Path traversal in the WPvivid - Backup, Migration & Staging WordPress plugin before 0.9.131 lets an attacker who possesses a valid site-to-site transfer key write a plugin-generated log file into any writable directory, including the web root, because an unsanitised value from the request is used to build the log file path. Publicly available exploit code exists (WPScan), but the impact is bounded: only the file's location is attacker-controlled while the filename suffix and the file contents (the plugin's own log header) are fixed, so this is arbitrary file placement rather than arbitrary content injection. Not listed in CISA KEV and EPSS is low (0.16%, 6th percentile), indicating little observed real-world exploitation.
Authentication bypass in the Simple JWT Login WordPress plugin before 3.6.8 lets unauthenticated attackers log in as any user - including administrators - by presenting a valid Google identity token that carries the victim's email address. Because the plugin never checks the token's audience (aud) claim, a Google-issued ID token minted for an entirely different OAuth application is accepted as proof of identity, turning any site with Google sign-in enabled into a full-account-takeover target. Publicly available exploit details exist (WPScan), though EPSS remains low (0.16%) and the flaw is not listed in CISA KEV.
Authentication bypass in Tenda AC10 firmware 16.03.10.09_multi_TDE01 allows unauthenticated remote attackers to circumvent the httpd web management interface's access controls via manipulation of the R7WebsSecurityHandler function. The vulnerability carries a CVSS 4.0 score of 8.9 with full confidentiality, integrity, and availability impact against the vulnerable system. A publicly available proof-of-concept exploit has been published on GitHub, materially lowering the exploitation barrier and enabling opportunistic mass-targeting of exposed devices.
Stack-based buffer overflow in Edimax EW-7478APC wireless access point firmware 1.04 enables remote code execution against the device by submitting an oversized PPPoE username to the WAN configuration endpoint. Low-privilege authenticated attackers with network access to the management interface can exploit the `pppUserName` parameter in `/goform/formWanTcpipSetup` to overwrite stack memory and gain arbitrary code execution on the device. A public proof-of-concept exploit exists; the vendor did not respond to responsible disclosure, leaving the device with no available patch.
Customer-uploaded file disclosure in Extra Product Options Builder for WooCommerce (all versions before 1.2.176) allows unauthenticated requesters who know a file's stored name to retrieve it via an unprotected plugin endpoint, bypassing a missing authorization check (CWE-862). The real-world severity is conditional on web server type: the plugin writes deny-all rules to upload directories, meaning this endpoint only crosses a new security boundary on Apache-hosted sites; on default nginx deployments, those files are already directly URL-accessible and the endpoint adds no measurable additional exposure. Publicly available exploit code exists, but no public exploit identified at time of analysis confirms active exploitation, and EPSS sits at 0.22% (12th percentile) despite the elevated CVSS score.
Unauthenticated information disclosure in CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 exposes media attachment metadata - including titles, file types, sizes, and direct URLs - from any configured folder, including those never published to a gallery. The missing authorization checks on REST API endpoints mean any external party can enumerate private document libraries without credentials. A publicly available exploit exists per WPScan, though EPSS sits at just 0.17% (7th percentile), suggesting limited observed exploitation activity at time of analysis.
SQL injection in WP Directory Kit WordPress plugin before 1.5.7 is exploitable by authenticated administrators, with materially elevated impact on WordPress multisite networks where a single-site admin can read data belonging to the entire network - data outside their authorized scope. A public PoC is available via WPScan, though EPSS sits at 0.17% (6th percentile), indicating targeted rather than opportunistic exploitation. No CISA KEV listing confirms active in-the-wild exploitation at time of analysis.
Privilege escalation in the All-in-One WP Migration and Backup WordPress plugin (versions prior to 7.108) on multisite installations allows subsite administrators to execute arbitrary PHP code across the entire WordPress network. The vulnerability stems from missing access control enforcement on the migration import feature, which should be restricted to network-level administrators but is accessible to lower-privileged subsite admins. A publicly available exploit exists per WPScan and SSVC classification; however, EPSS sits at only 0.14% (4th percentile), and CISA KEV does not list this as actively exploited at time of analysis.
Missing authorization checks in the ECS WordPress plugin before 4.3.10 allow any contributor-level or higher user to read custom field values and post metadata from WordPress posts they do not own, including private and draft content. The plugin's dynamic repeater data source feature accepts user-supplied post identifiers without validating ownership or post publication status, exposing potentially sensitive metadata to lower-privileged authenticated users. A publicly available proof-of-concept exists via WPScan, though EPSS at 0.15% (5th percentile) indicates limited observed exploitation activity and no CISA KEV listing has been issued.
Insufficient authorization in the Visualizer WordPress plugin before 4.0.7 permits any authenticated Contributor-level user to retrieve the full configuration of every chart on the site through a single API request, bypassing the plugin's own UI-level access controls. The exposed configuration data may include credentials for remote data sources - such as database connection strings or API keys - that chart owners have configured. A publicly available proof-of-concept is referenced by WPScan; no active exploitation has been confirmed by CISA KEV, though the low barrier to exploitation makes patching urgent for any site with untrusted contributor accounts.
Improper payout validation in the Premium Packages WordPress plugin (all versions before 7.0.7) allows any authenticated user - including subscribers with zero sales history - to submit withdrawal requests for arbitrary monetary amounts. Because the plugin never cross-references the requested amount against the user's actual earned balance, a low-privilege attacker can fabricate a payout claim that an administrator may approve and disburse as real funds. A publicly available proof-of-concept exists; no confirmed active exploitation (CISA KEV) has been recorded, and EPSS probability stands at 0.14% (4th percentile), suggesting opportunistic rather than widespread targeting.
Stored Cross-Site Scripting in the Masteriyo LMS WordPress plugin (all versions before 2.3.3) allows instructor-role users to inject persistent malicious scripts into quiz fields that execute in the browsers of any page visitor, including administrators. The vulnerability stems from the plugin granting instructors unfiltered HTML storage capability without sanitizing or escaping output, creating a privilege-escalation path from instructor to effective administrator compromise via session hijacking. A publicly available proof-of-concept exists per WPScan; EPSS is low at 0.16%, and the flaw is not listed in CISA KEV, though POC availability elevates practical risk for unpatched single-site deployments.
Unauthenticated arbitrary file upload leading to remote code execution affects the ProSolution WP Client WordPress plugin in all versions through 2.0.10, via the proSol_handleFileUpload function. The handler trusts the attacker-supplied Content-Disposition filename over the validated multipart filename and, critically, fails to delete files that its post-save extension check rejects, so a malicious PHP file remains on disk and executable. Because the gating nonce is publicly leaked through wp_localize_script on any page rendering the job-portal shortcode, no authentication is required; no public exploit or CISA KEV listing is identified at time of analysis, though the CVSS of 9.8 reflects trivial exploitability.
Privilege escalation in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.9) lets attackers take over the default administrator account by overwriting its password or email. The flaw stems from an authorization check that is silently skipped when the target user ID is a non-numeric string, which WordPress later coerces to integer 1 (the default admin). Where a public-facing frontend user form is configured the attack is fully unauthenticated; otherwise any subscriber-level account suffices. No public exploit identified at time of analysis, but the CVSS is 9.8 (Critical) and it was reported by Wordfence.
Silent OAuth 1.0a-to-1.0 protocol downgrade in the Perl module Net::OAuth::Client (versions before 0.32) lets a service provider strip the anti-session-fixation protection an application explicitly requested. When an app configures a callback (selecting 1.0a) but the provider's request-token response omits oauth_callback_confirmed, get_request_token silently reverts to OAuth 1.0, which drops the oauth_verifier from the access-token exchange with no exception or warning, re-exposing the app to OAuth session fixation. No public exploit identified at time of analysis; EPSS is low (0.21%) and this is not in CISA KEV, but the fix is vendor-confirmed in release 0.32.
Manual Image Crop WordPress plugin before version 1.15 exposes an authenticated AJAX crop action with neither capability check nor nonce verification, permitting any subscriber-level user to overwrite another user's media attachment thumbnails and corrupt stored image metadata across the entire Media Library. The flaw is simultaneously a broken authorization control and a CSRF vector - two distinct exploitation paths in one action. A public exploit exists per WPScan's disclosure, though EPSS at 0.10% (1st percentile) and SSVC's 'not automatable' rating indicate very limited observed exploitation, and no active exploitation is confirmed by CISA KEV.
SQL injection in Evergreen's open-ils.fielder OpenSRF Service, exposed via the /osrf-gateway-v1 HTTP gateway endpoint, affects all actively maintained branches through 3.14.11, 3.15.11, 3.16.5, and 3.17-beta1. The CVSS 4.0 vector confirms network-accessible, unauthenticated exploitation with low attack complexity, yielding partial confidentiality, integrity, and availability impact against the underlying database. A public proof-of-concept has been disclosed and patched releases (3.14.12, 3.15.12, 3.16.6, 3.17-beta2) are available, making delayed remediation difficult to justify given the exploit's public availability.
Stored cross-site scripting in the Divi WordPress theme (versions 5.0 through before 5.9.0) allows any contributor-role user to inject persistent JavaScript into the Social Media Follow module's link attributes, which executes in the browser of any higher-privileged user - including administrators - who subsequently views the affected post. A publicly available proof-of-concept exploit exists per WPScan, and the scope-changed CVSS vector (S:C) confirms the injected script runs in the victim's privileged session context rather than the attacker's. Vendor-released patch version 5.9.0 is available and should be applied immediately.
Unthrottled API-token brute force in SiYuan kernel before 3.7.4 lets an unauthenticated remote attacker repeatedly guess the Conf.Api.Token because the CheckAuth() middleware bypasses the app's CAPTCHA/lockout controls (NeedCaptcha/WrongAuthCount). Reported by VulnCheck and fixed in 3.7.4, a successful guess yields full RoleAdministrator access, permitting arbitrary file operations and SQL queries. There is no public exploit identified at time of analysis and it is not in CISA KEV, though the CVSS 4.0 base score is 9.3.
SQL injection in Phoca Cart, an e-commerce extension for Joomla, allows unauthenticated remote attackers to extract the entire database via the public shop items page. Versions 5.0.0 through 6.1.16 concatenate the a[] (attribute) and s[] (specification) GET array parameters directly into SQL WHERE clauses, so an attacker can dump credentials and order data using time-based blind techniques. No public exploit identified at time of analysis, but the flaw is trivially reachable and rated CVSS 4.0 9.3 (Critical).
Arbitrary CLR property writes in Scriban (the .NET templating engine) before 7.2.2 allow template code to mutate live host objects passed into a TemplateContext, bypassing C# setter-visibility rules entirely. Any object pushed via the documented ScriptObject pattern becomes fully writable, so template authors can set private, internal, and init-only setters as well as mass-assign public ones (e.g. {{ user.is_admin = true }}), and the changes persist on the host object after Render() returns. Publicly available proof-of-concept steps exist in the GHSA advisory; no active exploitation is reported (not in CISA KEV) and no EPSS score was supplied.
Sandbox escape in the Scriban .NET templating engine (all versions before 7.0.0) lets attacker-influenced templates read object members that a tightened MemberFilter was meant to hide, because type accessors are cached by Type alone and survive both filter changes and TemplateContext.Reset(). Applications that reuse a single TemplateContext across requests or tenants and rely on MemberFilter as a security boundary can leak filtered properties and fields to a later, more-restricted render. Reported by VulnCheck with a working proof-of-concept in the vendor advisory; not listed in CISA KEV, and no EPSS score was provided in the source data.
Information disclosure and authorization bypass in Scriban (the .NET text templating engine) before 7.0.0 lets attackers retrieve previously authorized include-template content from earlier renders. Because TemplateContext.Reset() clears output, globals, cultures, and source files but never clears the CachedTemplates dictionary, applications that pool a TemplateContext across requests and use a request-, tenant-, or user-dependent ITemplateLoader will serve a stale cached template to a later, less-privileged render without re-invoking TemplateLoader.Load(). A vendor patch exists (7.0.0) and a working proof-of-concept is published in the GHSA advisory, but there is no public exploit identified as used in active attacks.
Arbitrary file deletion in the ProSolution WP Client WordPress plugin (all versions through 2.0.8) lets unauthenticated attackers remove any file the web server can write to, escalating to full site takeover when critical files like wp-config.php are deleted. The flaw stems from missing path validation in the proSol_fileDeleteProcess handler, which trusts a traversal key that the attacker plants in their own session via a preceding proSol_fileUploadModalProcess call; both steps require only the publicly exposed frontend nonce. No public exploit identified at time of analysis, but the network, no-auth, no-interaction profile and 9.1 CVSS make this a high-priority patch.
Unauthorized data destruction in the Solace Extra WordPress plugin (versions through 1.6.0) lets low-privileged authenticated users invoke the import_zip() AJAX handler, which lacks a capability check. Because the handler trusts only the site-wide 'ajax-nonce' that WordPress emits on every admin page to any logged-in user, Subscriber-level accounts can wipe navigation menus, sidebar widgets, all theme mods, and Elementor templates, and force arbitrary demo-content imports. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the trivial exploitation path and 9.1 CVSS make it a high-priority integrity/availability issue.
Arbitrary file deletion leading to remote code execution in the Podlove Podcast Publisher WordPress plugin (all versions through 4.5.3) allows authenticated contributors to destroy critical server files and fully compromise the WordPress installation. The root cause is a PHP deserialization flaw in the shownotes REST API that activates a native POP chain via GenerationGuard::__destruct(), invoking wp_delete_file() on an attacker-controlled path - enabling deletion of wp-config.php to force WordPress into reinstallation mode. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though the POP chain is explicitly mapped in the CVE with source code references, indicating high confidence in exploitability.
Remote code execution in the Query Wrangler WordPress plugin affects all versions up to and including 1.5.57, allowing any authenticated subscriber-level user to invoke arbitrary PHP callables on the server. The vulnerability combines a missing capability check and absent nonce verification on the wp_ajax_qw_form_ajax AJAX handler with unsanitized attacker-controlled input passed directly to call_user_func_array(), making the only barrier a trivially satisfied function_exists() check. No public exploit has been identified at time of analysis and the vulnerability is not confirmed in CISA KEV, but the low privilege requirement and straightforward exploitation path make this a critical patching priority for any WordPress site running the affected plugin.
Server-Side Request Forgery in Royal Elementor Addons for WordPress (versions ≤1.7.1064) allows authenticated Contributor-level users to persistently configure a malicious webhook URL via the Form Builder widget, which is then dispatched by an AJAX handler registered for both authenticated and unauthenticated callers - meaning the trigger phase requires no authentication at all. The root flaw is that wp_remote_post() is invoked on the stored URL with no host allowlist, no scheme restriction, and no private/loopback IP filtering, despite the plugin containing wpr_is_blocked_remote_host and wpr_is_private_or_local_ip helpers that are simply not called on this code path. No public exploit or CISA KEV listing has been identified at time of analysis.
Scriban template engine versions 3.0.0 through 7.2.5 expose any application accepting untrusted templates to complete CPU exhaustion and garbage collection collapse via crafted array-multiplication expressions. The ScriptArray.Multiply operator fails to credit iterations against the caller-configured LoopLimit, rendering the safety mechanism entirely ineffective on this code path - even LoopLimit=1 provides no protection against the bypass. Vendor patches are available as two upstream commits referenced in GitHub security advisory GHSA-89cf-6hmv-8rxm, with no active exploitation confirmed at time of analysis.
Uncontrolled resource consumption in Scriban's .NET templating engine allows any party who can submit template input to bypass the LoopLimit safety control and exhaust CPU or memory on the host process. Versions 0 through 6.6.0 of the nuget/scriban and nuget/Scriban.Signed packages are affected; the root cause is that LoopLimit enforcement is coupled exclusively to script-level loop statements and is never invoked by built-in operators such as the range constructor or string multiplication. A working proof-of-concept is publicly available in the GitHub Security Advisory GHSA-c875-h985-hvrc, making exploitation trivially reproducible for any application that renders attacker-controlled templates; no public exploit identified at time of analysis for CISA KEV status.
Remote denial of service in Scriban before 6.6.0 allows unauthenticated attackers to crash the entire .NET hosting process by submitting deeply nested template expressions to the recursive-descent parser. Because the ExpressionDepthLimit property in ParserOptions defaults to null (disabled), an attacker can supply thousands of nested parentheses or blocks that exhaust thread stack space, triggering a StackOverflowException - which .NET cannot intercept - causing immediate, unrecoverable process termination. A proof-of-concept is publicly documented in the vendor's GitHub Security Advisory GHSA-wgh7-7m3c-fx25; no authentication is required, and the fix is available in version 6.6.0.
Process-terminating stack overflow in Scriban's template parser affects all versions before 7.0.0, allowing any attacker who can supply content to Template.Parse to crash the hosting .NET application via an uncatchable StackOverflowException. The flaw exploits a recursion path (ParseArrayInitializer → ParseExpression → ParseArrayInitializer) that is structurally separate from the ExpressionDepthLimit guard introduced in the prior fix for GHSA-wgh7-7m3c-fx25, meaning teams who applied that earlier patch retain a false sense of protection and remain fully vulnerable. A proof-of-concept is publicly available in the GitHub Security Advisory; no confirmed active exploitation appears in the CISA KEV catalog at time of analysis.
Scriban's template rendering engine before version 6.6.0 crashes the entire .NET hosting process when object graphs containing circular references are passed to the template context, because the ObjectRecursionLimit property defaults to 0 (unlimited) rather than a bounded safe value. Any endpoint that maps user-controlled input - such as a JSON request body or ORM entity graph - to a Scriban TemplateContext is susceptible to complete process termination with no authentication required (CVSS 4.0 AV:N/AC:L/PR:N). No public exploit or CISA KEV listing has been identified at time of analysis; however, a proof-of-concept is published in GitHub Security Advisory GHSA-grr9-747v-xvcp.
Uncontrolled memory allocation in Scriban's string.pad_left and string.pad_right template functions enables unauthenticated remote denial of service against any application that exposes Scriban to attacker-controlled template input. All NuGet releases of scriban and scriban.Signed prior to 7.0.0 are affected, with a publicly documented 39-byte proof-of-concept payload capable of forcing ~1GB synchronous allocations per request, crashing the host process via OutOfMemoryException. No active exploitation has been confirmed in CISA KEV at time of analysis, but the trivial PoC and zero-complexity attack lower the effective risk bar significantly for exposed deployments.
Uncontrolled recursion in Scriban's `object.to_json` builtin allows any attacker who can submit template content to fatally terminate the hosting .NET process. The internal `WriteValue()` serialization function (ObjectFunctions.cs:494) recurses through object members and arrays without depth limits or circular reference detection - bypassing the `ObjectRecursionLimit`, `EnterRecursive()`, and `EnsureSufficientExecutionStack()` guards used everywhere else in Scriban. Because `StackOverflowException` is unrecoverable in .NET, a single crafted template request causes immediate, irreversible process death. No public exploit or CISA KEV listing identified at time of analysis; vendor-confirmed fix is available in version 7.0.0.
Process-terminating denial-of-service in Scriban 6.6.0-7.2.0 allows any network-reachable attacker to crash a host .NET application by submitting a crafted template containing deeply nested parentheses, array initializers, object initializers, or unary operators. The `ExpressionDepthLimit` parser guard is structurally non-enforcing: it logs a non-fatal error and sets a flag but never halts recursive descent, allowing the call stack to exhaust until an uncatchable `StackOverflowException` terminates the process - roughly achievable with an 8 KB payload. This is a regression that re-opens two previously reported 'fixed' advisories (GHSA-wgh7-7m3c-fx25, fixed in 6.6.0; GHSA-p6q4-fgr8-vx4p, fixed in 7.0.0), confirming both prior fixes are incomplete; no public exploit or KEV listing exists at time of analysis.
Resource exhaustion in Scriban 3.0.0 through 7.2.0 allows unauthenticated remote attackers to force multi-gigabyte memory allocations using a ~40-byte template containing the array multiplication operator. The flaw is an overlooked sibling of operations hardened in prior releases: `string * integer` and `array.insert_at` received LoopLimit guards in versions 7.0.0 and 7.2.0, but `array * integer` in `ScriptArray<T>.TryEvaluate` was never subjected to those checks. The vendor-released fix is available in Scriban 7.2.1 and Scriban.Signed 7.2.1; no public exploit identified at time of analysis.
Memory exhaustion denial of service in stoatchat before 0.15.0 allows unauthenticated remote attackers to crash the service by submitting concurrent proxy requests referencing attacker-hosted SVGs with arbitrarily large viewBox width and height values. The proxy endpoint allocates memory proportional to declared SVG dimensions without enforcing any upper bound (CWE-400), and concurrent exploitation amplifies impact across all running replicas simultaneously. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 8.7 reflects the high availability impact with no confidentiality or integrity component.
Unbounded memory allocation in Scriban's `array.insert_at` built-in function allows any template author to crash the host process with a single template call. Affected are all releases of the nuget/scriban and nuget/Scriban.Signed packages up to and including version 7.1.0. By supplying a sufficiently large index parameter, an attacker triggers a tight C# fill loop that allocates hundreds of millions of null entries, causing an `OutOfMemoryException` that terminates the host process in under a second - bypassing all existing safety controls including `LoopLimit` and `LimitToString`. A public proof-of-concept template is documented in the vendor's GHSA advisory; no CISA KEV listing has been issued at the time of analysis.
Remote buffer overflow in Edimax EW-7478APC firmware 1.04 allows network-authenticated attackers to corrupt memory via the selSSID argument in the formWlSiteSurvey handler, with potential for arbitrary code execution on both the vulnerable device and downstream systems. The CVSS 4.0 vector scores this at 8.6 with full high-impact triad across both vulnerable and subsequent systems, reflecting the embedded device context where exploitation typically yields root-level access. A public exploit exists (CVSS 4.0 E:P confirmed), and the vendor has not responded to coordinated disclosure, meaning no patch is available or expected in the near term.
Unauthenticated PII exposure in WP Travel Engine (WordPress plugin, all versions ≤ 6.8.4) allows any visitor to retrieve private customer booking details - including full name, email, street address, city, and phone number - by supplying an arbitrary booking ID to the checkout endpoint. The plugin's only access control on the affected AJAX handler is a frontend nonce broadcast publicly to all visitors via the wteL10n JavaScript global, meaning it functions solely as a CSRF token and does not gate unauthenticated access. No public exploit code has been identified at time of analysis, but the attack is mechanically trivial and requires no prior account or privileges.
Remote code execution in the WCPOS Point of Sale plugin for WordPress/WooCommerce (all versions through 1.9.14) allows authenticated Shop Manager-level users to inject and execute arbitrary PHP on the server. The flaw lies in Receipt_Renderer_Factory incorrectly routing 'thermal' engine templates to Legacy_Php_Renderer, which writes attacker-controlled content to a temporary file and executes it via PHP's include(). No public exploit or CISA KEV listing identified at time of analysis; however, full server compromise is achievable by any user holding the manage_woocommerce_pos capability.
Stored cross-site scripting in the Bookly WordPress appointment booking plugin (versions up to and including 27.7) enables unauthenticated remote attackers to inject persistent JavaScript via the bookly_speed_up_update_addons AJAX endpoint, with payloads stored verbatim in the bookly_log.details database column and executing in administrator browser sessions when they navigate to the Diagnostics → Logs page. The injection point is registered under the wp_ajax_nopriv_* hook prefix, making it reachable without any authentication via the standard WordPress AJAX endpoint; the error-logging code path in lib/PluginsUpdater.php writes attacker-controlled input directly to the database when a request is submitted without a valid signature. No public exploit code or CISA KEV listing has been confirmed at time of analysis, though the zero-barrier injection path combined with privileged execution context represents a realistic and impactful threat to any active Bookly installation.
SQL injection in the Gallery by BestWebSoft WordPress plugin (all versions through 4.7.9) allows Editor-level or higher authenticated attackers to exfiltrate or manipulate the entire WordPress database by injecting arbitrary SQL via crafted array key names in the `_gallery_order_{post_id}` POST parameter. The `gllr_save_postdata()` function writes these unsanitized array keys directly into post meta without escaping or prepared statements, and downstream SQL queries consume them verbatim. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Stored XSS in the Autopay (Platnosci Online Blue Media) WordPress plugin through version 5.0.0 permits unauthenticated remote attackers to permanently inject arbitrary JavaScript into the WooCommerce checkout page by sending a single crafted POST request targeting the bm_woocommerce_css_editor_content parameter. The plugin's CSS editor save handler is registered on WordPress's 'init' hook with no capability check, no nonce verification, and no input sanitization, causing raw attacker-controlled content to be persisted in the WordPress options table and rendered unescaped inside a style block on every subsequent checkout page load. No public exploit has been identified at time of analysis and this vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, but the unauthenticated write path combined with persistent execution on a high-value payment page represents a credible payment-skimming threat vector.
Stored Cross-Site Scripting in the Infility Global WordPress plugin (versions ≤ 2.15.21) allows unauthenticated remote attackers to inject persistent malicious scripts via the /cf7_record log endpoint, which then execute in the browsers of any authenticated WordPress user who accesses the /cf7_records viewer - including those with only Subscriber-level access. Reported by Wordfence with source-code references corroborating the unsanitized input and unescaped output in InfilityGlobalErrorRecord.php; no public exploit code or CISA KEV listing has been confirmed at time of analysis. The CVSS 7.2 rating reflects a changed-scope attack: the unauthenticated submission context crosses into authenticated user sessions, amplifying impact beyond a typical stored XSS.
Denial of service in Scriban's .NET template engine (all versions before 7.0.0) allows low-privileged attackers who can supply templates to exhaust host application memory and crash the process. By rendering a string just under the 1MB LimitToString default inside a template loop, each iteration resets the per-call length counter in ObjectToString while the underlying StringBuilderOutput appends to a StringBuilder with no cumulative size guard - enabling ~1GB of allocation across 1,000 loop iterations. No public exploit tool has been separately released, but the GitHub security advisory (GHSA-m2p3-hwv5-xpqw) contains full source-level reproduction detail sufficient to implement the attack without further research.
Three distinct denial-of-service vulnerabilities in Scriban's expression evaluator (all versions before 7.0.0) allow any low-privileged attacker who can supply templates to exhaust host process memory or CPU, typically crashing the entire .NET application. The flaws are particularly deceptive because they bypass Scriban's own built-in safety controls - LimitToString and LoopLimit - through unbounded string multiplication, uncapped BigInteger left-shift operations, and lazy range enumeration passed to builtin functions, giving developers a false sense of protection. No public exploit has been identified at time of analysis, but the GHSA advisory provides full source-code-level disclosure of all three code paths with file and line references.
Permission bypass in stoatchat before 0.15.0 allows authenticated users holding only ViewChannel access to read individual message content through the message_fetch route, circumventing the ReadMessageHistory restriction that bulk read routes correctly enforce. Organizations that deliberately deny ReadMessageHistory to specific users or roles - intending to block historical message access - are exposed because the single-message fetch path uses a weaker authorization check. No public exploit code has been identified and the product is not listed in CISA KEV, but the authorization inconsistency is straightforward to exploit for any actor already authenticated to the platform.
IV race condition in the Linux kernel's AF_ALG skcipher interface allows local unprivileged users to inject attacker-controlled initialization vectors into in-flight AIO cryptographic operations. For CTR and CBC modes, IV reuse enables keystream derivation and plaintext recovery of concurrent cipher operations sharing the same AF_ALG socket. No public exploit has been identified at time of analysis; patches are confirmed available across all major stable kernel branches (5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 7.1.5, 7.2-rc1).