Improper input validation in Adobe Content Credentials - specifically the Content Credentials Rust SDK and its companion command-line tool - allows remote, unauthenticated attackers to bypass a security check and obtain limited unauthorized write access when a victim visits a maliciously crafted URL or interacts with a compromised web page. The flaw is network-delivered (AV:N/AC:L/PR:N) but is gated by mandatory user interaction (UI:R), and its impact is confined to limited integrity loss (C:N/I:L/A:N) with no confidentiality or availability effect, giving it a CVSS base score of 4.3. This is a genuine but low-priority issue: no public exploit code has been identified at time of analysis and there is no confirmed actively exploited (CISA KEV) status, and it is not exploitable against a purely passive or non-interacting deployment.
Stored cross-site scripting in the Hostel plugin for WordPress (all versions up to and including 1.1.8) lets an authenticated attacker with Administrator-level access inject arbitrary web scripts through the 'custom_currency' parameter or the 'locale_url' setting, which then execute for any user viewing the injected page. Exploitation is gated by layered prerequisites: the actor must already hold Administrator rights and the site must be a WordPress multi-site network or have the unfiltered_html capability explicitly disabled, so the issue does not apply to standard single-site installations where Administrators can already post unfiltered HTML. No public exploit code has been identified at time of analysis and the vulnerability is not in CISA KEV; assessed severity is low (CVSS 4.4) consistent with the high privileges and non-default configuration required.
A local out-of-bounds read in radare2 6.0 and earlier (fixed in 6.2.0) can crash or corrupt the analysis session when an analyst opens a crafted Mach-O binary containing Swift type or class metadata. The CVSS 3.1 score is 3.3 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L), reflecting a 4-byte read immediately before the allocated field-metadata buffer that yields at most a process termination or incorrect metadata processing - no attacker-observable memory disclosure has been demonstrated, and the 'Information Disclosure' tag on this record is not substantiated by the advisory. Exploitation requires the victim to deliberately load an untrusted Mach-O file (user interaction), and there is no remote or unauthenticated path; no public exploit identified at time of analysis and the issue is not in CISA KEV.
Authenticated Mattermost users can drive excessive database load by submitting an oversized post ID array to the bulk reactions endpoint POST /api/v4/posts/ids/reactions, because Mattermost does not enforce a server-side length cap on that array (CWE-770). The flaw affects 11.7.x through 11.7.10, 11.8.x through 11.8.5, 11.9.x through 11.9.1, and 11.10.x through 11.10.1, requires only a valid account with API access (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, 4.3), and has availability-only impact, meaning a single crafted request causes transient load rather than a persistent outage. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is a low-to-moderate operational risk rather than a critical priority.
Authenticated remote users of IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can forge entries in the transaction audit log by supplying a crafted HTTP header that the application fails to validate properly. Successful abuse requires only valid low-privilege credentials (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), so the practical consequence is limited to the integrity of the audit trail - no data disclosure, no service disruption, and no unauthenticated attack path. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score provided; combined with the narrow, specialized deployment footprint of the platform, this is a genuinely low-priority issue whose signals are consistent rather than conflicting.
Authenticated Instructor-level users on WordPress sites running the Tutor LMS plugin 4.0.7 or earlier can overwrite, re-parent, or delete quiz question and answer rows belonging to other instructors and administrators by abusing broken ownership checks in the tutor_quiz_builder_save AJAX action. The handler validates only the top-level course_id/topic_id and payload['ID'], then passes attacker-supplied nested question_id, answer_id, deleted_question_ids[], and deleted_answer_ids[] values straight into $wpdb->update and DELETE statements, so an Instructor who controls one course can reach rows owned by others. Impact is limited to integrity of quiz content (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) and is only meaningful on multi-instructor or multi-tenant course sites; there is no public exploit code identified at time of analysis and no confirmed active exploitation (not in CISA KEV), and the Instructor privilege prerequisite is the main factor bounding realistic risk. A vendor fix is available in Tutor LMS 4.0.8.
Authorization bypass in the wpForo Forum plugin for WordPress (all versions up to and including 3.1.5) lets an authenticated attacker with subscriber-level access or higher take over another guest author's forum post and rewrite its title, body, author name, and stored owner email address. Exploitation is conditional rather than automatic: the forum must be configured with BOTH guest posting AND guest editing enabled (a non-default deployment choice), and the attacker must already know the specific target guest author's email address, which functions as the record selector. Impact is integrity-only on a single post (vendor CVSS 4.3, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), and no public exploit has been identified at time of analysis; CISA KEV does not list this issue.
Authenticated users with contributor-level access or higher on WordPress sites running the WP-CRM System plugin (all versions up to and including 3.4.6) can enumerate the contact_id parameter to read PII belonging to arbitrary CRM contact records, including full names, email addresses, phone, mobile and fax numbers, and physical addresses. The flaw is a CWE-200 sensitive information exposure reachable over the network with low privileges (CVSS 4.3, AV:N/AC:L/PR:L/UI:N) and requires only a valid contributor account plus a populated CRM address book; no user interaction or special configuration is needed beyond the plugin being installed. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no KEV listing), so the practical risk is a low-severity, read-only privacy disclosure whose real-world exposure scales with how freely contributor accounts are granted on the site.
Authenticated users with contributor-level access or above can permanently delete arbitrary media attachments site-wide on any WordPress installation running the Custom Field Template plugin up to and including version 2.7.8, because the edit_meta_value function trusts an attacker-supplied numeric attachment ID in the file-field parameter without verifying ownership. The attack precondition is the plugin's default behavior - a post governed by a template containing at least one file-type field where the mediaRemove option is not enabled - so exposure is common rather than exotic, and exploitation is remote, low-complexity and requires no user interaction. Impact is limited to integrity (deletion of media, causing content loss and broken pages) with no data disclosure or code execution; no public exploit code and no confirmed active exploitation were identified at time of analysis, and a vendor changeset exists although a corrected plugin version could not be independently confirmed.
Any authenticated WordPress user holding only Subscriber-level access can remotely deactivate the ThumbPress plugin on versions 6.2.1 and earlier, because the send_deactivation_survey() handler registered to the wp_ajax_pl-plugin-deactivation action performs no capability check and no nonce verification. The impact is deliberately narrow - a low-privilege account can only turn the plugin off, with no path to data disclosure, code execution, or persistence - which aligns with the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N score of 4.3. No public exploit code or confirmed active exploitation was identified at time of analysis, and exposure is limited to sites that actually allow low-privilege user registration; the upstream code change is visible in the public Trac changeset referenced by the advisory.
Missing authorization in the RW Elephant Rental Inventory plugin for WordPress (all versions up to and including 2.3.13) lets an authenticated attacker with only Subscriber-level access flip the plugin's cache setting on or off by sending a single POST of the toggle_cache action to /wp-admin/admin-ajax.php. The AJAX handler performs neither a capability check nor a nonce check, so the same endpoint can additionally be driven by cross-site request forgery against a higher-privileged logged-in user. The impact is confined to a low-integrity configuration change (no confidentiality or availability effect), no public exploit code has been identified at time of analysis, and the assessed CVSS 4.3 reflects a genuinely low-severity issue.
Authenticated Stripe integration hijacking in WP User Manager (User Profile Builder & Membership) versions up to and including 2.9.18 lets any logged-in user at Subscriber level or above overwrite the site's stored Stripe credentials, causing future payments to be routed to an attacker-controlled Stripe account. The flaw is a missing authorization check (CWE-862): Connect::complete() runs on admin_init without any current_user_can() or nonce verification, so merely reaching a /wp-admin/ page is enough to trigger it. Exploitation requires a low-privilege account on the target site plus a completed attacker-side Stripe Connect OAuth flow, and it only has impact where WPUM's Stripe Connect integration is actively in use; CVSS 3.1 base is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), reflecting integrity-only impact, and no public exploit code was identified at time of analysis.