Delegated administrators in Keycloak can bypass fine-grained reset-password restrictions through the Admin REST API's credential-deletion endpoint, deleting a targeted user's password credentials and locking that user out. The flaw (CWE-862) requires an authenticated, provisioned delegated admin who has user-management access but is specifically not granted the manage-credentials/reset-password permission; it is an insider/delegated-tenant privilege-boundary escalation within the admin's reachable user scope, not unauthenticated exploitation, account takeover, or data disclosure. No public exploit code has been identified at time of analysis, and exploitation depends on Keycloak's fine-grained admin permissions model being deployed.
Authenticated SQL injection in the Mediavine Create plugin for WordPress (all versions up to and including 2.5.3) lets users holding author-level capabilities or higher inject arbitrary SQL through the 'order' parameter and read sensitive data from the site database. The flaw only triggers when the request also supplies one of the advanced-filter parameters (linked_posts, created_after, created_before, missing_fields, post_id, a comma-separated type value, or exclude_type), which narrows but does not eliminate the exposure on multi-author sites. No public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); Wordfence rates the practical risk as moderate given the authenticated, role-gated prerequisites.
Sensitive information disclosure in the Divi Essential WordPress plugin through version 5.8.1 allows any authenticated user holding Subscriber-level access or above to enumerate every table in the site's WordPress database and read a caller-controlled number of rows from each, exposing usernames, emails, hashed passwords, session tokens, secret keys, and plugin-stored API credentials. The flaw is trivially reachable because the dnxte_get_database_tables and dnxte_get_database_data AJAX handlers only perform a nonce check when the 'nonce' POST parameter is supplied - omitting it skips the check entirely - and no current_user_can() capability enforcement exists. Authentication requirements are confirmed as low-privileged (CVSS PR:L) rather than unauthenticated, so the practical attack surface depends on whether the site allows open user self-registration; no public exploit code was identified at time of analysis, and the impact is confidentiality-only with no modification of data or loss of availability.
Stored cross-site scripting in the premium (pro) edition of the WPComplete WordPress plugin, affecting all versions up to and including 2.9.9.0, lets an authenticated user with contributor-level access or above inject arbitrary script into the 'empty' shortcode attribute; the payload persists in page content and executes in the browser of anyone who later views that page. The free version of the plugin is not affected, and exploitation requires the paid edition to be installed and active, which materially narrows the exposed population. There is no public exploit code identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing); this is assessed as a moderate, not urgent, priority given the pro-only scope and the prerequisite of an authenticated contributor account.
Stored cross-site scripting in the Redux Framework WordPress plugin affects versions up to and including 4.5.13, allowing an authenticated attacker with subscriber-level access or higher to persist arbitrary script into Media field filter values that execute when another user later loads the affected page. The flaw arises from insufficient sanitization of nested array values in user_meta_save() combined with unescaped output of filter CSS values in render(), yielding a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); the mandatory low-privilege account and the need for a higher-privileged victim to view the injected content are the primary exploitation constraints.
Stored cross-site scripting in the Redux Framework plugin for WordPress through version 4.5.13 lets an authenticated attacker with subscriber-level access or above persist arbitrary JavaScript into user meta via the spinner field, which is later emitted into an unquoted HTML attribute and executed in the browser of any user who views the affected page. Exploitation requires a low-privileged account (PR:L) plus a second user - typically an administrator or profile viewer - loading the injected content, so sites with open or self-registration enabled are at the greatest risk while sites that disable registration or have moved to 4.5.14+ are not exposed. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing).
Stored cross-site scripting in WP Composer - The Easiest Page Builder (Ghozylab) affects every release up to and including 1.0.5: the pbwp_raw_shortcode handler Base64-decodes its content and echoes it into the page without sanitization or escaping, so an attacker who can author content through the plugin can persist a script that runs in the browser of anyone who later views the page. Exploitation requires an authenticated account with Contributor-level capability or above (PR:L in the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N vector), and because the payload is Base64-encoded it contains no raw HTML characters at save time and therefore slips past WordPress's KSES content filtering - execution is deferred until a victim, ideally a higher-privileged editor or administrator, opens the injected page. Impact is limited to client-side script execution within the site origin (low confidentiality and integrity, no availability loss, no server-side compromise); no public exploit code or CISA KEV listing was identified at time of analysis, and consistent with the independent assessment this is a moderate, not urgent, priority.
Authenticated stored cross-site scripting (XSS) in the YS LeadGen WordPress plugin, versions up to and including 2.1.4, allows attackers with Subscriber-level access or higher to bypass authorization checks on AJAX popup-management endpoints and inject arbitrary JavaScript through created popups. The missing capability checks in app/Controllers/Ajax.php enable low-privileged users to create popups containing malicious script, which executes when a victim (such as an administrator or site visitor) views the popup. No public exploit code has been identified at time of analysis, and the CVSS score is 6.4 (medium).
Stored cross-site scripting in the Gum Addon for Elementor WordPress plugin (all versions up to and including 1.3.15) allows authenticated users with contributor-level access or higher to inject arbitrary JavaScript via the 'pop_tag' parameter of the popover button widget, which then executes in the browser of any user - including administrators - who views the affected page. The prerequisite is a valid low-privilege account plus an active, widget-enabled installation, so risk is concentrated on multi-author sites or blogs that permit open contributor registration; no public exploit code has been identified at time of analysis, and CVSS 3.1 scores the issue 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting limited confidentiality and integrity impact but a scope change because the payload crosses from the authoring context into other users' sessions.
Stored cross-site scripting in the AppMySite - WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) plugin, in all versions up to and including 3.15.3, lets any authenticated user with Subscriber-level access or above persist arbitrary JavaScript by invoking the plugin's save_ams_license_key AJAX handler, which enforces neither a capability check nor a nonce check. The injected script later runs in the browser of a higher-privileged user who loads the plugin's AMS home admin page, allowing the attacker to act in that user's session context. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) and no public exploit code was identified at time of analysis; this is a genuine but moderate authenticated stored XSS whose meaningful escalation depends on an administrator viewing the poisoned page.
Stored cross-site scripting in the Real3D Flipbook Lite WordPress plugin (versions up to and including 5.1.1) allows authenticated attackers holding Contributor-level access or higher to inject arbitrary JavaScript into pages via the 'lightboxtext' shortcode attribute and other attributes processed by on_shortcode(). The payload is persisted through the normal WordPress save path and renders inside a <script type="application/json"> block emitted by wp_json_encode() without the JSON_HEX_TAG flag, so a crafted value can break out of the JSON context and execute when a privileged user (typically an Editor or Administrator previewing or moderating the pending post) views the affected page. Successful exploitation therefore depends on a higher-privileged user opening the injected content, which is a meaningful precondition; no public exploit code has been identified at time of analysis, and there is no evidence of confirmed active exploitation (no CISA KEV listing).
Chunked-response smuggling in the Elixir Mint HTTP client (0.1.0 through 1.10.0) allows a malicious or compromised HTTP/1 origin to desynchronize an RFC-9112-strict intermediary from Mint on a shared, pooled connection, poisoning the response queue so that later requests reusing that socket receive another request's or attacker-chosen response content. Mint's chunk-size parser accepts trailing junk after the hex size (for example '5ZZZZZ', '5 9', or '0ZZZZ') while strict proxies reject it, so the two disagree on chunk boundaries and on where the message ends. Exploitation is unauthenticated (PR:N) but conditional and non-trivial: it requires a pooled connection to an attacker-influenced origin plus a strict intermediary in the path; impact is limited to confidentiality and integrity of responses on the poisoned connection (VC:L/VI:L), with no availability or code-execution effect, and no public exploit code has been identified at time of analysis. Note that upstream tag metadata for this CVE includes 'RCE'; that label is not supported by the assessed vector or impact and should not be used for prioritization.
An authenticated low-privilege user of the Grimmory (BookLore) self-hosted library service can read book files belonging to other accounts by tampering with the bookId argument passed to the Kobo download endpoint handled by KoboController.streamFileToResponse, an IDOR-style authorization bypass (CWE-639) rated CVSS 5.3 with confidentiality-only impact. Publicly available exploit code exists, and although upstream issue #2431 is closed as completed, its only comment states the report 'has already been reported elsewhere' with no fixing commit or pull request identified there. No KEV listing or independent evidence of active exploitation was found, so real-world risk depends on whether the instance is network-reachable to an attacker who already holds valid credentials and whether the Kobo download feature is exposed.
An incorrect authorization check in Grimmory (grimmory-tools/grimmory, published as BookLore) up to versions 3.3.3 and 3.4.1 lets any authenticated low-privilege account read admin-scoped application settings through the Settings API endpoint GET /api/v1/settings, because AppSettingController.getAppSettings returned the full settings map without filtering entries by the caller's PermissionType (ADMIN / MANAGE_METADATA_CONFIG). The exposure is configuration data - integration flags, OIDC session/group-sync settings, Kobo/Komga/OPDS toggles and metadata-provider configuration - not credentials or write access; the case is assessed at low severity (CVSS 4.0 base 2.1; independent CVSS 3.1 assessment AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) and no KEV exploitation is recorded. Publicly available exploit code exists (referenced GitHub issue 2430) and the issue is rated low real-world risk despite the 'Authentication Bypass' tag, since the attacker must already hold a valid account and only gains read access to settings.
Reflected cross-site scripting in the WP Customer Reviews plugin for WordPress (vendor: bompus) affects every release up to and including 3.7.8, allowing an unauthenticated attacker to inject arbitrary script into the review form through the 'wpcr3_fname' parameter. Exploitation is not automatic: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1 Medium) requires the victim to click an attacker-supplied link, and the injected code then runs only in that victim's browser session with limited confidentiality and integrity impact. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis; EPSS data was not provided, so real-world exploitation likelihood should be treated as low-to-moderate, driven by social engineering rather than mass scanning. Wordfence reported the issue and upstream code changes are visible in the plugin's Trac repository.
Reflected cross-site scripting in the MC4WP: Mailchimp for WordPress plugin through version 4.14.0 lets remote attackers inject arbitrary JavaScript into pages that render the plugin's 'data' dynamic content tag, executing in the browser of any user persuaded to click a crafted link. The weakness is insufficient input sanitization and output escaping in the plugin's dynamic-content and form-tag handling, rated CVSS 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N); exploitation is unauthenticated but requires user interaction and a page or form that actually uses the affected tag, so there is no unattended mass-exploitation path. Vendor-released patch: 4.14.1. No public exploit code and no confirmed active exploitation were identified at time of analysis; the issue is real but bounded.
Reflected cross-site scripting in the Pochipp plugin for WordPress (versions up to and including 1.20.2) lets unauthenticated attackers inject arbitrary script that executes in the browser of a logged-in user who holds the upload_files capability, i.e. an Author, Editor, or Administrator. The flaw is reachable through the plugin's media-upload search path, and exploitation depends on the attacker luring that privileged victim into clicking a crafted /wp-admin/media-upload link, so each victim must be individually tricked and the injected script never persists. Wordfence scores the issue 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), no public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical impact is limited by the required user interaction and the privileged-victim prerequisite.
Reflected cross-site scripting in the Tutor LMS WordPress plugin (all versions up to and including 4.0.8) lets unauthenticated attackers craft links whose 'search' parameter injects arbitrary JavaScript into the victim's browser when the dashboard or account search flow is rendered. Exploitation requires the victim to click the crafted link (CVSS 3.1 base 6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), so the payload never self-triggers, and no public exploit code or confirmed active exploitation was identified at time of analysis. Although any site visitor can be targeted, the practical payoff is highest when an authenticated or privileged user such as an instructor, administrator, or student is lured into clicking, because the script then executes inside that user's session context and can act on their behalf within the WordPress site.
Reflected cross-site scripting in the SSL Zen - SSL Certificate Installer & HTTPS Redirects WordPress plugin (all versions up to and including 4.7.42) lets unauthenticated attackers inject arbitrary script into a page via the 'host' parameter, but only while the plugin is in its transient 'system_requirements' setup-wizard stage and only if a victim clicks an attacker-supplied link. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) no authentication is needed, yet execution depends on user interaction - typically an administrator working through the setup wizard - and the script runs in the context of the affected site, potentially enabling session or credential theft and admin-side actions. Exploitation is confined to that narrow configuration state; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so the raw 6.1 score overstates practical risk in most deployments.
Stored cross-site scripting in the PHP-FTS full-text search library (olivier-ls/php-fts) through version 1.1.2 lets an attacker who can introduce content into the search index inject markup that executes in a victim's browser when the application renders the returned search highlights as HTML. The flaw sits in SearchEngine::buildHighlights in src/SearchEngine.php, which concatenates stored field text with opening and closing highlight tags without escaping it; per the vendor's own CVSS:4.0 vector the attacker is an authenticated remote user (PR:L) and exploitation requires the victim to interact (UI:P), with impact limited to manipulated content (VI:L) and no confidentiality or availability loss. The vendor shipped a fix in 1.1.3 (commit 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3) and publicly available exploit code exists for this issue, but there is no indication of confirmed active exploitation in the wild.
Unauthenticated information disclosure in the WordLift - AI powered SEO - Schema plugin for WordPress affects all versions up to and including 3.54.10, allowing remote attackers with no credentials to harvest the title, body content, author, publication and modification dates, word count, comment count, and other metadata of private, draft, and pending posts. The flaw stems from the plugin's /wordlift/v1/jsonld/ REST routes being registered with a permission_callback of '__return_true', combined with a downstream JSON-LD converter that calls get_post() without validating post status or the caller's capabilities, so sequential post-ID enumeration bypasses WordPress core access controls. No public exploit code was identified at time of analysis and the vulnerability is not reported as actively exploited; the CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects a confidentiality-only, low-complexity disclosure with no integrity or availability impact.
Unauthenticated information disclosure in the Bread WordPress plugin (versions up to and including 2.9.12) lets any remote visitor read the plugin's entire configuration export, including the PDF protection password stored in plaintext, by simply requesting the /?export-meeting-list=1 endpoint. The flaw is trivially reachable: the download_settings function is registered on the plugins_loaded hook and explicitly permits execution on non-admin public pages, so no authentication, authorization, or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U, base 5.3 MEDIUM). Impact is bounded to disclosure of the stored protection_password rather than site credentials or code execution, and no public exploit code has been identified at time of analysis; the practical risk depends on how sensitive the protected PDF meeting lists and their shared password are in a given deployment.
Unauthenticated attackers can impersonate the Better Messages plugin's own internal AI bot accounts on WordPress sites running versions up to and including 2.15.33, gaining entry to administrator-restricted chat rooms and reading the private message history of other users. The flaw is entirely pre-authentication (CVSS vector PR:N/UI:N) and requires only that unauthenticated guest registration is enabled and that the server forwards the client-supplied X-Real-IP header to the plugin, which stores it verbatim; the plugin's is_ai_bot_user() check then prefix-matches the attacker-chosen value against 'ai-chat-bot-'. No public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation, but the low complexity and lack of any credential requirement make the issue straightforward to abuse where restricted rooms exist. The vendor-assigned score is 5.3 (Medium, C:L/I:N); our reassessment raises confidentiality to High and adds a Low integrity impact because the same bypass allows posting into restricted rooms, netting a materially higher severity than the published vector implies.
A use-after-free memory-safety flaw in Exim before 4.100.1 can crash the mail transfer agent process when the daemon is compiled against the GnuTLS TLS backend and configured with certain non-default TLS settings; once a vulnerable server is reachable over the network, no authentication (PR:N) or user interaction (UI:N) is required, but the CVSS vector reflects high attack complexity (AC:H) because the triggering configuration is unusual and non-default. The assessed impact is availability-only (C:N/I:N/A:L) - a crash or degraded service rather than code execution or data exposure. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so practical risk is confined to the narrow subset of Exim deployments using GnuTLS with the specific triggering TLS options.
An out-of-bounds write in Exim versions before 4.100.1 occurs when the MTA is built and configured to use Proxy-Protocol (the hosts_proxy option) and accepts a PROXY header from an attacker-controlled or spoofed proxy, allowing remote memory corruption (CWE-787) with high integrity impact and low confidentiality/availability impact. The flaw is remotely reachable but unauthenticated only in the sense that no credentials are needed (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L, vendor score 7.0); the high attack complexity reflects that Proxy-Protocol is off by default and the attacker must be positioned on, or able to spoof, the trusted-proxy path in front of Exim. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was provided; a fixed release, Exim 4.100.1, exists and is the primary remedy.
The TikTok for Business WordPress plugin (all versions up to and including 1.4.1) fails to verify authorization on its TikTok OAuth token-exchange handler, allowing an unauthenticated remote request to overwrite the merchant's stored TikTok integration access token in the wp_options table and effectively hijack the site's TikTok Business account and product catalog link. Exploitation is heavily constrained: the request must carry a valid TikTok OAuth auth_code issued specifically for that merchant's registered TikTok app, and the plugin only persists the new token after TikTok's API returns message='OK', so forged or arbitrary codes fail. No public exploit code or in-the-wild exploitation has been identified at time of analysis, and the vendor has committed a fix to the plugin's code repository; the impact is integrity-only (C:N/I:L/A:N), which keeps real-world risk low despite the unauthenticated network vector.
Authenticated attackers holding only Subscriber-level access on a WordPress site running the Ibtana - Ecommerce Product Addons plugin (all versions up to and including 0.4.7.7) can update or delete arbitrary post meta entries by invoking the 'iepa_use_gt_editor' AJAX action, which performs no capability check. The impact is limited to integrity - post meta content can be altered or removed, but there is no confidentiality or availability loss, which is why the issue scores 5.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) despite the vendor's PR:N vector; Subscriber authentication is a hard prerequisite. There is no public exploit code identified at time of analysis and the CVE is not listed in CISA KEV, so exploitation requires a valid low-privilege account (trivial on sites with open registration, otherwise an existing user) and the vulnerable plugin version.
Forged Stripe webhook events can be injected into sites running the ThemeHigh "Payment Gateway of Stripe for WooCommerce" plugin through version 5.0.8, allowing unauthenticated remote attackers to manipulate WooCommerce order state - marking unpaid orders as paid or completed, forcing legitimate orders into a failed state, fabricating dispute notices, and pushing forged refund events into the store's records. The flaw only exists in the default post-install configuration, where the eh_stripe_webhook_secret option is empty and the plugin's publicly reachable woocommerce_api_wt_stripe endpoint accepts the raw POST body as a trusted Stripe event without ever calling \Stripe\Webhook::constructEvent(); once an administrator saves any valid signing secret, forged requests are rejected. The integrity-only impact and CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) understate operational risk for stores sitting on the unconfigured default; there is no public exploit code identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing).
Authenticated SQL injection in OpenPanel's ClickHouse-backed metrics and filter functionality lets a user with access to at least one project inject boolean SQL terms through crafted property/filter keys, bypassing project isolation to read analytics metrics belonging to other projects. All deployments of OpenPanel up through commit bad75bdd that expose the ClickHouse metrics/filter feature are affected; the CVSS 4.0 base score is 5.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L), reflecting a bounded, read-only, cross-tenant confidentiality impact rather than code execution or data tampering. At the time of analysis there is no indication of confirmed active exploitation (CISA KEV) and no public exploit code identified; the primary risk drivers are the authentication requirement (PR:L) and the fact that only metrics data can be read, not modified.
SMTP smuggling in Exim before 4.100.1 allows a remote, unauthenticated attacker to desynchronize message boundaries so that a message a receiving system reconstructs does not match any message actually sent, by first provoking a rejection during DATA processing and then delivering crafted follow-on data. The assessed impact is integrity-only (CVSS 4.0, AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N): no confidentiality or availability loss is expected, and successful abuse hinges on high attack complexity and on how downstream mail systems interpret the smuggled end-of-data boundary. The practical payoff is sender spoofing that can bypass SPF, DKIM, or DMARC alignment where other systems trust this Exim host as a relay, so it is a moderate, integrity-focused issue rather than a top priority; no public exploit has been identified at time of analysis.
SQL injection in WP Optimizer up to and including 2.5.0 allows authenticated administrator-level users to inject arbitrary SQL subqueries through the 's' parameter, enabling extraction of sensitive database information via time-based blind techniques. The flaw is rated CVSS 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) and its real-world priority is limited because the attacker must already hold WordPress administrator privileges, which already convey broad database access. No public exploit was identified at time of analysis, and no CISA KEV entry is present.
SQL injection in the GoPay for WooCommerce WordPress plugin (all versions up to and including 1.0.36) lets an attacker who already holds a Shop Manager or higher role inject extra SQL through the 'log_table_filter' parameter handled by the plugin's admin log view, allowing retrieval of sensitive data from the site's database (rated C:H/I:N/A:N, CVSS 4.9, authenticated with PR:H). The vulnerable code sits in an admin-area screen, so unauthenticated or low-privileged users cannot reach the parameter, and the practical threat is limited to insiders, rogue store staff, or sessions of already-compromised privileged accounts. No public exploit code has been identified at time of analysis and there is no evidence of confirmed active exploitation (CISA KEV).
Credential exposure in OpenPanel's Model Context Protocol (MCP) integration causes MCP authentication tokens supplied as URL query parameters to be written verbatim into plaintext application logs, letting anyone who can read application stdout, container/pod logs, or a centralized logging/SIEM store harvest base64-encoded credentials and replay MCP requests for read access to project analytics. The issue is gated by prior read access to the log data (CVSS 4.0 vector AV:L/PR:L; the independent assessment scores it low at CVSS 3.1 with only low confidentiality impact and no integrity or availability effect), so it is a real but low-priority defect rather than a remote unauthenticated path. No public exploit identified at time of analysis, and no confirmed actively exploited (CISA KEV) status is indicated in the provided data.
Reflected cross-site scripting in the LiteSpeed Cache plugin for WordPress in all versions up to and including 7.9 allows unauthenticated attackers to inject arbitrary script into a page that runs in a victim's browser when the victim is induced to click a crafted link or submit a crafted request. The payload must be delivered as a POST body field named 'esi' while the query string simultaneously carries a validly signed 'esi' value, exploiting PHP's $_REQUEST merge order so the POST value wins at execution; this two-part delivery plus the signature requirement raises attack complexity, and successful exploitation requires user interaction. Impact is limited to the client side (low confidentiality and integrity, no availability impact), giving a CVSS 3.1 base score of 4.7; no public exploit code has been identified at time of analysis and the flaw is not in CISA KEV.
Open redirect in the WP Ghost (Hide My WP Ghost) - Security & Firewall plugin for WordPress, affecting all versions up to and including 7.0.02, allows an unauthenticated attacker to bounce a victim to an arbitrary external site by crafting a logout link whose destination the plugin never validates. Exploitation is not hands-off: the attacker must socially engineer a currently logged-in user into clicking the crafted URL, and because the plugin's logout routine invokes wp_logout() before issuing the redirect, the victim is fully and irreversibly logged out as part of the attack chain, though the practical harm remains limited to redirection to a malicious page. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the 4.7 vendor score is consistent with the UI:R social-engineering gate combined with a scope change and low integrity impact.
Path traversal in rclone's Docker volume plugin ('rclone serve docker', versions 1.56.0 through 1.75.0) lets an attacker who can submit a VolumeDriver.Create request to the plugin socket make the privileged rclone process create a directory and mount an attacker-specified remote filesystem at an arbitrary host path. The attacker must already be in a high-privileged, socket-scoped position (PR:H) - normally the Docker daemon itself or, in a multi-tenant orchestration environment, a workload allowed to request named volumes - and no user interaction is required. Impact is bounded to unauthorized directory creation and remote-filesystem mounting over host paths rather than arbitrary code execution, and no public exploit code or confirmed active exploitation was identified at time of analysis; a vendor patch is available in 1.75.1.
Stored cross-site scripting in the WP2Social Auto Publish WordPress plugin (published in the repository as facebook-auto-publish) affects all versions up to and including 2.4.12, allowing an administrator-level user to persist arbitrary JavaScript into plugin admin settings so that it executes in the browser of anyone who later views the injected page. The flaw carries a CVSS v3.1 base score of 4.4 (AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) because it is gated behind high privilege and a non-default deployment posture: it only matters on WordPress multisite installations or on single-site installs where the unfiltered_html capability has been explicitly removed, since a normal single-site administrator already holds unfiltered_html and could inject markup legitimately. No public exploit code and no confirmed active exploitation were identified at time of analysis; this is a genuine but low-priority issue given the required administrative access and the non-default preconditions.
Stored cross-site scripting in the OTP Login & Register Woocommerce plugin for WordPress (versions up to and including 2.7.3) allows authenticated administrators to inject arbitrary web scripts via the 'fb-config' setting. Exploitation is practically limited to multisite installations where site administrators lack the unfiltered_html capability, potentially allowing them to target the network super administrator. No public exploit code has been identified, and the overall real-world risk is assessed as low despite the moderate CVSS score.
Authorization bypass in the Datalogics Ecommerce Delivery plugin for WordPress (all versions up to and including 2.6.65) lets any authenticated subscriber-level user exercise store-owner functions that should require higher privileges: creating and cancelling real shipping orders through the external logistics provider using the store's stored API token, rewriting arbitrary WooCommerce order post meta on any order, overwriting the plugin's own stored API token, and firing shipping-notification emails to customers. The issue is rated CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), so the impact is integrity-only and limited to business-logic abuse rather than code execution. It requires only a low-privilege WordPress account plus a site running WooCommerce with the plugin and a configured logistics API token; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV), though stores with open subscriber registration carry the greatest exposure.
Authenticated users holding only subscriber-level access can permanently delete arbitrary WordPress posts - pages, courses, quizzes, and WooCommerce products - on sites running the Tutor LMS plugin through version 4.0.8. The flaw is an authorization bypass: a lesson-deletion handler reaches wp_delete_post( $id, true ) without verifying the caller has capability over the target post, and the multi-stage exploit chain (create an authored attachment via the profile-photo upload flow, create a Tutor topic reparented to that attachment, then invoke the deletion handler) is required to satisfy the plugin's ownership checks. Wordfence reports it, vendor code changesets are referenced, and no public exploit code or confirmed active exploitation was identified at time of analysis; scored 4.3 by the reporter and assessed by our team as AC:H with moderate-to-low real-world risk, since authentication is mandatory and impact is limited to destructive integrity loss rather than code execution or data exfiltration.
Missing authorization in the Flex Import plugin for WordPress (all versions up to and including 3.0) allows any authenticated user with subscriber-level access or above to invoke the license_activate_fleximp and license_deactivate_fleximp AJAX handlers, which perform neither a current_user_can() capability check nor validation of the 'wpnonce' value the client-side script supplies. A low-privileged attacker can persist an arbitrary or fraudulent license key, flipping the plugin's validation, suspension, and bundle status options, or delete the site's legitimate key and set fleximp_validation_status to false, disrupting the plugin's premium functionality. The impact is confined to license-state manipulation with no data disclosure, privilege escalation, or code execution; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (4.3), and no public exploit identified at time of analysis.
Authenticated users with subscriber-level access or higher can alter Empik-specific WooCommerce product metadata on any store running the Empik for WooCommerce plugin up to and including version 1.5.1, because the plugin's CSV import and product/offer import handlers execute without verifying user capabilities. The missing authorization check (CWE-862) allows modification of the _empik_logistic_klass, _empik_product_state, _empik_product_state_all_variants, and export/offer flag fields on arbitrary products, producing an integrity-only impact scored at CVSS 4.3 with no confidentiality or availability effect and no code execution. No public exploit has been identified at the time of analysis; exposure is greatest on sites with open user registration, where any self-registered subscriber account is sufficient to reach the vulnerable endpoints.
Authenticated attackers holding only subscriber-level access on a WordPress site running the Search Atlas SEO - Otto AI SEO Automation plugin (slug metasync) can tamper with the plugin's whitelabel settings because the affected code fails to verify that the caller is authorized to change them. By overwriting the whitelabel settings password to an attacker-chosen value, a low-privilege user can unlock the whitelabel, general, and advanced configuration tabs that are otherwise gated behind that password, giving them control over settings they should never reach. The flaw affects all versions up to and including 2.6.23 and is rated CVSS 4.3 (integrity-only impact, no confidentiality or availability loss); no public exploit code and no confirmed active exploitation were identified at time of analysis, and upstream code changes referencing the vulnerable routines have been published in the plugin's Trac changeset 3676919.
Missing authorization in the Partial Shipment for WooCommerce plugin (versions up to and including 3.4) allows any authenticated WordPress user with Subscriber-level access to read order item details - product names, quantities and shipped counts - belonging to any customer, and to modify the shipment status and shipped quantities of arbitrary orders via the plugin's AJAX endpoints. The three affected handlers (wxp_order_shipment, wxp_order_item_shipment, wxp_order_set_shipped) perform no capability check, no nonce verification, and no validation that the caller owns the supplied order_id, and the related wxp_order_status action can additionally trigger order status transitions. This is a broken-access-control flaw, not an authentication bypass; no public exploit code has been identified at time of analysis, and there is no KEV or EPSS signal, but practical exposure is raised on stores that allow customer/subscriber self-registration during WooCommerce checkout.
Missing authorization checks in the PDF Builder for WooCommerce WordPress plugin (all versions up to and including 2.0.11) allow any authenticated user holding Subscriber-level access or above to read invoice numbers, formatted invoice numbers, and creation timestamps for arbitrary WooCommerce orders by supplying attacker-chosen OrderNumber and InvoiceId values together with a garbage nonce. The prerequisite authentication is trivially met on stores that allow open customer registration, but the disclosure is confined to invoice metadata rather than full order or customer records, so impact is limited to low confidentiality (CVSS 4.3). No public exploit code has been identified at time of analysis, and an upstream fix is available via plugin repository changeset 3626297.
Missing authorization and nonce checks in the Metasync plugin (distributed as Search Atlas SEO - Otto AI SEO Automation for WordPress) up to and including version 2.6.23 allow any authenticated user with Subscriber-level access or higher to overwrite the site-wide 'metasync_options_instant_indexing' option. Because save_instant_indexing_settings() is hooked to admin_init and only tests for the presence of $_POST['submit'], an attacker with a low-privilege login can silently change which post types are auto-submitted to Google's Instant Indexing service; no public exploit code has been identified at time of analysis, no CISA KEV entry applies, and the impact is integrity-only (CVSS 4.3, I:L) with no data disclosure or denial of service.
Authenticated attackers with Subscriber-level or higher access on WordPress sites running the VW Writer Blog theme (versions up to and including 1.3.8) can reset all theme customizer settings to their defaults because the 'vw_writer_blog_reset_all_settings' function lacks a capability check. This integrity-only issue has low impact-no data disclosure, code execution, or site downtime-and requires a valid low-privilege account; sites with registration disabled are less exposed. No public exploit or active exploitation is identified at time of analysis.
Missing authorization in the SEO Booster plugin for WordPress through version 7.4.7 allows any authenticated user with Subscriber-level access or above to overwrite the plugin's Google Search Console integration options - seobooster_access_token, seobooster_google_email and seobooster_gsc_sites - and to clear the seobooster_needs_reauth flag by simply requesting a crafted /wp-admin/ URL. Because the vulnerable handle_oauth_callback() routine is registered on the standard admin_init hook and only takes attacker-supplied $_GET parameters, the flaw requires nothing more than a low-privileged account (CVSS 3.1 PR:L, no user interaction, no admin rights, no non-default configuration), which is trivial for an attacker to obtain on any site with self-service registration enabled. Impact is bounded to integrity of those plugin settings at CVSS 4.3 with no confidentiality or availability effect, and although the advisory carries an 'Authentication Bypass' tag the underlying issue is classic broken access control; no public exploit code was identified at time of analysis.
Authorization bypass in the BlockSpare plugin for WordPress allows authenticated users with Subscriber-level access to create arbitrary posts on sites running versions up to and including 4.2.6. The issue is caused by a permission callback that combines capability checks with AND instead of OR, letting low-privileged accounts pass the authorization gate; impact is integrity-only with no data disclosure or service disruption. No public exploit identified at time of analysis, but sites with open user registration can significantly expand the attacker pool because attackers can self-register as Subscribers.
Keycloak's OpenID Connect token refresh path can issue fresh access tokens on behalf of an OIDC client that an administrator has already disabled, because the server restores requested audiences from stored client IDs without re-checking whether that audience client is still enabled. An attacker who already possesses a valid, unexpired refresh token for the affected client can therefore keep obtaining usable access tokens after the client is turned off, but only against resource servers that validate the JWT locally (offline signature/claim checks) rather than calling Keycloak for introspection or userinfo. Scoring is low at CVSS 4.2 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N), no public exploit code was identified at time of analysis, and exploitation requires both a live refresh token and a client that was disabled after that token was issued.