Unauthenticated arbitrary file upload in the Gravity Forms WordPress plugin through version 3.1.0.4 can lead to remote code execution on any site whose publicly reachable form contains a File Upload field with its Visibility set to 'Hidden', because hidden upload fields skip the extension-validation step and a rejected file's intact upload state is subsequently persisted by upload_file() without re-validation. Per the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), no credentials or user interaction are required (PR:N/UI:N) and the attack is fully remote (AV:N), but the non-default hidden File Upload field is a mandatory precondition; a secondary practical limiter is that code execution depends on the server actually executing the uploaded file type in the upload directory. No public exploit code and no CISA KEV entry were identified at time of analysis, yet the combination of unauthenticated access, arbitrary file write and PHP-execution potential makes this a high-priority fix for any installation that meets the precondition.
Unauthenticated remote attackers can abuse a missing authorization check in a REST route of the Botiga Pro WordPress plugin (versions before 1.6.5) to update arbitrary WordPress options, inject stored web scripts that execute on every front-end page, and move arbitrary posts to the trash. The option-write primitive enables privilege escalation and full site takeover, for example by altering registration or default-role settings, while the stored script injection yields persistent cross-site scripting against all site visitors. The issue is rated CVSS v3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), publicly available exploit code exists, and no CISA KEV listing has been observed; the only deployment prerequisite is that the Pro add-on plugin is installed and active, as the free Botiga theme alone is unaffected.
Code execution in OpenPanel's js-runtime component lets an authenticated user who holds project write access escape the JavaScript webhook template sandbox and run arbitrary code inside the worker process. The template validator fails to block computed (bracket-notation) member access that traverses a constructor chain to the Function constructor, so merely creating or editing a webhook template is sufficient - no user interaction is required (UI:N). No public exploit code has been identified at time of analysis, and no CISA KEV or EPSS signal was supplied, but our independent assessment rates this a genuine high-priority issue, with CVSS 3.1 AV:N/PR:L/UI:N/S:C/C:H/I:H/A:H (scope change to the host system and full confidentiality, integrity and availability impact).
A stack-based buffer overflow in the TOTOLINK A3002MU wireless router (firmware Hh-B20211125.1046) allows remote attackers to corrupt memory through the 'submit-url' argument handled by the formWlWds function at /boafrm/formWlWds, with the CVSS 4.0 vector scoring 9.3 and indicating no authentication or user interaction prerequisite (PR:N/UI:N), though the independent assessment notes the endpoint's pre-authentication status is not explicitly confirmed by the description. Impact is potentially full compromise of confidentiality, integrity, and availability on the device, but practical success depends on network reachability to the Boa web management interface, the specific firmware build, and the difficulty of converting an embedded-MIPS stack overflow into reliable code execution rather than a simple crash. Publicly available exploit code exists, but there is no confirmed active exploitation (no CISA KEV listing) at time of analysis.
OS command injection in the Totolink A3002MU router firmware (build Hh-B20211125.1046) lets a remote attacker who holds valid low-privilege credentials execute arbitrary shell commands on the device through the formWsc handler in /boafrm/formWsc by supplying a crafted localPin argument. Because the affected component is the router's BOA web management service, successful exploitation yields full compromise of confidentiality, integrity and availability (CVSS 4.0 score 8.6, PR:L, no user interaction), and on consumer routers the required low-privilege session is often trivially satisfied by unchanged default administrative credentials. Publicly available exploit code exists (a published proof-of-concept walkthrough for the A3002MU rce-formWsc path), and although there is no confirmation of active exploitation in CISA KEV, the combination of a public PoC, a network-reachable attack surface and low complexity makes this a high-priority patching target for internet- or LAN-exposed devices.
Remote code execution in The Welcomizer WordPress plugin versions up to and including 2.8.1 lets authenticated users with Subscriber-level access or higher execute arbitrary PHP on the server by abusing the twiz_ajax_callback AJAX action's savesection handler. The handler checks a nonce but omits a current_user_can() capability check, and eval() processes attacker-supplied PHP from the twiz_custom_logic POST parameter when output is set to twiz_logic_output; the nonce is exposed to any authenticated user via twiz-ajax.js.php, so it does not prevent exploitation. Wordfence reports this with CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and no public exploit identified at time of analysis.
Stored cross-site scripting in the Ultimate Member plugin for WordPress (all versions before 2.13.1) lets unauthenticated attackers - per the supplied CVSS vector, PR:N - register an account, set a crafted profile name, and plant JavaScript that executes in the browser of any visitor who opens that profile, including a logged-in administrator (UI:R). The root cause is a two-part failure: the plugin does not escape the profile-name-derived value before writing it into the page title, and it decodes HTML entities after its own sanitisation has already run, so the payload survives filtering. Publicly available exploit code exists, a vendor patch is available as 2.13.1, and the assessed confidentiality and integrity impact is high, which is why this reads as a genuine priority rather than a high-CVSS-but-low-risk paper cut.
Unauthenticated REST API abuse in the Master Blocks WordPress plugin (versions 1.4.1 up to but not including 1.5.0) lets any network attacker silently rewrite the plugin's settings, because one of its REST routes is registered without an authorization or permission callback. One of those attacker-controllable settings is later emitted unescaped in the WordPress admin area, so the injected value becomes stored XSS that executes in the browser session of any administrator who visits an affected wp-admin page. Publicly available exploit code exists, and there is no confirmed active exploitation (CISA KEV) at time of analysis; the independent assessment raises the scope to Changed (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, vendor score 8.8), reflecting that the impact escapes the plugin and lands inside the administrator's WordPress session.
Malformed UTF-16 decoding in libexpat through 2.8.4 lets remote attackers hide XML markup from the parser: a lone high surrogate paired with the following code unit is accepted as a valid surrogate pair, so a character such as '<' is consumed as part of the pair and never tokenized. Only applications that parse UTF-16-encoded XML (little- or big-endian) from an untrusted source are affected - the dominant UTF-8 input path is not exploitable - and meaningful integrity impact additionally requires a downstream filter, sanitizer, or validator that trusts the parsed structure and therefore sees different markup than Expat exposes. No public exploit has been identified at time of analysis; an upstream fix is available in the Expat repository (PR #1282, commit ff6e1d7e750bbe245178f51a47a965dc8342861a), reported via VulnCheck.
SQL injection in the VikRentItems Flexible Rental Management System WordPress plugin lets unauthenticated remote attackers pass crafted parameters into backend SQL statements, extracting database contents such as user credentials and booking records. All plugin versions below 1.2.4 are affected, and publicly available exploit code exists. The impact is confidentiality-only at high severity (assessed CVSS 8.6, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), and the practical risk is bounded by the plugin's narrow install base rather than by any technical precondition, since no authentication or user interaction is needed.
Cross-namespace data disclosure in Argo Workflows 4.1.0 through 4.1.3 lets an authenticated user who holds only namespace-scoped 'list' permission on archived workflows bypass the cluster-scoped access review and read archived workflows from every other namespace they were never granted access to. The bypass is triggered by supplying a negated metadata.namespace field selector (e.g. 'metadata.namespace!=<own-namespace>') to ListArchivedWorkflows; the server validates the caller's SelfSubjectAccessReview against the caller's own namespace instead of evaluating the request as a cluster-wide list, so the negated selector silently widens the result set. Exposed data includes workflow spec arguments, parameter values, and annotations, which frequently carry secrets, registry credentials, and internal endpoint details; the impact is confidentiality-only and is most severe in genuinely multi-tenant clusters where namespaces are treated as trust boundaries. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis, and the vendor has released a fixed version, so this is a substantiated but not mass-exploitation risk.
Account takeover of any user of the UsersWP WordPress plugin - administrators included - is possible on sites running versions before 1.5.10 when social login is enabled, because the plugin resolves an incoming social-login session to an existing local account using the email address asserted by the provider without first confirming that the provider actually verified ownership of that address. The flaw is remotely reachable without authentication (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, 8.1, CWE-269) and publicly available exploit code exists, so an attacker who registers at a lax or attacker-controlled provider can assert a victim's email and be logged into that victim's account. Exploitation carries the elevated complexity reflected in the AC:H rating: social login must be configured and enabled with at least one provider that permits assertion of an unverified address, and the attacker must already know the target's registered email. This is a genuinely high-priority vulnerability, not a high-CVSS-but-low-risk paper cut, since successful exploitation yields full account control including administrative takeover of the site.
Missing authorization in the Unbounce Landing Pages WordPress plugin (version 1.1.1 through versions before 1.1.5) lets any authenticated user, including a subscriber-level account, rewrite the target host of the plugin's front-end proxy and cause attacker-controlled content to be served from the victim site's own origin. Publicly available exploit code exists, and the plugin is patched in 1.1.5, but no CISA KEV entry was identified at time of analysis. The vendor's CVSS score of 8.0 is slightly generous: exploitation requires a valid low-privileged login (practical where self-registration is enabled) and, for the most damaging outcomes, a visitor or administrator must load the poisoned proxied path, which is why our independent assessment lowers availability impact to None while keeping confidentiality and integrity at High.
Unauthenticated, network-reachable attackers can read the WooCommerce API consumer key and secret stored by the MgoSync WordPress plugin in any version before 2.1.7, because one of its REST API endpoints performs no authorization check (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Exploitation is trivial and publicly available exploit code exists, though the leak only yields credentials on sites that have completed the MgoSync WooCommerce credential setup; from there, read/write access to the connected store's REST API further depends on that API being reachable and the leaked key retaining its original scope. The vendor has released 2.1.7, and because the exposed key is read/write, credential rotation - not patching alone - is required to close the exposure.
Privilege escalation in the WordPress plugin WP Import Export Lite before version 3.9.35 lets an authenticated user who holds only the delegated import permission create new administrator accounts and overwrite the credentials and roles of existing accounts, including administrators, because the import routine never verifies user-management capabilities. The flaw is only exploitable on sites that actually delegate the import capability to a non-administrator role; default WordPress installations that restrict imports to administrators gain nothing from it. Publicly available exploit code exists, no confirmed active exploitation (CISA KEV) has been reported, and the vendor has released a fixed version.
Path traversal in QloApps through 1.7.0 lets an authenticated back-office user read arbitrary files from the web server by supplying directory-traversal sequences in the 'email' parameter of the getEmailHTML action in admin/ajax.php. Because the vulnerable code passes an attacker-controlled path to file_get_contents without verifying it stays inside the mail template directory, stolen files can include configuration and database-credential material, giving a limited-privilege admin user read access to data far beyond their intended scope. Publicly available exploit code exists (a detailed write-up is referenced), but there is no evidence of confirmed active exploitation in the wild; the vendor fix is available upstream as PR #1719 / commit 8015495c, so exposure is realistically limited to unpatched installations.
Reflected cross-site scripting in the WordPress plugin Estatik Real Estate Plugin (versions 4.0.1 through 4.3.4) lets remote attackers inject arbitrary script into an unauthenticated AJAX response by supplying crafted values in a request parameter that the plugin decodes and reflects without sanitisation or escaping. No authentication is required to reach the vulnerable endpoint, but the victim must be induced to open an attacker-controlled link (UI:R), so the practical risk is highest when a logged-in administrator is lured into clicking, granting script execution in their session context. Publicly available exploit code exists and the vendor has shipped a fix in 4.3.5; the vendor vector scores 7.1 High, while our own assessment places impact at C:L/I:L/A:N.
Unauthenticated arbitrary file upload in the Ultra Addons for Contact Form 7 WordPress plugin (versions 3.2.4 through before 3.5.51) lets a remote attacker place a file with an attacker-chosen name and extension at a predictable public path inside the WordPress site. On hosts running the default Debian/Ubuntu Apache PHP package configuration, where .phar is mapped to the PHP handler alongside .php and .phtml, that uploaded file is interpreted and the issue escalates to remote code execution and full site takeover; on hosts that route only .php to PHP, the file is served inert from the site's own origin, degrading the outcome to stored cross-site scripting. No authentication, user interaction, or special access is required (our assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), publicly available exploit code exists, and the RCE path is immediate on affected Apache/mod_php stacks - which is why our independent assessment rates real-world severity above the vendor-assigned CVSS 6.5.
Unauthenticated attackers can publish arbitrary persisted query documents and claim (squat) query aliases on WordPress sites running the WPGraphQL Smart Cache plugin before 2.3.2, because the plugin neither requires authorization for the storage request nor validates the caller-supplied query identifier. WPScan reports that publicly available exploit code exists, though there is no confirmed active exploitation (not in CISA KEV); scoring is CVSS 3.1 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) and the independent assessment characterizes this as a moderate, integrity-focused risk. Practical impact is bounded by whether the site actually depends on persisted queries and aliases and by a first-claim race - the attacker must register an alias before the site's own frontend does - and WPGraphQL's own access controls still govern what any stored query can return, so confidentiality loss is not demonstrated.
Arbitrary file deletion in the WordPress plugin JetFormBuilder - Dynamic Blocks Form Builder (versions 3.5.6.2 through before 3.6.5.3) allows a user who can create or manage forms to point a custom field-validation callback at a PHP file-deletion function that the plugin's blocklist fails to exclude, and the deletion is then executed when the form is submitted. The weaponization step is gated behind form-management privileges (CVSS PR:H - typically an administrator or a delegated form-editor role), while the destructive submission itself requires no authentication; publicly available exploit code exists, though there is no confirmed active exploitation (CISA KEV). With a CVSS base score of 5.5 and impact limited to integrity and availability (C:N/I:L/A:L, S:C), this is a moderate-priority issue rather than a critical one, and risk is materially lower on sites that do not delegate form-management capability to untrusted users.
Object-level authorization failures in the Hydra Booking - Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 let any user holding the plugin's administrator-assigned host-management custom role read, modify, and permanently delete other hosts' records along with the linked WordPress user accounts. The flaw is remotely reachable with low complexity (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N, 5.5) but is gated behind a role that a WordPress administrator must first provision, making this an insider or delegated-privilege abuse scenario rather than an unauthenticated attack; publicly available exploit code exists (WPScan disclosure), though no confirmed active exploitation (CISA KEV) has been reported. The integrity impact is the dominant concern because deletions are irreversible and extend to WordPress user accounts, not just plugin data.
Unauthenticated attackers can mark pending orders as paid in the Rede Itaú for WooCommerce plugin before 5.4.7 by abusing its PIX payment webhook, which fails to verify authenticity before updating order status. The issue affects stores running versions from 3.6.1 up to 5.4.7 with the PIX payment method enabled, requires no authentication or user interaction, and produces integrity-only financial fraud impact rather than code execution or data disclosure. Publicly available exploit code exists, and exploitation is straightforward once a pending order and reachable webhook are present; the vendor-released fix is version 5.4.7.
Unauthenticated remote attackers can reach administrator-oriented REST API routes in the Mailchimp for WooCommerce WordPress plugin before 6.1.1 because the permission callback does not verify the requesting user's capability, allowing a persistent state change (CWE-862). Publicly available exploit code exists. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, so the impact is limited to low integrity with no confidentiality or availability effect, but the unauthenticated nature and available exploit code make this a real, actionable priority driven more by exploitability signals than by raw severity.
Unauthenticated attackers can execute arbitrary WordPress shortcodes through the Forminator Forms plugin (all versions up to and including 1.57.2) because a value reaching do_shortcode in the quizzes front-action handler is not properly validated. A site is only reachable through this path if Forminator is installed and active and a form or quiz routes through the vulnerable front-action, and the real-world damage is bounded by which shortcodes other installed plugins register - benign shortcodes mean limited impact, while data- or state-changing shortcodes raise it substantially. No public exploit code or confirmed in-the-wild activity (CISA KEV) was identified at time of analysis; note that the vendor-assigned CVSS 9.1 overstates the assessed impact, which our analysis places at CVSS 6.5 (C:L/I:L) for fully remote, unauthenticated, low-complexity exploitation.
Shortcode injection in the WP Recipe Maker plugin for WordPress (all versions up to and including 10.8.1) lets an attacker plant arbitrary registered shortcode tokens inside the content of an approved wprm-comment-rating comment, which the plugin later feeds through do_shortcode() during recipe metadata generation and reflects into the JSON-LD reviewBody field served on every recipe page render. Because execution occurs before the plugin's strip_shortcodes()/wp_strip_all_tags() cleanup runs on the resulting string, output from sensitive shortcodes (attachment captions, private post fields, other data exposed by installed shortcodes) can be disclosed to any visitor loading the affected page. The CVSS vector records PR:N, so the injection itself is unauthenticated, but practical exploitation is gated by the site's comment-approval threshold and by whether installed shortcodes actually expose sensitive content; the vendor score of 9.1 is assessed as inflated relative to an AC:H/I:L reality, and no public exploit code has been identified at time of analysis.
Arbitrary PHP function invocation in the Save as PDF Plugin by PDFCrowd for WordPress (all versions up to and including 4.6.1) allows any authenticated user with Contributor-level access or higher to have the server AES-encrypt an attacker-chosen pdf_created_callback value into a valid button blob, which is later passed to PHP as a callable when any unauthenticated visitor POSTs that blob to the wp_ajax_nopriv_save_as_pdf_pdfcrowd AJAX endpoint. Published CVSS 3.1 is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); our assessment retains the High rating but bounds the impact to C:H/I:L/A:L because the invoked callback receives only the plugin's options array as its single, fixed argument, making disclosure of the site's stored PDFCrowd API key and username the most reliable outcome rather than fully attacker-controlled code execution. Contributors are required only to mint the blob - the trigger replay is unauthenticated - and no public exploit identified at time of analysis, with no confirmed actively exploited (CISA KEV) status.
Unauthenticated visitors to WordPress sites running the Online Scheduling and Appointment Booking System plugin (versions 28.1 through before 28.2) can read other visitors' AI booking-assistant messages and inject new messages into their in-progress conversations, because the plugin's unauthenticated conversation actions never verify that the requester owns the conversation ID being referenced. Rated CVSS 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) under CWE-639, the practical risk hinges on how conversation identifiers are generated: if they are sequential or guessable the flaw is broadly automatable, but if they are opaque tokens exploitation is opportunistic and low-volume, which is why the base score is only moderately elevated. Publicly available exploit code exists and the issue was reported by WPScan, though there is no evidence of confirmed active exploitation (CISA KEV) at time of analysis. There is no availability impact and no path to site takeover described; exposure is limited to the confidentiality and integrity of other visitors' assistant conversations.
Authenticated users who hold the Hydra Booking 'host' role on a WordPress site can modify other hosts' profile data and reassign ownership of another host's record to themselves, because the plugin (versions 1.1.0 through before 1.2.3) does not verify that the host record being modified belongs to the requester. Publicly available exploit code exists, but there is no CISA KEV entry indicating active exploitation. The issue is a horizontal privilege-abuse/IDOR flaw rated CVSS 4.7 (MEDIUM) under the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - the attacker must already possess host-level access and gains only limited, cross-host read/write capability, not administrative or site-wide control.
Remote code execution in Mistral Vibe before 2.25.5 allows an attacker to run arbitrary shell commands with the privileges of the user running the tool, because worktree creation executes a repository's own git hooks - notably the post-checkout hook and the fsmonitor command - before any workspace trust validation takes place. The attack requires the victim to deliberately open, clone, or check out an attacker-controlled repository (user interaction is mandatory, and the request itself is unauthenticated per the CVSS PR:N vector), and code execution is bounded by the permissions of the Vibe user, with no privilege escalation or server-side attack surface. There is no public exploit identified at time of analysis and the flaw is not confirmed as actively exploited; a vendor-released patch in 2.25.5 addresses the ordering bug.
Missing authorization in the Nimble Page Builder WordPress plugin through 3.3.8 lets an authenticated user with only Subscriber-level access read the page-builder content of arbitrary non-public posts and pages, including drafts, pending, private and scheduled items. The plugin's authenticated AJAX action returns stored page-builder content without verifying that the requester is allowed to edit the target post, so an attacker can enumerate post IDs and exfiltrate unpublished content; publicly available exploit code exists and the WPScan disclosure serves as the entry point, though the issue has not been reported as actively exploited in CISA KEV. Impact is confined to information disclosure (CVSS 3.1 4.3, C:L only, PR:L, no integrity or availability effect), and sites that allow open user registration effectively lower the bar to any remote registrant.
Authenticated users with subscriber-level access or higher can execute arbitrary WordPress shortcodes through the ProfilePress plugin (slug wp-user-avatar) in all versions up to and including 4.17.2, because user-controlled values reach do_shortcode() without validation. Exploitation requires a low-privilege account, which is trivially obtained on sites that enable the plugin's self-service registration feature, and no user interaction is needed; however, the practical impact is variable and often limited, since substantial confidentiality or integrity loss only materializes when other privileged or data-exposing shortcodes are registered on the same site. The vendor's upstream severity rating is 8.1, while independent assessment rates the realistic vector as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N (limited C/I, no availability impact); no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Authenticated users holding the plugin's booking-provider role on WordPress sites running Hydra Booking - Appointment Scheduling & Booking Calendar before 1.2.2 can cancel and permanently delete bookings belonging to other providers, because two booking endpoints act on a supplied booking identifier without confirming that the booking belongs to the requesting user. The issue is a classic insecure direct object reference (CWE-639) and is only meaningful on installations that host multiple providers, so single-provider sites gain no adversarial advantage. Publicly available exploit code exists, but no active exploitation has been confirmed (no CISA KEV listing), and the practical risk remains low: the attacker must already hold a legitimate provider account and the outcome is limited to integrity (cancel/modify) and availability (deletion) impact on booking records, with no confidentiality exposure.
Unauthenticated visitors to WordPress sites running the Secure Custom Fields plugin before 6.9.4 can submit data against a registered form other than the one that was actually rendered to them, overwriting the title and content of the post that the abused form is bound to. The vulnerability is only reachable where SCF's front-end form-submission feature is actively deployed and rendered publicly, and successful exploitation requires the attacker to enumerate a second registered form plus its bound post, which is why the assessed CVSS is a modest 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - integrity-only, low impact). Publicly available exploit code exists (the WPScan entry is tagged as an exploit reference), but there is no KEV confirmation of active exploitation; the vendor has released a fix in Secure Custom Fields 6.9.4, so the practical priority is patching sites that use front-end forms rather than emergency response.
Remote code execution in WP Photo Album Plus affects all versions through the wppa_image_magick path, allowing authenticated attackers with subscriber-level access and above to run server-side code when the site uses ImageMagick processing. The issue is argument injection into an ImageMagick command executed via PHP exec(), enabled by insufficient sanitization of the multipart upload filename and reliance on escapeshellcmd() instead of proper argument quoting. Exploitation requires ImageMagick to be available and the plugin to route uploads through ImageMagick rather than GD, and no public exploit was identified at time of analysis; CVSS 3.1 base score is 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Unauthenticated information disclosure in the YS LeadGen plugin for WordPress (all versions up to and including 2.1.4) lets any remote attacker dump the entire store of captured lead-form submissions by simply invoking the plugin's AJAX action, exposing names, email addresses, and message content of every visitor who filled out a form. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack is remote, unauthenticated, and requires no user interaction, and our independent assessment rates it a genuine high-priority issue rather than a high-score-but-low-real-risk case, because the exposed data is directly monetizable PII and the only practical limiter is how much data a given site has collected - not any defensive barrier. No public exploit code and no active exploitation have been identified at time of analysis, but the barrier to abuse is trivially low for anyone able to reach the site.
Information disclosure in Exim before 4.100.1 allows attackers who control or can impersonate a proxy in the configured proxy_protocol_hosts set to read uninitialized stack memory when PROXY Protocol is enabled, but only in non-default deployments and with limited confidentiality impact. This is a conditional flaw requiring attacker control of a trusted proxy; stock Exim installations without Proxy-Protocol are unaffected. No public exploit code or evidence of active exploitation was identified at time of analysis.
Formatting an attacker-supplied POD document with Pod::Text (part of the podlators distribution) before version 6.1.1 drives the formatter into a non-terminating loop that exhausts CPU and memory, allowing a remote unauthenticated attacker who controls the POD content to deny service to any application or service that renders untrusted POD. The trigger is a document with deeply nested =over directives whose cumulative indentation makes the wrapping margin greater than or equal to the configured output width, so that wrap() has zero or negative space for text, matches the empty string in its line-splitting substitution, and appends padding forever without consuming input. Exploitation status is limited: no public exploit code was identified at time of analysis, CISA SSVC records exploitation as none, and EPSS is low at 0.21% (11th percentile), so this is a genuine but modest-priority availability issue whose real-world risk is concentrated on services that render untrusted POD rather than on the ordinary local pod2text/perldoc workflow.
Stored cross-site scripting in the Business Name Generator WordPress plugin through version 1.3 allows an authenticated high-privilege user (administrator) to inject malicious script into the plugin's unsanitised settings fields, which then executes when a second privileged user renders the affected settings page. Publicly available exploit code exists, but exploitation is tightly constrained: it requires high privileges, victim interaction, and a configuration where the unfiltered_html capability is withheld from admins, chiefly WordPress multisite networks, making this a low-priority, high-CVSS-noise-floor issue rather than a genuine threat. No vendor-released patch was identified at time of analysis.
Stored cross-site scripting in the Quill Forms WordPress plugin (Conversational Multi Step Forms, Surveys & Quizzes) through version 5.7.1 lets unauthenticated attackers inject arbitrary JavaScript into a form entry by abusing the free-text 'Other' option of a Multiple Choice block; the script is persisted server-side and executes in the browser of an administrator who later opens the submitted-entries/results view in wp-admin. The vulnerable path is reachable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2 High), with the scope change reflecting execution inside the privileged WordPress admin context rather than the anonymous submission context; the practical limitation is that impact only materializes when a privileged user reviews the affected entry, so administrator-side interaction effectively gates execution even though the vector scores UI:N. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so there is no confirmation of active exploitation.
Stored cross-site scripting in the WordPress plugin Asset CleanUp: Page Speed Booster (all versions through 1.4.0.5) lets unauthenticated visitors inject arbitrary script through comment content, which then executes in the browser of any user who subsequently loads the affected page. The flaw is gated by a non-default configuration: the combine_loaded_css CSS-combining optimization must be explicitly enabled, and the site must accept comments, so most default installs are not exposed; the independent assessment rates exploitation complexity as High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) with impact confined to client-side script execution rather than server compromise. No public exploit code or confirmed active exploitation has been identified at time of analysis, and no EPSS or KEV signal is present in the provided intelligence.
Arbitrary file write via path traversal in Gopeed (through 2.0.0-beta.3) allows a crafted archive to drop files anywhere on the filesystem of the machine running the downloader. An unauthenticated remote attacker can deliver the malicious archive, but exploitation only occurs when the victim has AutoExtract enabled and downloads and extracts the file, which is why the vendor vector carries UI:A and scores 7.0 (High); integrity and availability are both rated High while confidentiality is not directly impacted. No public exploit code and no CISA KEV entry were identified at time of analysis, and an upstream fix commit has been published, though a tagged patched release has not been independently confirmed.
Authentication bypass in the OpenPanel tracking API allows unauthenticated remote attackers to inject forged revenue metrics and evade bot-detection filters by supplying arbitrary dummy secrets-only a public client ID, intentionally exposed in the client-side tracking snippet, is required. Affected versions extend through commit bad75bddc74d12d36cfb843f4531d3b830a8d994; the flaw is a moderate-severity integrity issue (CVSS 3.1 I:L) with no public exploit identified at time of analysis.
Local file disclosure in Calculator Lock for Android allows a local actor with shared external storage access, such as an authorized non-root ADB shell or a co-resident file-reading app, to copy the vault's SQLite database and media files without entering the calculator passcode. The published CVSS is 6.8, and the independent assessment (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms high confidentiality impact with no integrity or availability impact; the passcode still gates the in-app UI. The independent assessment classifies this as a genuine but low-urgency local issue, and no public exploit identified at time of analysis.
Privilege escalation in the Keycloak Admin REST API allows an already-authenticated delegated administrator to add their own account to a group that carries administrative role mappings, turning scoped, fine-grained management rights into effective control of the entire realm. The group-membership endpoints do not verify whether the target group grants privileged roles (CWE-862, Missing Authorization), so the escalation is a single API call away for anyone holding manage-users or equivalent group-scoped permissions. Reachability is limited: anonymous users and ordinary end-users cannot trigger it, a high-privilege group must already exist in the same realm, and deployments that only use a single super-admin gain nothing new because those actors are already fully privileged. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV. Affected builds include Red Hat Build of Keycloak and Red Hat Single Sign-On 7.
Authorization bypass in the Better Messages - Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress (all versions up to and including 2.15.33) allows authenticated users with custom-level access or above to retrieve the full message transcript, thread metadata and participant user data of chat-room threads they are not members of. The root cause is a missing authorization check (CWE-862) on the plugin's REST endpoints, and exploitation is further gated on a target room's only_joined_can_read setting retaining its default value of '0' - rooms reconfigured to '1' are not affected. Rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N, confidentiality-only impact), this is a real but moderate-priority confidentiality issue rather than a critical emergency; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV.
Authenticated SQL injection in the Custom Field Template plugin for WordPress, affecting all versions up to and including 2.7.8, lets any Contributor-level user inject arbitrary SQL through the unsanitized 'post_ID' parameter and read the entire site database, including password hashes, private post content, and secrets stored by other plugins. The plugin's current_user_can('edit_post', $id) guard does not stop the attack because WordPress casts the identifier to an integer for the permission decision while the original unsanitized string continues to the SQL sink, and the accompanying nonce is legitimately obtainable by any Contributor from the post edit screen. Risk is concentrated on sites with open registration, untrusted or multi-author Contributor accounts; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, with impact limited to confidentiality (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
SQL injection in the Mediavine Create plugin for WordPress (all versions up to and including 2.5.3) allows any authenticated user holding Author-level access, or the publish_posts capability generally, to inject arbitrary SQL through the REST endpoint's 'order_by' parameter and read sensitive data from the site's database. The endpoint's permission callback defaults to publish_posts, so the vulnerable code path is reachable with no extra precondition beyond that role. With a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), impact is limited to confidentiality (database extraction) with no integrity or availability effect, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; no EPSS score was supplied.
Server-side request forgery in the Wow Elements Addons for Elementor WordPress plugin (all versions up to and including 1.11.2) lets an authenticated attacker with Contributor-level access or higher coerce the site's web server into issuing HTTP requests to arbitrary attacker-chosen destinations. The flaw is in the plugin's Changelog widget, which passes the user-controlled 'Changelog File' setting directly into wp_remote_get() with no URL validation or sanitisation, allowing requests to be aimed at internal-only resources such as cloud metadata endpoints or intranet APIs. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; the Contributor authentication prerequisite and the bounded, low-level confidentiality/integrity/availability impact keep this a genuine but moderate-priority issue rather than an emergency patch item.
Any authenticated WordPress user holding contributor-level capabilities or higher can pull the entire customer dataset out of the Easy Appointments plugin (all versions up to and including 3.12.27) because the handle_customers_ajax handler returns ea_customers records without enforcing an adequate capability check. The exposed records contain personally identifiable information such as names, email addresses, mobile numbers, dates of birth, and physical addresses, so the impact is a high-confidentiality, read-only disclosure with no integrity or availability effect, consistent with the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N score of 6.5 (MEDIUM). Exploitation is not possible for unauthenticated visitors - an attacker must first hold a low-privilege account - and no public exploit identified at time of analysis; risk is concentrated on multi-author sites, membership sites, or any installation that hands out contributor accounts or has self-registration mapped to elevated default roles.
Tutor LMS WordPress plugin versions up to 4.0.8 expose arbitrary users' email addresses and Tutor profile phone numbers to any logged-in subscriber-level attacker through an insecure direct object reference in the student_id parameter. This moderate-priority CWE-639 flaw requires only an authenticated account; open registration on LMS/course sites makes that precondition easy to meet, but exploitation is limited to confidentiality of those fields and does not provide credentials, write access, or code execution. No public exploit code or confirmed active exploitation was identified at time of analysis, and our independent assessment rates confidentiality impact as Low under CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.