Unauthenticated information disclosure in the My Private Site WordPress plugin (all versions before 4.2.3) exposes post content, post URLs, and comments to anonymous visitors, directly defeating the plugin's stated purpose of enforcing mandatory login across a WordPress site. The plugin fails to apply its privacy gate to certain front-end read surfaces, meaning requests to those endpoints bypass the authentication requirement entirely. A publicly available proof-of-concept exists; the vendor has released a corrective patch in version 4.2.3.
Stored Cross-Site Scripting in the Joli Table Of Contents WordPress plugin (versions up to and including 2.8.0) allows authenticated administrator-level users to inject persistent malicious scripts into admin settings pages that execute in the browsers of other administrators who view those pages. The vulnerability bypasses WordPress's unfiltered_html capability restriction, making it particularly relevant in WordPress multisite deployments where that capability is intentionally withheld from site administrators. A vendor-released patch (2.8.1) is available, and a public proof-of-concept has been published by WPScan.
Path traversal in the JCH Optimize WordPress plugin (versions before 5.0.1) permits authenticated administrators - including sub-site administrators on WordPress multisite installations - to enumerate directories and file names outside the web root via an unsanitized path parameter in the plugin's administrative image-browsing feature. A public proof-of-concept is available through WPScan, though SSVC confirms no active exploitation and EPSS sits at the 5th percentile. Real-world impact is confined to confidentiality of filesystem structure: attackers can map server directory layouts and file names but cannot read file contents or modify data.
Unauthorized post-content disclosure in the Smart Post WordPress plugin before 4.0.8 allows any contributor-level authenticated user to duplicate any private or password-protected post into a personal draft, exposing the full content and metadata regardless of the original post's visibility or ownership restrictions. The flaw is rooted in the plugin's post-duplication feature entirely omitting checks on post type, status, and ownership before creating the copy. A public PoC is available via WPScan; no active exploitation has been confirmed by CISA KEV and the EPSS score sits at the 4th percentile.
Information disclosure in the EmbedPress WordPress plugin (versions 4.6.0 through 4.6.3) allows any authenticated contributor-level user or above to retrieve the site administrator's email address via an improperly restricted Google Reviews REST API endpoint. WordPress core deliberately withholds administrator email from the contributor role as a privacy control; this plugin bypass defeats that restriction without requiring administrative privileges. A publicly available proof-of-concept has been published by WPScan, though EPSS at 0.14% and SSVC exploitation status of 'none' indicate no observed active exploitation at time of analysis.
The Events Calendar WordPress plugin before 6.17.3.1 exposes unpublished site content - drafts, pending posts, and private records from all users - through its public REST API archive endpoints to any contributor-level authenticated user. The plugin fails to enforce WordPress's standard post-status visibility controls on its custom REST routes, allowing a low-privilege account holder to enumerate and read the full body of every non-public record site-wide, bypassing intended access controls. A public proof-of-concept is documented via WPScan, and a vendor patch (6.17.3.1) is available.
Insufficient authorization on the EmbedPress WordPress plugin's Google Reviews REST API endpoint allows any authenticated Contributor-role user to overwrite the site-wide reviews store in versions 4.6.0 through 4.6.3. An attacker with a Contributor account can delete administrator-configured review entries and inject fabricated ones that render publicly across the entire WordPress site, enabling reputation manipulation or social engineering. A publicly available exploit exists per WPScan; however, SSVC marks exploitation as none and EPSS sits at 0.13% (3rd percentile), reflecting the prerequisite of a legitimate account.
Insufficient per-object authorization in the Kirki WordPress plugin before 6.3.0 allows users with administrator-granted content-level page builder access to alter the state of collaboration comments left by any user, including on pages those users cannot themselves open. The root cause is CWE-639 (Authorization Through User-Controlled Key / IDOR): the comment-state endpoint accepts a user-supplied comment identifier without verifying whether the requesting user holds authorization over that specific comment object. Despite a publicly available PoC from WPScan, EPSS sits at 0.13% (3rd percentile) and the vulnerability is not in the CISA KEV catalog, indicating negligible opportunistic exploitation risk.
NULL pointer dereference in libxml2's xmlRegNewParserCtxt() function crashes any application invoking the XML regular-expression engine under memory-pressure conditions. Versions before 2.15.4 call strlen() on the return value of xmlStrdup() without first verifying the pointer is non-NULL; when strdup() fails due to memory exhaustion, the subsequent strlen(NULL) causes a process crash. No confidentiality or integrity impact is possible - the vulnerability is limited to a local, high-complexity denial-of-service. No public exploit or CISA KEV listing exists; the fix shipped in libxml2 2.15.4.
Hard-coded WPA passphrase in Tenda CP3 version 27.5.57.101 exposes the device's SoftAP (software access point) mode to unauthorized WiFi access by any party who possesses the fixed credential value embedded in custom-x/softap/hostapd. Because the passphrase is statically compiled into the hostapd configuration rather than randomly generated per device, all units running this firmware version share an identical WPA key. A public proof-of-concept has been disclosed per the CVSS 4.0 exploit maturity indicator (E:P), lowering the barrier for adversaries who identify target devices in range.