Stored Cross-Site Scripting in Xpro Addons for WordPress (before 1.7.4) allows any user holding the Contributor role or higher to inject malicious JavaScript through insufficiently escaped widget settings, which are then rendered unsanitized within HTML attributes on the front end. When a privileged user such as an administrator views a page containing the compromised widget, the attacker's payload executes in their browser session. A publicly available exploit has been documented by WPScan; no CISA KEV listing is present, but the low barrier to exploitation (any registered Contributor) makes this a meaningful risk on multi-author or membership WordPress sites.
Stored Cross-Site Scripting in the All in One SEO WordPress plugin before version 5.0.0.1 enables users holding the contributor role or above to inject persistent malicious scripts into post content that execute in the browser of any higher-privileged user who subsequently edits that post. The attack effectively allows a low-trust contributor to hijack administrator sessions, enabling full site compromise. A publicly available proof-of-concept from WPScan exists, and the plugin's broad deployment across millions of WordPress installations amplifies aggregate exposure.
Stored Cross-Site Scripting in the Social Media Share Buttons & Social Sharing Icons WordPress plugin (versions before 3.0.1) allows users with the Contributor role or higher to inject persistent JavaScript payloads via unescaped post titles rendered inside inline event handlers on share buttons. Payload execution is deferred to site visitors who interact with those buttons - enabling session theft or full site compromise if an administrator triggers it. A publicly available proof-of-concept from WPScan exists; no active exploitation confirmed in CISA KEV at time of analysis.
Stored cross-site scripting in the Ultimate Before After Image Slider & Gallery WordPress plugin before version 4.7.19 enables any authenticated user holding the Author role or higher to plant a malicious JavaScript payload within a slider's before-label field. Because the plugin's bundled client-side script re-injects that label value into the DOM without sanitization, the payload executes automatically in the browser of every visitor - including administrators - who views the affected slider. A publicly available proof-of-concept was published by WPScan; vendor-released patch version 4.7.19 is available, and no active exploitation has been confirmed in the CISA KEV catalog.
Stored cross-site scripting in the Ultimate Before After Image Slider & Gallery WordPress plugin (all versions before 4.7.19) allows users holding the Author role or above to embed a persistent browser payload in a slider's after-label field, which executes in every visitor's browser - including site administrators - when the slider is rendered. The plugin's bundled client-side script re-injects the stored label value directly into the DOM without HTML encoding. A publicly available exploit exists per WPScan, making this a practical privilege-escalation path on any WordPress site granting Author access to untrusted users.
Control-character (newline) injection in Yoast SEO Premium before 27.6.1 allows an authenticated WordPress Author to write arbitrary Apache directives into the site's root .htaccess file via unsanitized redirect origins in file-based redirect mode. On Apache servers that process PHP directives, the injected auto_prepend_file directive can be chained with a polyglot image upload (available to Author-role users) to achieve full Remote Code Execution as the web server process. A public exploit is available via WPScan, making real-world exploitation feasible wherever the three required conditions align.
Unauthenticated attackers can bypass WordPress nonce validation in the HIPAA FORMS plugin (all versions before 3.2.0) by including a hardcoded parameter in any AJAX request, which causes the server to skip its nonce check entirely. Because the plugin handles HIPAA-regulated healthcare intake forms, this exposes protected AJAX endpoints to unauthorized read and write operations without any credentials. A public exploit is available via WPScan, and no exploitation complexity is required beyond knowledge of the hardcoded value.
Missing authorization in the Booking for Appointments and Events Calendar WordPress plugin (versions before 2.4.9) allows unauthenticated remote attackers to trigger the post-booking action chain - including email notifications and third-party integration callbacks - for any booking by guessing or enumerating its numeric identifier. The plugin fails to validate either session authentication or a nonce/request token before executing post-booking hooks, meaning an attacker can impersonate the completion of any booking without ever making a real reservation. A publicly available proof-of-concept exploit exists per WPScan, though no KEV listing confirms active mass exploitation.
Insecure Direct Object Reference in the WC Vendors WordPress plugin before 2.7.2.1 allows any authenticated user holding the vendor role to tamper with product variations owned by other vendors and to overwrite the status and title of arbitrary WordPress posts. The root cause is that the plugin never validates whether a user-supplied object ID actually belongs to the requesting vendor before persisting changes. A publicly available proof-of-concept exploit exists; the issue is not currently listed in CISA KEV.
Base-path prefix bypass in Astro prior to 7.2.4 allows unauthenticated remote attackers to reach protected server-side routes by exploiting a missing path-segment boundary check in the framework's base-stripping logic. When a non-root base (e.g., '/app') is configured, a request to '/appX/admin' passes the router's prefix check and resolves to the internal '/admin' route while middleware still observes '/appX/admin' in context.url.pathname, causing pathname-based authorization rules to silently fail. Version 7.2.4 patches the flaw across all four affected subsystems; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated access to the first-run Super-Admin bootstrap endpoint (/api/v1/bootstrap/setup) and all 17 admin/DPO console pages in tsi-coop tsi-dpdp-cms ≤0.5.0 allows remote attackers to claim full administrative control of any fresh or reset deployment and to retrieve page source containing internal API endpoints, function names, and request schemas. The root cause is CWE-306: console pages relied solely on client-side JavaScript redirects with no server-side session gate, and the bootstrap endpoint imposed no token or expiry requirement. A publicly available proof-of-concept exploit exists on GitHub; the vendor has released v0.5.1 which adds server-side session enforcement and a required deployment token.
Missing server-side authentication on all 17 admin and DPO compliance console pages in tsi-dpdp-cms ≤0.5.0 allows any unauthenticated network client to retrieve complete console page source, including internal API endpoint paths, function names, and request schemas. The root cause is exclusive reliance on client-side JavaScript redirects as the sole access gate - a plain curl request to any console URL receives full page content with no credentials. A public POC exploit exists on GitHub, and vendor-released patch v0.5.1 is available.
Path traversal in Piwigo's Image Derivative Handler (i.php) exposes arbitrary server-side files to remote unauthenticated attackers on installations up to version 16.3.0. The CVSS 4.0 vector confirms network-accessible, zero-authentication exploitation with low confidentiality and integrity impact, consistent with a traversal primitive that can both read and potentially write files in unanticipated filesystem locations. A public proof-of-concept titled 'unauthenticated_derivative_path_traversal' is available on GitHub, materially lowering the bar for exploitation; no active exploitation has been confirmed in CISA KEV at time of analysis.
Unauthenticated remote denial of service in rowboatlabs rowboat through v0.9.1 allows any network attacker to disrupt the Composio webhook endpoint by sending a crafted HTTP request body that exploits improper resource handling in the Next.js route handler (apps/rowboat/app/api/composio/webhook/route.ts). A proof-of-concept is publicly available on GitHub, removing any skill barrier for exploitation. The vendor resolved the issue in v0.9.2 by deleting the legacy Next.js application entirely rather than patching the underlying flaw, meaning no security control was introduced - only the attack surface was removed.
Uncontrolled resource consumption in simular-ai Agent-S up to version 0.3.2 allows remote unauthenticated attackers to exhaust server resources via the OCR HTTP API's ImageData function. By supplying crafted img_bytes input to the exposed endpoint in gui_agents/s1/utils/ocr_server.py, an attacker can trigger a denial-of-service condition against the OCR processing service. Publicly available exploit code exists on GitHub; the vendor did not respond to responsible disclosure, leaving no official patch.
Missing server-side authentication in tsi-coop tsi-dpdp-cms ≤0.5.0 exposes all 17 admin and DPO console pages to unauthenticated HTTP clients: the application enforced access via a client-side JavaScript redirect only, so any HTTP request that ignores the redirect receives the full page source including internal API endpoints, function names, and request schemas. A second bundled vulnerability allows unauthenticated super-admin account creation via an unprotected first-run setup endpoint (/api/v1/bootstrap/setup), enabling complete platform takeover on fresh or reset deployments. A public proof-of-concept demonstrating the bypass is available, and the vendor has released a patched version (v0.5.1) confirmed to address both issues.
HTTP Header Injection in the Ajaxify Comments WordPress plugin (before version 3.2) allows unauthenticated remote attackers to inject arbitrary HTTP response headers via unsanitized user-supplied input that is echoed into server responses. The plugin fails to neutralize CRLF sequences, enabling response splitting that could facilitate session fixation, cache poisoning, or cross-site scripting via crafted HTTP responses. A publicly available exploit has been documented by WPScan; no active exploitation (CISA KEV) has been confirmed at time of analysis.
Privilege escalation in the Theme My Login WordPress plugin (versions before 7.2.0) allows low-privileged users to silently bypass the network's site-creation restrictions on multisite WordPress installations, gaining administrator-level control over a newly created site. Subscriber-level authenticated users - and on some networks, unauthenticated users - can invoke the site-signup flow to create sites even when the network's registration setting prohibits it. A publicly available proof-of-concept exploit exists, raising the urgency for patching. The vendor has released a fix in version 7.2.0.
Cross-site request forgery in the Simple Membership MailChimp Integration WordPress plugin (versions before 1.9.8) allows a network-positioned attacker to replace the site's configured MailChimp API key with one under attacker control by tricking a logged-in administrator into loading a crafted page. Once the API key is substituted, all subsequent member registration data - including name, email address, and membership level - is silently forwarded to the attacker's MailChimp account until the change is detected. A publicly available exploit exists and a vendor patch (1.9.8) is available; no active exploitation has been confirmed in CISA KEV.
Unauthenticated post creation and publication is possible in the User Frontend WordPress plugin before 4.3.11 due to a server-side enforcement gap in its subscription-gating logic. The plugin validates subscription status only at form-render time, not during form submission processing, so an attacker who bypasses the rendered form and submits directly to the backend endpoint can create - and depending on form configuration, immediately publish - posts that should be restricted to paying subscribers. A publicly available proof-of-concept exists and was disclosed through WPScan. No public exploit in CISA KEV at time of analysis.
Global protection bypass in the Passster WordPress plugin (versions before 4.2.26) allows unauthenticated remote attackers to access password-protected content by submitting crafted URLs that circumvent the plugin's site-wide protection checks. Because Passster's entire purpose is content gating, this vulnerability entirely nullifies the plugin's security guarantee for affected sites. A publicly available PoC exists, reported by WPScan, making automated scanning and exploitation straightforward.
Route normalization bypass in the Restrict User Access WordPress plugin (all versions before 2.8.1) lets unauthenticated remote attackers read content the plugin is configured to restrict and enumerate WordPress user accounts. The plugin compares raw incoming REST API route strings against its protection rules without first canonicalizing the path, so a subtly non-canonical request (extra slash, encoded character, etc.) matches no rule and is passed through unrestricted. A publicly available PoC is documented by WPScan; the vulnerability is not in CISA KEV at time of analysis.
Unauthenticated information disclosure in the Wp Edit Password Protected WordPress plugin (before 1.3.5) exposes password-protected page and post content via the WordPress REST API. The plugin enforces content protection on standard page views but fails to apply the same restriction to REST API endpoints, allowing any remote unauthenticated requester to retrieve the full content of pages the site owner intended to keep gated behind a password. A publicly available proof-of-concept is documented by WPScan; no active exploitation has been confirmed in CISA KEV. The CVSS score of 5.3 reflects the limited scope - confidentiality only, no integrity or availability impact.
Payment bypass in the RegistrationMagic WordPress plugin before 6.0.9.9 allows unauthenticated users to register for paid forms without completing payment and immediately receive an activated account holding whatever role the form is configured to grant. The plugin fails to validate a client-supplied quantity multiplier when computing the total registration price server-side, enabling an attacker to force the calculated total to zero or an arbitrary value. A publicly available proof-of-concept exploit exists per WPScan, and no authentication is required. No public exploit identified at time of analysis for active exploitation, but the low attack complexity combined with public PoC makes this a realistic threat for any site monetizing registrations via this plugin.
Price validation bypass in the RegistrationMagic WordPress plugin before 6.0.9.9 allows unauthenticated users to complete paid registrations without payment and receive fully activated accounts. The plugin fails to verify the total registration price server-side, meaning client-submitted price values are accepted without cross-checking against the configured amount. A publicly available proof-of-concept exploit exists, and no CISA KEV listing has been recorded at time of analysis.
Unauthenticated information disclosure in the Passster WordPress plugin (versions before 4.2.24) allows remote attackers to retrieve the values of password-protected content via an improperly handled AJAX action. Because Passster's sole function is gating content behind passwords, this flaw entirely negates its intended protection guarantee. A public exploit is available via WPScan, and the zero-prerequisite attack vector makes this trivially exploitable against any affected installation.
Unauthenticated information disclosure in the Notification Bar for WordPress plugin (through v1.1.8) allows any remote attacker to retrieve the full subscriber email list via an exposed CSV export script that performs no authentication or capability check. A publicly available proof-of-concept published by WPScan confirms trivial exploitation requiring only a single HTTP request. The vulnerability is not currently in CISA KEV, but the zero-friction exploitation path creates meaningful privacy and regulatory exposure (GDPR, CAN-SPAM) for any WordPress site running this plugin.
SQL injection in the Comments WordPress plugin before 7.6.66 allows unauthenticated remote attackers to read restricted comment content by injecting SQL grammar into an unvalidated query parameter. Affected content includes comments awaiting moderation, spam and trash comments, and comments attached to private or draft posts. The impact is scoped to comment disclosure rather than full database extraction, as the injection manipulates query structure rather than enabling arbitrary SELECT statements. No public exploit identified at time of analysis is contradicted by WPScan confirming publicly available exploit code exists.
Rank Math SEO WordPress plugin versions before 1.0.277.1 exposes the full content of password-protected posts to unauthenticated users via publicly generated SEO metadata. The plugin fails to enforce WordPress's native post-password gate before extracting post content for use in meta tags and structured data, making protected content readable by anyone who can access the SEO output. A publicly available proof-of-concept is documented by WPScan; a vendor patch (1.0.277.1) is available.
Unauthenticated information disclosure in the Ultimate Member WordPress plugin (all versions before 2.13.0) exposes the content of comments still awaiting moderation and activity from private user profiles to any anonymous visitor. The plugin's profile activity endpoint fails to verify both comment approval status and profile privacy settings before returning data, meaning moderated/private content is served as if it were public. A publicly available proof-of-concept exists; no active exploitation has been confirmed via CISA KEV.
Unauthenticated information disclosure in the Solace Extra WordPress plugin before 1.7.0 exposes the full content of non-published Site Builder parts - drafts, pending posts, private pages, and trashed items - to any anonymous visitor via an unprotected AJAX action. The plugin registers an AJAX handler that performs no capability check and no post-status validation, bypassing WordPress's normal access controls entirely. A public proof-of-concept is available through WPScan; the vendor has released version 1.7.0 to close the gap.
Unauthenticated information disclosure in the MultiVendorX WordPress plugin (versions prior to 5.0.15) exposes sensitive marketplace data through an improperly secured REST API listing route. Any unauthenticated remote attacker can query the endpoint to retrieve vendor contact information, payout details, pending payout amounts, and administrative notes attached to store applications. A publicly available exploit code exists via WPScan, and a vendor patch has been released in version 5.0.15.
Unauthenticated IDOR (CWE-639) in the MotoPress Appointment Booking WordPress plugin before version 2.4.8 enables any remote attacker to permanently delete arbitrary users' reservations by supplying a known booking identifier to an unprotected deletion endpoint. This CVE documents an incomplete fix of CVE-2026-9180 - the vulnerable deletion path remains reachable on sites using payment confirmation workflows, confirmed through version 2.4.7. A publicly available proof-of-concept was disclosed by WPScan, and the vendor has released a corrective patch in version 2.4.8.
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin before 3.7.46 exposes the titles and IDs of an author's unpublished courses - including draft, pending, and private posts - through an unprotected REST API endpoint. The affected route performs no access control check and applies no publication-status filter, meaning any unauthenticated network request can enumerate course content that site owners intended to keep hidden. A publicly available proof-of-concept exists per the WPScan advisory; no active exploitation has been confirmed in CISA KEV at time of analysis.
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin (all versions before 3.7.46) exposes per-student course enrollment and learning progress data to any remote attacker without credentials. The plugin fails to perform an authorization check before returning student-specific data, allowing enumeration of any registered user's enrolled courses and progress metrics. A publicly available exploit exists via WPScan; no active exploitation (KEV) has been confirmed, and the CVSS 5.3 score accurately reflects limited confidentiality impact.
FormLayer WordPress plugin before version 1.0.9 discloses full form configuration data to unauthenticated users through its public submission handler, which performs no authorization check before returning stored settings. Notification recipient email addresses, confirmation redirect targets, and third-party integration credentials are exposed for all forms - including unpublished drafts invisible to end users. A public exploit exists via WPScan, and a vendor patch is available at version 1.0.9.
Payment verification bypass in WP Express Checkout WordPress plugin before 2.4.9 allows unauthenticated remote attackers to forge completed orders without submitting actual payment. The plugin fails to perform server-side confirmation that a payment transaction was successfully processed before transitioning an order to 'paid' status, enabling fraudulent order completion. A publicly available exploit exists per WPScan, making active abuse by financially motivated actors a realistic near-term risk for any e-commerce site running an affected version.
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin before 3.7.46 exposes learning statistics for any registered user without authorization. The plugin's student statistics endpoint performs no access control check, allowing any remote attacker to retrieve course counts, accumulated points, certificates, quiz totals, and assignment totals for arbitrary user accounts. A publicly available exploit exists per WPScan, and the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required.
Stored cross-site scripting in the SEOWriting WordPress plugin (through version 1.12.5) allows authenticated Contributor-level users to inject arbitrary JavaScript that executes in the browser session of higher-privileged users - Editors or Administrators - who view or preview the affected post. The root cause is a misconfigured KSES allowlist that explicitly whitelists the `onload` event attribute on `iframe` elements, bypassing WordPress's built-in content sanitization. A publicly available proof-of-concept confirms the attack path is reproducible; the vulnerability is not currently listed in the CISA KEV catalog, suggesting active exploitation has not been widely observed at time of analysis.
Rank Math SEO WordPress plugin before version 1.0.277 allows authenticated users holding at minimum an Author role to overwrite arbitrary post and user metadata across the entire WordPress installation, including metadata belonging to higher-privileged accounts such as Editors and Administrators. The flaw is an IDOR (CWE-639): the metadata update endpoint accepts a user-controlled row reference without verifying that the targeted record belongs to an object the requesting user is authorized to modify. A publicly available proof-of-concept exploit exists, confirmed by WPScan; no active exploitation in CISA KEV is noted at time of analysis.
Shortcode injection in the Brave WordPress plugin before 0.8.8 allows unauthenticated remote attackers to execute arbitrary WordPress shortcodes server-side by passing crafted values through URL parameters designed for pre-filling form fields. The exploitable shortcodes and their consequences depend entirely on which shortcodes are registered on the target installation - ranging from information disclosure to, in worst-case scenarios involving code-execution shortcodes, elevated impact. A publicly available proof-of-concept exists per WPScan; no active exploitation (KEV) has been confirmed. The CVSS score of 4.8 with AC:H reflects that real-world impact is highly site-dependent.
Plaintext password disclosure in the Gutentor WordPress page builder plugin (before 4.0.6) allows any authenticated subscriber-level user to retrieve the passwords of password-protected posts via a misconfigured REST API endpoint. The endpoint fails to enforce WordPress's built-in content-access context restrictions, meaning the security model of password-protected posts is completely bypassed for any site user who can authenticate. A publicly available exploit exists per WPScan, and a patched release (4.0.6) is available from the vendor.
Insufficient access control in GamiPress (WordPress plugin before 7.9.9.6) allows any authenticated Subscriber-level user to abuse the video watch-tracking endpoint to award configured gamification points, achievements, and ranks to any WordPress user on the site - including administrators - and to accrue them without limit. The flaw maps to CWE-639 (Authorization Bypass Through User-Controlled Key), where the endpoint accepts a user-controlled target identifier without verifying the requester's authorization to grant rewards to that target. A publicly available proof-of-concept is documented by WPScan, and a vendor patch is available.
Missing order-ownership verification in WC Vendors WordPress plugin before 2.7.2.1 allows any authenticated vendor to manipulate shipment records belonging to other vendors. An attacker with a valid vendor account can submit a front-end shipment status update referencing any order ID regardless of ownership, causing the order to be falsely marked as shipped, an order note to be injected under the victim vendor's identity, and the customer to receive a fraudulent dispatch notification. A publicly available proof-of-concept exists via WPScan; no active exploitation is confirmed in CISA KEV.
Broken object-level authorization in MasterStudy LMS WordPress Plugin before 3.7.46 exposes course sales records of any instructor to any authenticated WordPress user. The plugin's order line-item retrieval endpoint accepts a user-supplied identifier without verifying that the requesting user is the record owner, enabling subscriber-level accounts to enumerate and read other instructors' transaction histories. A publicly available exploit exists per WPScan, and the fix is present in version 3.7.46.
Cross-site request forgery vulnerabilities in JetStyleManager for Gutenberg WordPress plugin (all versions before 1.3.9) allow an unauthenticated attacker to delete or modify custom widget skins by tricking a logged-in Contributor-level (or higher) user into visiting a crafted page or clicking a malicious link. The missing CSRF token (nonce) validation on affected AJAX endpoints means the victim's authenticated browser session is silently weaponized against their own site. A publicly available exploit exists via WPScan and vendor-released patch version 1.3.9 resolves the issue.
CSRF protection is absent on front-end order shipment status actions in the WC Vendors WordPress plugin before version 2.7.2.1, allowing network-based attackers to manipulate a logged-in vendor's order shipment state by inducing them to visit a crafted page. The vulnerability requires no attacker authentication and no special deployment configuration beyond active vendor use of the plugin's front-end dashboard. A publicly available exploit exists via WPScan, though no CISA KEV listing was identified, and the practical impact is bounded to order status modification rather than data breach or site takeover.
Email content injection in the CatalogX WordPress plugin before 6.1.3 allows unauthenticated attackers to permanently plant unsanitized content into product enquiry notification emails delivered to site administrators. The injected payload is stored server-side upon submission of a product enquiry and is included verbatim in the administrator notification email each time any subsequent visitor triggers a new enquiry. A publicly available proof-of-concept exists; no public exploit confirmed as actively exploited per CISA KEV.
SQL injection in the WPvivid Backup, Migration & Staging WordPress plugin (all versions before 0.9.133) allows authenticated WordPress administrators to inject arbitrary SQL through an unsanitized list of identifiers passed directly to database queries. The CVSS scope change (S:C) indicates injected queries may reach beyond the plugin's own data, potentially touching other schemas on the shared MySQL host. A publicly available proof-of-concept has been disclosed via WPScan, though SSVC reports no confirmed active exploitation; vendor-released patch 0.9.133 is available.
Server-side request forgery in Mailpit's link-checking and proxy functionality allows unauthenticated remote attackers to bypass the IsInternalIP deny list and reach restricted internal network destinations. The deny list in net.go failed to include the Azure WireServer address (168.63.129.16/32) and the RFC 2765/6145 IPv4-translated IPv6 prefix (::ffff:0:0:0/96), enabling DNS rebinding-style attacks where attacker-controlled hostnames resolve to these unblocked addresses. When Mailpit is deployed in Azure environments, this specifically enables access to the platform metadata channel used by the Azure host agent. No public exploit or KEV listing identified at time of analysis.