Unauthenticated arbitrary file upload in the Gravity Forms WordPress plugin through version 3.1.0.4 can lead to remote code execution on any site whose publicly reachable form contains a File Upload field with its Visibility set to 'Hidden', because hidden upload fields skip the extension-validation step and a rejected file's intact upload state is subsequently persisted by upload_file() without re-validation. Per the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), no credentials or user interaction are required (PR:N/UI:N) and the attack is fully remote (AV:N), but the non-default hidden File Upload field is a mandatory precondition; a secondary practical limiter is that code execution depends on the server actually executing the uploaded file type in the upload directory. No public exploit code and no CISA KEV entry were identified at time of analysis, yet the combination of unauthenticated access, arbitrary file write and PHP-execution potential makes this a high-priority fix for any installation that meets the precondition.
Unauthenticated remote attackers can abuse a missing authorization check in a REST route of the Botiga Pro WordPress plugin (versions before 1.6.5) to update arbitrary WordPress options, inject stored web scripts that execute on every front-end page, and move arbitrary posts to the trash. The option-write primitive enables privilege escalation and full site takeover, for example by altering registration or default-role settings, while the stored script injection yields persistent cross-site scripting against all site visitors. The issue is rated CVSS v3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), publicly available exploit code exists, and no CISA KEV listing has been observed; the only deployment prerequisite is that the Pro add-on plugin is installed and active, as the free Botiga theme alone is unaffected.
Code execution in OpenPanel's js-runtime component lets an authenticated user who holds project write access escape the JavaScript webhook template sandbox and run arbitrary code inside the worker process. The template validator fails to block computed (bracket-notation) member access that traverses a constructor chain to the Function constructor, so merely creating or editing a webhook template is sufficient - no user interaction is required (UI:N). No public exploit code has been identified at time of analysis, and no CISA KEV or EPSS signal was supplied, but our independent assessment rates this a genuine high-priority issue, with CVSS 3.1 AV:N/PR:L/UI:N/S:C/C:H/I:H/A:H (scope change to the host system and full confidentiality, integrity and availability impact).
A stack-based buffer overflow in the TOTOLINK A3002MU wireless router (firmware Hh-B20211125.1046) allows remote attackers to corrupt memory through the 'submit-url' argument handled by the formWlWds function at /boafrm/formWlWds, with the CVSS 4.0 vector scoring 9.3 and indicating no authentication or user interaction prerequisite (PR:N/UI:N), though the independent assessment notes the endpoint's pre-authentication status is not explicitly confirmed by the description. Impact is potentially full compromise of confidentiality, integrity, and availability on the device, but practical success depends on network reachability to the Boa web management interface, the specific firmware build, and the difficulty of converting an embedded-MIPS stack overflow into reliable code execution rather than a simple crash. Publicly available exploit code exists, but there is no confirmed active exploitation (no CISA KEV listing) at time of analysis.
Unauthenticated attackers can execute arbitrary WordPress shortcodes through the Forminator Forms plugin (all versions up to and including 1.57.2) because a value reaching do_shortcode in the quizzes front-action handler is not properly validated. A site is only reachable through this path if Forminator is installed and active and a form or quiz routes through the vulnerable front-action, and the real-world damage is bounded by which shortcodes other installed plugins register - benign shortcodes mean limited impact, while data- or state-changing shortcodes raise it substantially. No public exploit code or confirmed in-the-wild activity (CISA KEV) was identified at time of analysis; note that the vendor-assigned CVSS 9.1 overstates the assessed impact, which our analysis places at CVSS 6.5 (C:L/I:L) for fully remote, unauthenticated, low-complexity exploitation.
Shortcode injection in the WP Recipe Maker plugin for WordPress (all versions up to and including 10.8.1) lets an attacker plant arbitrary registered shortcode tokens inside the content of an approved wprm-comment-rating comment, which the plugin later feeds through do_shortcode() during recipe metadata generation and reflects into the JSON-LD reviewBody field served on every recipe page render. Because execution occurs before the plugin's strip_shortcodes()/wp_strip_all_tags() cleanup runs on the resulting string, output from sensitive shortcodes (attachment captions, private post fields, other data exposed by installed shortcodes) can be disclosed to any visitor loading the affected page. The CVSS vector records PR:N, so the injection itself is unauthenticated, but practical exploitation is gated by the site's comment-approval threshold and by whether installed shortcodes actually expose sensitive content; the vendor score of 9.1 is assessed as inflated relative to an AC:H/I:L reality, and no public exploit code has been identified at time of analysis.