Reflected cross-site scripting in the Unlimited Elements For Elementor WordPress plugin (versions ≤2.0.16) allows unauthenticated remote attackers to inject arbitrary JavaScript into pages viewed by victims who follow a crafted link. The vulnerable `show_preview` AJAX action is registered without authentication, and while it is gated by a WordPress nonce, that nonce is trivially retrievable by loading any publicly accessible page on the target site, rendering the protection ineffective. No public exploit has been identified at time of analysis, though the low complexity of exploitation makes this straightforward to weaponize in phishing or drive-by attack chains.
Reflected cross-site scripting in HUSKY - Products Filter Professional for WooCommerce (WordPress plugin, versions ≤1.4.3) allows unauthenticated attackers to inject arbitrary JavaScript into page responses by embedding malicious payloads inside SEO-friendly permalink URL filter path segments. The root cause is in wp_load_js(), which calls parse_url_query() to extract filter values from the URL path and serializes them with PHP's json_encode() into an inline script block without escaping single quotes, enabling string-context escape and script injection. Exploitation requires social engineering - the victim must click a crafted link - but a successful attack against a store administrator can lead to session hijacking or full WooCommerce backend compromise. No public exploit identified at time of analysis.
Reflected XSS in WP-Members Membership Plugin for WordPress (all versions through 3.5.6) allows unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser session. The vulnerability exists in the registration form's URL query string handling within class-wp-members-forms.php (lines 2202-2203), where unsanitized input is echoed into page output without proper escaping. Exploitation depends on a two-step social engineering chain - the victim must visit an attacker-crafted URL and then click the Terms of Service link on the rendered registration page - with no public exploit identified at time of analysis.
Reflected XSS in the Chaty (Floating Chat Widget) WordPress plugin by Premio affects all versions through 3.5.9, allowing unauthenticated attackers to inject arbitrary JavaScript into a victim's browser session by tricking them into clicking a crafted search URL. The root cause is a subtle DOM-level bypass: WordPress server-side HTML-encodes the 's' search parameter into the page title, but the plugin's frontend JavaScript reads that title via jQuery's `.text()` method, which invokes the browser DOM API and silently decodes the HTML entities back to raw characters before embedding the value unescaped into an HTML attribute. Wordfence has confirmed the vulnerability and a corrective code change is visible in the WordPress plugin repository changeset; no public exploit code has been identified at time of analysis.
Reflected Cross-Site Scripting in the Themify WooCommerce Product Filter WordPress plugin (versions ≤1.5.5) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers by tricking them into clicking a crafted URL containing a malicious query parameter name. The vulnerability stems from insufficient sanitization and escaping in class-wpf-utils.php and class-wpf-public.php, as confirmed by Wordfence source references. An upstream fix has been committed to the WordPress plugin SVN trunk, though an exact released patched version is not confirmed from available data. No public exploit code or CISA KEV listing has been identified.
CSRF in Concrete CMS 9.5.2 and below allows a remote unauthenticated attacker to permanently delete all entries of an Express entity by tricking an authenticated administrator into visiting an attacker-controlled page. The root flaw is that the delete_entries controller records a CSRF token mismatch but proceeds with the destructive operation anyway, making the protection entirely non-functional. The default Contact Express object ships with a fixed, predictable entity UUID, so attackers can target that data store without any prior dashboard access.
Reflected cross-site scripting in the p.rfihub.com tracking component of the Zeta Marketing Platform (ZMP) v1.0 allows an attacker to inject a crafted URL into the 'ca' parameter and execute arbitrary JavaScript in a victim's browser when the link is opened. The flaw requires victim interaction (UI:R) but no authentication (PR:N), and because the script runs in the origin of a Zeta-controlled marketing domain, it can be used for session/token theft, credential phishing, or defacement of the trusted brand context. No CISA KEV listing is present and EPSS is only 0.15% (5th percentile), so the near-term mass-exploitation risk is low, but a public researcher disclosure with technical detail exists for this issue.
Cross-site scripting (CWE-79) in Microsoft Edge (Chromium-based) allows unauthenticated remote attackers to perform content spoofing by injecting malicious scripts that execute in a victim's browser after user interaction. The scope-changed vector (S:C) indicates injected scripts can affect resources beyond the immediate page context, enabling session manipulation or UI redirection. Microsoft has released an official patch via MSRC; temporal metrics (E:U) confirm no public exploit code has been observed at time of analysis.
Heap buffer overflow in the libtiff `tiff2pdf` utility allows local attackers to cause severe memory corruption and application crashes by supplying a crafted BigTIFF file. The root cause is an integer truncation: a 64-bit `StripByteCounts` value is silently narrowed to 32 bits, producing an undersized heap allocation that a subsequent memory copy overflows. Red Hat has issued advisory RHSA-2026:53467 and an upstream fix is available via libtiff GitLab merge request #729; no public exploit or active exploitation has been identified at time of analysis.
Reflected cross-site scripting in IdeaSoft Smart E-Commerce through version 11092026 allows remote unauthenticated attackers to inject malicious JavaScript into HTTP responses delivered to victim browsers. Exploitation requires social engineering a user into clicking a crafted URL, after which the injected script executes in the context of the e-commerce application's origin, enabling session hijacking, credential theft, or unauthorized actions. Vendor-released patch is not available - IdeaSoft did not respond to TR-CERT's coordinated disclosure attempt, leaving all deployments on the affected version without an official fix.
XML External Entity (XXE) injection in the RemoteQueryCachePlugin of AWS Advanced JDBC Wrapper 3.3.0-4.2.0 allows an actor with write access to the shared cache infrastructure to exfiltrate sensitive files - including database credentials and IAM role credentials - from any application host that reads poisoned cached query results. The attack is conditioned on the RemoteQueryCachePlugin being enabled and the application caching XML column types (SQLXML); an adversary with cache write access injects crafted XML containing external entity references into a cached column value, which are resolved when the application deserializes the cached result. Amazon released version 4.3.0 on 2026-07-23 to fix the issue; no public exploit or CISA KEV listing has been identified at time of analysis.
Improper certificate validation (CWE-295) in an ICS component's reverse proxy allows a network-adjacent attacker to impersonate the identity provider during token discovery, introspection, and credential exchange, resulting in forged authentication tokens being accepted across the deployment. The affected product is covered under ICS-CERT advisory ICSA-26-254-01, indicating an industrial or operational technology context. No public exploit code or active exploitation has been identified at time of analysis; exploitation requires adversarial positioning on the internal network segment between the reverse proxy and the identity provider.
Stored cross-site scripting in Concrete CMS's RSS Displayer block (versions below 9.5.3) allows an external attacker who controls a syndicated feed to inject arbitrary JavaScript into any page that renders that feed, executing in the site origin for all visitors including authenticated administrators. The attack requires no account on the vulnerable site; the malicious payload persists across all page loads until the feed content changes or the block is removed. Concrete CMS assigned a CVSS 4.0 score of 6.0 reflecting high attack complexity, and no public exploit has been identified at time of analysis.
Missing per-entry authorization in Concrete CMS 9.2.0-9.5.2 allows any low-privileged OAuth token holder to enumerate Express entries they are not permitted to view via the REST API collection endpoint. The Express entry list endpoint omitted the per-entry view permission check, so a token with read scope for an Express entity returns restricted records including identifiers, URLs, labels, dates, and any custom attribute or associated-entry data requested through the includes parameter. The issue is fixed in 9.5.3; no public exploit has been identified and it is not listed in CISA KEV.
Unauthorized group enumeration in Concrete CMS 9.2.0 through 9.5.2 exposes the full organizational group structure to any authenticated API user holding a groups:read token. The root cause is a permission-checker callback in the REST API Groups controller that unconditionally returns true, eliminating per-object (tree-node) authorization on the group collection endpoint. With authentication required and no public exploit identified, the practical blast radius is limited to insiders or compromised API accounts, but the disclosed group hierarchy can materially assist privilege-escalation reconnaissance on affected sites.
Server-Side Template Injection in Concrete CMS 9 through 9.5.2 allows a privileged user holding the Theme Customization permission to inject arbitrary LESS directives into style values processed by the server-side LESS compiler. By crafting an @import (inline) directive within color, font, or image style fields, the attacker can read arbitrary files from the server filesystem and reach internal network resources via PHP stream wrappers, with the compiled output - including any exfiltrated file contents - written directly to the publicly accessible CSS cache. This combination of sensitive file disclosure and SSRF enables credential theft and further lateral movement; no public exploit has been identified at time of analysis.
Missing authorization in the block alias route of Concrete CMS 9.x through 9.5.2 allows an authenticated editor holding only a limited area-scoped add_block_to_area delegation to read and permanently destroy arbitrary block content across the entire site. The vulnerable method Process::alias() in concrete/controllers/backend/block/process.php accepts caller-supplied block IDs without verifying ownership over the source block or confirming it is genuinely orphaned on the caller's page, enabling cross-page content theft via duplication and forced silent deletion of the original. No active exploitation has been confirmed in CISA KEV and no public exploit code exists, but the attack is mechanically straightforward for any qualifying editor account.
Credential interception vulnerability in Schneider Electric SCADAPack RTUs (Remote Terminal Units) exposes authentication information over the network, enabling unauthorized access to RTU functionality. Affected products span the SCADAPack 3xx, 32, 47x/470R, and 57x families - all version ranges per CPE wildcards - used extensively in critical infrastructure sectors such as oil and gas pipelines, water systems, and electrical utilities. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but successful exploitation yields full credential disclosure and subsequent unauthorized control of industrial RTU assets.
Payment notification forgery in the Payment Gateway PayPay for WooCommerce WordPress plugin (versions 0.5-0.9.3) allows unauthenticated network attackers who possess the target store's merchant identifier to submit fake payment webhooks, marking arbitrary orders as paid without actual payment, or cancelling and failing legitimate orders. The vulnerability stems from missing authenticity verification on incoming payment callbacks - essentially an absent webhook signature check. No public exploit code or KEV listing has been identified; the CVSS AC:H reflects the requirement to know the merchant identifier beforehand.
Uncaught TypeError in hbs 4.3.0 crashes the Node.js process when an async Handlebars helper resolves to an object with a truthy but non-callable `toHTML` property. Handlebars' `escapeExpression` unconditionally invokes `toHTML()` on any value that exposes it; because async helper substitution executes on a later event-loop tick, the resulting TypeError falls outside the render function's try/catch and becomes a fatal uncaught exception, terminating the entire process without sending a response. The flaw is remotely triggerable when the async helper's resolved value is influenced by attacker-controlled input such as parsed JSON. No public exploit code has been identified at time of analysis, and the issue is fixed in hbs 4.3.1.
Stored XSS in Concrete CMS 9.0.0-9.5.2 allows a user with board-editing permissions to inject arbitrary JavaScript into the description field of a summary object via the Board Custom Slot's `save_template` endpoint, which accepts the raw client-supplied `selectedTemplateOption[collection]` parameter without server-side validation or sanitization. The default summary template renders the description field without output encoding, so the stored payload fires in the browser of every subsequent visitor to the affected board slot - including unauthenticated front-end users and dashboard administrators. Successful exploitation enables session hijacking or forced CSRF actions, potentially escalating to full administrative compromise. No public exploit has been identified and the vulnerability is not listed in CISA KEV.
Cross-site request forgery in Concrete CMS before 9.5.3 allows an attacker to silently relocate user group tree nodes on behalf of an authenticated administrator, exploiting the missing action-token validation on the dashboard/users/groups/bulkupdate/confirm() endpoint. Because Concrete CMS inherits parent-group permissions down to child-group members, a forged group move can silently expand the authorization scope of affected users, granting access to restricted content areas without any administrator awareness. No public exploit has been identified at time of analysis; the vendor released a fix in version 9.5.3.
Out-of-bounds heap write in PCRE2's pcre2_convert() function on 32-bit platforms allows any attacker who can supply a large, attacker-controlled pattern string to corrupt heap memory with high integrity impact. Affected releases are all PCRE2 versions before 10.48 on architectures where size_t is 32 bits; 64-bit systems are unaffected. No public exploit has been identified at time of analysis, and the 32-bit platform constraint substantially limits the exposed surface in modern enterprise environments, though embedded Linux, IoT firmware, and legacy 32-bit deployments remain genuinely at risk.
Path traversal in CPython's tarfile module allows an attacker to write files outside the intended extraction directory by exploiting a filter bypass in the link-fallback code path. On systems that do not support symbolic or hard links, tarfile falls back to extracting the link target as a regular archive member; in this fallback path the filter function is called a second time but its return value is discarded, so a filter that returns None to reject a dangerous member silently fails to block extraction. An attacker who can supply a crafted tar archive containing a hardlink-to-symlink chain can abuse this to achieve path traversal when a victim extracts the archive using a filter that selectively returns None. No public exploit code exists and CISA KEV listing has not been confirmed.
Symlink-following in libvirt's qemuTPMEmulatorPrepareHost() allows a local attacker with access to the swtpm service account to redirect a path-based chown() call - executed by libvirtd running as root - to transfer ownership of any arbitrary file on the system to the swtpm user. This affects libvirt on Red Hat Enterprise Linux 6 through 10. With ownership of a sensitive file such as /etc/shadow or a cron directory transferred to swtpm, the attacker gains a privilege escalation primitive beyond the swtpm account boundary. No public exploit or active exploitation has been identified at time of analysis.
Local information disclosure in Pardus About (versions 1.2.1 through 1.2.4) allows a low-privileged local user to read sensitive system data that should be restricted to higher-privileged users. The root cause is missing authorization checks (CWE-862) in the desktop information viewer component of the Pardus Linux distribution, developed by TUBITAK BILGEM. TR-CERT disclosed the issue with a fix available in version 1.2.5; no public exploit code or CISA KEV listing has been identified.
Open redirect in Concrete CMS 9.5.0-9.5.2 allows an unauthenticated attacker to craft a legitimate-looking URL on the victim site that silently forwards an authenticated user to an arbitrary external domain immediately after login or registration. The vulnerability targets the newly introduced `rcURL` parameter in the authentication and registration flows, making it uniquely scoped to the 9.5.x minor release line. Exploitation facilitates phishing and credential harvesting by abusing the implicit trust users place in a URL belonging to a known, legitimate domain. No public exploit code or active exploitation has been identified at time of analysis.
Missing server-side authorization (CWE-862) in four Livewire Settings components of Shopper Framework allows any authenticated staff user holding only the coarse `access_setting` permission to invoke destructive delete/edit actions - permanently removing shipping zones, carrier options, tax zones, and tax rates - without holding any `delete_*` or `edit_*` permission. The parent Filament page authorizes `access_setting` but child Livewire components handle their own `/livewire/update` HTTP requests independently and carry zero `->authorize()` calls, creating a privilege boundary gap. A working proof-of-concept validated against the real Livewire/Filament code path is included in the GHSA advisory, confirming low-sophistication exploitation; the fix is available in shopper/framework 2.9.2.
Cross-Site Request Forgery (CSRF) in the RTMKit WordPress plugin (by RomeTheme, for Elementor) version 2.1.5 and earlier allows unauthenticated remote attackers to forge requests on behalf of authenticated site users, resulting in limited modification of plugin state and minor availability disruption. Exploitation requires social engineering to trick a logged-in WordPress user into visiting a crafted page. No public exploit code or active exploitation has been identified at time of analysis.
Reflected cross-site scripting and open redirect in an ICS inventory management web interface allows unauthenticated network attackers to craft malicious URLs that, when clicked by a legitimate user, execute arbitrary JavaScript within the application's browser context. The vulnerable endpoint reflects a URL segment into both a JavaScript execution sink and an anchor href attribute without output encoding, enabling both script injection and browser hijacking from a single crafted request. Successful exploitation yields session-level access to the application on behalf of the victim, as disclosed in ICS-CERT advisory ICSA-26-254-01.
Unauthenticated access to the GraphiQL playground and schema introspection endpoints in NL Portal Backend Libraries (up to and including v3.0.0) exposes the complete GraphQL API surface to any network-reachable caller under default deployment configuration. The commit diff confirms the fix is a two-line configuration change disabling both `graphiql.enabled` and `introspection.enabled` in the Spring Boot application.yml, indicating these developer features were shipped enabled by default. While no user data is directly disclosed, a caller can retrieve the full set of queries, mutations, types, and arguments, substantially reducing the effort needed to probe or exploit other weaknesses in the API.
Unauthorized customer data modification in the Booktics WordPress plugin allows unauthenticated remote attackers to overwrite any existing customer's stored name, phone number, and linked WordPress user ID by supplying only the target's email address in a crafted REST API request. All plugin versions through 1.0.23 by Arraytics are affected, with the root cause split between a permission callback that unconditionally returns true and a guest-update function that applies caller-supplied contact data to any record whose email matches without ownership verification. No public exploit code has been identified at time of analysis, but the low-complexity, zero-authentication attack path makes systematic data poisoning of booking reminders, SMS notifications, and CRM integrations feasible for any attacker who can enumerate customer emails.
XML injection in WWBN AVideo's AD_Server plugin (`plugin/AD_Server/VMAP.php`) allows a remote unauthenticated attacker to inject arbitrary VMAP ad-break nodes into video ad playlist responses when the AD_Server plugin is enabled. When a victim opens a crafted VMAP URL or a video page referencing it, the player's IMA ad client follows the injected ad tag URIs, enabling attacker-controlled ad injection and cross-origin requests from the victim's playback session. The vulnerability was unfixed at time of reporting, and no public exploit has been identified.
Incorrect authorization in this ICS inventory management component defaults to granting access when a request handler is absent from the role-requirements lookup table, violating deny-by-default principles. Any authenticated user - regardless of assigned role - can reach handlers not explicitly enrolled in the table, and every newly added handler is exposed to all authenticated users until a developer manually registers it. With CVSS 4.0 scoring AV:N/PR:L/VC:L, no public exploit has been identified, but the systemic nature of the flaw means the attack surface grows automatically as the application evolves.
Tag-write authorization bypass in a read-only deployment mode of a bundled packet-analysis component allows authenticated users to add or remove tags on stored network session records despite the deployment's intended read-only posture. The flaw stems from an incomplete deny-list pattern in the proxy configuration that blocks most write routes but leaves tag-modification endpoints exposed, combined with the proxy permitting the HTTP method those endpoints require. Affected are deployments explicitly configured for read-only access, where the operator's security model assumes all write operations are blocked for non-privileged authenticated users. No public exploit code exists and the vulnerability is not in CISA KEV.
Path-based server-side request forgery in an ICS inventory management platform allows authenticated low-privilege users to inject arbitrary path components into backend requests destined for an internal search and analytics data store. The application unwittingly proxies attacker-controlled paths using its own elevated service credentials, enabling enumeration and reading of internal configuration and administrative data from the backend that would otherwise be inaccessible. No public exploit or active exploitation has been identified; the ICS operational context reported by ICS-CERT elevates the consequence of internal configuration exposure.
Missing ownership-check IDOR in AVideo through 29.0 allows an authenticated low-privilege user to recursively delete any category's on-disk asset directory (icons and images) regardless of ownership. The vulnerable endpoint `objects/categoryDeleteAssets.json.php` validates the CSRF nonce and the `canCreateCategory` capability but skips the `userCanEditCategory` ownership check enforced by the sibling delete handler, passing attacker-controlled category IDs directly to `Category::deleteAssets()`. No patched version was available at the time of advisory publication; exploitation requires the non-default `usersCanCreateNewCategories` site setting to be enabled.
Missing CSRF token validation in Concrete CMS before 9.5.3 allows a remote attacker to trick an authenticated calendar editor into silently creating unwanted duplicate events. The vulnerable endpoint - the Calendar event duplicate dialog's submit() action in concrete/controllers/dialog/event/duplicate.php - enforced only object-level permissions (canAccess() and canAddCalendarEvent()) without verifying an anti-CSRF synchronizer token, meaning any forged cross-site request submitted on behalf of a legitimate session could produce spurious CalendarEvent and CalendarEventVersions database records. No public exploit or active exploitation has been identified; the vendor-assigned CVSS 4.0 score of 5.3 reflects the bounded, integrity-only impact.
Replay attack vulnerability in WeenyGenius, a computer lab management system by Howyar Technologies, allows unauthenticated adjacent-network attackers to forge student attendance status. By intercepting a legitimate student connection packet and replaying it, an attacker can make the management system believe the student remains connected after they have disconnected. No public exploit has been identified at time of analysis, and EPSS data is not available for this entry.
Sensitive data exposure in the ElasticPress WordPress plugin (versions through 5.3.4) allows unauthenticated network attackers to retrieve embedded sensitive information from plugin responses. The root cause is CWE-201: the plugin inserts confidential data into outbound payloads - likely search query results or API responses passed to Elasticsearch/OpenSearch - where it becomes accessible without authentication. Reported by Patchstack with a CVSS 5.3 Medium rating; no public exploit code or active exploitation confirmed at time of analysis.
Sensitive data exposure in bbPress WordPress forum plugin 2.6.14 and earlier allows unauthenticated remote attackers to access restricted information due to missing authorization checks (CWE-862). The CVSS vector confirms network-accessible, no-authentication-required exploitation with a low confidentiality impact, consistent with unauthorized read access to content that should be gated. No public exploit code and no CISA KEV listing are identified at time of analysis, and the moderate CVSS 5.3 score reflects a real but bounded data-exposure risk rather than a full compromise.
Broken access control in the Flexible Quantity - Measurement Price Calculator for WooCommerce plugin (WPDesk) version 2.3.21 and earlier allows unauthenticated network attackers to perform restricted actions due to missing server-side authorization checks. The vulnerability (CWE-862) results in low-severity integrity impact - likely unauthorized manipulation of quantity or pricing-related plugin functionality - without requiring credentials or user interaction. No public exploit code or active exploitation has been identified at time of analysis, and Patchstack reported this as a standard missing-authorization class issue with a CVSS base score of 5.3.
Broken access control in the Booktics WordPress plugin (by Arraytics) through version 1.0.24 permits unauthenticated remote attackers to perform restricted write operations without any authentication. The CVSS vector (PR:N, I:L) confirms the flaw allows unauthorized integrity-impacting actions - such as modifying booking data or plugin state - accessible directly over the network. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in the Masteriyo LMS WordPress plugin through version 3.4.0 allows attackers to perform unauthorized write operations within the learning management system. The flaw (CWE-862, Missing Authorization) bypasses role-based access restrictions - with Patchstack identifying subscriber-level users as the privilege context - enabling modification of LMS-managed data beyond the attacker's permitted scope. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, though the integrity impact and network-accessible attack vector make prompt patching advisable.
Broken access control in the Passster WordPress content-protection plugin (versions up to and including 4.3.13) allows unauthenticated remote attackers to read content that site owners have restricted behind passwords. The root cause is CWE-862 (Missing Authorization) - the plugin fails to verify entitlement before serving protected material, directly undermining its core security purpose. No public exploit or CISA KEV listing exists at time of analysis, and impact is limited to partial confidentiality with no integrity or availability effect.
Broken access control in the Deposits and Partial Payments for WooCommerce plugin (MagePeople Team) versions up to and including 3.1.0 allows unauthenticated network attackers to perform unauthorized integrity-impacting actions on deposit and partial payment functionality. The root cause is CWE-862 (Missing Authorization), meaning certain plugin endpoints or AJAX actions execute restricted operations without validating whether the caller has permission to do so. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated IDOR in Quiz And Survey Master WordPress plugin (versions ≤ 11.2.5) allows remote attackers to access quiz or survey objects they are not authorized to view by manipulating user-controlled resource identifiers. The flaw carries a CVSS 5.3 (C:L/I:N/A:N), meaning impact is limited to confidentiality - no data modification or denial of service is possible. No public exploit code or CISA KEV listing is identified at time of analysis, but the unauthenticated network vector lowers the bar for opportunistic discovery.
Stored cross-site scripting in Chamilo LMS allows unauthenticated remote attackers to inject persistent malicious scripts into survey reporting views by exploiting deterministic invitation codes to bypass the survey submission authorization check. Affected versions are Chamilo LMS before 1.11.42 (1.x branch) and before 3.0.0 (3.x branch). When a teacher or administrator subsequently views the survey reporting interface, the stored payload executes in their browser session, enabling session hijacking and - per the description - automated creation of backdoor administrative accounts. No public exploit identified at time of analysis, but VulnCheck has published a dedicated advisory.
Payment authority reuse in the Persian Elementor WordPress plugin (versions 2.7.10 through before 2.8.2) lets unauthenticated attackers complete pending orders without making a real payment. The ZarinPal payment callback handler accepts any valid authority token without verifying it was issued for the specific transaction being fulfilled, so an attacker who obtains an authority token from any ZarinPal transaction can submit it to a different pending order's callback and have the plugin mark that order as paid. No public exploit code has been identified at time of analysis, but the low attack complexity makes abuse straightforward on affected sites running active ZarinPal integrations.
Insecure Direct Object Reference in the Nexi XPay Build WordPress payment plugin (versions 7.6.1-7.6.2) exposes stored card token references and valid authorization signatures belonging to arbitrary customers to unauthenticated network attackers. The plugin's token retrieval endpoint performs no ownership verification, allowing any external actor to enumerate and retrieve payment credentials associated with other users' accounts. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the unauthenticated, zero-complexity vector makes automated harvesting trivial.