Unrestricted file upload in the Embed HTML5 Game WordPress plugin (versions through 1.3) lets unauthenticated attackers upload arbitrary files - including PHP scripts - because the plugin neither restricts who may upload nor validates file type, enabling planting of PHP backdoors and full remote code execution. WPScan reports the flaw with a publicly available exploit, and the CVSS 10.0 rating reflects unauthenticated network exploitation with complete impact. No CISA KEV listing exists, but the combination of PR:N and a public PoC makes opportunistic scanning likely.
Remote code execution in the WatchMan-Site7 WordPress plugin (all versions through 4.2.0) allows any authenticated user - including a low-privilege subscriber - to run arbitrary PHP on the server because the plugin's debugging console, which evaluates user-supplied PHP, is not access-restricted. Publicly available exploit code exists (reported by WPScan), and with CVSS 9.9 this represents full server compromise from the lowest authenticated role. There is no public evidence of active in-the-wild exploitation at time of analysis.
Unauthenticated arbitrary file upload in the Developer Tools WordPress plugin (versions through 1.1.3) lets remote attackers upload malicious files via the bundled, legacy SWFUpload component, typically leading to remote code execution when a PHP webshell is placed in a web-accessible directory. Any WordPress site running this plugin at or below 1.1.3 is exposed with no authentication required. Publicly available exploit code exists (reported by WPScan), though there is no public evidence of active exploitation.
PHP Object Injection in the User Frontend WordPress plugin (versions before 4.3.11) allows any authenticated subscriber-level user to trigger deserialization of attacker-controlled field values by reopening a previously submitted post in the plugin's frontend editing form. If a suitable PHP gadget chain is present in the WordPress installation - supplied by other installed themes or plugins - this escalates to full remote code execution. A public proof-of-concept is available via WPScan, making exploitation accessible to low-skilled attackers on vulnerable installs.
Stored cross-site scripting in the Simple Ajax Chat WordPress plugin (versions before 20260827) permits unauthenticated users to inject arbitrary HTML and JavaScript into chat messages, which execute in the browser of any viewer including site administrators. Because no authentication is required to post messages and the plugin does not sanitize or escape content before rendering, a single malicious chat post persists and fires against every subsequent visitor. A publicly available exploit demonstrates the issue, and CVSS PR:N/UI:R confirms the attacker-to-victim delivery model: the attacker posts once, then waits for an administrator to trigger code execution by viewing the chat.
Stored XSS in the FAQ Builder AYS WordPress plugin (versions before 1.8.5) permits unauthenticated remote attackers to inject persistent JavaScript payloads via visitor-submitted content that is stored without sanitization and later rendered in the WordPress admin dashboard. A double-bypass condition compounds the flaw: the plugin's own partial HTML escaping is undone by a subsequent server-side decoding step, ensuring injected scripts reach the admin browser intact. When a logged-in administrator views the affected admin panel page, the payload executes with full administrative privileges, enabling session hijacking or complete site takeover. A publicly available exploit exists per WPScan; vendor patch version 1.8.5 is available.
Unauthenticated cross-origin RCE in Windows ML CLI (winml-cli < 0.4.0) is reachable when a developer runs the `serve` command, which exposes a localhost HTTP API with a wildcard CORS policy and no authentication gate. Any malicious webpage visited by the user while the server is running can send cross-origin requests to `/v1/cli/build` or `/v1/cli/config`, inject `trust_remote_code=true`, and cause the server to call `AutoConfig.from_pretrained(trust_remote_code=True)` - downloading and executing attacker-controlled Python code from a remote model repository as the server user. The vendor has released a fix in version 0.4.0; no public exploit is identified at time of analysis.
Authenticated administrators in UnoPim before version 2.1.5 can achieve full server-side remote code execution by uploading arbitrary PHP files through the TinyMCE image upload endpoint, which performs no file extension or MIME type validation before writing files to the public storage disk. The server response discloses the uploaded file's URL, enabling direct invocation of the web shell and arbitrary OS command execution under the web server process context. A publicly available proof-of-concept and vendor-released patch (v2.1.5) both exist; no CISA KEV listing was identified at time of analysis.
Missing authorization on REST API endpoints in the Auto x LINE WordPress plugin (through version 1.0.0) allows unauthenticated remote attackers to read and modify plugin settings and erase log data. The plugin facilitates LINE messaging integration for WordPress sites, meaning exposed settings likely include LINE API credentials and channel tokens. A publicly available proof-of-concept exists per WPScan, and the unauthenticated network-accessible nature of the flaw (PR:N, AV:N) makes it trivially exploitable against any exposed instance. No actively exploited status confirmed in CISA KEV at time of analysis.
Authentication bypass in the OAuth Single Sign On WordPress plugin (versions 6.25.0 through <7.0.1) allows unauthenticated remote attackers to log in as any non-administrator WordPress user by forging the identity assertion returned during the Steam SSO flow, without possessing valid credentials. Attackers can additionally register entirely new accounts, providing persistent footholds. A publicly available proof-of-concept exploit reported by WPScan materially elevates real-world risk and makes this an immediate patching priority for affected sites.
Unauthenticated administrator account takeover in the Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 is possible when a site exposes a front-end user-update form configured to target an administrator account with a visitor-supplied password field. The plugin's Forms module skips the authorization check on who may edit the targeted account unless the submitted role is administrator or super_admin, creating a gap exploitable by any site visitor. A publicly available proof-of-concept from WPScan exists and a vendor patch is available at version 0.9.2.7.
Privilege escalation to administrator in the Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 allows unauthenticated visitors to bypass role restrictions enforced on front-end user registration forms. The plugin fails to validate that a submitted role value matches those actually offered by the configured form, and its blocklist against privileged roles is incomplete, enabling a two-stage attack: register with an elevated role, then escalate that account to full site administrator. A publicly available exploit exists per WPScan disclosure, raising the urgency of patching; no public KEV listing has been identified at time of analysis.
Stored XSS in the RegistrationMagic WordPress plugin prior to version 6.0.9.9 allows unauthenticated attackers to inject malicious scripts into registration form fields that are rendered unescaped within HTML attributes on WordPress administrative pages. When a privileged administrator subsequently views the affected backend page, the attacker's payload executes in the admin's browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. A publicly available proof-of-concept exists via WPScan, and a vendor-released patch (6.0.9.9) is confirmed available.
Reflected XSS in Photo Gallery by 10Web WordPress plugin (all versions before 1.8.44) lets an unauthenticated attacker execute arbitrary JavaScript inside the authenticated browser session of an administrator or contributor by tricking them into clicking a crafted link. Two distinct injection sinks exist: the Shortcode admin page (exploitable against contributors and above) and the Galleries/Albums list page (requires the site to have more than 20 galleries, and targets administrators). Both sinks reflect unsanitized request parameters into HTML input-attribute values and weaponize an auto-firing onfocus event handler, bypassing some user-interaction defenses. A publicly available PoC via WPScan confirms the issue; vendor-patched version 1.8.44 is available.
Reflected Cross-Site Scripting in the Social Media Share Buttons & Social Sharing Icons WordPress plugin (all versions before 3.0.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by embedding a malicious payload in a crafted URL targeting an unescaped request parameter rendered inside an inline JavaScript event handler. Exploitation is constrained to sites running a non-default icon display configuration, and requires the victim to interact with the affected share button. A public proof-of-concept is available via WPScan; no active exploitation has been confirmed by CISA KEV.
Privilege escalation in the JetBackup WordPress plugin before 3.1.23.5 allows a subscriber-level user to gain full administrator access by exploiting the plugin's failure to validate account roles during a site restore or migration. When the site owner performs a legitimate backup restore or migration, JetBackup blindly preserves and promotes accounts in the backup set without re-verifying their roles or capabilities, silently elevating an attacker's low-privilege account to administrator. A publicly available proof-of-concept exists per WPScan, though no confirmed mass exploitation (CISA KEV) is on record; the CVSS 7.1 score (AC:H/UI:R) reflects real-world complexity imposed by the site-owner trigger.
Stored Cross-Site Scripting in Xpro Addons for WordPress (before 1.7.4) allows any user holding the Contributor role or higher to inject malicious JavaScript through insufficiently escaped widget settings, which are then rendered unsanitized within HTML attributes on the front end. When a privileged user such as an administrator views a page containing the compromised widget, the attacker's payload executes in their browser session. A publicly available exploit has been documented by WPScan; no CISA KEV listing is present, but the low barrier to exploitation (any registered Contributor) makes this a meaningful risk on multi-author or membership WordPress sites.
Stored Cross-Site Scripting in the All in One SEO WordPress plugin before version 5.0.0.1 enables users holding the contributor role or above to inject persistent malicious scripts into post content that execute in the browser of any higher-privileged user who subsequently edits that post. The attack effectively allows a low-trust contributor to hijack administrator sessions, enabling full site compromise. A publicly available proof-of-concept from WPScan exists, and the plugin's broad deployment across millions of WordPress installations amplifies aggregate exposure.
Stored Cross-Site Scripting in the Social Media Share Buttons & Social Sharing Icons WordPress plugin (versions before 3.0.1) allows users with the Contributor role or higher to inject persistent JavaScript payloads via unescaped post titles rendered inside inline event handlers on share buttons. Payload execution is deferred to site visitors who interact with those buttons - enabling session theft or full site compromise if an administrator triggers it. A publicly available proof-of-concept from WPScan exists; no active exploitation confirmed in CISA KEV at time of analysis.
Stored cross-site scripting in the Ultimate Before After Image Slider & Gallery WordPress plugin before version 4.7.19 enables any authenticated user holding the Author role or higher to plant a malicious JavaScript payload within a slider's before-label field. Because the plugin's bundled client-side script re-injects that label value into the DOM without sanitization, the payload executes automatically in the browser of every visitor - including administrators - who views the affected slider. A publicly available proof-of-concept was published by WPScan; vendor-released patch version 4.7.19 is available, and no active exploitation has been confirmed in the CISA KEV catalog.
Stored cross-site scripting in the Ultimate Before After Image Slider & Gallery WordPress plugin (all versions before 4.7.19) allows users holding the Author role or above to embed a persistent browser payload in a slider's after-label field, which executes in every visitor's browser - including site administrators - when the slider is rendered. The plugin's bundled client-side script re-injects the stored label value directly into the DOM without HTML encoding. A publicly available exploit exists per WPScan, making this a practical privilege-escalation path on any WordPress site granting Author access to untrusted users.
Control-character (newline) injection in Yoast SEO Premium before 27.6.1 allows an authenticated WordPress Author to write arbitrary Apache directives into the site's root .htaccess file via unsanitized redirect origins in file-based redirect mode. On Apache servers that process PHP directives, the injected auto_prepend_file directive can be chained with a polyglot image upload (available to Author-role users) to achieve full Remote Code Execution as the web server process. A public exploit is available via WPScan, making real-world exploitation feasible wherever the three required conditions align.
Unauthenticated attackers can bypass WordPress nonce validation in the HIPAA FORMS plugin (all versions before 3.2.0) by including a hardcoded parameter in any AJAX request, which causes the server to skip its nonce check entirely. Because the plugin handles HIPAA-regulated healthcare intake forms, this exposes protected AJAX endpoints to unauthorized read and write operations without any credentials. A public exploit is available via WPScan, and no exploitation complexity is required beyond knowledge of the hardcoded value.
Missing authorization in the Booking for Appointments and Events Calendar WordPress plugin (versions before 2.4.9) allows unauthenticated remote attackers to trigger the post-booking action chain - including email notifications and third-party integration callbacks - for any booking by guessing or enumerating its numeric identifier. The plugin fails to validate either session authentication or a nonce/request token before executing post-booking hooks, meaning an attacker can impersonate the completion of any booking without ever making a real reservation. A publicly available proof-of-concept exploit exists per WPScan, though no KEV listing confirms active mass exploitation.
Insecure Direct Object Reference in the WC Vendors WordPress plugin before 2.7.2.1 allows any authenticated user holding the vendor role to tamper with product variations owned by other vendors and to overwrite the status and title of arbitrary WordPress posts. The root cause is that the plugin never validates whether a user-supplied object ID actually belongs to the requesting vendor before persisting changes. A publicly available proof-of-concept exploit exists; the issue is not currently listed in CISA KEV.
Base-path prefix bypass in Astro prior to 7.2.4 allows unauthenticated remote attackers to reach protected server-side routes by exploiting a missing path-segment boundary check in the framework's base-stripping logic. When a non-root base (e.g., '/app') is configured, a request to '/appX/admin' passes the router's prefix check and resolves to the internal '/admin' route while middleware still observes '/appX/admin' in context.url.pathname, causing pathname-based authorization rules to silently fail. Version 7.2.4 patches the flaw across all four affected subsystems; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Remote OS command injection in AS203038 Looking Glass before 1.3.5 lets remote attackers inject shell commands through the ping/traceroute/BGP diagnostic inputs. The root cause is an unanchored regular expression in the input-validation layer that fails to bind matching to the full input, allowing malicious payloads to slip past validation and reach an underlying command. No public exploit or CISA KEV listing exists at time of analysis, but the network-facing, unauthenticated nature (CVSS 9.8) makes it high-priority for any exposed instance.
Improper resource lifecycle control (CWE-664) in Cisco IOS XR Software is addressed by a batch software-hardening release stemming from Cisco's internal security review (advisory cisco-sa-hardening-iosxr-qg64NcM). The provided CVSS vector (AV:N/AC:L/PR:N/UI:N, 9.8) implies a remotely reachable, unauthenticated flaw with high confidentiality, integrity, and availability impact on IOS XR routers, but Cisco's omnibus advisory publishes no technical specifics on the affected component or trigger. No public exploit identified at time of analysis, and no EPSS/KEV data was supplied.
Authentication bypass in on-premises Delinea Secret Server allows an attacker to register an attacker-controlled FIDO2 credential against a victim's account and subsequently log in as that user (CWE-290, spoofing). Because Secret Server is a privileged-access-management vault, a successful bypass yields access to whatever secrets and privileges the impersonated account holds. No public exploit identified at time of analysis and no CISA KEV listing; the vendor rates it CVSS 9.8, though the description qualifies exploitation as occurring only 'under specific conditions.'
Cross-user session confusion in libcurl allows one user's HTTP request to be silently transmitted over another user's previously authenticated Negotiate (SPNEGO/Kerberos) connection. When an initial request to a host is made with empty credentials, libcurl incorrectly treats the resulting connection as eligible for reuse, so a subsequent request from a different principal inherits the earlier authenticated context. There is no public exploit identified at time of analysis; EPSS is low (0.26%, 17th percentile), and the flaw is only meaningful in multi-user or proxy-style deployments that share a single libcurl handle/connection pool.
Access-restriction bypass in Google Chrome desktop prior to 152.0.7977.75 lets a remote attacker who first tricks a user via social engineering leverage a co-installed application to escape Chrome's system access boundaries. The flaw is an improper input validation (CWE-20) issue in the browser's DataTransfer component, rated High by Chromium and fixed in the September 2026 Stable channel. EPSS is low (0.16%, 5th percentile), no public exploit or CISA KEV listing exists, so realistic risk is bounded by the required user interaction and the presence of a malicious co-installed app.
Improper access control in Cisco IOS XR Software allows remote unauthenticated attackers to bypass authorization restrictions and gain full compromise of affected routing platforms, per Cisco's CVSS 9.8 rating. The flaw is one of several internally discovered issues addressed in a batch of software-hardening releases from Cisco's proactive security review (advisory cisco-sa-hardening-iosxr-qg64NcM). No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; the vendor-supplied description is high-level boilerplate with no concrete technical detail.
Remote code execution in the Silicon One integration of Cisco Nexus 9000 Series Switches (Cisco NX-OS Software) lets an unauthenticated attacker run code as root by connecting to TCP ports 43210 and 43211, which are exposed by default in the Layer 3 default VRF. Crafted input to the S1HAL process is executed with root privileges, and the same flaw can crash S1HAL to force a device reload (denial of service). Rated CVSS 9.8; no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the pre-authentication, network-facing nature makes it a top-priority patch.
Unauthenticated privilege escalation in the WordPress Authorizer plugin (versions 3.15.1 and earlier) lets remote attackers with no credentials elevate themselves to elevated/administrative roles, according to a CVSS 9.8 rating and CWE-266 (incorrect privilege assignment). Authorizer is an authentication/SSO plugin, so a flaw in its role-assignment logic effectively hands attackers control of the authentication gate itself. No public exploit identified at time of analysis, and the issue is reported by Patchstack rather than listed in CISA KEV.
Arbitrary file deletion in the SigmaForms Pro - AI Generated Forms plugin for WordPress (all versions through 1.4.11) lets unauthenticated attackers submit a path-traversal string through a form's file-upload field, which is stored in the database and processed by the vulnerable delete_submission_files function. When an administrator later deletes the submission record, the plugin removes the attacker-specified file - deleting wp-config.php (or similar) can escalate to full site takeover/remote code execution. Reported by Wordfence; no public exploit identified at time of analysis and no CISA KEV listing.
Unauthenticated privilege escalation in the WordPress plugin Booking for Appointments and Events Calendar - Amelia (Premium) versions 8.0 through 9.6.2 lets remote attackers gain full administrator control of a site. By abusing insufficient validation of the 'type' parameter in the customer update endpoint (with 'externalId' set to 0), an attacker elevates a customer to the manager role, then creates a provider entity linked to an existing administrator and overwrites that administrator's password. No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network reachability make this a high-priority patch for affected sites.
Incomplete patch for OS command injection in the Nuclio serverless dashboard (local/Docker platform, all versions prior to 1.17.4) leaves the list-all resource code path exploitable by unauthenticated remote attackers. Shell metacharacters injected via the X-Nuclio-Function-Namespace, X-Nuclio-Project-Namespace, or X-Nuclio-Function-Event-Namespace HTTP headers bypass the prior fix and reach a /bin/sh -c invocation in pkg/platform/local/client/store.go unescaped, enabling arbitrary command execution inside the dashboard container. No public exploit has been identified at time of analysis, but the attack surface is network-accessible and requires no authentication, lowering the bar significantly for any attacker already familiar with the previously disclosed injection class (GHSA-jx7q-cpg6-669g).
Sandbox-escaping remote code execution in Google Chrome for Android before 152.0.7977.75 stems from a use-after-free in the Shared Tab Groups feature (CWE-416). A remote attacker who lures a victim into visiting a crafted HTML page can corrupt freed memory to execute arbitrary code outside the renderer sandbox. Chromium rates the severity Critical (CVSS 9.6); the vendor has shipped a fix, but no public exploit has been identified at time of analysis.
Sandbox-escaping remote code execution in Google Chrome for Android before 152.0.7977.75 stems from a use-after-free in the WebGL implementation, letting a remote attacker who lures a victim to a crafted HTML page execute arbitrary code OUTSIDE the renderer sandbox. Rated Critical by Chromium with a CVSS 9.6 (scope-changed) vector; a vendor patch shipped in the September 2026 Stable channel update. No public exploit identified at time of analysis, though the tracker bug (issues.chromium.org/546260492) and Google's own reporting indicate the flaw is well characterized.
Remote code execution in Google Chrome for Android before 152.0.7977.75 stems from a use-after-free in Dawn, Chrome's WebGPU/GPU graphics abstraction layer, and - per Google's advisory - allows a crafted HTML page to execute arbitrary code outside the renderer sandbox. Exploitation only requires an unauthenticated victim to visit a malicious page, giving the attacker high-impact code execution on the device. No public exploit has been identified at time of analysis and the issue is not in CISA KEV, though the sandbox-escape framing makes it a high-priority browser patch.
Sandbox escape and out-of-sandbox arbitrary code execution in Google Chrome (desktop) before 152.0.7977.75, rooted in an incorrect authorization flaw in the FileSystem component. A remote attacker who lures a victim into opening a crafted HTML page can break out of the renderer sandbox and run code with the privileges of the browser process. Rated High by Chromium and CVSS 9.6; the vendor has shipped a stable-channel patch, though no public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated access to the first-run Super-Admin bootstrap endpoint (/api/v1/bootstrap/setup) and all 17 admin/DPO console pages in tsi-coop tsi-dpdp-cms ≤0.5.0 allows remote attackers to claim full administrative control of any fresh or reset deployment and to retrieve page source containing internal API endpoints, function names, and request schemas. The root cause is CWE-306: console pages relied solely on client-side JavaScript redirects with no server-side session gate, and the bootstrap endpoint imposed no token or expiry requirement. A publicly available proof-of-concept exploit exists on GitHub; the vendor has released v0.5.1 which adds server-side session enforcement and a required deployment token.
Missing server-side authentication on all 17 admin and DPO compliance console pages in tsi-dpdp-cms ≤0.5.0 allows any unauthenticated network client to retrieve complete console page source, including internal API endpoint paths, function names, and request schemas. The root cause is exclusive reliance on client-side JavaScript redirects as the sole access gate - a plain curl request to any console URL receives full page content with no credentials. A public POC exploit exists on GitHub, and vendor-released patch v0.5.1 is available.
Path traversal in Piwigo's Image Derivative Handler (i.php) exposes arbitrary server-side files to remote unauthenticated attackers on installations up to version 16.3.0. The CVSS 4.0 vector confirms network-accessible, zero-authentication exploitation with low confidentiality and integrity impact, consistent with a traversal primitive that can both read and potentially write files in unanticipated filesystem locations. A public proof-of-concept titled 'unauthenticated_derivative_path_traversal' is available on GitHub, materially lowering the bar for exploitation; no active exploitation has been confirmed in CISA KEV at time of analysis.
Unauthenticated remote denial of service in rowboatlabs rowboat through v0.9.1 allows any network attacker to disrupt the Composio webhook endpoint by sending a crafted HTTP request body that exploits improper resource handling in the Next.js route handler (apps/rowboat/app/api/composio/webhook/route.ts). A proof-of-concept is publicly available on GitHub, removing any skill barrier for exploitation. The vendor resolved the issue in v0.9.2 by deleting the legacy Next.js application entirely rather than patching the underlying flaw, meaning no security control was introduced - only the attack surface was removed.
Uncontrolled resource consumption in simular-ai Agent-S up to version 0.3.2 allows remote unauthenticated attackers to exhaust server resources via the OCR HTTP API's ImageData function. By supplying crafted img_bytes input to the exposed endpoint in gui_agents/s1/utils/ocr_server.py, an attacker can trigger a denial-of-service condition against the OCR processing service. Publicly available exploit code exists on GitHub; the vendor did not respond to responsible disclosure, leaving no official patch.
Missing server-side authentication in tsi-coop tsi-dpdp-cms ≤0.5.0 exposes all 17 admin and DPO console pages to unauthenticated HTTP clients: the application enforced access via a client-side JavaScript redirect only, so any HTTP request that ignores the redirect receives the full page source including internal API endpoints, function names, and request schemas. A second bundled vulnerability allows unauthenticated super-admin account creation via an unprotected first-run setup endpoint (/api/v1/bootstrap/setup), enabling complete platform takeover on fresh or reset deployments. A public proof-of-concept demonstrating the bypass is available, and the vendor has released a patched version (v0.5.1) confirmed to address both issues.
HTTP Header Injection in the Ajaxify Comments WordPress plugin (before version 3.2) allows unauthenticated remote attackers to inject arbitrary HTTP response headers via unsanitized user-supplied input that is echoed into server responses. The plugin fails to neutralize CRLF sequences, enabling response splitting that could facilitate session fixation, cache poisoning, or cross-site scripting via crafted HTTP responses. A publicly available exploit has been documented by WPScan; no active exploitation (CISA KEV) has been confirmed at time of analysis.
Privilege escalation in the Theme My Login WordPress plugin (versions before 7.2.0) allows low-privileged users to silently bypass the network's site-creation restrictions on multisite WordPress installations, gaining administrator-level control over a newly created site. Subscriber-level authenticated users - and on some networks, unauthenticated users - can invoke the site-signup flow to create sites even when the network's registration setting prohibits it. A publicly available proof-of-concept exploit exists, raising the urgency for patching. The vendor has released a fix in version 7.2.0.
Cross-site request forgery in the Simple Membership MailChimp Integration WordPress plugin (versions before 1.9.8) allows a network-positioned attacker to replace the site's configured MailChimp API key with one under attacker control by tricking a logged-in administrator into loading a crafted page. Once the API key is substituted, all subsequent member registration data - including name, email address, and membership level - is silently forwarded to the attacker's MailChimp account until the change is detected. A publicly available exploit exists and a vendor patch (1.9.8) is available; no active exploitation has been confirmed in CISA KEV.