OS command injection in the Totolink A3002MU router firmware (build Hh-B20211125.1046) lets a remote attacker who holds valid low-privilege credentials execute arbitrary shell commands on the device through the formWsc handler in /boafrm/formWsc by supplying a crafted localPin argument. Because the affected component is the router's BOA web management service, successful exploitation yields full compromise of confidentiality, integrity and availability (CVSS 4.0 score 8.6, PR:L, no user interaction), and on consumer routers the required low-privilege session is often trivially satisfied by unchanged default administrative credentials. Publicly available exploit code exists (a published proof-of-concept walkthrough for the A3002MU rce-formWsc path), and although there is no confirmation of active exploitation in CISA KEV, the combination of a public PoC, a network-reachable attack surface and low complexity makes this a high-priority patching target for internet- or LAN-exposed devices.
Remote code execution in The Welcomizer WordPress plugin versions up to and including 2.8.1 lets authenticated users with Subscriber-level access or higher execute arbitrary PHP on the server by abusing the twiz_ajax_callback AJAX action's savesection handler. The handler checks a nonce but omits a current_user_can() capability check, and eval() processes attacker-supplied PHP from the twiz_custom_logic POST parameter when output is set to twiz_logic_output; the nonce is exposed to any authenticated user via twiz-ajax.js.php, so it does not prevent exploitation. Wordfence reports this with CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and no public exploit identified at time of analysis.
Stored cross-site scripting in the Ultimate Member plugin for WordPress (all versions before 2.13.1) lets unauthenticated attackers - per the supplied CVSS vector, PR:N - register an account, set a crafted profile name, and plant JavaScript that executes in the browser of any visitor who opens that profile, including a logged-in administrator (UI:R). The root cause is a two-part failure: the plugin does not escape the profile-name-derived value before writing it into the page title, and it decodes HTML entities after its own sanitisation has already run, so the payload survives filtering. Publicly available exploit code exists, a vendor patch is available as 2.13.1, and the assessed confidentiality and integrity impact is high, which is why this reads as a genuine priority rather than a high-CVSS-but-low-risk paper cut.
Unauthenticated REST API abuse in the Master Blocks WordPress plugin (versions 1.4.1 up to but not including 1.5.0) lets any network attacker silently rewrite the plugin's settings, because one of its REST routes is registered without an authorization or permission callback. One of those attacker-controllable settings is later emitted unescaped in the WordPress admin area, so the injected value becomes stored XSS that executes in the browser session of any administrator who visits an affected wp-admin page. Publicly available exploit code exists, and there is no confirmed active exploitation (CISA KEV) at time of analysis; the independent assessment raises the scope to Changed (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, vendor score 8.8), reflecting that the impact escapes the plugin and lands inside the administrator's WordPress session.
Malformed UTF-16 decoding in libexpat through 2.8.4 lets remote attackers hide XML markup from the parser: a lone high surrogate paired with the following code unit is accepted as a valid surrogate pair, so a character such as '<' is consumed as part of the pair and never tokenized. Only applications that parse UTF-16-encoded XML (little- or big-endian) from an untrusted source are affected - the dominant UTF-8 input path is not exploitable - and meaningful integrity impact additionally requires a downstream filter, sanitizer, or validator that trusts the parsed structure and therefore sees different markup than Expat exposes. No public exploit has been identified at time of analysis; an upstream fix is available in the Expat repository (PR #1282, commit ff6e1d7e750bbe245178f51a47a965dc8342861a), reported via VulnCheck.
SQL injection in the VikRentItems Flexible Rental Management System WordPress plugin lets unauthenticated remote attackers pass crafted parameters into backend SQL statements, extracting database contents such as user credentials and booking records. All plugin versions below 1.2.4 are affected, and publicly available exploit code exists. The impact is confidentiality-only at high severity (assessed CVSS 8.6, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), and the practical risk is bounded by the plugin's narrow install base rather than by any technical precondition, since no authentication or user interaction is needed.
Cross-namespace data disclosure in Argo Workflows 4.1.0 through 4.1.3 lets an authenticated user who holds only namespace-scoped 'list' permission on archived workflows bypass the cluster-scoped access review and read archived workflows from every other namespace they were never granted access to. The bypass is triggered by supplying a negated metadata.namespace field selector (e.g. 'metadata.namespace!=<own-namespace>') to ListArchivedWorkflows; the server validates the caller's SelfSubjectAccessReview against the caller's own namespace instead of evaluating the request as a cluster-wide list, so the negated selector silently widens the result set. Exposed data includes workflow spec arguments, parameter values, and annotations, which frequently carry secrets, registry credentials, and internal endpoint details; the impact is confidentiality-only and is most severe in genuinely multi-tenant clusters where namespaces are treated as trust boundaries. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis, and the vendor has released a fixed version, so this is a substantiated but not mass-exploitation risk.
Account takeover of any user of the UsersWP WordPress plugin - administrators included - is possible on sites running versions before 1.5.10 when social login is enabled, because the plugin resolves an incoming social-login session to an existing local account using the email address asserted by the provider without first confirming that the provider actually verified ownership of that address. The flaw is remotely reachable without authentication (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, 8.1, CWE-269) and publicly available exploit code exists, so an attacker who registers at a lax or attacker-controlled provider can assert a victim's email and be logged into that victim's account. Exploitation carries the elevated complexity reflected in the AC:H rating: social login must be configured and enabled with at least one provider that permits assertion of an unverified address, and the attacker must already know the target's registered email. This is a genuinely high-priority vulnerability, not a high-CVSS-but-low-risk paper cut, since successful exploitation yields full account control including administrative takeover of the site.
Missing authorization in the Unbounce Landing Pages WordPress plugin (version 1.1.1 through versions before 1.1.5) lets any authenticated user, including a subscriber-level account, rewrite the target host of the plugin's front-end proxy and cause attacker-controlled content to be served from the victim site's own origin. Publicly available exploit code exists, and the plugin is patched in 1.1.5, but no CISA KEV entry was identified at time of analysis. The vendor's CVSS score of 8.0 is slightly generous: exploitation requires a valid low-privileged login (practical where self-registration is enabled) and, for the most damaging outcomes, a visitor or administrator must load the poisoned proxied path, which is why our independent assessment lowers availability impact to None while keeping confidentiality and integrity at High.
Unauthenticated, network-reachable attackers can read the WooCommerce API consumer key and secret stored by the MgoSync WordPress plugin in any version before 2.1.7, because one of its REST API endpoints performs no authorization check (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Exploitation is trivial and publicly available exploit code exists, though the leak only yields credentials on sites that have completed the MgoSync WooCommerce credential setup; from there, read/write access to the connected store's REST API further depends on that API being reachable and the leaked key retaining its original scope. The vendor has released 2.1.7, and because the exposed key is read/write, credential rotation - not patching alone - is required to close the exposure.
Privilege escalation in the WordPress plugin WP Import Export Lite before version 3.9.35 lets an authenticated user who holds only the delegated import permission create new administrator accounts and overwrite the credentials and roles of existing accounts, including administrators, because the import routine never verifies user-management capabilities. The flaw is only exploitable on sites that actually delegate the import capability to a non-administrator role; default WordPress installations that restrict imports to administrators gain nothing from it. Publicly available exploit code exists, no confirmed active exploitation (CISA KEV) has been reported, and the vendor has released a fixed version.
Path traversal in QloApps through 1.7.0 lets an authenticated back-office user read arbitrary files from the web server by supplying directory-traversal sequences in the 'email' parameter of the getEmailHTML action in admin/ajax.php. Because the vulnerable code passes an attacker-controlled path to file_get_contents without verifying it stays inside the mail template directory, stolen files can include configuration and database-credential material, giving a limited-privilege admin user read access to data far beyond their intended scope. Publicly available exploit code exists (a detailed write-up is referenced), but there is no evidence of confirmed active exploitation in the wild; the vendor fix is available upstream as PR #1719 / commit 8015495c, so exposure is realistically limited to unpatched installations.
Reflected cross-site scripting in the WordPress plugin Estatik Real Estate Plugin (versions 4.0.1 through 4.3.4) lets remote attackers inject arbitrary script into an unauthenticated AJAX response by supplying crafted values in a request parameter that the plugin decodes and reflects without sanitisation or escaping. No authentication is required to reach the vulnerable endpoint, but the victim must be induced to open an attacker-controlled link (UI:R), so the practical risk is highest when a logged-in administrator is lured into clicking, granting script execution in their session context. Publicly available exploit code exists and the vendor has shipped a fix in 4.3.5; the vendor vector scores 7.1 High, while our own assessment places impact at C:L/I:L/A:N.
Arbitrary PHP function invocation in the Save as PDF Plugin by PDFCrowd for WordPress (all versions up to and including 4.6.1) allows any authenticated user with Contributor-level access or higher to have the server AES-encrypt an attacker-chosen pdf_created_callback value into a valid button blob, which is later passed to PHP as a callable when any unauthenticated visitor POSTs that blob to the wp_ajax_nopriv_save_as_pdf_pdfcrowd AJAX endpoint. Published CVSS 3.1 is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); our assessment retains the High rating but bounds the impact to C:H/I:L/A:L because the invoked callback receives only the plugin's options array as its single, fixed argument, making disclosure of the site's stored PDFCrowd API key and username the most reliable outcome rather than fully attacker-controlled code execution. Contributors are required only to mint the blob - the trigger replay is unauthenticated - and no public exploit identified at time of analysis, with no confirmed actively exploited (CISA KEV) status.
Remote code execution in Mistral Vibe before 2.25.5 allows an attacker to run arbitrary shell commands with the privileges of the user running the tool, because worktree creation executes a repository's own git hooks - notably the post-checkout hook and the fsmonitor command - before any workspace trust validation takes place. The attack requires the victim to deliberately open, clone, or check out an attacker-controlled repository (user interaction is mandatory, and the request itself is unauthenticated per the CVSS PR:N vector), and code execution is bounded by the permissions of the Vibe user, with no privilege escalation or server-side attack surface. There is no public exploit identified at time of analysis and the flaw is not confirmed as actively exploited; a vendor-released patch in 2.25.5 addresses the ordering bug.
Authenticated users with subscriber-level access or higher can execute arbitrary WordPress shortcodes through the ProfilePress plugin (slug wp-user-avatar) in all versions up to and including 4.17.2, because user-controlled values reach do_shortcode() without validation. Exploitation requires a low-privilege account, which is trivially obtained on sites that enable the plugin's self-service registration feature, and no user interaction is needed; however, the practical impact is variable and often limited, since substantial confidentiality or integrity loss only materializes when other privileged or data-exposing shortcodes are registered on the same site. The vendor's upstream severity rating is 8.1, while independent assessment rates the realistic vector as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N (limited C/I, no availability impact); no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Remote code execution in WP Photo Album Plus affects all versions through the wppa_image_magick path, allowing authenticated attackers with subscriber-level access and above to run server-side code when the site uses ImageMagick processing. The issue is argument injection into an ImageMagick command executed via PHP exec(), enabled by insufficient sanitization of the multipart upload filename and reliance on escapeshellcmd() instead of proper argument quoting. Exploitation requires ImageMagick to be available and the plugin to route uploads through ImageMagick rather than GD, and no public exploit was identified at time of analysis; CVSS 3.1 base score is 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Unauthenticated information disclosure in the YS LeadGen plugin for WordPress (all versions up to and including 2.1.4) lets any remote attacker dump the entire store of captured lead-form submissions by simply invoking the plugin's AJAX action, exposing names, email addresses, and message content of every visitor who filled out a form. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack is remote, unauthenticated, and requires no user interaction, and our independent assessment rates it a genuine high-priority issue rather than a high-score-but-low-real-risk case, because the exposed data is directly monetizable PII and the only practical limiter is how much data a given site has collected - not any defensive barrier. No public exploit code and no active exploitation have been identified at time of analysis, but the barrier to abuse is trivially low for anyone able to reach the site.
Information disclosure in Exim before 4.100.1 allows attackers who control or can impersonate a proxy in the configured proxy_protocol_hosts set to read uninitialized stack memory when PROXY Protocol is enabled, but only in non-default deployments and with limited confidentiality impact. This is a conditional flaw requiring attacker control of a trusted proxy; stock Exim installations without Proxy-Protocol are unaffected. No public exploit code or evidence of active exploitation was identified at time of analysis.
Formatting an attacker-supplied POD document with Pod::Text (part of the podlators distribution) before version 6.1.1 drives the formatter into a non-terminating loop that exhausts CPU and memory, allowing a remote unauthenticated attacker who controls the POD content to deny service to any application or service that renders untrusted POD. The trigger is a document with deeply nested =over directives whose cumulative indentation makes the wrapping margin greater than or equal to the configured output width, so that wrap() has zero or negative space for text, matches the empty string in its line-splitting substitution, and appends padding forever without consuming input. Exploitation status is limited: no public exploit code was identified at time of analysis, CISA SSVC records exploitation as none, and EPSS is low at 0.21% (11th percentile), so this is a genuine but modest-priority availability issue whose real-world risk is concentrated on services that render untrusted POD rather than on the ordinary local pod2text/perldoc workflow.
Stored cross-site scripting in the Quill Forms WordPress plugin (Conversational Multi Step Forms, Surveys & Quizzes) through version 5.7.1 lets unauthenticated attackers inject arbitrary JavaScript into a form entry by abusing the free-text 'Other' option of a Multiple Choice block; the script is persisted server-side and executes in the browser of an administrator who later opens the submitted-entries/results view in wp-admin. The vulnerable path is reachable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2 High), with the scope change reflecting execution inside the privileged WordPress admin context rather than the anonymous submission context; the practical limitation is that impact only materializes when a privileged user reviews the affected entry, so administrator-side interaction effectively gates execution even though the vector scores UI:N. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so there is no confirmation of active exploitation.
Stored cross-site scripting in the WordPress plugin Asset CleanUp: Page Speed Booster (all versions through 1.4.0.5) lets unauthenticated visitors inject arbitrary script through comment content, which then executes in the browser of any user who subsequently loads the affected page. The flaw is gated by a non-default configuration: the combine_loaded_css CSS-combining optimization must be explicitly enabled, and the site must accept comments, so most default installs are not exposed; the independent assessment rates exploitation complexity as High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) with impact confined to client-side script execution rather than server compromise. No public exploit code or confirmed active exploitation has been identified at time of analysis, and no EPSS or KEV signal is present in the provided intelligence.
Arbitrary file write via path traversal in Gopeed (through 2.0.0-beta.3) allows a crafted archive to drop files anywhere on the filesystem of the machine running the downloader. An unauthenticated remote attacker can deliver the malicious archive, but exploitation only occurs when the victim has AutoExtract enabled and downloads and extracts the file, which is why the vendor vector carries UI:A and scores 7.0 (High); integrity and availability are both rated High while confidentiality is not directly impacted. No public exploit code and no CISA KEV entry were identified at time of analysis, and an upstream fix commit has been published, though a tagged patched release has not been independently confirmed.