Path traversal in the WPvivid - Backup, Migration & Staging WordPress plugin before 0.9.131 lets an attacker who possesses a valid site-to-site transfer key write a plugin-generated log file into any writable directory, including the web root, because an unsanitised value from the request is used to build the log file path. Publicly available exploit code exists (WPScan), but the impact is bounded: only the file's location is attacker-controlled while the filename suffix and the file contents (the plugin's own log header) are fixed, so this is arbitrary file placement rather than arbitrary content injection. Not listed in CISA KEV and EPSS is low (0.16%, 6th percentile), indicating little observed real-world exploitation.
Authentication bypass in the Simple JWT Login WordPress plugin before 3.6.8 lets unauthenticated attackers log in as any user - including administrators - by presenting a valid Google identity token that carries the victim's email address. Because the plugin never checks the token's audience (aud) claim, a Google-issued ID token minted for an entirely different OAuth application is accepted as proof of identity, turning any site with Google sign-in enabled into a full-account-takeover target. Publicly available exploit details exist (WPScan), though EPSS remains low (0.16%) and the flaw is not listed in CISA KEV.
Unauthenticated arbitrary file upload leading to remote code execution affects the ProSolution WP Client WordPress plugin in all versions through 2.0.10, via the proSol_handleFileUpload function. The handler trusts the attacker-supplied Content-Disposition filename over the validated multipart filename and, critically, fails to delete files that its post-save extension check rejects, so a malicious PHP file remains on disk and executable. Because the gating nonce is publicly leaked through wp_localize_script on any page rendering the job-portal shortcode, no authentication is required; no public exploit or CISA KEV listing is identified at time of analysis, though the CVSS of 9.8 reflects trivial exploitability.
Privilege escalation in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.9) lets attackers take over the default administrator account by overwriting its password or email. The flaw stems from an authorization check that is silently skipped when the target user ID is a non-numeric string, which WordPress later coerces to integer 1 (the default admin). Where a public-facing frontend user form is configured the attack is fully unauthenticated; otherwise any subscriber-level account suffices. No public exploit identified at time of analysis, but the CVSS is 9.8 (Critical) and it was reported by Wordfence.
Silent OAuth 1.0a-to-1.0 protocol downgrade in the Perl module Net::OAuth::Client (versions before 0.32) lets a service provider strip the anti-session-fixation protection an application explicitly requested. When an app configures a callback (selecting 1.0a) but the provider's request-token response omits oauth_callback_confirmed, get_request_token silently reverts to OAuth 1.0, which drops the oauth_verifier from the access-token exchange with no exception or warning, re-exposing the app to OAuth session fixation. No public exploit identified at time of analysis; EPSS is low (0.21%) and this is not in CISA KEV, but the fix is vendor-confirmed in release 0.32.
Unthrottled API-token brute force in SiYuan kernel before 3.7.4 lets an unauthenticated remote attacker repeatedly guess the Conf.Api.Token because the CheckAuth() middleware bypasses the app's CAPTCHA/lockout controls (NeedCaptcha/WrongAuthCount). Reported by VulnCheck and fixed in 3.7.4, a successful guess yields full RoleAdministrator access, permitting arbitrary file operations and SQL queries. There is no public exploit identified at time of analysis and it is not in CISA KEV, though the CVSS 4.0 base score is 9.3.
SQL injection in Phoca Cart, an e-commerce extension for Joomla, allows unauthenticated remote attackers to extract the entire database via the public shop items page. Versions 5.0.0 through 6.1.16 concatenate the a[] (attribute) and s[] (specification) GET array parameters directly into SQL WHERE clauses, so an attacker can dump credentials and order data using time-based blind techniques. No public exploit identified at time of analysis, but the flaw is trivially reachable and rated CVSS 4.0 9.3 (Critical).
Arbitrary CLR property writes in Scriban (the .NET templating engine) before 7.2.2 allow template code to mutate live host objects passed into a TemplateContext, bypassing C# setter-visibility rules entirely. Any object pushed via the documented ScriptObject pattern becomes fully writable, so template authors can set private, internal, and init-only setters as well as mass-assign public ones (e.g. {{ user.is_admin = true }}), and the changes persist on the host object after Render() returns. Publicly available proof-of-concept steps exist in the GHSA advisory; no active exploitation is reported (not in CISA KEV) and no EPSS score was supplied.
Sandbox escape in the Scriban .NET templating engine (all versions before 7.0.0) lets attacker-influenced templates read object members that a tightened MemberFilter was meant to hide, because type accessors are cached by Type alone and survive both filter changes and TemplateContext.Reset(). Applications that reuse a single TemplateContext across requests or tenants and rely on MemberFilter as a security boundary can leak filtered properties and fields to a later, more-restricted render. Reported by VulnCheck with a working proof-of-concept in the vendor advisory; not listed in CISA KEV, and no EPSS score was provided in the source data.
Information disclosure and authorization bypass in Scriban (the .NET text templating engine) before 7.0.0 lets attackers retrieve previously authorized include-template content from earlier renders. Because TemplateContext.Reset() clears output, globals, cultures, and source files but never clears the CachedTemplates dictionary, applications that pool a TemplateContext across requests and use a request-, tenant-, or user-dependent ITemplateLoader will serve a stale cached template to a later, less-privileged render without re-invoking TemplateLoader.Load(). A vendor patch exists (7.0.0) and a working proof-of-concept is published in the GHSA advisory, but there is no public exploit identified as used in active attacks.
Arbitrary file deletion in the ProSolution WP Client WordPress plugin (all versions through 2.0.8) lets unauthenticated attackers remove any file the web server can write to, escalating to full site takeover when critical files like wp-config.php are deleted. The flaw stems from missing path validation in the proSol_fileDeleteProcess handler, which trusts a traversal key that the attacker plants in their own session via a preceding proSol_fileUploadModalProcess call; both steps require only the publicly exposed frontend nonce. No public exploit identified at time of analysis, but the network, no-auth, no-interaction profile and 9.1 CVSS make this a high-priority patch.
Unauthorized data destruction in the Solace Extra WordPress plugin (versions through 1.6.0) lets low-privileged authenticated users invoke the import_zip() AJAX handler, which lacks a capability check. Because the handler trusts only the site-wide 'ajax-nonce' that WordPress emits on every admin page to any logged-in user, Subscriber-level accounts can wipe navigation menus, sidebar widgets, all theme mods, and Elementor templates, and force arbitrary demo-content imports. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the trivial exploitation path and 9.1 CVSS make it a high-priority integrity/availability issue.