SSH authentication bypass in MikroTik RouterOS allows any unauthenticated network attacker to skip the entire SSH user-authentication phase by triggering a client-requested rekey, causing the server to advance directly into the connection protocol and accept session channel and exec requests. The result is unauthenticated file creation, overwrite, and exfiltration within the RouterOS managed file namespace - including support bundles containing configuration and diagnostic data. Publicly available exploit code exists, CERT-PL has published dedicated research, and a companion CERT-PL post titled 'vulnerabilities-in-mikrotik-routeros-actively-exploited' suggests observed exploitation in the wild, though CISA KEV listing is not confirmed in the available data.
Unauthenticated remote access to restricted internal APIs is possible in N-able N-central due to an incomplete access control filter, classified under CWE-791. All N-central deployments prior to versions 2026.3 HF3 and 2026.4 are affected, as confirmed by the vendor advisory. Impact is limited to partial information disclosure (CVSS 4.0 VC:L) with no integrity or availability effects reported; no public exploit code or active exploitation has been identified at time of analysis.
SQL injection in the Video Player for YouTube WordPress plugin (versions before 2.1.0) allows authenticated users holding the Contributor role or higher to inject arbitrary SQL commands via unsanitized input, enabling them to read any data stored in the underlying WordPress database. The scope change reflected in the CVSS vector (S:C) indicates that exploitation extends reads beyond the plugin's own tables to potentially include WordPress user credentials, secrets, and configuration data held elsewhere in the database. A public PoC exists via WPScan, but EPSS sits at 0.16% and CISA has not added this to KEV, indicating low observed exploitation activity.
Stored cross-site scripting in the Joli Table Of Contents WordPress plugin (versions before 3.0.3) permits any user holding the Author role or higher to inject arbitrary HTML attributes and JavaScript via an unsanitized shortcode attribute, with the payload executing in the browser of any visitor - including administrators - who views the post. Because Authors in WordPress are explicitly barred from posting unfiltered HTML, this constitutes a privilege-boundary violation that can be leveraged to hijack administrator sessions or trigger privileged actions covertly. A public exploit is documented by WPScan; EPSS stands at 0.15% (5th percentile), indicating limited automated targeting, and no CISA KEV listing exists.
Stored XSS in CatFolders Document Gallery & PDF Library WordPress plugin before version 2.0.7 allows any user holding an Author account or higher to inject persistent malicious scripts via an unsanitized block attribute that is directly interpolated as an HTML tag name in gallery rendering output. Any visitor who views a post containing the crafted gallery block will execute the attacker's payload in their browser without additional interaction. No active exploitation has been confirmed in CISA KEV, but a publicly available proof-of-concept exists per WPScan disclosure, reducing the technical barrier for any authenticated attacker.
Stored XSS in VikWidgetsLoader WordPress plugin before 1.12.0 allows Contributor-role users to permanently embed arbitrary JavaScript into posts by supplying a malicious block attribute that is output unsanitized inside an inline script tag. When an administrator reviews the pending submission, the payload executes in their browser, enabling full session hijacking and site takeover without any further attacker interaction. A publicly available exploit exists (via WPScan), though EPSS is low (0.15%, 5th percentile) and SSVC records no confirmed exploitation at this time.
Stored cross-site scripting in King Addons for Elementor WordPress plugin before version 51.1.77 allows any Contributor-level (or higher) user to inject persistent JavaScript into a widget display-style setting that is written unescaped into an HTML attribute at render time. The payload fires in every visitor's browser upon page load - including logged-in administrators - enabling session hijacking, credential theft, or silent execution of privileged site actions. A publicly available proof-of-concept was disclosed via WPScan; no active exploitation is confirmed in the CISA KEV catalog at time of analysis.
SQL injection in the Kirki WordPress plugin (versions 6.0.0 through <6.3.0) enables authenticated users with editor-level access or above to append arbitrary SQL to an unescaped identifier, exfiltrating the full WordPress database including hashed credentials for all user accounts. The scope change (S:C) in the CVSS vector reflects that credential exposure extends impact beyond the attacker's own session to all other platform users. A publicly available proof-of-concept is documented by WPScan, and the vendor has released a remediated version (6.3.0).
Stored cross-site scripting in Bold Page Builder WordPress plugin (all versions before 5.9.8) allows authenticated Contributor-level users to inject persistent arbitrary JavaScript through unsanitized shortcode attribute values, which then execute in the browsers of any visitor rendering the affected page. A publicly available proof-of-concept exists via WPScan, and the vendor has released a patched version (5.9.8). Despite a low EPSS score (0.15%, 5th percentile), the public PoC and low privilege bar make this a realistic attack vector against sites with open contributor registration.
Stored cross-site scripting in the Bold Page Builder WordPress plugin before 5.9.8 allows authenticated users holding the Contributor role or higher to inject arbitrary JavaScript via a crafted link URL that bypasses the plugin's client-side filter. When a victim user subsequently clicks the malicious link rendered in the page builder output, the injected script executes in their browser session. A publicly available proof-of-concept exists per WPScan, though EPSS remains very low (0.15%), indicating limited observed exploitation despite public disclosure.
Stored cross-site scripting in the Greenshift WordPress plugin (all versions before 13.2.0) allows any user with Contributor-level access or higher to inject arbitrary JavaScript via an improperly escaped block animation attribute rendered into an HTML attribute context. When a higher-privileged user such as an administrator views the affected content, the injected script executes in their browser session, enabling session hijacking or unauthorized administrative actions. A publicly available proof-of-concept exists per WPScan reporting, making exploitation accessible to low-skilled threat actors despite the low EPSS score of 0.15%.
Stored Cross-Site Scripting in the Masteriyo LMS WordPress plugin before version 3.4.0 allows any user holding the course-author role to inject unsanitized JavaScript into course settings fields, where it silently executes in the browser of every subsequent visitor - including logged-in administrators. Because the injected payload runs within the victim's full session context, a successful attack against a site administrator can result in complete WordPress site takeover through credential theft, rogue plugin installation, or arbitrary content modification. A publicly available proof-of-concept has been published by WPScan; no active exploitation is confirmed by CISA KEV, and the EPSS score of 0.15% (5th percentile) reflects limited observed exploitation probability at time of analysis.
Local file inclusion in Eventin WordPress plugin before 4.1.21 enables authenticated contributors and higher-privileged users to include and execute arbitrary PHP files on the web server. The plugin fails to validate a user-supplied template path parameter before passing it to a PHP file-inclusion routine, allowing path traversal to any locally accessible PHP file. A publicly available proof-of-concept has been published by WPScan; vendor patch 4.1.21 is available and should be applied immediately.
TLS server impersonation in MikroTik RouterOS is enabled by improper RSA/PKCS#1 v1.5 signature verification that fails to reject malformed signatures produced via cube-root forgery against an e=3 root CA already present in the router's trust store. An attacker positioned to intercept outbound RouterOS TLS sessions can forge a trusted intermediate CA certificate - using only the root CA's public certificate, without its private key - and issue leaf certificates for arbitrary hostnames, fully impersonating TLS servers the router connects to. A publicly available exploit exists based on CERT-PL research and independent reverse-engineering of the 7.23.4 silent patch; vendor-released patches are available across all supported branches.
Search Atlas SEO WordPress plugin before 2.6.24 allows any subscriber-level authenticated user to overwrite or permanently delete the site's stored Google service-account credentials by invoking a settings-update handler that performs no nonce verification or capability check. Any registered user on an affected WordPress site can trigger this handler via a crafted HTTP request, disrupting Google Search Console, Analytics, or other Google API integrations that depend on those credentials. A publicly available exploit is documented by WPScan; EPSS remains at 0.14% and CISA KEV status is absent, indicating no observed active exploitation at time of analysis.
Cross-user disclosure in NetBox through 4.7.0 exposes all users' private Notifications, Subscriptions, and Bookmark records to any authenticated user with standard view permissions, via unscoped querysets in both the REST API and GraphQL API. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): affected endpoints return the full table rather than filtering records to the requesting user's identity. A publicly available proof-of-concept exists demonstrating exploitation against a default 4.7.0 installation; no active exploitation has been confirmed in CISA KEV.
Unauthorized story access in Pixelfed through 0.12.9 allows any authenticated user to bypass follower-gating on private stories by invoking the StoryComposeController react and comment API endpoints without a follower-relationship check. Because story IDs are sequential, an attacker can enumerate all stories on an instance and submit reactions or comments to retrieve protected media URLs and author metadata from accounts they do not follow. A public proof-of-concept is available, and no vendor-released patch has been identified at time of analysis.
Unauthenticated information disclosure in the Smart Post WordPress plugin (versions prior to 4.0.8) exposes both the content of password-protected posts and the passwords themselves via an unprotected AJAX endpoint. Any unauthenticated remote user can query the endpoint to bypass WordPress's native post-password protection mechanism entirely, retrieving guarded content without knowing the password - and also harvesting the password itself for reuse. A public exploit is documented by WPScan; a vendor patch (4.0.8) has been released.
Order-integrity bypass in the Accept Stripe Payments WordPress plugin before 2.1.4 allows unauthenticated customers who complete a genuine Stripe payment to receive fulfillment for a different product than the one they purchased. The plugin validates only that the payment amount is at least the referenced product's price at checkout completion, without verifying that the fulfilled product matches the product for which payment was originally captured. A public proof-of-concept is available via WPScan; no active exploitation is confirmed in CISA KEV, and the EPSS score (0.15%, 4th percentile) indicates low automated exploitation likelihood.
Missing authorization on the EmbedPress WordPress plugin's review-loading action (versions 4.6.0-4.6.3) permits unauthenticated remote attackers to abuse the site's stored third-party API credentials - triggering repeated billable API calls against the site owner's account - while simultaneously injecting an unbounded number of attacker-controlled rows into the WordPress database. A publicly available PoC exploit was documented by WPScan. Although EPSS probability is low (0.14%), SSVC rates the attack as automatable, making mass targeting of vulnerable WordPress deployments feasible with minimal tooling.
Missing authorization on Eventin's event-management REST routes allows low-privilege WordPress contributors to perform integrity-impacting actions outside their permitted scope. Affected installations running Eventin before 4.1.22 expose endpoints that let contributor-role users redirect the site's public front page to an arbitrary event they do not own, and create, edit, or delete global event and speaker taxonomy terms site-wide. A publicly available exploit is documented by WPScan, though SSVC exploitation status is none and EPSS is 0.13%, indicating no confirmed active abuse at time of analysis.
HTML injection via unsanitized email notifications in JetFormBuilder WordPress plugin (versions before 3.6.5.2) allows unauthenticated form submitters to embed arbitrary HTML-and conditionally JavaScript-into notification emails delivered to administrators and other configured recipients. The scope change is real: a public form submission influences the admin's email client environment rather than the WordPress server itself, with JavaScript execution gated on the recipient's mail client rendering capability. A publicly available proof-of-concept exists via WPScan, though EPSS at 0.18% (8th percentile) reflects no widespread active exploitation; the vulnerability is not in CISA KEV.
Open redirect in the Accept Stripe Payments WordPress plugin before version 2.1.4 enables unauthenticated attackers to craft URLs that silently redirect site visitors to arbitrary external destinations, creating a phishing vector against users who trust the legitimate domain. The vulnerability stems from unvalidated user-supplied redirect parameters in the plugin's payment flow. A publicly available proof-of-concept exists per WPScan, though the EPSS score of 0.16% (5th percentile) indicates minimal observed automated exploitation at time of analysis.
Server-side request forgery in the Greenshift WordPress plugin before 13.2.0 allows contributor-level (and higher) authenticated users to direct the server to fetch arbitrary external or internal URLs and read the response. The flaw stems from missing URL validation before server-side HTTP requests are dispatched, enabling internal network reconnaissance, port scanning, or cloud instance metadata credential theft in hosted environments. A publicly available exploit exists and was reported by WPScan; EPSS stands at 0.13% (3rd percentile), suggesting no widespread automated exploitation at time of analysis despite the public PoC.
Unauthenticated form action execution in the Grav Form Plugin before 9.1.22 allows anonymous visitors to trigger save, upload, email, or call actions defined on login-restricted or unpublished pages. The plugin resolves forms by name across all pages without verifying whether the requesting user is authorized to access the page where the form is defined, so an attacker can POST to any public page while referencing a restricted form by name to bypass access controls entirely. No public exploit or CISA KEV listing has been identified, but the zero-authentication, network-accessible vector makes this trivially exploitable once form names are known.
Unauthenticated cross-site scripting in AVideo's YPTSocket plugin allows remote attackers to execute arbitrary JavaScript in the browsers of connected users by sending crafted WebSocket messages. The attack leverages the plugin's WebSocket callback dispatch mechanism, which resolves attacker-controlled callback names to global JavaScript functions (e.g., `avideoConfirmHTML`) that assign untrusted message data directly to `innerHTML` without sanitization. Because the exploit path runs entirely through the WebSocket layer, no authentication and no secondary victim interaction beyond holding an active session are required, enabling persistent script injection into any connected user's origin context.
Heap-based buffer overflow in libxml2 before 2.15.4 allows arbitrary code execution via a crafted XML document containing an excessively long XPointer expression. The root cause is integer length saturation in `xmlStrlen` within `xmlXPtrEvalXPtrPart`: when the XPointer string length overflows to zero, the subsequent heap allocation is undersized, enabling a controlled write beyond the buffer boundary. Any application using libxml2's XPointer evaluation on attacker-influenced XML is affected. No public exploit is identified at time of analysis, though a vendor-confirmed patch (v2.15.4) is available with a corresponding commit diff.
Heap-based buffer overflow in libxml2 before 2.15.4 allows an attacker who can supply maliciously crafted XML with oversized namespace-qualified names to corrupt heap memory within any application linking against the library, potentially enabling code execution or sensitive memory disclosure. The root cause is an integer overflow in xmlDictAddQString (dict.c) during dictionary string-pool growth, where unchecked multiplication and addition of the buffer size and string lengths could wrap around, producing an undersized heap allocation subsequently overwritten with full-length data. No public exploit code or CISA KEV listing is present at time of analysis, though the pervasive embedding of libxml2 across OS stacks, language runtimes, and application middleware substantially widens the potential attack surface.
Integer overflow in libxml2 before 2.15.4 passes negative-length values into application-level XML write callbacks when output buffer sizes reach or exceed INT_MAX, enabling out-of-bounds memory reads or writes within any callback that trusts the supplied length parameter. The root cause is a type mismatch: xmlBufUse() returns size_t, but xmlOutputWriteCallback expects int - without an overflow guard, buffers of sufficient size silently wrap to negative values. Applications embedding libxml2 with custom output callbacks and processing attacker-influenced large XML payloads face C:H/I:H impact; the severity is callback-implementation-dependent. No public exploit has been identified at time of analysis.
Integer overflow in libxml2's xmlURIEscapeStr function (uri.c) before version 2.15.4 creates a heap memory corruption primitive with potential arbitrary read/write impact. When processing a URI string whose computed escape-output length wraps to zero via arithmetic overflow, the function proceeds with a corrupted buffer size, enabling writes beyond the allocated region. Fixed in v2.15.4 via commit 8edbbdb09f24d26a2f900141fddc2b9d014f53b0; no public exploit code or CISA KEV listing identified at time of analysis.
Out-of-bounds read in CDT (Constrained Delaunay Triangulation) before 1.4.5 crashes any application that passes attacker-supplied geometry data through the library's constraint-edge insertion path. When nearly-degenerate constraint edges are provided, floating-point rounding during intersection computation places a split vertex outside the adjacent triangles, causing opposedVertexInd() to perform an unchecked out-of-bounds array access. No public exploit has been identified at time of analysis; a vendor-released patch is available in version 1.4.5.
Directory traversal in JoomUnited's WP File Download WordPress plugin (all versions through 6.3.8) enables server-side file disclosure via a two-stage attack chain. A subscriber-level authenticated attacker first poisons a post-meta value through an unprotected file.save handler, after which the plugin's streaming endpoint — registered on WordPress's init hook with no authentication check — resolves and serves the traversed file path to any HTTP caller, including fully unauthenticated visitors. No public exploit code or CISA KEV listing has been identified at time of analysis, but Wordfence has published the vulnerability details and a trac browser link pointing directly to the vulnerable code at app/site/init.php line 225.
Stored XSS in the FooGallery WordPress plugin (all versions through 3.3.2) allows authenticated contributors to inject persistent JavaScript via the `custom_settings` shortcode attribute. The malicious payload executes in any visitor's browser when they access an affected page, enabling session hijacking, credential theft, or privilege escalation against higher-privileged users including site administrators. No public exploit code or CISA KEV listing has been identified, but the low privilege barrier - a contributor account - makes this realistically exploitable on sites with open or loosely managed contributor registration.
Stored Cross-Site Scripting in the Dear Flipbook WordPress plugin (≤2.4.30) allows authenticated contributors to inject persistent JavaScript payloads that execute silently in any visitor's browser. The attack exploits the plugin's client-side parseCSSElements() function, which Base64-decodes JSON embedded in CSS class names of Custom HTML blocks via atob()/JSON.parse() and renders the logo property as raw innerHTML with no server-side or client-side sanitization intercept. No public exploit code identified at time of analysis; a patched version (2.4.37) has been released per WordPress SVN changeset references.
Stored Cross-Site Scripting in the Dear Flipbook WordPress plugin (versions ≤2.4.30) allows authenticated Contributor-level users to inject persistent JavaScript payloads into pages, executing in every subsequent visitor's browser. The attack exploits the `parseThumbs()` function in `dflip.js`, which unsafely accepts the inner HTML of `.df-element` divs from Custom HTML blocks as a `title` argument and writes it directly into the DOM without sanitization - enabling both direct `innerHTML` injection and attribute breakout via `onerror` event handlers on crafted `img` elements. No public exploit code or CISA KEV listing identified at time of analysis, but the scope-change (S:C) in the CVSS vector signals that successfully stored payloads affect all site visitors, including administrators.
Stored Cross-Site Scripting in the Pods - Custom Content Types and Fields WordPress plugin (all versions ≤ 3.3.9.1) allows contributor-level authenticated attackers to inject persistent malicious scripts via the 'not_found' shortcode attribute, executing in victim browsers on page load. The root cause is insufficient sanitization and output escaping in general.php (lines 1399, 2535, 2539) and PodsInit.php (line 514), as identified by Wordfence. No public exploit or KEV listing has been identified at time of analysis, but the contributor-level access bar is low on multi-author WordPress sites.
Stored cross-site scripting in the Social Chat - Click To Chat App Button WordPress plugin (all versions ≤8.6.2) allows authenticated contributors to plant arbitrary JavaScript via the consent_message JSON attribute in the .qlwapp data-box element. When auto_open and consent_enabled are both set to 'yes' in the injected configuration, the malicious script fires immediately on page load with no additional victim interaction required, enabling session-cookie theft, credential harvesting, or malicious redirects against any visitor who loads the affected page. A patched version (8.6.3) is confirmed available via the WordPress plugin repository changeset; no public exploit code has been identified at time of analysis.
DOM-based stored Cross-Site Scripting in the Divi WordPress theme (all versions through 4.27.6) allows authenticated Contributor-level attackers to inject persistent arbitrary JavaScript via the `image_src` attribute of the `et_pb_video_slider_item` shortcode. The payload survives server-side sanitization because `esc_attr()` encodes double quotes as `"`, but jQuery's `.data('image')` call in `custom.unified.js` silently HTML-entity-decodes that value at runtime, and the decoded string is then concatenated into HTML and injected into the DOM via `jQuery.after()` with no further escaping. No public exploit or CISA KEV listing is identified; a patched release (4.27.7) is available per the Divi changelog.
Rate limiting in AVideo's API is completely nullified when requests include a bot User-Agent header, exposing all eight rate-protected operations - most critically the login endpoint - to unlimited brute-force attempts from a single IP address. An unauthenticated remote attacker who sets any bot User-Agent string can bypass the application's only credential-stuffing defense and attempt unlimited password guesses against any account. No active exploitation (CISA KEV) or public proof-of-concept code has been identified at time of analysis.
Reflected XSS in the Unlimited Elements For Elementor WordPress plugin (all versions through 2.0.17) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL containing a malicious payload in the `formData[id]` parameter. The plugin registers a front-end AJAX handler on the public WordPress `wp` action with no nonce, capability, or referer check; the attacker-controlled parameter value is interpolated verbatim into an exception message and echoed in the HTTP response without output escaping, and when the content-type resolves to text/html the browser parses and executes the injected markup. No public exploit has been identified at the time of analysis, though the unauthenticated network vector and low attack complexity make social-engineering delivery straightforward against WordPress sites running this plugin.
Reflected XSS in Beaver Builder Plugin (Starter Version) for WordPress (all versions ≤2.11.0.1) permits unauthenticated attackers to inject arbitrary JavaScript via the unsanitized `no_results_message` parameter in the `node_preview` endpoint. Successful exploitation requires tricking a victim into clicking a crafted URL, after which the injected script executes in the victim's browser with access to session cookies, page DOM, and any credentials present in that context. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unbounded string storage in Ash Framework versions 0.10.0 through 3.32.x allows unauthenticated attackers to bypass max_length and min_length constraints by submitting Unicode strings whose grapheme count is small but whose codepoint and byte footprint is arbitrarily large. Ash's constraint logic calls Elixir's String.length/1, which counts graphemes; a single base character followed by millions of combining accent codepoints is one grapheme but megabytes of data, satisfying max_length: 2 while writing the entire payload to storage. When the backing store is a PostgreSQL text column, ETS table, or Mnesia table, the oversized value is persisted without limit, enabling storage exhaustion. No public exploit code or CISA KEV listing exists at the time of analysis.
Flag-propagation failure in libxml2's XInclude processor before version 2.15.4 allows security-critical parse options - most notably XML_PARSE_NONET, which blocks outbound network entity loading - to be silently discarded when xmlXIncludeProcess or xmlXIncludeProcessTree resolves included sub-documents. Applications that rely on XML_PARSE_NONET as a sandboxing boundary may unknowingly initiate outbound HTTP connections to attacker-controlled hosts, enabling server-side request forgery (SSRF), XML external entity (XXE) data extraction, or denial of service via intentionally slow network responses. No public exploit identified at time of analysis, and no CISA KEV listing is present.
Infinite-loop denial of service in libpcap's BPF interpreter allows a local low-privileged attacker to hang any process that evaluates a crafted BPF filter program via pcap_offline_filter(). The 'ja L' (jump always) instruction stores its target offset as a signed integer, enabling backward jumps that implement looping, but the interpreter imposed no cap on iterations, so a self-referential or backward-looping filter causes unbounded CPU consumption. The upstream fix (commit ff3c83475a) introduces a MAX_BACKWARD_JUMPS limit of 64 per packet and adds validator rejection of self-jumps; no active exploitation or public exploit code has been identified at time of analysis.
Division by zero in libpcap's BPF interpreter can crash any application using the library when processing a crafted filter program containing 'div #k' or 'mod #k' ALU instructions with k=0. The flaw, reported by The Tcpdump Group, affects all versions of libpcap (cpe:2.3:a:the_tcpdump_group:libpcap) and requires a locally-supplied malicious BPF filter - typically via an application that accepts user-controlled filter expressions and calls pcap_offline_filter(). No public exploit or active exploitation has been identified; the vendor has released a patch via GitHub commit.
Process termination via crafted BPF filter in libpcap allows a local attacker with low privileges to crash any application linked against the library by supplying a filter program containing an invalid BPF opcode. The BPF interpreter in bpf_filter.c calls abort() on encountering an unrecognized opcode - a reachable assertion (CWE-617) that converts a defensive check into a denial-of-service vector. No public exploit or active exploitation has been identified; the Tcpdump Group has released a patch replacing abort() with a safe return 0.
Out-of-bounds memory reads in libpcap's userland BPF interpreter allow a local attacker who can supply a crafted filter program to drive the interpreter's program counter past the end of the filter buffer, reading up to 32 GiB of surrounding process memory on 64-bit systems or the entire address space on 32-bit systems. All libpcap versions tracked under CPE cpe:2.3:a:the_tcpdump_group:libpcap are affected; The Tcpdump Group has published a fix via commit d3f358d3. No active exploitation has been confirmed and no public exploit exists; the vulnerability is restricted to uncommon application patterns that pass raw BPF bytecode directly to the interpreter without prior validation.
Stored XSS in the Events Manager WordPress plugin (versions ≤ 7.3.3) enables persistent JavaScript injection via event attribute values using the '#_ATT{key}' template placeholder, which is stored without sanitization and rendered without output escaping. Authenticated users with Author-level access can exploit this on any site running the plugin without special configuration; when the plugin's anonymous event submission feature is enabled (a non-default setting), unauthenticated attackers can achieve the same result. Payloads execute in the browser of any visitor who views the compromised event page. No public exploit code or CISA KEV listing has been identified at time of analysis.
Authorization bypass in the LearnDash LMS WordPress plugin (versions 4.25.0-5.1.6) allows attackers to enroll arbitrary users in paid courses without completing payment, systematically circumventing the plugin's entire payment verification workflow. The root cause is CWE-862 (Missing Authorization): enrollment action handlers fail to verify that the requesting party has the appropriate permission or has satisfied payment conditions. A patched release (5.1.6.1) is available, and no public exploit has been identified at time of analysis.
Confused deputy SSRF bypass in Sim before 0.8.14 allows authenticated workflow authors to reach internal-only API endpoints by exploiting URL prefix matching without scheme normalization. When an HTTP block in a workflow specifies a path beginning with /api/, the routing layer misclassifies the request as internal, skips SSRF validation, and mints an internal authentication token - granting the attacker access to endpoints such as POST /api/function/execute that are meant to be restricted to the server itself. No public exploit is confirmed at time of analysis, but a researcher disclosure writeup is available on GitHub, and a fix was shipped in PR #7179 targeting v0.8.14.