listed in CISA KEV; the EPSS score of 22% reflects meaningful but not top-tier near-term exploitation probability.
Authentication bypass in the VentraConnect Social Login WordPress plugin (all versions ≤ 1.4.3) allows unauthenticated attackers to fully hijack any existing WordPress account - including administrators - by weaponizing Spotify's unverified email field. The plugin's Generic::normalize_common() blindly copies the email value returned by Spotify's /v1/me API endpoint into the normalized user profile, and User_Links::link_or_login_user() then matches that value against WordPress accounts via get_user_by('email') and issues a persistent session cookie via wp_set_auth_cookie() without any email-verified assertion, mailbox challenge, or approval step. No public exploit has been identified at time of analysis, but the attack surface is fully network-accessible, requires no victim interaction, and yields complete site compromise; CVSS rates this 8.1 High with AC:H reflecting the prerequisite of a controlled Spotify account bearing the target's email address.
Privilege escalation and account takeover in the Events Manager WordPress plugin before 7.4.1 lets unauthenticated attackers reset passwords, promote accounts to Administrator, or delete accounts whose user ID collides with the ID of one of the plugin's own posts. The flaw stems from the plugin overriding WordPress's own capability decisions for unrelated privileged user actions. Publicly available exploit code exists (WPScan), EPSS is a notable 15%, and SSVC rates it automatable with total technical impact, though it is not currently listed in CISA KEV.
Unauthenticated remote denial-of-service in Phoenix Contact's PLCnext Engineer communication interface allows any network-accessible attacker to interrupt engineering access to a broad range of Phoenix Contact industrial controllers. Exploitation triggers CWE-770 resource exhaustion in the PLCnext service, causing it to stop accepting connections from the PLCnext Engineer client application. Recovery requires a manual service restart - an operationally significant constraint in industrial environments where unplanned downtime carries physical and safety implications. No public exploit code is known, and the vulnerability is not listed in CISA KEV at time of analysis.
Unauthenticated SQL injection in WP Directory Kit WordPress plugin (all versions before 1.5.6) allows remote attackers to read arbitrary data from the WordPress database, including user credentials and sensitive site content. The flaw was reported by WPScan, a public proof-of-concept exploit is available, and exploitation requires no authentication - though it is conditioned on a non-default search field type being configured in the plugin. Patch version 1.5.6 resolves the vulnerability; sites using customized search field configurations are the exposed population.
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipulating the Session-Id argument processed by the fd_msg_sess_get function, causing the HSS service to fail. Low-privileged network access to the Diameter interface is sufficient to exploit this flaw, and a proof-of-concept packet capture (HSS_ULR_error_poc.pcapng.zip) has been publicly released via GitHub. No active exploitation has been confirmed in CISA KEV, but the public POC materially lowers the barrier for targeted attacks against private LTE/5G deployments running this stack.
SQL injection in the KiviCare WordPress plugin (all versions before 4.5.2) enables authenticated clinic staff users to execute arbitrary SQL against the underlying WordPress database. Unsanitized user-supplied parameters are passed directly into SQL queries, granting an attacker full read, write, and delete access to database contents including patient records and credentials. With a publicly available proof-of-concept, an EPSS of 17%, and a CVSS of 8.8, this is a high-priority patch for any healthcare-sector WordPress deployment running this plugin - though no CISA KEV-confirmed active exploitation has been identified at time of analysis.
Confused-deputy privilege escalation in snowflake.core (Snowflake Python API) prior to version 1.13.0 enables attackers with low-privileged access to a downstream application to perform unauthorized Snowflake operations under the application's higher-privileged session. Two related input-sanitization weaknesses make this possible: path traversal via unencoded `..` segments in REST URL paths (CWE-22), and HTTP parameter pollution via injected `&`, `#`, or `=` characters in query strings (CWE-141), either of which can subvert swap, clone, or rename operations against unintended resources. No public exploit code has been identified at time of analysis and no CISA KEV listing is confirmed; the vendor-released fix is snowflake.core 1.13.0, available on PyPI and requiring manual upgrade.
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (multicloud-integrations / ArgoCD pull-model integration) lets a low-privileged hub tenant who can create Application CRs redirect propagation to arbitrary managed spoke clusters. Because the Application propagation controller trusts the attacker-supplied `ocm-managed-cluster` annotation without validation, an attacker forces ArgoCD on targeted spokes to sync attacker-controlled manifests, yielding code execution or privilege escalation there. CVSS 9.9 with scope change; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Financial/business-logic bypass in the Wallet for WooCommerce WordPress plugin (all versions before 1.6.10) lets a customer credit their wallet balance for less than the amount actually paid, because the plugin credits the top-up before confirming the sum the payment gateway actually collected. Any registered store customer can effectively mint store credit at a discount, causing direct monetary loss to the merchant. Publicly available exploit code exists (WPScan); the flaw is not listed in CISA KEV, and EPSS is a moderate 13%.
SQL injection in WP Directory Kit WordPress plugin (all versions before 1.5.6) allows any authenticated user - including low-privilege Subscribers - to query or manipulate the WordPress database via an AJAX endpoint that performs no input sanitization and enforces no authorization check. With a publicly available proof-of-concept reported by WPScan and an EPSS of 16%, the exploitation barrier is low for any site with user registration enabled. A vendor patch is available in version 1.5.6.
SQL injection in the Events Manager WordPress plugin (versions before 7.4.1) allows any subscriber-level or higher authenticated user to manipulate raw SQL queries and tamper with booking consent records belonging to other users. The flaw arises from a user-controlled value being interpolated directly into a database query without sanitization (CWE-89), enabling both unauthorized data disclosure and integrity violations against other users' booking records. A publicly available proof-of-concept exists per WPScan's disclosure, and an EPSS score of 16% reflects meaningful exploitation likelihood, though active exploitation has not been formally confirmed in CISA's KEV catalog.
Second-order SQL injection in Form Maker by 10Web WordPress plugin (all versions before 1.15.45) allows any subscriber-level authenticated user to execute arbitrary SQL against the WordPress database by submitting crafted input to database-backed choice fields, yielding high confidentiality and integrity impact. A publicly available proof-of-concept from WPScan lowers the exploitation barrier, and an EPSS of 16% reflects above-baseline real-world risk. No active exploitation is confirmed in CISA KEV at time of analysis, though the combination of low required privilege, network accessibility, and public exploit code makes this a credible near-term threat on unpatched installations.
Unauthenticated account creation in the Eventin WordPress plugin (all versions before 4.1.20) allows any remote attacker to register arbitrary email addresses as WordPress user accounts and inject order records by exploiting a missing authorization check on the waiting-list registration handler. The dual impact - rogue account creation and order record injection - can be chained with WordPress's built-in password reset flow to achieve full account takeover for any email address on the system. With a publicly available exploit and a 15% EPSS score placing this well above the median exploitation probability, this represents an elevated and realistic risk for all WordPress sites running the unpatched plugin; no CISA KEV listing is confirmed at time of analysis.
Blind SQL injection in the Essekia "Tablesome Table" WordPress plugin (versions up to and including 1.2.9) lets remote attackers inject malicious SQL into database queries, enabling inference-based extraction of database contents. The CVSS 3.1 score of 9.3 reflects unauthenticated network exploitability with a scope change (S:C), meaning the impact reaches the underlying WordPress database beyond the plugin itself. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Missing authentication in FitSoft's POS System exposes the entire platform to unauthenticated remote attackers who can directly access and fully operate the system over the network without any credential barrier. All versions of the product are affected per the CPE wildcard, and the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero preconditions are required beyond network reachability. No public exploit has been identified at time of analysis, but the trivial exploitation conditions make this a high-priority remediation target for any deployment with external or semi-trusted network exposure.
Unauthenticated information disclosure in WP Photo Album Plus (WordPress plugin, all versions before 9.2.07.002) allows any remote attacker to read arbitrary autoloaded WordPress option values by supplying a crafted suffix to a public, unprotected endpoint. The plugin constructs an option name from client-controlled input without restricting it to its own namespace or verifying any capability or nonce, exposing site-wide secrets stored in wp_options. A publicly available proof-of-concept exists, SSVC rates this as automatable with partial technical impact, and EPSS sits at 16%, indicating meaningful real-world exploitation interest despite the absence of a CISA KEV listing.
Unauthenticated arbitrary file deletion in WP Photo Album Plus (versions before 9.2.07.002) exposes WordPress sites to path traversal attacks through a public endpoint that accepts unvalidated client-controlled file path values with no authorization check in place. Any remote unauthenticated attacker can manipulate this path parameter to target and delete ZIP archives stored anywhere on the server, including directories outside the web root. A publicly available proof-of-concept exists, EPSS scores this at 16%, and no public exploit identified at time of analysis maps to confirmed mass exploitation - but the low attack complexity and zero authentication barrier make rapid weaponization realistic.
Unauthenticated exposure of the backup authorization secret in Total Upkeep WordPress plugin (all versions before 1.17.3) enables remote attackers to both exfiltrate sensitive backup archives and trigger arbitrary full-site restores that overwrite live site files and the database. WPScan disclosed a publicly available proof-of-concept exploit, and SSVC rates the attack as automatable, creating conditions for mass exploitation campaigns. The vendor-reported CVSS score of 7.5 covers only the confidentiality dimension and substantially understates real-world risk by omitting the integrity and availability destruction possible through forced site restores.
Unauthenticated export file disclosure in Import WP WordPress plugin (all versions before 2.14.23) allows any remote attacker to download administrator-generated export files without credentials. The export download handler performs no authorization check, exposing files that may contain user PII including email addresses, login names, and role assignments. A publicly available exploit exists (reported by WPScan), and EPSS sits at 16%, indicating meaningful real-world exploitation interest; exploitation is contingent on two prerequisites that meaningfully reduce actual exposure relative to the raw CVSS score.
Unauthenticated database export exposure in the Ezoic WordPress plugin (versions 2.6.35 through before 2.23.1) allows any remote attacker to trigger a full server-side export of the site's database, harvesting user password hashes and active password reset tokens - the latter enabling immediate account takeover without password cracking. The same missing authorization flaw (CWE-862) additionally permits unauthenticated persistent modification of plugin settings. A publicly available exploit exists per WPScan, and the CVSS vector confirms trivial remote exploitation with no authentication, interaction, or special conditions required.
Cross-tenant bearer-token disclosure in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM) lets an authenticated tenant abuse the GitOpsCluster controller in the multicloud-integrations component to redirect spoke-cluster credentials into a namespace they control. Because the controller acts on the tenant's behalf across trust boundaries (a confused-deputy flaw), a low-privileged user can obtain tokens that grant access to managed spoke clusters and bypass ArgoCD AppProject scoping controls. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS base score is 9.6 (Critical).
Cross-tenant data exposure in Velociraptor's multi-tenant GUI allows authenticated root-org users to read Stacked result sets belonging to child organizations by bypassing the prefix deny list that enforces datastore path isolation. The GUI endpoint that serves result sets does not correctly validate requested paths against the deny list, so a crafted request can resolve to a sub-org datastore directory the requester should not have access to. No public exploit has been identified and exploitation requires existing high-privilege authenticated access, but the confidentiality impact is significant in shared DFIR environments where tenant isolation is a core security guarantee.
Argument (git option) injection in Semaphore UI before 2.18.17 and 2.19.5-beta2 lets a project Manager or Owner achieve OS command execution on the server by supplying a repository git_url beginning with a dash (e.g. --upload-pack=/tmp/evil.sh). The malicious URL is passed as a positional argument to the git binary via CmdGitClient.GetLastRemoteCommitHash, triggered both by POST /api/project/{id}/repositories and by scheduled commit-hash polling, so exploitation can fire automatically without further attacker action. No public exploit identified at time of analysis, though the fixing commits and a detailed GHSA advisory publicly document the mechanism.
Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash the directory service with a single crafted BIND request. The flaw resides in `get_ldapmessage_controls_ext()`, which frees a parsed controls array when rejecting an unknown critical Session Tracking control but fails to clear the corresponding SLAPI_REQCONTROLS pblock slot - causing operation teardown to free the same pointer a second time. Affected deployments include Red Hat Directory Server 11 through 13 and the 389-ds-base package across all supported RHEL versions (6-10). No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; the CVSS AC:H rating reflects that reliable heap exploitation requires specific memory layout conditions rather than a trivially repeatable one-shot crash.
Server-Side Request Forgery in the PowerPress Podcasting plugin by Blubrry for WordPress (versions before 11.17.1) allows any authenticated Contributor-level user to supply arbitrary URLs in the Podcast Episode URL settings field, causing the server to issue unvalidated HTTP requests that can reach internal network services, cloud metadata endpoints, or other systems not directly exposed to the internet. The CVSS 7.1 score reflects high confidentiality impact against reachable internal services, and a publicly available proof-of-concept combined with a 13% EPSS score makes this an actionable priority for WordPress site operators running the plugin. No active exploitation has been confirmed in CISA KEV at time of analysis.
SQL injection in Budibase's MySQL integration (all versions prior to 3.40.0) lets attackers execute arbitrary, stacked SQL statements against connected databases because the MySQL driver is instantiated with multipleStatements: true. Malicious input submitted through Budibase app fields bound to a MySQL datasource is passed to the backend database, enabling full read/write/destroy access. A proof-of-concept is published in the GHSA advisory; there is no public exploit identified as being used in active attacks (not in CISA KEV).
Reflected Cross-Site Scripting in the WP Photo Album Plus WordPress plugin (all versions before 9.2.07.002) allows unauthenticated attackers to inject arbitrary JavaScript into a victim's browser by reflecting an unsanitized parameter directly into an inline script block on gallery pages. Exploitation requires social engineering - the victim must open a crafted link - but no attacker credentials are needed. A publicly available proof-of-concept exists, reported by WPScan, and EPSS places exploitation probability at 17%, a notably elevated figure for a reflected XSS in a plugin.
Eventin WordPress plugin versions before 4.1.20 exposes stored customer records - including names and email addresses - to any authenticated WordPress user holding contributor-level access or higher, due to missing server-side capability checks on customer data retrieval. A publicly available proof-of-concept exploit exists per the WPScan advisory, and an EPSS score of 15% places exploitation probability well above the median for medium-severity CVEs. The vendor-released patch (version 4.1.20) resolves the access control gap; no active exploitation is confirmed in the CISA KEV catalog at time of analysis.
Unauthorized access to paid course content in LearnPress WordPress plugin (all versions before 4.4.4) allows any authenticated user - including low-privilege subscribers - to retrieve lesson material from courses they have not purchased or enrolled in. The flaw resides in the plugin's AI-assistant feature, which processes lesson content requests without first verifying the requesting user's enrollment status, exposing an authorization bypass at the content-serving layer. With a publicly available proof-of-concept from WPScan and a 15% EPSS score, this is a realistic and low-barrier threat to any WordPress e-learning deployment running an affected version.
CSV formula injection in Velociraptor's export pipeline allows attacker-controlled endpoint artifacts to execute as formulas when a forensic analyst opens the exported CSV in Microsoft Excel. Affected export paths include the GUI, offline collector, and data export features - any of which may produce unsanitized CSV output when collected data contains leading formula-trigger characters (=, +, -, @, tab). No public exploit code has been identified and no CISA KEV listing exists; however, the CVSS scope-change metric (S:C) and high confidentiality rating (C:H) correctly reflect that successful exploitation results in formula execution within the analyst's own workstation environment rather than the Velociraptor server itself.
WPC Admin Columns WordPress plugin exposes arbitrary metadata to subscriber-level authenticated users through an AJAX endpoint that lacks any authorization check. Any account with the lowest default WordPress role - subscriber - can query user, post, and term metadata site-wide, including sensitive data belonging to administrator accounts. Publicly available exploit code documented by WPScan lowers the practical barrier to exploitation; patch version 2.3.4 is available and should be applied immediately.
Stored cross-site scripting in GitLab CE/EE 19.2 before 19.2.2 lets an authenticated user holding only developer-role permissions inject unsanitized HTML that executes in the browser of a higher-privileged user who opens a CI job modal, enabling privilege escalation. Publicly available exploit code exists (HackerOne report #3880796), though EPSS is modest at 0.30% (22nd percentile) and CISA SSVC records no observed exploitation. The high CVSS 9.0 is driven by a scope change and total confidentiality/integrity/availability impact once the payload runs in a victim's session.
Server-side request forgery in ProSolution WP Client WordPress plugin (all versions before 2.0.9) allows any authenticated user - including low-privileged subscribers - to force the hosting server to issue arbitrary HTTP requests to internal hosts and services, with full attacker control over request method, headers, and body. The vulnerability bypasses both WordPress capability checks and nonce verification entirely. Publicly available exploit code exists, though no CISA KEV listing confirms active in-the-wild exploitation at time of analysis.
Memory corruption in Open5GS versions through 2.7.1 is remotely exploitable via the freeDiameter protocol component, allowing low-privileged network-accessible attackers to corrupt memory with limited confidentiality, integrity, and availability impact. The vulnerability falls under CWE-119 and is tagged as a buffer overflow class flaw within the Diameter protocol handling stack used in 5G/4G core network deployments. No public exploit has been identified at time of analysis, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog; however, the telecom-grade attack surface warrants attention for operators running Open5GS in production.
Privilege escalation in Velociraptor's notebook VQL execution path allows analyst-role users to bypass the COLLECT_CLIENT permission check and schedule new client collections, a capability normally restricted to the investigator role. The bypass is achieved by executing a VQL query that resets the authorization provider, collapsing the RBAC boundary between analyst and investigator roles. No public exploit has been identified at time of analysis, though the remediation commit is publicly visible on GitHub.
Stored cross-site scripting in GitLab CE/EE's analytics dashboard component allows an authenticated low-privilege user to inject malicious JavaScript into table cell content that executes in the browsers of other users who view the affected dashboard. The scope change (S:C in CVSS) confirms the impact crosses security boundaries, enabling session hijacking, credential theft, or unauthorized API actions on behalf of victims including administrators. A publicly available proof-of-concept exploit exists via HackerOne report #3830478; no confirmed active exploitation in CISA KEV at time of analysis.
Stored or reflected cross-site scripting in GitLab CE/EE's analytics dashboard allows an authenticated attacker with low privileges to inject malicious scripts into pagination controls, executing in the browser context of any user who views the affected page. Affected versions span 18.2 through 19.2.1 across all three supported release trains. A publicly available proof-of-concept exists via HackerOne report 3830061; the Changed scope (S:C) and High C/I impacts elevate real-world risk significantly beyond a typical low-privilege XSS.
URLSecurityValidator SSRF bypass in compliance-trestle <= 4.0.3 allows a network-positioned attacker to reach cloud metadata services, loopback admin interfaces, and RFC 1918 internal networks by embedding IPv4-mapped IPv6 literals (e.g., [::ffff:169.254.169.254]) or the unspecified address 0.0.0.0 in OSCAL artifact import references processed by HTTPSFetcher or SFTPFetcher. Python's ipaddress module silently returns False - rather than raising TypeError - when comparing IPv6Address objects against IPv4Network ranges, so the validator's membership checks pass these forms through to requests.get unchanged. A publicly available proof-of-concept reproduces end-to-end IMDS credential exfiltration; no active exploitation is listed in CISA KEV and EPSS stands at 0.42%.
Stored cross-site scripting in the Welcart e-Commerce WordPress plugin (all versions before 2.11.34) allows any authenticated user holding the Author role or above to permanently inject malicious JavaScript into product pages, executing in every subsequent visitor's browser. A publicly available proof-of-concept exploit exists and the EPSS score of 16% reflects above-average exploitation probability for a medium-severity plugin flaw. The vendor has released a fix in version 2.11.34, and patching is the primary recommended action.
Stored XSS in the Patterns Kit WordPress plugin (versions through 1.0.3) enables any Contributor-level user to inject a JavaScript payload into an unescaped link attribute, which a client-side script inserts directly into the DOM. Victim browsers execute the payload when a user views the content and clicks the affected element, with the CVSS scope change (S:C) confirming the attack crosses from the WordPress application into the victim browser context. No vendor-released patch has been identified at time of analysis; a public proof-of-concept is available and the 16% EPSS score indicates above-average real-world exploitation probability for this severity class.
Improper authorization in GitLab CE/EE pipeline reference validation allows authenticated developer-role users to execute CI/CD pipelines on protected branches they lack push permissions to access, effectively bypassing branch protection policies. All GitLab versions from 19.0 through 19.2 are affected until the respective patch releases. A publicly available exploit exists via HackerOne report #3832069, though no confirmed active exploitation has been recorded in the CISA KEV catalog at time of analysis.