Stored XSS in the User Profile Builder WordPress plugin (versions before 4.0.1) allows users with contributor-level WordPress roles to embed persistent JavaScript via an improperly escaped optional shortcode, executing in the browser of any user who views the affected content - including administrators. A publicly available exploit exists per WPScan intelligence, though EPSS remains at 0.15% (5th percentile) and the vulnerability is absent from CISA's KEV catalog. The non-default shortcode requirement meaningfully limits exposure to sites that have explicitly enabled the affected feature.
PHP Object Injection in User Profile Builder WordPress plugin (versions 3.3.4 through before 4.0.1) allows authenticated administrators to inject arbitrary PHP objects by uploading a malicious configuration file through the plugin's import feature. Exploitation is gated by two non-trivial conditions: the affected free add-on must be explicitly enabled (it is disabled by default), and a suitable POP chain gadget must exist in another installed plugin or theme before code execution is achievable. A public POC exists per WPScan, but no public exploit identified at time of analysis maps to confirmed in-the-wild abuse - EPSS sits at just 0.23% (13th percentile), consistent with the high practical bar imposed by admin-level access and gadget dependencies.
Unauthenticated settings overwrite in the HEL Online Classroom WordPress plugin (versions through 1.0.3) allows any remote attacker to redirect all classroom sessions to attacker-controlled infrastructure and replace the shared secret used to sign those sessions. Because no authentication or authorization check exists on the settings-save endpoint, the entire plugin's operational trust model - both the backend URL and the signing secret - can be silently hijacked without any credentials. A publicly available exploit exists via WPScan, though EPSS sits at 0.18% (7th percentile), indicating no confirmed widespread exploitation at time of analysis.
Unauthenticated REST API access in the HEL Online Classroom WordPress plugin (through 1.0.3) allows any remote user to obtain a signed meeting join link for any classroom - including those protected by an access code - and join it with moderator privileges. All WordPress sites running this plugin through version 1.0.3 are affected regardless of classroom configuration. A publicly available exploit exists via WPScan, though EPSS (0.14%, 3rd percentile) indicates limited automated exploitation activity at time of analysis; no CISA KEV confirmation of active widespread exploitation is present.
Broken order authorization in MStore API WordPress plugin (before 4.21.1) allows any authenticated user, including low-privilege Subscribers, to mark arbitrary orders as paid without actual payment being taken. The plugin's wallet payment handler neither verifies that the targeted order belongs to the requesting user nor deducts the wallet balance for most payment methods, enabling financial fraud against WooCommerce stores. A publicly available exploit exists per WPScan, though EPSS sits at 0.13% (3rd percentile), suggesting limited opportunistic exploitation to date.
MStore API WordPress plugin before 4.21.1 allows any authenticated user - including the lowest-privilege Subscriber role - to mark arbitrary WooCommerce orders as completed and paid without making any payment, constituting a business-logic fraud vulnerability. The root cause is a missing ownership authorization check (CWE-862) in a delivery status endpoint that accepts order IDs without verifying they belong to the requesting user. A publicly available exploit exists, though EPSS at 0.13% (3rd percentile) indicates limited automated mass exploitation to date; this vulnerability is not currently listed in the CISA KEV catalog.
Comma-split value parsing in the qs npm library (versions 6.14.2 through 6.15.3) bypasses the caller-configured `arrayLimit` when the bracket-push key form (`a[]=`) is combined with both `comma: true` and `throwOnLimitExceeded: true` options. An `isFlatArrayValue` flag in `parseArrayValue` incorrectly excluded `[]=` key forms from the pre-split comma count check introduced by the CVE-2026-2391 patch, allowing a single crafted parameter to allocate an arbitrarily large inner array while the documented limit silently fails open. A proof-of-concept is confirmed in the vendor advisory; the CVE is not listed in CISA KEV and no active exploitation has been confirmed. The fix ships in v6.16.0 via commit 8859c37.
Cross-Site Request Forgery in the Newsletters WordPress plugin (versions before 4.17) enables unauthenticated attackers to overwrite arbitrary plugin settings - including API credentials - by tricking a logged-in administrator into submitting a crafted request. The vulnerability arises from a complete absence of nonce verification and capability checks on the settings-save endpoint, meaning the plugin blindly applies every submitted parameter. A publicly available proof-of-concept exploit exists per WPScan, though EPSS sits at 0.10%, suggesting opportunistic mass exploitation has not yet materialized.
Catfolders Document Gallery Pro WordPress plugin before version 2.0.7 exposes private, unpublished folder contents to unauthenticated remote attackers through two compounding weaknesses: REST API routes that lack authorization checks, and a content-identifying token scheme that can be forged entirely client-side without prior authenticated access. Any network-accessible attacker can enumerate and download files from folders site administrators intentionally withheld from public publication. A publicly available proof-of-concept exists per WPScan, though EPSS places exploitation probability at 0.14% (3rd percentile), indicating limited observed opportunistic activity at time of analysis.
Rank Math SEO WordPress plugin versions prior to 1.0.277 allows users holding the Editor role to modify site-wide administrator-reserved WordPress settings by invoking the plugin's automated SEO fix endpoint without proper capability verification. The root cause (CWE-863, Incorrect Authorization) is a missing capability check in the fix-handling code path - WordPress requires specific admin capabilities such as manage_options to alter core settings, but Rank Math does not enforce these checks before acting on the request. A publicly available proof-of-concept is documented via WPScan; the vulnerability is not in CISA KEV, and the EPSS score of 0.13% indicates very low observed exploitation activity at time of analysis.
Payment verification bypass in MasterStudy LMS WordPress Plugin before 3.7.40 permits unauthenticated attackers to fraudulently complete full-price course orders by submitting payment webhook notifications with only a token amount. The plugin neglects to validate the transaction amount, receiving account, currency, or payment status before updating order state to completed, granting unauthorized access to paid LMS content. A public proof-of-concept is available via WPScan, though EPSS remains low at 0.15% (4th percentile) and no CISA KEV listing has been confirmed.
Predictable API key generation in the Newsletters WordPress plugin (versions before 4.17) enables unauthenticated network-accessible attackers who successfully derive the key to perform privileged API operations - including adding or deleting subscribers and sending bulk emails. Exploitation requires the plugin's optional API feature to be enabled. A publicly available proof-of-concept exists via WPScan, though EPSS stands at 0.10% (1st percentile), indicating minimal observed exploitation at time of analysis and no CISA KEV listing.
Open redirect in MasterStudy LMS WordPress Plugin before version 3.7.43 enables unauthenticated attackers to supply an unvalidated redirect parameter during user registration, silently forwarding newly registered users to arbitrary external URLs. This creates a reliable phishing vector: an attacker crafts a registration link pointing to a spoofed login page, and the plugin delivers the victim there immediately post-registration without warning. A publicly available proof-of-concept exists per WPScan, though the EPSS score of 0.14% (3rd percentile) indicates exploitation has not yet become widespread or automated.
Unauthorized deletion of arbitrary membership plans is possible in the Frontend Admin by DynamiApps WordPress plugin (all versions before 3.29.11) due to a missing capability check on an AJAX endpoint accessible to any logged-in user. Any subscriber-level WordPress account holder can send a crafted AJAX request to invoke the unprotected action and permanently remove membership plans without administrative authorization. A publicly available proof-of-concept exists per WPScan, though the EPSS score of 0.13% (3rd percentile) indicates very limited observed exploitation activity at time of analysis, and the vulnerability is not listed in CISA KEV.
Stripe Payment Forms by WP Full Pay WordPress plugin before version 8.5.5 exposes an Insecure Direct Object Reference (IDOR) flaw in its customer-portal subscription cancellation endpoint, allowing an authenticated portal user to cancel subscriptions belonging to entirely different customers by substituting an arbitrary subscription ID in the cancellation request. Exploitation requires prior knowledge of the victim's Stripe subscription ID, which is high-entropy and not enumerable through the plugin itself, meaningfully constraining real-world exploitation despite a publicly available proof-of-concept. No active exploitation is confirmed - the vulnerability is absent from CISA KEV and carries a negligible EPSS score of 0.13% (3rd percentile), consistent with the practical access barrier imposed by the non-guessable subscription identifier.
SQL injection in WP Ultimate CSV Importer WordPress plugin (versions before 9.0) allows authenticated administrators to extract database contents by supplying crafted field values in CSV imports that are passed unsanitized into SQL statements. A publicly available proof-of-concept exists per the WPScan advisory, though the EPSS score of 0.16% (5th percentile) indicates minimal observed exploitation activity. No active exploitation has been confirmed by CISA KEV, and the administrative privilege requirement substantially narrows the realistic attack surface.
Server-side request forgery in Memos through 0.30.0 allows unauthenticated remote attackers to make the application's link-metadata fetcher issue HTTP requests to hosts in the 100.64.0.0/10 carrier-grade NAT address space, a range the application's IP blocklist incorrectly omits. The server returns page titles and HTML meta descriptions from targeted internal hosts, enabling partial reconnaissance of CGNAT-addressed infrastructure. No public exploit has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Account enumeration in Cockpit CMS before 2.14.1 exposes valid usernames through measurable response-time differences in the authentication check endpoint. When a submitted username matches an existing account, the application performs a full bcrypt hash comparison - an intentionally slow operation - whereas non-existent accounts return immediately without any hash computation, creating a statistically detectable timing delta. Unauthenticated remote attackers can exploit this by issuing repeated authentication probes and measuring latency, building a list of valid accounts to target with credential stuffing or brute-force attacks. No public exploit code or CISA KEV listing has been identified at time of analysis, though a researcher advisory (MFC-2026-001) exists.
Session termination via unsigned SAML LogoutRequest in pac4j-saml before 6.5.6 allows unauthenticated remote attackers to destroy any active SAML session by submitting a forged, unsigned LogoutRequest containing a guessed NameID (e.g., an email address used as the SAML subject identifier) when the IdP omits a SessionIndex. The root cause is that SAML2LogoutValidator.validateLogoutRequest() did not enforce signature validation in this code path, permitting the NameID alone to trigger session destruction without any cryptographic proof of IdP origin. No public exploit code is known and this is not listed in CISA KEV; however, the attack is low-complexity and entirely unauthenticated per the CVSS 4.0 vector.
Authentication bypass in pac4j-oidc before 6.5.6 allows remote unauthenticated attackers to establish authenticated sessions by submitting OIDC callback requests carrying only a third-party access token, bypassing issuer, audience, nonce, and subject validation entirely. Applications built on the pac4j Java security framework that use OIDC for single sign-on are vulnerable to token substitution attacks from any attacker who holds a valid access token issued by the same identity provider for any other registered OAuth client. No public exploit code has been identified at time of analysis; vendor-released patch is available in version 6.5.6.
Server-Side Request Forgery in MITRE SAF Heimdall 2.11.6 through 2.13.x allows unauthenticated remote attackers to reach internal network hosts by supplying an arbitrary host_url parameter to the Tenable proxy endpoint, which the backend forwards without validation. The root cause is the absence of both authentication guards and URL allowlist enforcement on the /tenable proxy route, as confirmed by the fix commit adding JwtAuthGuard and an origin-based allowlist. No public exploit code and no CISA KEV entry are identified at time of analysis, limiting immediate real-world risk despite the network-accessible, no-authentication attack vector.
Stored XSS in Formwork through 2.3.14 allows unauthenticated remote attackers to inject persistent malicious markup into the Statistics panel by crafting HTTP requests with malicious Referer headers. The visit-tracking subsystem records the Referer host value without HTML escaping, storing attacker-controlled content in the statistics data. When an administrator opens the Statistics panel, the injected payload executes in their browser, enabling session hijacking, credential theft, or further compromise of the admin interface. No public exploit code or CISA KEV listing is identified at time of analysis.
Open redirect in pac4j-core before 6.5.6 allows network-accessible attackers to redirect authenticated users to attacker-controlled sites immediately after logout. DefaultLogoutLogic.perform() validated logout redirect targets against a URL pattern regex, but that regex did not exclude backslash characters; browsers normalize backslash-prefixed paths (e.g., \evil.com) into network-path references (//evil.com), bypassing the intended allow-list. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the low attack complexity makes exploitation straightforward once a crafted logout link reaches a victim.
TOTP code replay in Rodauth before 2.47.0 allows an attacker who has already obtained a victim's credentials and observed a valid one-time password to reuse that code within the configured drift window, bypassing the second authentication factor. The otp feature lacked any mechanism to record when a code was last accepted, so a single 30-second TOTP token could authenticate multiple distinct sessions during the drift period. No active exploitation is confirmed in CISA KEV, but the patch commit includes a working exploit reproduction in the regression test suite, and the attack mechanic is mechanically straightforward for any adversary who holds prior credential access.
JWT access token indefinite renewal in Rodauth before 2.47.0 allows an attacker who possesses a valid access token to bypass the refresh token requirement entirely. By sending a non-POST HTTP request to the jwt_refresh route, the library still issues a new valid JWT access token without validating a refresh token, enabling perpetual session extension. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the patch is available in version 2.47.0.
Open redirect in Rodauth before 2.47.0 enables post-authentication phishing by failing to reject protocol-relative return-to paths beginning with double slashes. The three affected features - confirm_password, login_return_to_requested_location, and two_factor_auth_return_to_requested_location - stored the raw request path into session without validating that it could not resolve as an external URL. No public exploit or active exploitation has been confirmed at time of analysis, and a patch is available in version 2.47.0.
CSRF protection bypass in Rodauth before 2.47.0 allows remote attackers to force victims into authenticated sessions under attacker-controlled accounts by exploiting an unanchored regular expression in the JSON feature. The JSON content type detection regex used a word-boundary anchor instead of a start-of-string anchor, enabling cross-origin form submissions with content types such as 'application/x-www-form-urlencoded; application/json' to be misclassified as JSON requests, which Rodauth treats as CSRF-exempt. No active exploitation has been confirmed in CISA KEV, and no public exploit tooling has been identified at time of analysis.