Unauthenticated XSS in the Stripe Payments WordPress plugin (versions ≤ 2.1.2) allows remote attackers to inject malicious scripts into victim browsers with no attacker-side authentication required, as disclosed by Patchstack (EUVD-2026-65176). The CVSS Scope:Changed metric reflects that injected scripts execute within the victim's browser security context, enabling session hijacking, credential theft, or malicious content injection against WordPress site visitors or administrators. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Unauthenticated XSS in the Toolset Blocks WordPress plugin (versions through 1.6.26) allows remote attackers to inject malicious scripts into pages rendered by the plugin without any prior authentication. The CVSS vector's scope-change indicator (S:C) signals that injected code executes in the victim's browser context outside the vulnerable component itself, making administrator session hijacking a realistic secondary impact. Reported by Patchstack and tracked under EUVD-2026-65171; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated cross-site scripting in the Event Tickets WordPress plugin (versions ≤ 5.29.2.1) allows remote, unauthenticated attackers to inject and execute arbitrary JavaScript in victims' browsers by delivering a crafted link or triggering stored output. The scope-changed CVSS vector (S:C) indicates the injected script can operate outside the plugin's own execution boundary, enabling session theft, credential harvesting, or defacement against authenticated WordPress users who interact with affected pages. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Unauthenticated cross-site scripting in the Boost WordPress plugin (versions ≤ 2.0.4) allows a remote, unauthenticated attacker to inject arbitrary JavaScript that executes in the browser context of any user who visits or interacts with the affected page, confirmed by PR:N in the CVSS vector. The scope change metric (S:C) reflects that impact crosses from the plugin/server boundary into the victim's browser session, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Out-of-bounds read in SpaceDot AcubeSAT On-Board Computer software exposes the spacecraft's CAN bus message handler to denial-of-service attacks. An attacker with access to the CAN bus network can send a crafted PerformFunction message to the OBC, triggering an out-of-bounds read in the CAN::Application::parsePerformFunctionMessage component that crashes the on-board computer. No public exploit identified at time of analysis, and EPSS exploitation probability sits at 0.14% (4th percentile), consistent with a highly specialized embedded aerospace target.
Token exfiltration in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows any actor with code execution inside a scanned project's build to read the Black Duck API token from the process environment inherited by scanning subprocesses. The token - when supplied via BLACKDUCK_API_TOKEN or BD_HUB_TOKEN - is passed in plaintext to child processes spawned during build capture and signature scanning, where it is observable by co-located code. No public exploit has been identified at time of analysis; however, the vendor explicitly warns that upgrading does not remediate prior exposure, making token rotation a mandatory incident-response step for all affected deployments.
Incomplete remediation of CVE-2025-9615 in NetworkManager exposes WPA-Enterprise (802.1X) connections to server certificate validation bypass on Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. An unprivileged local user can set the 802-1x.ca-path or phase2-ca-path properties of a private connection profile to an attacker-controlled directory because the private_user restriction was never applied to these directory-valued fields. When the victim system subsequently connects to a wireless network, the bypassed CA validation enables credential theft via a rogue access point presenting a certificate signed by the attacker-supplied CA. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis; however, SSVC rates the attack as automatable with total technical impact once local access exists.
Authenticated path traversal in rConfig before 8.2.13 allows any logged-in user to read arbitrary files accessible by the application process by supplying crafted filenames containing directory traversal sequences to the export download endpoint. The fix is confirmed in rConfig V8 Core 8.2.13, released as a dedicated security update and documented in GitHub advisory GHSA-m5rw-jcrm-mmwc. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the release notes reveal that 8.2.13 simultaneously patched multiple related path-containment deficiencies across the application, indicating a systemic pattern rather than an isolated flaw.
Unauthenticated cross-site scripting in the Urna WordPress theme (by Thembay) affects all versions up to and including 2.6.2, allowing a remote attacker to inject malicious scripts into pages viewed by other users. The scope-changed CVSS vector (S:C) confirms the payload executes in the victim's browser context, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege attack path lowers the barrier for opportunistic exploitation against sites running the vulnerable theme.
Cross-site scripting in Brave Conversion Engine (PRO), a WordPress plugin by Amplebyte Pvt Limited, is exploitable by unauthenticated remote attackers against all versions through 0.8.6. The CVSS scope-change indicator (S:C) confirms that successful injection executes attacker-controlled JavaScript within a victim user's browser context - separate from the vulnerable server component - enabling session hijacking, credential theft, or malicious redirects. No active exploitation has been confirmed via CISA KEV, and no EPSS score was included in available intelligence; however, the PR:N/AC:L attack profile means any internet-accessible WordPress installation running this plugin is trivially reachable.
Broken access control in the ProLancer Element WordPress plugin (themebing) affects all versions up to and including 1.4.8, allowing any authenticated subscriber-level user to invoke privileged plugin functionality without proper authorization. The flaw stems from missing authorization checks (CWE-862), yielding high integrity impact and low availability impact against affected WordPress installations. No active exploitation or public exploit code has been identified at time of analysis; Patchstack has published the disclosing advisory.
Unauthenticated XSS in the Goodlayers Tourmaster WordPress plugin (versions ≤ 5.4.9) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages served to victims, with a scope change that can affect the broader WordPress session context. Exploitation requires victim interaction - typically clicking a crafted link - but carries no authentication prerequisite, keeping the barrier to attempt low. No CISA KEV listing and no public exploit code have been identified at the time of analysis, placing this in a 'patch promptly but not emergency' risk tier.
Unauthenticated cross-site scripting in the Events Made Easy WordPress plugin (versions up to and including 3.2.5) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser upon interaction with attacker-controlled content. The CVSS scope change (S:C) indicates the injected script operates outside the plugin's own security context, enabling actions such as session hijacking, credential theft, or admin account takeover. No public exploit code or active exploitation has been identified at time of analysis; however, the unauthenticated attack vector and low attack complexity lower the barrier for abuse.
Unauthenticated cross-site scripting in the Social Media & Share Icons WordPress plugin (by Inisev, versions ≤ 2.9.9) allows remote attackers to inject arbitrary JavaScript that executes in the context of a victim's browser when they visit an affected page. The CVSS scope change (S:C) indicates injected scripts can breach the plugin's own security boundary, enabling session hijacking, credential theft, or page defacement against site visitors and administrators. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, but the zero-authentication requirement substantially lowers the exploitation bar.
Unauthenticated cross-site scripting in the WPComplete WordPress plugin (versions up to and including 2.9.5.6) allows remote attackers to inject and execute arbitrary JavaScript in the context of another user's browser session, with scope change indicating the payload crosses the plugin's security boundary to affect authenticated users such as site administrators. The CVSS vector (PR:N/UI:R/S:C) is consistent with a stored or reflected XSS pattern where an unauthenticated attacker plants a payload that is later triggered when a privileged user visits an affected page. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Cross-site scripting in the 12 Step Meeting List WordPress plugin (versions ≤ 3.19.16) allows unauthenticated remote attackers to inject arbitrary JavaScript that executes in the browsers of visitors or administrators who interact with affected pages. Carrying a CVSS 7.1 score with a Scope:Changed flag, the vulnerability crosses from the plugin context into the victim's browser session, enabling session hijacking, credential theft, or page defacement. No active exploitation or public POC code has been identified at time of analysis.
Macro injection in rpmbuild's tarball mode allows arbitrary code execution on systems running Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and OpenShift Container Platform 4. When rpmbuild processes a tarball in tarball mode, specially crafted tar member names are interpreted as RPM macros, enabling an attacker who can distribute a malicious tarball to achieve full RCE in the context of the user running the build. No public exploit or active exploitation has been identified at time of analysis, but the social-engineering requirement is realistic in open-source build pipeline contexts where developers routinely fetch and build third-party source tarballs.
Integer overflow in GIMP's file-pcx plugin on 32-bit builds enables a heap-based buffer overflow when a user opens a specially crafted PCX image, potentially leading to arbitrary code execution or denial of service. The flaw is architecturally constrained to 32-bit builds - 64-bit installations are unaffected - and exploitation additionally requires user interaction to open the malicious file. No active exploitation (CISA KEV) and no public proof-of-concept have been identified at time of analysis.
Insecure file creation in RansomLook (≤ 2.0.0) exposes the Flask session-signing secret to any local OS user with read access to the application home directory, enabling complete authentication bypass. The secret key governs Flask session cookie signing and the legacy API-key derivation function; possession of it allows an attacker to forge valid session cookies and impersonate any user, including administrators. In LDAP-configured deployments, exploitation is especially direct because the session user loader accepts arbitrary usernames without verifying their existence against any user store. No public exploit has been identified at time of analysis.
Stored cross-site scripting in NethServer's WebTop calendar component (versions 1.5.6 and earlier) permits an authenticated attacker to inject malicious JavaScript into calendar event fields, which silently executes in the browser of any user who subsequently views the poisoned event. The impact scope includes session hijacking, unauthorized access to emails, contacts, and files, and the ability to perform actions as the victim within the platform - all without the victim taking any action beyond viewing the event. No active exploitation or public exploit code has been identified at time of analysis; a vendor-released patch exists in WebTop 1.5.7.