Verifier bypass in PREVAIL, the polynomial-runtime eBPF verifier (used notably as the abstract-interpretation verifier in ebpf-for-windows), affects all versions prior to 0.2.4. When a destination register carries a non-singleton typeset - two or more simultaneously possible pointer types, e.g. {ctx, shared} or a {number, pointer} union - EbpfTransformer::add() silently skips updating the pointer offset variable, leaving a stale pre-add offset. Subsequent bounds checks reason from that stale offset and accept out-of-bounds memory accesses, so a crafted BPF program that would corrupt memory at runtime is incorrectly accepted as safe; the fix landed in 0.2.4 and no public exploit has been identified.
Verifier bypass in PREVAIL (vbpf/prevail), the polynomial-runtime eBPF static verifier, before version 0.2.4 lets an attacker get an unsafe eBPF program accepted as safe. The abstract transformer treats stores through a context-typed (T_CTX) base register as a silent no-op, so a program can overwrite a context pointer field such as ctx->data, reload it typed as a packet pointer (T_PACKET), and dereference an attacker-controlled address while prevail still reports PASS, enabling out-of-bounds memory access. Fixed in 0.2.4; no public exploit identified at time of analysis beyond the maintainer's regression test cases, which concretely demonstrate the bypass shape.
SQL injection in the WCFM Marketplace WordPress plugin (versions 3.8.1 and earlier) lets remote unauthenticated attackers inject arbitrary SQL into backend database queries. Per the CVSS vector this is exploitable over the network without privileges or user interaction, and the changed scope with high confidentiality impact indicates database contents can be read across the WordPress store's data. Reported by Patchstack; no public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in BookStack before 26.05.4 lets a user with editor-level permissions upload a malicious SVG through the drawing upload endpoint, which accepts unvalidated base64 content and stores it without inspection. The image gallery API later streams the file with no content-type validation and no CSP headers, so the embedded script executes in the browser of any administrator who views it - enabling admin session/account takeover. No public exploit is identified at time of analysis, but the fixing commit and test case publicly document the vulnerable code path.
Unauthenticated post creation and publication is possible in the User Frontend WordPress plugin before 4.3.11 due to a server-side enforcement gap in its subscription-gating logic. The plugin validates subscription status only at form-render time, not during form submission processing, so an attacker who bypasses the rendered form and submits directly to the backend endpoint can create - and depending on form configuration, immediately publish - posts that should be restricted to paying subscribers. A publicly available proof-of-concept exists and was disclosed through WPScan. No public exploit in CISA KEV at time of analysis.
Global protection bypass in the Passster WordPress plugin (versions before 4.2.26) allows unauthenticated remote attackers to access password-protected content by submitting crafted URLs that circumvent the plugin's site-wide protection checks. Because Passster's entire purpose is content gating, this vulnerability entirely nullifies the plugin's security guarantee for affected sites. A publicly available PoC exists, reported by WPScan, making automated scanning and exploitation straightforward.
Route normalization bypass in the Restrict User Access WordPress plugin (all versions before 2.8.1) lets unauthenticated remote attackers read content the plugin is configured to restrict and enumerate WordPress user accounts. The plugin compares raw incoming REST API route strings against its protection rules without first canonicalizing the path, so a subtly non-canonical request (extra slash, encoded character, etc.) matches no rule and is passed through unrestricted. A publicly available PoC is documented by WPScan; the vulnerability is not in CISA KEV at time of analysis.
Unauthenticated information disclosure in the Wp Edit Password Protected WordPress plugin (before 1.3.5) exposes password-protected page and post content via the WordPress REST API. The plugin enforces content protection on standard page views but fails to apply the same restriction to REST API endpoints, allowing any remote unauthenticated requester to retrieve the full content of pages the site owner intended to keep gated behind a password. A publicly available proof-of-concept is documented by WPScan; no active exploitation has been confirmed in CISA KEV. The CVSS score of 5.3 reflects the limited scope - confidentiality only, no integrity or availability impact.
Payment bypass in the RegistrationMagic WordPress plugin before 6.0.9.9 allows unauthenticated users to register for paid forms without completing payment and immediately receive an activated account holding whatever role the form is configured to grant. The plugin fails to validate a client-supplied quantity multiplier when computing the total registration price server-side, enabling an attacker to force the calculated total to zero or an arbitrary value. A publicly available proof-of-concept exploit exists per WPScan, and no authentication is required. No public exploit identified at time of analysis for active exploitation, but the low attack complexity combined with public PoC makes this a realistic threat for any site monetizing registrations via this plugin.
Price validation bypass in the RegistrationMagic WordPress plugin before 6.0.9.9 allows unauthenticated users to complete paid registrations without payment and receive fully activated accounts. The plugin fails to verify the total registration price server-side, meaning client-submitted price values are accepted without cross-checking against the configured amount. A publicly available proof-of-concept exploit exists, and no CISA KEV listing has been recorded at time of analysis.
Unauthenticated information disclosure in the Passster WordPress plugin (versions before 4.2.24) allows remote attackers to retrieve the values of password-protected content via an improperly handled AJAX action. Because Passster's sole function is gating content behind passwords, this flaw entirely negates its intended protection guarantee. A public exploit is available via WPScan, and the zero-prerequisite attack vector makes this trivially exploitable against any affected installation.
Unauthenticated information disclosure in the Notification Bar for WordPress plugin (through v1.1.8) allows any remote attacker to retrieve the full subscriber email list via an exposed CSV export script that performs no authentication or capability check. A publicly available proof-of-concept published by WPScan confirms trivial exploitation requiring only a single HTTP request. The vulnerability is not currently in CISA KEV, but the zero-friction exploitation path creates meaningful privacy and regulatory exposure (GDPR, CAN-SPAM) for any WordPress site running this plugin.
SQL injection in the Comments WordPress plugin before 7.6.66 allows unauthenticated remote attackers to read restricted comment content by injecting SQL grammar into an unvalidated query parameter. Affected content includes comments awaiting moderation, spam and trash comments, and comments attached to private or draft posts. The impact is scoped to comment disclosure rather than full database extraction, as the injection manipulates query structure rather than enabling arbitrary SELECT statements. No public exploit identified at time of analysis is contradicted by WPScan confirming publicly available exploit code exists.
Rank Math SEO WordPress plugin versions before 1.0.277.1 exposes the full content of password-protected posts to unauthenticated users via publicly generated SEO metadata. The plugin fails to enforce WordPress's native post-password gate before extracting post content for use in meta tags and structured data, making protected content readable by anyone who can access the SEO output. A publicly available proof-of-concept is documented by WPScan; a vendor patch (1.0.277.1) is available.
Unauthenticated information disclosure in the Ultimate Member WordPress plugin (all versions before 2.13.0) exposes the content of comments still awaiting moderation and activity from private user profiles to any anonymous visitor. The plugin's profile activity endpoint fails to verify both comment approval status and profile privacy settings before returning data, meaning moderated/private content is served as if it were public. A publicly available proof-of-concept exists; no active exploitation has been confirmed via CISA KEV.
Unauthenticated information disclosure in the Solace Extra WordPress plugin before 1.7.0 exposes the full content of non-published Site Builder parts - drafts, pending posts, private pages, and trashed items - to any anonymous visitor via an unprotected AJAX action. The plugin registers an AJAX handler that performs no capability check and no post-status validation, bypassing WordPress's normal access controls entirely. A public proof-of-concept is available through WPScan; the vendor has released version 1.7.0 to close the gap.
Firmware-level compromise of the Phison PS3111-S11 SATA SSD controller allows an attacker with privileged local host access to read and write controller SRAM and raw NAND flash by abusing privileged vendor unique commands (VUCs) exposed over the ATA interface. Firmware builds through SBFQT1.3 either ship with no VUC lock or use a weak CRC-16 unlock handshake that can be trivially defeated, enabling a persistent firmware implant that survives power cycles and OS reinstalls. Public tooling and a technical writeup exist (VulnCheck advisory plus GitHub 'disksec' and 'psychite' projects), so publicly available exploit code exists, though there is no evidence of active exploitation.
Unauthenticated information disclosure in the MultiVendorX WordPress plugin (versions prior to 5.0.15) exposes sensitive marketplace data through an improperly secured REST API listing route. Any unauthenticated remote attacker can query the endpoint to retrieve vendor contact information, payout details, pending payout amounts, and administrative notes attached to store applications. A publicly available exploit code exists via WPScan, and a vendor patch has been released in version 5.0.15.
Unauthenticated IDOR (CWE-639) in the MotoPress Appointment Booking WordPress plugin before version 2.4.8 enables any remote attacker to permanently delete arbitrary users' reservations by supplying a known booking identifier to an unprotected deletion endpoint. This CVE documents an incomplete fix of CVE-2026-9180 - the vulnerable deletion path remains reachable on sites using payment confirmation workflows, confirmed through version 2.4.7. A publicly available proof-of-concept was disclosed by WPScan, and the vendor has released a corrective patch in version 2.4.8.
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin before 3.7.46 exposes the titles and IDs of an author's unpublished courses - including draft, pending, and private posts - through an unprotected REST API endpoint. The affected route performs no access control check and applies no publication-status filter, meaning any unauthenticated network request can enumerate course content that site owners intended to keep hidden. A publicly available proof-of-concept exists per the WPScan advisory; no active exploitation has been confirmed in CISA KEV at time of analysis.
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin (all versions before 3.7.46) exposes per-student course enrollment and learning progress data to any remote attacker without credentials. The plugin fails to perform an authorization check before returning student-specific data, allowing enumeration of any registered user's enrolled courses and progress metrics. A publicly available exploit exists via WPScan; no active exploitation (KEV) has been confirmed, and the CVSS 5.3 score accurately reflects limited confidentiality impact.
FormLayer WordPress plugin before version 1.0.9 discloses full form configuration data to unauthenticated users through its public submission handler, which performs no authorization check before returning stored settings. Notification recipient email addresses, confirmation redirect targets, and third-party integration credentials are exposed for all forms - including unpublished drafts invisible to end users. A public exploit exists via WPScan, and a vendor patch is available at version 1.0.9.
Payment verification bypass in WP Express Checkout WordPress plugin before 2.4.9 allows unauthenticated remote attackers to forge completed orders without submitting actual payment. The plugin fails to perform server-side confirmation that a payment transaction was successfully processed before transitioning an order to 'paid' status, enabling fraudulent order completion. A publicly available exploit exists per WPScan, making active abuse by financially motivated actors a realistic near-term risk for any e-commerce site running an affected version.
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin before 3.7.46 exposes learning statistics for any registered user without authorization. The plugin's student statistics endpoint performs no access control check, allowing any remote attacker to retrieve course counts, accumulated points, certificates, quiz totals, and assignment totals for arbitrary user accounts. A publicly available exploit exists per WPScan, and the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required.
Authentication bypass in Team Password Manager before 14.184.308 lets unauthenticated remote attackers abuse the local account password-reset flow to set arbitrary passwords for existing local users and then log in as them. Because this product is a self-hosted vault storing credentials for entire teams, a successful reset yields full account takeover and access to whatever secrets the victim can view. No public exploit has been identified at time of analysis, though the flaw was reported by VulnCheck and a fixed release is available.
Heap out-of-bounds write in NGINX JavaScript (njs) xml.exclusiveC14n() allows unauthenticated remote attackers to crash NGINX worker processes or cause unbounded memory growth, with theoretical code execution that has not been demonstrated. The vulnerability is directly reachable in the nginxinc/nginx-saml reference SAML SP implementation, which passes untrusted InclusiveNamespaces/@PrefixList values to xml.exclusiveC14n() before signature verification completes - meaning no valid SAML signature is required to trigger it. Both the njs (default) and QuickJS engines are affected, with differing crash-vs-leak behavior, but both result in denial of service. No public exploit is identified at time of analysis.
Remote code execution as root on the Submariner gateway node is possible in cert-auth mode, affecting Submariner as bundled in Red Hat Advanced Cluster Management for Kubernetes 2. The gateway builds its IPsec connection configuration from unvalidated free-form CRD fields, so a malicious member cluster can publish a CableName containing embedded newlines and ipsec.conf directives (e.g. a leftupdown hook) that get executed on the gateway. No public exploit identified at time of analysis; the flaw is reported and tracked by Red Hat.
Privilege escalation in Craft CMS before 5.10.11 lets remote attackers gain administrator rights by registering a new account using the email address of a previously deactivated admin, because the admin flag is not validated and persists across registration. Exploitation requires public user registration to be enabled and email verification to be disabled. Reported by VulnCheck with a vendor security advisory (GHSA-242m-9wq7-vhwq); no public exploit identified at time of analysis.
Incorrect authorization in the Drupal Commerce PayPal contribution module (versions up to 1.12.0 and 2.0.0 through 2.1.3) lets remote unauthenticated attackers reach protected resources or actions through forceful browsing - directly requesting URLs/endpoints that should be access-checked. A vendor patch exists via Drupal security advisory SA-contrib-2026-095. No public exploit has been identified at time of analysis, and the module is a niche payment-integration component rather than Drupal core.
Use-after-free in libcurl's HTTP/2 Server Push handling affects applications that enable server push while sharing connections across easy handles via the curl share interface. A malicious or compromised HTTP/2 server can trigger the freed-then-reused memory during connection cleanup, leading to memory corruption, crashes, and potential integrity impact against any of the vast range of software that embeds libcurl. EPSS is low (0.21%, 11th percentile) and there is a referenced HackerOne report (#3916059) but no public exploit code and no CISA KEV listing; no public exploit identified at time of analysis.
Stored cross-site scripting in the SEOWriting WordPress plugin (through version 1.12.5) allows authenticated Contributor-level users to inject arbitrary JavaScript that executes in the browser session of higher-privileged users - Editors or Administrators - who view or preview the affected post. The root cause is a misconfigured KSES allowlist that explicitly whitelists the `onload` event attribute on `iframe` elements, bypassing WordPress's built-in content sanitization. A publicly available proof-of-concept confirms the attack path is reproducible; the vulnerability is not currently listed in the CISA KEV catalog, suggesting active exploitation has not been widely observed at time of analysis.
Authenticated SQL injection across Zohocorp ManageEngine Password Manager Pro, PAM360, and Access Manager Plus enables any low-privilege authenticated user to query or manipulate the backend database. Because these products serve as enterprise privileged access management vaults - centralizing credentials for critical infrastructure - a successful injection attack could expose the entire stored credential set. Zohocorp has released fixed builds for all three products and no public exploit has been identified at time of analysis.
Remote code execution in Google Chrome desktop before 152.0.7977.75 stems from a use-after-free in the Proxy component that a remote attacker can trigger with crafted network traffic to run arbitrary code OUTSIDE the browser sandbox. Google rates the Chromium severity High and a patched Stable channel build is available; no public exploit code has been identified at time of analysis. Because the flaw yields a sandbox escape rather than a contained renderer bug, successful exploitation gives attacker-controlled code on the host at browser-process privilege.
Improper certificate validation in the KrakenD-based API Gateway of Eclipse aeriOS allows a network man-in-the-middle to compromise bearer-token validation. The bundled KrakenD configuration hard-codes disable_jwk_security to true with no Helm override, so KrakenD skips TLS certificate verification (and in the shipped config fetched the JWKS over plaintext HTTP) when retrieving the JSON Web Key Set used to validate JWTs. Only pre-release development builds are affected; there is no public exploit identified at time of analysis and the flaw is not in CISA KEV.
Remote code execution in Jenkins 2.579 and earlier (LTS 2.568.2 and earlier) allows any low-privileged authenticated user to compromise the Jenkins controller by submitting a crafted `config.xml` document. The document embeds objects that Jenkins treats as independent top-level configuration types - such as job definitions or global settings - as nested field values; once bound into Jenkins' runtime object graph, Stapler (Jenkins' HTTP routing framework) begins dispatching live HTTP requests through those embedded objects, providing an attacker-controlled code execution path. Vendor-released patches (Jenkins 2.580, LTS 2.568.3) are available as of 2026-09-02; no KEV listing or public POC is confirmed at time of analysis.
Remote code execution is possible in the DevKit Pro WordPress plugin (versions ≤ 2.3.0) by any authenticated user holding Subscriber-level access or higher. The DPDEV_install_themes_func() function, registered on the wp_ajax_DPDEV_install_themes AJAX action, lacks both a WordPress capability check and nonce validation, allowing low-privileged users to upload and extract arbitrary theme ZIP packages - including PHP webshells - into the web-accessible wp-content/themes/ directory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the low privilege requirement (Subscriber) makes this a realistic risk on any WordPress site with open user registration.
Rank Math SEO WordPress plugin before version 1.0.277 allows authenticated users holding at minimum an Author role to overwrite arbitrary post and user metadata across the entire WordPress installation, including metadata belonging to higher-privileged accounts such as Editors and Administrators. The flaw is an IDOR (CWE-639): the metadata update endpoint accepts a user-controlled row reference without verifying that the targeted record belongs to an object the requesting user is authorized to modify. A publicly available proof-of-concept exploit exists, confirmed by WPScan; no active exploitation in CISA KEV is noted at time of analysis.
Arbitrary file write to remote code execution in Jenkins File Parameter Plugin (versions ≤ 425.v3fa_801681b_5e) is achievable by any low-privilege authenticated Jenkins user through a Stapler data binding flaw. By crafting a build request with a path-traversal file parameter, an attacker can write attacker-controlled content to arbitrary locations on the Jenkins controller filesystem, enabling code execution by overwriting Groovy init scripts, SSH authorized_keys, or other sensitive files. No public exploit has been identified at time of analysis, and CISA SSVC rates current exploitation as none - but the technical impact ceiling is total controller compromise.
Unsafe type instantiation during form data binding in Jenkins Stapler allows low-privileged authenticated users to trigger instantiation of arbitrary object types unrelated to the intended field type, achieving full compromise (C:H/I:H/A:H) of the Jenkins controller. Affected are Jenkins 2.579 and earlier and LTS 2.568.2 and earlier, via Stapler 2107.v8dfcb_e8ed317 and earlier (excluding the backport 2088.2093.vd7c3e58008a_6). The root cause is CWE-502-class unsafe deserialization/type-binding: Stapler fails to constrain which Java types may be instantiated when processing attacker-controlled HTTP form submissions. No public exploit code or CISA KEV listing is identified at time of analysis, but Jenkins is pervasively deployed in CI/CD pipelines and the low privilege bar (Overall/Read) makes this a high-priority patch target.
NGINX JavaScript (njs) and QuickJS (qjs) fail open during the js_access phase when an exception is thrown inside an asynchronous request-body processing handler before an explicit access-denial is returned. The flaw (CWE-636, Not Failing Securely) allows unauthenticated remote attackers to bypass js_access controls entirely and reach protected backend resources. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation is bounded by the requirement for a specific async access-handler pattern.
Unrestricted Java deserialization in Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier enables any user holding Item/Configure permission to execute arbitrary code on the Jenkins controller. The plugin stores performance test results as serialized Java objects in the build directory and reads them back without enforcing a class allowlist, enabling classic gadget-chain exploitation (CWE-502). No public exploit has been identified at time of analysis, and SSVC rates exploitation as none with non-automatable delivery, but technical impact is rated total - full Jenkins controller compromise.
Path traversal in Jenkins Allure Plugin 2.35.2 and earlier allows any user holding Item/Read permission on a Jenkins job that publishes Allure test reports to read arbitrary files from the Jenkins controller's filesystem, including credentials, configuration files, and secrets stored on the controller. The vulnerability is reachable over the network with only low-level authenticated access - a standard privilege held by most Jenkins users in typical multi-user deployments. No public exploit code has been identified at time of analysis, and CISA SSVC classifies exploitation as none currently, though technical impact is rated total given unconstrained file read on the controller.
Unauthenticated remote access to PikiwiDB (Pika) v3.5.7's internal protobuf replication server allows attackers to exfiltrate complete database snapshots and intercept live write streams without any credentials. The replication port - exposed on a fixed, predictable offset from the client port (default 11221) - routes TrySync, DBSync, BinlogSync, and RemoveSlaveNode requests directly without requiring a prior authenticated MetaSync handshake, rendering the requirepass/masterauth configuration control entirely ineffective. No active exploitation is confirmed at time of analysis, but the remote, unauthenticated, low-complexity attack path makes this a high-priority exposure for any deployment where the replication port is reachable from untrusted networks.
Unsafe Java deserialization in Jenkins 2.579 and earlier (LTS 2.568.2 and earlier) allows authenticated users with configuration-submission permissions to control the values of transient fields during deserialization, with impact ranging up to full server compromise depending on how those fields are used internally. Transient fields in Java are normally excluded from serialization to protect derived or sensitive state; this flaw breaks that guarantee when processing externally supplied configuration data. No public exploit code or active exploitation has been confirmed at time of analysis, but given Jenkins' role as a CI/CD orchestrator with broad network access and secrets, the blast radius of exploitation is significant.
Stored XSS in Jenkins' system log viewer exposes administrators and privileged users to session hijacking and UI redress attacks, exploitable by any attacker who controls a Jenkins agent process. The vulnerability affects Jenkins 2.579 and earlier (including LTS 2.568.2 and earlier), where log record metadata - source, level, and timestamp - is rendered in the browser without HTML escaping, allowing persistent JavaScript injection via agent-controlled log channels. Patch versions 2.580 (weekly) and LTS 2.568.3 are available per the Jenkins security advisory SECURITY-3967; no public exploit code or CISA KEV listing has been identified at time of analysis.
PHP Object Injection in the Ninja Forms - Layout & Styles WordPress plugin (versions ≤ 3.0.31) exposes sites to unauthenticated remote code execution through unsafe deserialization of attacker-controlled PHP objects. Classified under CWE-502 (Deserialization of Untrusted Data), the flaw allows a crafted serialized payload to trigger property-oriented programming gadget chains already present in the WordPress plugin environment, yielding full confidentiality, integrity, and availability compromise of the affected server. No active exploitation has been confirmed in the CISA KEV catalog, but the unauthenticated network attack path and high-impact triad (C:H/I:H/A:H) demand immediate remediation across all affected WordPress deployments.
Verification bypass in prevail eBPF verifier versions before 0.2.4 allows any caller with eBPF program submission access - including unprivileged users on BPF-enabled kernels - to load programs that incorrectly pass safety checks but destroy the upper 32 bits of kernel pointer registers at runtime via ALU32 ADD and SUB instructions. The runtime effect is either a program fault (availability impact) or exposure of the lower 32 bits of a kernel pointer as a leakable scalar, partially defeating kernel ASLR. A vendor patch is available at v0.2.4; no active exploitation or public exploit code has been identified at time of analysis.
Stored cross-site scripting in Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows authenticated attackers with permission to modify plugin appearance settings to inject persistent JavaScript payloads via a crafted SVG icon, executing in the browser context of any Jenkins user who loads the affected header. Because the header renders on every Jenkins page, a single write operation by a low-privileged attacker broadly affects all platform users, including administrators. No public exploit code has been identified at time of analysis, and SSVC categorizes exploitation as none, though technical impact is rated total.
Privilege escalation in the LiquidThemes Booking Hub WordPress plugin (≤1.3.1) allows authenticated low-privileged users to incorrectly assign themselves or others elevated WordPress roles, up to and including administrator. The flaw stems from CWE-266 (Incorrect Privilege Assignment) - the plugin fails to enforce proper capability checks before processing role or privilege assignment operations. CVSS 8.8 (PR:L) confirms exploitation requires an existing low-privilege account; no public exploit code or CISA KEV listing identified at time of analysis.
Improper neutralization flaws (CWE-707) in Cisco IOS XR Software allow an authenticated remote attacker with low privileges to achieve full confidentiality, integrity, and availability impact against affected devices. The vulnerabilities were identified internally by Cisco's security engineering team and addressed in a batch hardening release, reference advisory cisco-sa-hardening-iosxr-qg64NcM. No public exploit code has been identified at time of analysis, though the CVSS 8.8 score and complete C/I/A triad reflect significant potential impact in carrier and enterprise routing infrastructure.