Unauthenticated arbitrary file upload in the Ultra Addons for Contact Form 7 WordPress plugin (versions 3.2.4 through before 3.5.51) lets a remote attacker place a file with an attacker-chosen name and extension at a predictable public path inside the WordPress site. On hosts running the default Debian/Ubuntu Apache PHP package configuration, where .phar is mapped to the PHP handler alongside .php and .phtml, that uploaded file is interpreted and the issue escalates to remote code execution and full site takeover; on hosts that route only .php to PHP, the file is served inert from the site's own origin, degrading the outcome to stored cross-site scripting. No authentication, user interaction, or special access is required (our assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), publicly available exploit code exists, and the RCE path is immediate on affected Apache/mod_php stacks - which is why our independent assessment rates real-world severity above the vendor-assigned CVSS 6.5.
Unauthenticated attackers can publish arbitrary persisted query documents and claim (squat) query aliases on WordPress sites running the WPGraphQL Smart Cache plugin before 2.3.2, because the plugin neither requires authorization for the storage request nor validates the caller-supplied query identifier. WPScan reports that publicly available exploit code exists, though there is no confirmed active exploitation (not in CISA KEV); scoring is CVSS 3.1 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) and the independent assessment characterizes this as a moderate, integrity-focused risk. Practical impact is bounded by whether the site actually depends on persisted queries and aliases and by a first-claim race - the attacker must register an alias before the site's own frontend does - and WPGraphQL's own access controls still govern what any stored query can return, so confidentiality loss is not demonstrated.
Arbitrary file deletion in the WordPress plugin JetFormBuilder - Dynamic Blocks Form Builder (versions 3.5.6.2 through before 3.6.5.3) allows a user who can create or manage forms to point a custom field-validation callback at a PHP file-deletion function that the plugin's blocklist fails to exclude, and the deletion is then executed when the form is submitted. The weaponization step is gated behind form-management privileges (CVSS PR:H - typically an administrator or a delegated form-editor role), while the destructive submission itself requires no authentication; publicly available exploit code exists, though there is no confirmed active exploitation (CISA KEV). With a CVSS base score of 5.5 and impact limited to integrity and availability (C:N/I:L/A:L, S:C), this is a moderate-priority issue rather than a critical one, and risk is materially lower on sites that do not delegate form-management capability to untrusted users.
Object-level authorization failures in the Hydra Booking - Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 let any user holding the plugin's administrator-assigned host-management custom role read, modify, and permanently delete other hosts' records along with the linked WordPress user accounts. The flaw is remotely reachable with low complexity (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N, 5.5) but is gated behind a role that a WordPress administrator must first provision, making this an insider or delegated-privilege abuse scenario rather than an unauthenticated attack; publicly available exploit code exists (WPScan disclosure), though no confirmed active exploitation (CISA KEV) has been reported. The integrity impact is the dominant concern because deletions are irreversible and extend to WordPress user accounts, not just plugin data.
Unauthenticated attackers can mark pending orders as paid in the Rede Itaú for WooCommerce plugin before 5.4.7 by abusing its PIX payment webhook, which fails to verify authenticity before updating order status. The issue affects stores running versions from 3.6.1 up to 5.4.7 with the PIX payment method enabled, requires no authentication or user interaction, and produces integrity-only financial fraud impact rather than code execution or data disclosure. Publicly available exploit code exists, and exploitation is straightforward once a pending order and reachable webhook are present; the vendor-released fix is version 5.4.7.
Unauthenticated remote attackers can reach administrator-oriented REST API routes in the Mailchimp for WooCommerce WordPress plugin before 6.1.1 because the permission callback does not verify the requesting user's capability, allowing a persistent state change (CWE-862). Publicly available exploit code exists. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, so the impact is limited to low integrity with no confidentiality or availability effect, but the unauthenticated nature and available exploit code make this a real, actionable priority driven more by exploitability signals than by raw severity.
Unauthenticated visitors to WordPress sites running the Online Scheduling and Appointment Booking System plugin (versions 28.1 through before 28.2) can read other visitors' AI booking-assistant messages and inject new messages into their in-progress conversations, because the plugin's unauthenticated conversation actions never verify that the requester owns the conversation ID being referenced. Rated CVSS 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) under CWE-639, the practical risk hinges on how conversation identifiers are generated: if they are sequential or guessable the flaw is broadly automatable, but if they are opaque tokens exploitation is opportunistic and low-volume, which is why the base score is only moderately elevated. Publicly available exploit code exists and the issue was reported by WPScan, though there is no evidence of confirmed active exploitation (CISA KEV) at time of analysis. There is no availability impact and no path to site takeover described; exposure is limited to the confidentiality and integrity of other visitors' assistant conversations.
Authenticated users who hold the Hydra Booking 'host' role on a WordPress site can modify other hosts' profile data and reassign ownership of another host's record to themselves, because the plugin (versions 1.1.0 through before 1.2.3) does not verify that the host record being modified belongs to the requester. Publicly available exploit code exists, but there is no CISA KEV entry indicating active exploitation. The issue is a horizontal privilege-abuse/IDOR flaw rated CVSS 4.7 (MEDIUM) under the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - the attacker must already possess host-level access and gains only limited, cross-host read/write capability, not administrative or site-wide control.
Missing authorization in the Nimble Page Builder WordPress plugin through 3.3.8 lets an authenticated user with only Subscriber-level access read the page-builder content of arbitrary non-public posts and pages, including drafts, pending, private and scheduled items. The plugin's authenticated AJAX action returns stored page-builder content without verifying that the requester is allowed to edit the target post, so an attacker can enumerate post IDs and exfiltrate unpublished content; publicly available exploit code exists and the WPScan disclosure serves as the entry point, though the issue has not been reported as actively exploited in CISA KEV. Impact is confined to information disclosure (CVSS 3.1 4.3, C:L only, PR:L, no integrity or availability effect), and sites that allow open user registration effectively lower the bar to any remote registrant.
Authentication bypass in the OpenPanel tracking API allows unauthenticated remote attackers to inject forged revenue metrics and evade bot-detection filters by supplying arbitrary dummy secrets-only a public client ID, intentionally exposed in the client-side tracking snippet, is required. Affected versions extend through commit bad75bddc74d12d36cfb843f4531d3b830a8d994; the flaw is a moderate-severity integrity issue (CVSS 3.1 I:L) with no public exploit identified at time of analysis.
Local file disclosure in Calculator Lock for Android allows a local actor with shared external storage access, such as an authorized non-root ADB shell or a co-resident file-reading app, to copy the vault's SQLite database and media files without entering the calculator passcode. The published CVSS is 6.8, and the independent assessment (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms high confidentiality impact with no integrity or availability impact; the passcode still gates the in-app UI. The independent assessment classifies this as a genuine but low-urgency local issue, and no public exploit identified at time of analysis.
Privilege escalation in the Keycloak Admin REST API allows an already-authenticated delegated administrator to add their own account to a group that carries administrative role mappings, turning scoped, fine-grained management rights into effective control of the entire realm. The group-membership endpoints do not verify whether the target group grants privileged roles (CWE-862, Missing Authorization), so the escalation is a single API call away for anyone holding manage-users or equivalent group-scoped permissions. Reachability is limited: anonymous users and ordinary end-users cannot trigger it, a high-privilege group must already exist in the same realm, and deployments that only use a single super-admin gain nothing new because those actors are already fully privileged. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV. Affected builds include Red Hat Build of Keycloak and Red Hat Single Sign-On 7.
Authorization bypass in the Better Messages - Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress (all versions up to and including 2.15.33) allows authenticated users with custom-level access or above to retrieve the full message transcript, thread metadata and participant user data of chat-room threads they are not members of. The root cause is a missing authorization check (CWE-862) on the plugin's REST endpoints, and exploitation is further gated on a target room's only_joined_can_read setting retaining its default value of '0' - rooms reconfigured to '1' are not affected. Rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N, confidentiality-only impact), this is a real but moderate-priority confidentiality issue rather than a critical emergency; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV.
Authenticated SQL injection in the Custom Field Template plugin for WordPress, affecting all versions up to and including 2.7.8, lets any Contributor-level user inject arbitrary SQL through the unsanitized 'post_ID' parameter and read the entire site database, including password hashes, private post content, and secrets stored by other plugins. The plugin's current_user_can('edit_post', $id) guard does not stop the attack because WordPress casts the identifier to an integer for the permission decision while the original unsanitized string continues to the SQL sink, and the accompanying nonce is legitimately obtainable by any Contributor from the post edit screen. Risk is concentrated on sites with open registration, untrusted or multi-author Contributor accounts; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, with impact limited to confidentiality (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
SQL injection in the Mediavine Create plugin for WordPress (all versions up to and including 2.5.3) allows any authenticated user holding Author-level access, or the publish_posts capability generally, to inject arbitrary SQL through the REST endpoint's 'order_by' parameter and read sensitive data from the site's database. The endpoint's permission callback defaults to publish_posts, so the vulnerable code path is reachable with no extra precondition beyond that role. With a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), impact is limited to confidentiality (database extraction) with no integrity or availability effect, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; no EPSS score was supplied.
Server-side request forgery in the Wow Elements Addons for Elementor WordPress plugin (all versions up to and including 1.11.2) lets an authenticated attacker with Contributor-level access or higher coerce the site's web server into issuing HTTP requests to arbitrary attacker-chosen destinations. The flaw is in the plugin's Changelog widget, which passes the user-controlled 'Changelog File' setting directly into wp_remote_get() with no URL validation or sanitisation, allowing requests to be aimed at internal-only resources such as cloud metadata endpoints or intranet APIs. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; the Contributor authentication prerequisite and the bounded, low-level confidentiality/integrity/availability impact keep this a genuine but moderate-priority issue rather than an emergency patch item.
Any authenticated WordPress user holding contributor-level capabilities or higher can pull the entire customer dataset out of the Easy Appointments plugin (all versions up to and including 3.12.27) because the handle_customers_ajax handler returns ea_customers records without enforcing an adequate capability check. The exposed records contain personally identifiable information such as names, email addresses, mobile numbers, dates of birth, and physical addresses, so the impact is a high-confidentiality, read-only disclosure with no integrity or availability effect, consistent with the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N score of 6.5 (MEDIUM). Exploitation is not possible for unauthenticated visitors - an attacker must first hold a low-privilege account - and no public exploit identified at time of analysis; risk is concentrated on multi-author sites, membership sites, or any installation that hands out contributor accounts or has self-registration mapped to elevated default roles.
Tutor LMS WordPress plugin versions up to 4.0.8 expose arbitrary users' email addresses and Tutor profile phone numbers to any logged-in subscriber-level attacker through an insecure direct object reference in the student_id parameter. This moderate-priority CWE-639 flaw requires only an authenticated account; open registration on LMS/course sites makes that precondition easy to meet, but exploitation is limited to confidentiality of those fields and does not provide credentials, write access, or code execution. No public exploit code or confirmed active exploitation was identified at time of analysis, and our independent assessment rates confidentiality impact as Low under CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
Delegated administrators in Keycloak can bypass fine-grained reset-password restrictions through the Admin REST API's credential-deletion endpoint, deleting a targeted user's password credentials and locking that user out. The flaw (CWE-862) requires an authenticated, provisioned delegated admin who has user-management access but is specifically not granted the manage-credentials/reset-password permission; it is an insider/delegated-tenant privilege-boundary escalation within the admin's reachable user scope, not unauthenticated exploitation, account takeover, or data disclosure. No public exploit code has been identified at time of analysis, and exploitation depends on Keycloak's fine-grained admin permissions model being deployed.
Authenticated SQL injection in the Mediavine Create plugin for WordPress (all versions up to and including 2.5.3) lets users holding author-level capabilities or higher inject arbitrary SQL through the 'order' parameter and read sensitive data from the site database. The flaw only triggers when the request also supplies one of the advanced-filter parameters (linked_posts, created_after, created_before, missing_fields, post_id, a comma-separated type value, or exclude_type), which narrows but does not eliminate the exposure on multi-author sites. No public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); Wordfence rates the practical risk as moderate given the authenticated, role-gated prerequisites.
Sensitive information disclosure in the Divi Essential WordPress plugin through version 5.8.1 allows any authenticated user holding Subscriber-level access or above to enumerate every table in the site's WordPress database and read a caller-controlled number of rows from each, exposing usernames, emails, hashed passwords, session tokens, secret keys, and plugin-stored API credentials. The flaw is trivially reachable because the dnxte_get_database_tables and dnxte_get_database_data AJAX handlers only perform a nonce check when the 'nonce' POST parameter is supplied - omitting it skips the check entirely - and no current_user_can() capability enforcement exists. Authentication requirements are confirmed as low-privileged (CVSS PR:L) rather than unauthenticated, so the practical attack surface depends on whether the site allows open user self-registration; no public exploit code was identified at time of analysis, and the impact is confidentiality-only with no modification of data or loss of availability.
Stored cross-site scripting in the premium (pro) edition of the WPComplete WordPress plugin, affecting all versions up to and including 2.9.9.0, lets an authenticated user with contributor-level access or above inject arbitrary script into the 'empty' shortcode attribute; the payload persists in page content and executes in the browser of anyone who later views that page. The free version of the plugin is not affected, and exploitation requires the paid edition to be installed and active, which materially narrows the exposed population. There is no public exploit code identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing); this is assessed as a moderate, not urgent, priority given the pro-only scope and the prerequisite of an authenticated contributor account.
Stored cross-site scripting in the Redux Framework WordPress plugin affects versions up to and including 4.5.13, allowing an authenticated attacker with subscriber-level access or higher to persist arbitrary script into Media field filter values that execute when another user later loads the affected page. The flaw arises from insufficient sanitization of nested array values in user_meta_save() combined with unescaped output of filter CSS values in render(), yielding a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); the mandatory low-privilege account and the need for a higher-privileged victim to view the injected content are the primary exploitation constraints.
Stored cross-site scripting in the Redux Framework plugin for WordPress through version 4.5.13 lets an authenticated attacker with subscriber-level access or above persist arbitrary JavaScript into user meta via the spinner field, which is later emitted into an unquoted HTML attribute and executed in the browser of any user who views the affected page. Exploitation requires a low-privileged account (PR:L) plus a second user - typically an administrator or profile viewer - loading the injected content, so sites with open or self-registration enabled are at the greatest risk while sites that disable registration or have moved to 4.5.14+ are not exposed. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing).
Stored cross-site scripting in WP Composer - The Easiest Page Builder (Ghozylab) affects every release up to and including 1.0.5: the pbwp_raw_shortcode handler Base64-decodes its content and echoes it into the page without sanitization or escaping, so an attacker who can author content through the plugin can persist a script that runs in the browser of anyone who later views the page. Exploitation requires an authenticated account with Contributor-level capability or above (PR:L in the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N vector), and because the payload is Base64-encoded it contains no raw HTML characters at save time and therefore slips past WordPress's KSES content filtering - execution is deferred until a victim, ideally a higher-privileged editor or administrator, opens the injected page. Impact is limited to client-side script execution within the site origin (low confidentiality and integrity, no availability loss, no server-side compromise); no public exploit code or CISA KEV listing was identified at time of analysis, and consistent with the independent assessment this is a moderate, not urgent, priority.
Authenticated stored cross-site scripting (XSS) in the YS LeadGen WordPress plugin, versions up to and including 2.1.4, allows attackers with Subscriber-level access or higher to bypass authorization checks on AJAX popup-management endpoints and inject arbitrary JavaScript through created popups. The missing capability checks in app/Controllers/Ajax.php enable low-privileged users to create popups containing malicious script, which executes when a victim (such as an administrator or site visitor) views the popup. No public exploit code has been identified at time of analysis, and the CVSS score is 6.4 (medium).
Stored cross-site scripting in the Gum Addon for Elementor WordPress plugin (all versions up to and including 1.3.15) allows authenticated users with contributor-level access or higher to inject arbitrary JavaScript via the 'pop_tag' parameter of the popover button widget, which then executes in the browser of any user - including administrators - who views the affected page. The prerequisite is a valid low-privilege account plus an active, widget-enabled installation, so risk is concentrated on multi-author sites or blogs that permit open contributor registration; no public exploit code has been identified at time of analysis, and CVSS 3.1 scores the issue 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting limited confidentiality and integrity impact but a scope change because the payload crosses from the authoring context into other users' sessions.
Stored cross-site scripting in the AppMySite - WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) plugin, in all versions up to and including 3.15.3, lets any authenticated user with Subscriber-level access or above persist arbitrary JavaScript by invoking the plugin's save_ams_license_key AJAX handler, which enforces neither a capability check nor a nonce check. The injected script later runs in the browser of a higher-privileged user who loads the plugin's AMS home admin page, allowing the attacker to act in that user's session context. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) and no public exploit code was identified at time of analysis; this is a genuine but moderate authenticated stored XSS whose meaningful escalation depends on an administrator viewing the poisoned page.
Stored cross-site scripting in the Real3D Flipbook Lite WordPress plugin (versions up to and including 5.1.1) allows authenticated attackers holding Contributor-level access or higher to inject arbitrary JavaScript into pages via the 'lightboxtext' shortcode attribute and other attributes processed by on_shortcode(). The payload is persisted through the normal WordPress save path and renders inside a <script type="application/json"> block emitted by wp_json_encode() without the JSON_HEX_TAG flag, so a crafted value can break out of the JSON context and execute when a privileged user (typically an Editor or Administrator previewing or moderating the pending post) views the affected page. Successful exploitation therefore depends on a higher-privileged user opening the injected content, which is a meaningful precondition; no public exploit code has been identified at time of analysis, and there is no evidence of confirmed active exploitation (no CISA KEV listing).
Chunked-response smuggling in the Elixir Mint HTTP client (0.1.0 through 1.10.0) allows a malicious or compromised HTTP/1 origin to desynchronize an RFC-9112-strict intermediary from Mint on a shared, pooled connection, poisoning the response queue so that later requests reusing that socket receive another request's or attacker-chosen response content. Mint's chunk-size parser accepts trailing junk after the hex size (for example '5ZZZZZ', '5 9', or '0ZZZZ') while strict proxies reject it, so the two disagree on chunk boundaries and on where the message ends. Exploitation is unauthenticated (PR:N) but conditional and non-trivial: it requires a pooled connection to an attacker-influenced origin plus a strict intermediary in the path; impact is limited to confidentiality and integrity of responses on the poisoned connection (VC:L/VI:L), with no availability or code-execution effect, and no public exploit code has been identified at time of analysis. Note that upstream tag metadata for this CVE includes 'RCE'; that label is not supported by the assessed vector or impact and should not be used for prioritization.
Reflected cross-site scripting in the WP Customer Reviews plugin for WordPress (vendor: bompus) affects every release up to and including 3.7.8, allowing an unauthenticated attacker to inject arbitrary script into the review form through the 'wpcr3_fname' parameter. Exploitation is not automatic: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1 Medium) requires the victim to click an attacker-supplied link, and the injected code then runs only in that victim's browser session with limited confidentiality and integrity impact. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis; EPSS data was not provided, so real-world exploitation likelihood should be treated as low-to-moderate, driven by social engineering rather than mass scanning. Wordfence reported the issue and upstream code changes are visible in the plugin's Trac repository.
Reflected cross-site scripting in the MC4WP: Mailchimp for WordPress plugin through version 4.14.0 lets remote attackers inject arbitrary JavaScript into pages that render the plugin's 'data' dynamic content tag, executing in the browser of any user persuaded to click a crafted link. The weakness is insufficient input sanitization and output escaping in the plugin's dynamic-content and form-tag handling, rated CVSS 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N); exploitation is unauthenticated but requires user interaction and a page or form that actually uses the affected tag, so there is no unattended mass-exploitation path. Vendor-released patch: 4.14.1. No public exploit code and no confirmed active exploitation were identified at time of analysis; the issue is real but bounded.
Reflected cross-site scripting in the Pochipp plugin for WordPress (versions up to and including 1.20.2) lets unauthenticated attackers inject arbitrary script that executes in the browser of a logged-in user who holds the upload_files capability, i.e. an Author, Editor, or Administrator. The flaw is reachable through the plugin's media-upload search path, and exploitation depends on the attacker luring that privileged victim into clicking a crafted /wp-admin/media-upload link, so each victim must be individually tricked and the injected script never persists. Wordfence scores the issue 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), no public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical impact is limited by the required user interaction and the privileged-victim prerequisite.
Reflected cross-site scripting in the Tutor LMS WordPress plugin (all versions up to and including 4.0.8) lets unauthenticated attackers craft links whose 'search' parameter injects arbitrary JavaScript into the victim's browser when the dashboard or account search flow is rendered. Exploitation requires the victim to click the crafted link (CVSS 3.1 base 6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), so the payload never self-triggers, and no public exploit code or confirmed active exploitation was identified at time of analysis. Although any site visitor can be targeted, the practical payoff is highest when an authenticated or privileged user such as an instructor, administrator, or student is lured into clicking, because the script then executes inside that user's session context and can act on their behalf within the WordPress site.
Reflected cross-site scripting in the SSL Zen - SSL Certificate Installer & HTTPS Redirects WordPress plugin (all versions up to and including 4.7.42) lets unauthenticated attackers inject arbitrary script into a page via the 'host' parameter, but only while the plugin is in its transient 'system_requirements' setup-wizard stage and only if a victim clicks an attacker-supplied link. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) no authentication is needed, yet execution depends on user interaction - typically an administrator working through the setup wizard - and the script runs in the context of the affected site, potentially enabling session or credential theft and admin-side actions. Exploitation is confined to that narrow configuration state; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so the raw 6.1 score overstates practical risk in most deployments.
Unauthenticated information disclosure in the WordLift - AI powered SEO - Schema plugin for WordPress affects all versions up to and including 3.54.10, allowing remote attackers with no credentials to harvest the title, body content, author, publication and modification dates, word count, comment count, and other metadata of private, draft, and pending posts. The flaw stems from the plugin's /wordlift/v1/jsonld/ REST routes being registered with a permission_callback of '__return_true', combined with a downstream JSON-LD converter that calls get_post() without validating post status or the caller's capabilities, so sequential post-ID enumeration bypasses WordPress core access controls. No public exploit code was identified at time of analysis and the vulnerability is not reported as actively exploited; the CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects a confidentiality-only, low-complexity disclosure with no integrity or availability impact.
Unauthenticated information disclosure in the Bread WordPress plugin (versions up to and including 2.9.12) lets any remote visitor read the plugin's entire configuration export, including the PDF protection password stored in plaintext, by simply requesting the /?export-meeting-list=1 endpoint. The flaw is trivially reachable: the download_settings function is registered on the plugins_loaded hook and explicitly permits execution on non-admin public pages, so no authentication, authorization, or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U, base 5.3 MEDIUM). Impact is bounded to disclosure of the stored protection_password rather than site credentials or code execution, and no public exploit code has been identified at time of analysis; the practical risk depends on how sensitive the protected PDF meeting lists and their shared password are in a given deployment.
Unauthenticated attackers can impersonate the Better Messages plugin's own internal AI bot accounts on WordPress sites running versions up to and including 2.15.33, gaining entry to administrator-restricted chat rooms and reading the private message history of other users. The flaw is entirely pre-authentication (CVSS vector PR:N/UI:N) and requires only that unauthenticated guest registration is enabled and that the server forwards the client-supplied X-Real-IP header to the plugin, which stores it verbatim; the plugin's is_ai_bot_user() check then prefix-matches the attacker-chosen value against 'ai-chat-bot-'. No public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation, but the low complexity and lack of any credential requirement make the issue straightforward to abuse where restricted rooms exist. The vendor-assigned score is 5.3 (Medium, C:L/I:N); our reassessment raises confidentiality to High and adds a Low integrity impact because the same bypass allows posting into restricted rooms, netting a materially higher severity than the published vector implies.
A use-after-free memory-safety flaw in Exim before 4.100.1 can crash the mail transfer agent process when the daemon is compiled against the GnuTLS TLS backend and configured with certain non-default TLS settings; once a vulnerable server is reachable over the network, no authentication (PR:N) or user interaction (UI:N) is required, but the CVSS vector reflects high attack complexity (AC:H) because the triggering configuration is unusual and non-default. The assessed impact is availability-only (C:N/I:N/A:L) - a crash or degraded service rather than code execution or data exposure. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so practical risk is confined to the narrow subset of Exim deployments using GnuTLS with the specific triggering TLS options.
An out-of-bounds write in Exim versions before 4.100.1 occurs when the MTA is built and configured to use Proxy-Protocol (the hosts_proxy option) and accepts a PROXY header from an attacker-controlled or spoofed proxy, allowing remote memory corruption (CWE-787) with high integrity impact and low confidentiality/availability impact. The flaw is remotely reachable but unauthenticated only in the sense that no credentials are needed (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L, vendor score 7.0); the high attack complexity reflects that Proxy-Protocol is off by default and the attacker must be positioned on, or able to spoof, the trusted-proxy path in front of Exim. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was provided; a fixed release, Exim 4.100.1, exists and is the primary remedy.
The TikTok for Business WordPress plugin (all versions up to and including 1.4.1) fails to verify authorization on its TikTok OAuth token-exchange handler, allowing an unauthenticated remote request to overwrite the merchant's stored TikTok integration access token in the wp_options table and effectively hijack the site's TikTok Business account and product catalog link. Exploitation is heavily constrained: the request must carry a valid TikTok OAuth auth_code issued specifically for that merchant's registered TikTok app, and the plugin only persists the new token after TikTok's API returns message='OK', so forged or arbitrary codes fail. No public exploit code or in-the-wild exploitation has been identified at time of analysis, and the vendor has committed a fix to the plugin's code repository; the impact is integrity-only (C:N/I:L/A:N), which keeps real-world risk low despite the unauthenticated network vector.
Authenticated attackers holding only Subscriber-level access on a WordPress site running the Ibtana - Ecommerce Product Addons plugin (all versions up to and including 0.4.7.7) can update or delete arbitrary post meta entries by invoking the 'iepa_use_gt_editor' AJAX action, which performs no capability check. The impact is limited to integrity - post meta content can be altered or removed, but there is no confidentiality or availability loss, which is why the issue scores 5.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) despite the vendor's PR:N vector; Subscriber authentication is a hard prerequisite. There is no public exploit code identified at time of analysis and the CVE is not listed in CISA KEV, so exploitation requires a valid low-privilege account (trivial on sites with open registration, otherwise an existing user) and the vulnerable plugin version.
Forged Stripe webhook events can be injected into sites running the ThemeHigh "Payment Gateway of Stripe for WooCommerce" plugin through version 5.0.8, allowing unauthenticated remote attackers to manipulate WooCommerce order state - marking unpaid orders as paid or completed, forcing legitimate orders into a failed state, fabricating dispute notices, and pushing forged refund events into the store's records. The flaw only exists in the default post-install configuration, where the eh_stripe_webhook_secret option is empty and the plugin's publicly reachable woocommerce_api_wt_stripe endpoint accepts the raw POST body as a trusted Stripe event without ever calling \Stripe\Webhook::constructEvent(); once an administrator saves any valid signing secret, forged requests are rejected. The integrity-only impact and CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) understate operational risk for stores sitting on the unconfigured default; there is no public exploit code identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing).
Authenticated SQL injection in OpenPanel's ClickHouse-backed metrics and filter functionality lets a user with access to at least one project inject boolean SQL terms through crafted property/filter keys, bypassing project isolation to read analytics metrics belonging to other projects. All deployments of OpenPanel up through commit bad75bdd that expose the ClickHouse metrics/filter feature are affected; the CVSS 4.0 base score is 5.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L), reflecting a bounded, read-only, cross-tenant confidentiality impact rather than code execution or data tampering. At the time of analysis there is no indication of confirmed active exploitation (CISA KEV) and no public exploit code identified; the primary risk drivers are the authentication requirement (PR:L) and the fact that only metrics data can be read, not modified.
SMTP smuggling in Exim before 4.100.1 allows a remote, unauthenticated attacker to desynchronize message boundaries so that a message a receiving system reconstructs does not match any message actually sent, by first provoking a rejection during DATA processing and then delivering crafted follow-on data. The assessed impact is integrity-only (CVSS 4.0, AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N): no confidentiality or availability loss is expected, and successful abuse hinges on high attack complexity and on how downstream mail systems interpret the smuggled end-of-data boundary. The practical payoff is sender spoofing that can bypass SPF, DKIM, or DMARC alignment where other systems trust this Exim host as a relay, so it is a moderate, integrity-focused issue rather than a top priority; no public exploit has been identified at time of analysis.
SQL injection in WP Optimizer up to and including 2.5.0 allows authenticated administrator-level users to inject arbitrary SQL subqueries through the 's' parameter, enabling extraction of sensitive database information via time-based blind techniques. The flaw is rated CVSS 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) and its real-world priority is limited because the attacker must already hold WordPress administrator privileges, which already convey broad database access. No public exploit was identified at time of analysis, and no CISA KEV entry is present.
SQL injection in the GoPay for WooCommerce WordPress plugin (all versions up to and including 1.0.36) lets an attacker who already holds a Shop Manager or higher role inject extra SQL through the 'log_table_filter' parameter handled by the plugin's admin log view, allowing retrieval of sensitive data from the site's database (rated C:H/I:N/A:N, CVSS 4.9, authenticated with PR:H). The vulnerable code sits in an admin-area screen, so unauthenticated or low-privileged users cannot reach the parameter, and the practical threat is limited to insiders, rogue store staff, or sessions of already-compromised privileged accounts. No public exploit code has been identified at time of analysis and there is no evidence of confirmed active exploitation (CISA KEV).
Credential exposure in OpenPanel's Model Context Protocol (MCP) integration causes MCP authentication tokens supplied as URL query parameters to be written verbatim into plaintext application logs, letting anyone who can read application stdout, container/pod logs, or a centralized logging/SIEM store harvest base64-encoded credentials and replay MCP requests for read access to project analytics. The issue is gated by prior read access to the log data (CVSS 4.0 vector AV:L/PR:L; the independent assessment scores it low at CVSS 3.1 with only low confidentiality impact and no integrity or availability effect), so it is a real but low-priority defect rather than a remote unauthenticated path. No public exploit identified at time of analysis, and no confirmed actively exploited (CISA KEV) status is indicated in the provided data.
Reflected cross-site scripting in the LiteSpeed Cache plugin for WordPress in all versions up to and including 7.9 allows unauthenticated attackers to inject arbitrary script into a page that runs in a victim's browser when the victim is induced to click a crafted link or submit a crafted request. The payload must be delivered as a POST body field named 'esi' while the query string simultaneously carries a validly signed 'esi' value, exploiting PHP's $_REQUEST merge order so the POST value wins at execution; this two-part delivery plus the signature requirement raises attack complexity, and successful exploitation requires user interaction. Impact is limited to the client side (low confidentiality and integrity, no availability impact), giving a CVSS 3.1 base score of 4.7; no public exploit code has been identified at time of analysis and the flaw is not in CISA KEV.
Open redirect in the WP Ghost (Hide My WP Ghost) - Security & Firewall plugin for WordPress, affecting all versions up to and including 7.0.02, allows an unauthenticated attacker to bounce a victim to an arbitrary external site by crafting a logout link whose destination the plugin never validates. Exploitation is not hands-off: the attacker must socially engineer a currently logged-in user into clicking the crafted URL, and because the plugin's logout routine invokes wp_logout() before issuing the redirect, the victim is fully and irreversibly logged out as part of the attack chain, though the practical harm remains limited to redirection to a malicious page. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the 4.7 vendor score is consistent with the UI:R social-engineering gate combined with a scope change and low integrity impact.