SQL Injection in WPML Multilingual CMS for WordPress allows authenticated attackers holding translator-level access or above to extract sensitive information from the underlying database on all plugin versions through 4.9.5. The vulnerable code resides in the Translation Manager REST API's job-ordering logic - specifically the unsanitized 'sorting' parameter processed by OrderQueryHelper - where user-supplied input is appended to existing SQL queries without adequate escaping or prepared-statement protections. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the translator role is routinely provisioned on multilingual WordPress sites, making the authenticated barrier lower than it may appear from the CVSS score alone.
SQL injection in the Groundhogg WordPress CRM plugin (versions through 4.5.14) permits authenticated attackers holding vendor-level or higher access to append arbitrary SQL to database queries via the insufficiently escaped 'tag_query' parameter, resulting in full read-access to the WordPress database. The exploitation path is non-trivial: the attacker must deliberately force execution into the deprecated Legacy_Contact_Query handler by submitting an unknown filter type that triggers a FilterException, bypassing the modern query handler's protections. No public exploit has been identified at time of analysis, and the vendor has issued a code fix (SVN changeset 3643654), though the exact patched release version is not independently confirmed in available data.
Second-order SQL injection in the Contest Gallery WordPress plugin (all versions through 30.0.7) allows authenticated attackers with author-level access to append arbitrary SQL into backend queries via the `cgRealId` parameter within the `cg_multiple_files_for_post` upload mechanism. The injected payload is first stored in the database without adequate sanitization and later executed unsafely by backend AJAX handlers in `ajax/ajax-functions-backend.php` and gallery administration scripts, enabling extraction of sensitive information from the WordPress database. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
SQL Injection in the KiviCare Clinic & Patient Management System (EHR) WordPress plugin through version 4.5.1 exposes sensitive healthcare database contents to authenticated low-privilege users. The unsanitized 'searchTerm' parameter in SettingsController/ListingData.php (lines 69, 442, 456) is interpolated directly into SQL queries without parameterization, enabling arbitrary data extraction from the underlying WordPress database - including patient records, clinical data, and credential hashes. Exploitation is constrained to KiviCare custom roles bearing the 'settings_view' permission (e.g., Doctor, Receptionist), limiting but not eliminating insider-threat and compromised-account scenarios. No public exploit identified at time of analysis and no CISA KEV listing confirmed.
SQL injection in the Image Uploader for Welcart WordPress plugin (all versions up to and including 1.4.6) allows authenticated attackers holding author-level access or above to exfiltrate sensitive data from the WordPress database by appending arbitrary SQL to queries constructed around the unsanitized 'post_title' parameter. The root cause is the absence of both input escaping and prepared statement usage in the plugin's database interaction code, confirmed by Wordfence with direct source code references. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low authentication bar makes this a credible risk on any multi-author Welcart installation.
Cross-site privilege escalation in the Backup Migration WordPress plugin (versions before 2.1.7) exposes WordPress multisite networks to unauthorized administrative access. A sub-site administrator can exploit an improperly restricted post-restore automatic login mechanism to obtain a persistent, long-lived authenticated session as an administrator of a separate site within the same network - without supplying credentials and bypassing any two-factor authentication controls in place on the target site. No public exploit code has been identified at time of analysis, and EPSS sits at 0.18% (8th percentile), indicating low current exploitation probability despite the high confidentiality and integrity impact.
Unauthorized user enumeration in the Simply Schedule Appointments WordPress plugin before 1.6.12.17 allows authenticated staff-role users to retrieve names and email addresses of all registered users via insufficiently scoped REST API endpoints. The vulnerability stems from missing authorization checks that should limit returned user records to those the requester is permitted to view. No public exploit has been identified and EPSS sits at 0.14% (4th percentile), indicating low exploitation probability, though the confidentiality impact is rated High due to unrestricted PII exposure.
Stored Cross-Site Scripting in Beaver Builder Page Builder for WordPress (all versions up to and including 2.10.2.2) allows authenticated users at Author level or above to permanently inject arbitrary JavaScript via the Button Module's Button Code field. The injected payload executes in any visitor's browser upon loading the affected page, enabling session hijacking, credential theft, or drive-by malware delivery across the site's entire visitor population. No active exploitation is confirmed in the CISA KEV catalog, and no public proof-of-concept exploit has been identified at the time of analysis.
Stored Cross-Site Scripting in the Hydra Booking WordPress plugin (all versions ≤ 1.2.2) allows injection of arbitrary web scripts via the unsanitized `first_name` parameter in host profiles, with payloads executing against any visitor who loads the affected host archive pages. Although the CVSS vector assigns PR:L, the plugin's public Signup shortcode permits any site visitor to self-register as a `tfhb_host`, collapsing the practical exploitation barrier to effectively unauthenticated. No CISA KEV listing or public exploit code has been identified at time of analysis, and an upstream fix commit (SVN changeset 3632543) is available in the WordPress plugin repository.
Insufficient entropy in API key generation for pkp/pkp-lib 3.3.0, 3.4.0, and 3.5.0 exposes generated API keys to brute-force prediction. The vulnerable code derived API keys using SHA1 of the current Unix timestamp (sha1(time())), which yields a deterministic, low-entropy value easily narrowed to a small candidate window if the approximate key-generation time is known or guessable. No public exploit or CISA KEV listing exists at time of analysis, but the upstream fix commit (529b5df) is publicly visible and the flaw is self-evident from the diff.
Information disclosure in Shescape, a Node.js shell-argument escaping library, affects versions before 2.1.15 and the 3.0.x line before 3.0.2 when the library's escape/escapeAll output is placed in a shell variable assignment and the runtime shell is explicitly set to "sh" (or true) with /bin/sh symlinked to BusyBox. Under those conditions an attacker who controls the escaped input can inject an unescaped tilde (~) that BusyBox expands, revealing the user's home directory path and, depending on how the assignment feeds the command, redirecting the filesystem location a command targets. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix is delivered via an upstream commit and tagged releases 2.1.15 and 3.0.2.
Missing encryption of sensitive data in TRENDnet TEW-WLC100 (firmware 2.05b02) exposes VPN negotiation material when the racoon IKE daemon is configured to use IKE Phase 1 Aggressive Mode. An unauthenticated remote attacker positioned on the network path can passively intercept Aggressive Mode handshake traffic, capturing identity information and pre-shared key (PSK) hashes in cleartext, which are then subject to offline cracking. No public exploit code or CISA KEV listing has been identified at time of analysis; CVSS 4.0 rates this at 6.3 (Medium) with AC:H, reflecting the elevated complexity needed to intercept IKE traffic.
Direct unauthenticated access to a SQL database backup file exposes sensitive data in SourceCodester Online Clothing Store 1.0. The file /db/shopping.sql is placed within a web-accessible directory with no access restriction, allowing any remote attacker to download the full database backup by issuing a direct HTTP request. Based on the publicly disclosed Medium write-up, the exposed backup contains administrative credentials, meaning exploitation can serve as a stepping stone to full application compromise. A proof-of-concept has been publicly disclosed; no public active exploitation (CISA KEV) has been confirmed.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/edit_teacher.php` endpoint to unauthenticated remote exploitation via an unsanitized `ID` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms low-complexity, unauthenticated, network-accessible exploitation with partial confidentiality, integrity, and availability impact. A public proof-of-concept exploit exists (E:P in CVSS 4.0 threat metrics); no vendor-released patch has been identified at time of analysis.
SQL injection in Jinher OA 1.0 exposes the attendance approval endpoint to unauthenticated remote attackers via the unvalidated `httpOID` parameter in `/C6/JHSoft.Web.HrmAttendance/attendance_out_approve.aspx`. Publicly available exploit code exists, lowering the bar for exploitation significantly. The vendor was notified prior to disclosure but did not respond, meaning no official patch has been issued.
Stored cross-site scripting in the ECS WordPress plugin before 4.3.8 allows a Contributor-level user to inject arbitrary JavaScript into any post - including administrator-authored pages - by exploiting missing authorization and object-ownership checks on the Dynamic Repeater AJAX handlers. The plugin gates these endpoints solely with a capability-agnostic nonce distributed through the Elementor editor, making them reachable by any edit_posts user who can then write unsanitized data-source bindings that execute in the browser of any visitor or administrator who views the affected page. No public exploit has been confirmed and EPSS sits at 0.15% (5th percentile), but the low privilege bar and potential to chain into admin account takeover make patching to 4.3.8 a straightforward and time-sensitive action.
Login CSRF in @fastify/oauth2 versions 7.2.0 through 8.2.x allows an attacker controlling a sibling subdomain to plant predictable OAuth state and PKCE code verifier cookies, silently signing a victim into the attacker's account instead of their own. The root cause is the absence of server-side session binding and cookie prefixing - the plugin validates OAuth state exclusively by comparing callback parameters against unprefixed cookies, which sibling subdomains sharing the same registrable domain can freely overwrite. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept exists; the high attack complexity limits opportunistic risk.
Price manipulation in the Pinpoint Booking System - Version 2 WordPress plugin (all versions ≤2.9.9.6.8) enables unauthenticated remote attackers to purchase any WooCommerce bookable product at a self-chosen price by injecting an arbitrary `price_total` value into the `cart_data` POST parameter. The vulnerable `dopbsp_woocommerce_add_to_cart` AJAX handler - registered via `wp_ajax_nopriv_*` with no authentication and no nonce check - persists the attacker-supplied price directly to the database and a subsequent WooCommerce hook reads it back to set the product price without recalculation. No public exploit has been identified at time of analysis, though the code paths are fully visible in the public WordPress plugin repository, materially lowering the barrier to exploitation.
Authorization bypass in the wpdevart Booking Calendar, Appointment Booking System plugin for WordPress (all versions through 3.2.36) permits unauthenticated remote attackers to write attacker-controlled payment status and transaction data directly into the plugin's payments database table, bypassing any payment gateway verification. This enables fraudulent marking of reservations as paid or completed, cancellation of legitimate customer payments, and dispatch of transactional booking confirmation emails to arbitrary parties. No public exploit has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Blind SQL injection in the Form Maker by 10Web WordPress plugin exposes full database read access to authenticated subscriber-level attackers through a two-stage exploitation path involving profile manipulation and a crafted AJAX request. All plugin versions through 1.15.44 are affected per Wordfence's disclosure, with specific vulnerable code paths confirmed at multiple locations in WDW_FM_Library.php and the plugin's frontend controllers. No public exploit code has been identified at time of analysis, and exploitation is gated behind a non-default form configuration, substantially limiting mass exploitation risk despite the C:H confidentiality rating.
Unauthorized disclosure of unpublished Elementor content affects the ECS WordPress plugin before version 4.3.8, allowing any unauthenticated internet user to retrieve the fully rendered HTML of private, draft, or pending Elementor documents by supplying a valid post identifier to a plugin AJAX endpoint. The plugin's AJAX handler for rendering Elementor documents performs no post-status check and enforces no WordPress capability, completely bypassing the platform's native visibility controls for those requests. No public exploit code has been identified and EPSS is 0.15% (5th percentile), indicating low observed exploitation probability, though the zero-authentication requirement makes the attack trivially automatable against enumerable sequential post IDs.
SQL injection in the Invisible Anti-Spam & CAPTCHA - reCAPTCHA Alternative for All Forms WordPress plugin (all versions through 5.1) exposes WordPress database contents to authenticated attackers holding editor-level or higher roles. The 'key' parameter in plugin admin functionality lacks sufficient escaping and prepared-statement handling, allowing appended SQL to read arbitrary database tables. No public exploit exists and the vulnerability is not listed in CISA KEV; exploitation is constrained by the high privilege requirement, keeping real-world risk moderate despite the high confidentiality impact.
SQL Injection in the 'Invisible Anti-Spam & CAPTCHA - reCAPTCHA Alternative for All Forms' WordPress plugin (all versions through 5.1) permits authenticated users holding editor-level or higher WordPress roles to append arbitrary SQL clauses to existing database queries via unsanitized Pattern JSON keys and values. The attack yields full read access to the WordPress database - including user credentials, PII, and configuration data - while carrying no integrity or availability impact per the CVSS vector (I:N, A:N). No public exploit code has been identified and the vulnerability does not appear in the CISA KEV catalog at time of analysis.
Cross-request data leakage in Apache Struts 7.2.1's JSON plugin allows an authenticated remote attacker to observe response content associated with a concurrent request belonging to a different user. The root cause is a thread-safety defect (CWE-567) in the SMD/JSON-RPC interceptor, where per-response serialization state is not isolated between concurrent requests. Exploitation is constrained to the non-default SMD/JSON-RPC mode of the JSON interceptor; no public exploit code has been identified at time of analysis, and the EPSS score of 0.15% (4th percentile) reflects the limited realistic exploitation surface.
Cross-request data exposure in the Apache Struts JSON plugin (version 7.2.1) results from per-request parsing state being improperly shared across concurrent requests, enabling information observable in one user's session to leak into another's. Authenticated remote attackers targeting applications that have explicitly enabled JSON action population can exploit this concurrency flaw (CWE-567) to read partial request data or circumvent configured parsing limits. With an EPSS of 0.15% (4th percentile), no CISA KEV listing, and no public exploit identified at time of analysis, real-world risk is low and narrowed further by the non-default plugin requirement.
Missing authorization on ECS WordPress plugin's dynamic repeater actions (versions before 4.3.8) allows any contributor-level account or above to read, alter, and delete binding configurations of posts they do not own, and to overwrite site-wide plugin presets. The plugin relies solely on a nonce for these actions - a token available to anyone who can open the page builder - without performing capability or ownership checks (CWE-862). No public exploit has been identified at time of analysis, and the EPSS score of 0.13% (3rd percentile) indicates very low current exploitation probability; however, the attack requires only a standard contributor account, making multi-author WordPress sites the primary risk surface.