Improper privilege management in Kiteworks Core before 9.5.0 allows an authenticated administrative user who holds only limited, non-Sysadmin role-management permissions to grant another account full system-administrator (Sysadmin) rights that the grantor was never authorized to confer. The flaw sits in the role-assignment logic, which fails to constrain grantable privileges to the subset the granting administrator actually possesses, so a single delegated-admin session is enough to escalate a chosen account to the highest privilege level. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, score 7.2) the attack is network-reachable with no user interaction but requires an already-authenticated high-privilege session; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV). This is best characterized as a genuine but access-gated integrity risk whose real-world exposure depends on how many delegated administrators exist in a deployment and how tightly their role scopes are managed.
Stored SQL injection in Kiteworks Core before 9.5.0 allows an authenticated administrator to read sensitive data from the underlying database and to degrade availability of the service. Exploitation is only reachable through the affected administrative reporting feature and requires an existing, authenticated administrative account (CVSS:3.1/AV:N/AC:L/PR:H/UI:N), so the flaw is not exposed to unauthenticated or low-privileged users; no public exploit code has been identified at time of analysis, and no CISA KEV entry or EPSS score accompanies this CVE. Our independent assessment rates the issue at moderate priority: confidentiality and availability impact are high, but integrity impact is limited (C:H/I:L/A:H), and the mandatory full administrative privilege sharply narrows the realistic attack surface to trusted insiders or attackers who have already compromised an admin session.
Unauthenticated access to an internal service function in the Kiteworks Advanced Forms / Secure Data Forms component allows remote attackers who can reach the exposed endpoint to invoke a limited set of backend service operations on the Kiteworks platform. The flaw requires no credentials and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) and is bounded by design: the vendor states the reachable function cannot access user accounts, stored files, or form submissions, and exploitation is impossible if the component is not network-exposed. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS/KEV signals were not provided; overall this represents a moderate real-world risk concentrated on internet-facing Kiteworks deployments that have the Advanced Forms functionality enabled.
PHP object injection in the ThemeHigh 'Extra Product Options For WooCommerce | Custom Product Addons and Fields' plugin through version 3.3.8 allows an authenticated user holding the WooCommerce shop_manager role or higher to pass a crafted serialized payload into a deserialization sink, enabling arbitrary PHP object instantiation that can escalate to code execution or data tampering if a usable gadget chain exists in the surrounding WordPress/WooCommerce stack. The issue is rated CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting high impact but a high-privilege, backend-only prerequisite rather than unauthenticated exposure. There is no public exploit identified at time of analysis, and the plugin has not been confirmed as exploited in the wild; exploitation additionally requires WooCommerce to be installed and active and the plugin to remain at a vulnerable version.
PHP object injection in Page Builder by SiteOrigin (siteorigin-panels) version 2.36.0 and earlier allows an authenticated WordPress user holding high privileges - an Administrator or the Editor-level role implied by the advisory - to supply crafted, serialized content through the page-builder editor that the plugin then deserializes, yielding high confidentiality, integrity and availability impact (CVSS 3.1 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Because the flaw is a CWE-502 deserialization issue, weaponization into full remote code execution depends on a usable PHP POP gadget chain being present in the plugin, WordPress core, or another installed component, so the practical worst case is conditional rather than guaranteed. There is currently no evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but the high-privilege authentication prerequisite is the main barrier to mass abuse, not the technical difficulty - low-privilege or anonymous users cannot reach it.
Code injection in the MediaWiki CentralAuth extension (versions 1.43, 1.45 and 1.46) lets an already highly privileged operator who controls a CentralAuth configuration or system setting push attacker-influenced values into executable code paths, with the impact crossing into other federated wikis because the vulnerable component changes scope. Exploitation is not reachable by anonymous users: the assessed vector requires high privileges (PR:H), high attack complexity (AC:H), a present attack requirement (AT:P) and a passive user-interaction step (UI:P), so a victim session or request must traverse the vulnerable code path. There is no CISA KEV listing confirming active exploitation, and the vendor's CVSS 4.0 vector carries only an E:P (proof-of-concept) exploit-maturity metric; the overall picture is a real but conditions-gated, lower-urgency issue affecting multi-wiki/wiki-farm SSO deployments rather than standalone MediaWiki installs.
Authenticated low-privilege users can exploit a deserialization flaw in the MediaWiki Wikibase extension (versions 1.43, 1.45, and 1.46) to potentially execute arbitrary code, but exploitation is gated by high attack complexity, a specific precondition, and victim interaction. The vulnerability (CWE-502) allows untrusted serialized data to be processed, leading to code execution in non-executable files. A proof-of-concept exploit may exist (CVSS 4.0 E:P), but there is no confirmed active exploitation (not in CISA KEV).
Privilege escalation in the SureCart WordPress plugin through version 4.7.2 allows an authenticated user who holds the limited 'Shop Worker' store-staff role to elevate to full administrator-level control of the WordPress site. The flaw is a case of incorrect privilege assignment (CWE-266) inside a SureCart operation, and because the assessed vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, no user interaction or special conditions are needed once the Shop Worker role is held - making it a straightforward path for a malicious insider or anyone who has compromised a shop-staff credential. Anonymous or self-registering visitors cannot reach the flaw; there is no public exploit identified at time of analysis.
PHP object injection in the Themefic Ultimate Addons for Contact Form 7 WordPress plugin (versions through 3.5.51) allows an authenticated user holding the Editor role to feed crafted serialized data into a plugin code path that calls PHP's unserialize, which can lead to code execution, file operations, or data tampering if a viable POP gadget chain exists in the plugin or elsewhere on the site. The issue is network-reachable and needs no user interaction, but exploitation is access-gated by the Editor-privilege prerequisite, and no public exploit code has been identified at time of analysis; EPSS data was not provided.
PHP object injection in the WordPress plugin Content Egg through version 6.3.1 allows an attacker who holds the Shop manager role to trigger unsafe deserialization of attacker-controlled data, potentially leading to full site compromise. The vulnerability is network-reachable with low attack complexity and requires no user interaction, but the PR:H rating in the CVSS vector means a valid authenticated account at the Shop manager privilege level is a prerequisite, and meaningful code-execution impact further depends on the presence of a usable PHP POP gadget chain in Content Egg or another loaded plugin or theme. No public exploit code has been identified at time of analysis, and there is no indication that the flaw is being actively exploited in the wild.
Privilege escalation in the Vitepos WordPress point-of-sale plugin through version 3.5.0 lets an authenticated account that already holds a custom or elevated Vitepos role - such as POS staff or manager - raise its own privileges to a higher level on the affected site, rated CVSS 7.2 (High). Exploitation is remote and low-complexity with no user interaction required once such an account exists, but the high-privilege prerequisite (PR:H) means anonymous visitors and ordinary subscriber-level users cannot trigger it, and only WordPress sites with the Vitepos plugin installed and active are exposed. No public exploit code has been identified at time of analysis, and the issue is reported by Patchstack as an improper privilege assignment (CWE-266) defect in the plugin's custom role handling.
PHP object injection in the Implecode eCommerce Product Catalog plugin for WordPress (3.6.0 and earlier) allows an authenticated attacker holding a high-privilege custom role to feed crafted serialized data into PHP's unserialize(), enabling arbitrary object instantiation that can escalate to remote code execution where a usable POP gadget chain exists in loaded code. Rated CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), it carries full confidentiality, integrity and availability impact, but is access-gated: the high-privilege custom role requirement (PR:H) means anonymous and low-privileged users cannot reach the vulnerable path, so this is a genuine but access-gated risk rather than an internet-wide exposure. No public exploit identified at time of analysis.
PHP object injection in WP ERP 1.17.9 and earlier allows an authenticated high-privilege user to execute arbitrary code or otherwise compromise a WordPress site via deserialization of untrusted input in the plugin's custom role functionality. The CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting network reachability, no user interaction, and high confidentiality, integrity, and availability impact, but the flaw is gated behind a high-privilege prerequisite (PR:H). No public exploit identified at time of analysis; exploitation also requires a reachable POP gadget chain.
PHP object injection in Kadence WooCommerce Email Designer (versions up to and including 1.5.19.1) lets an authenticated account holding the WooCommerce 'Shop manager' role pass attacker-controlled serialized data into a PHP unserialize() path, potentially leading to arbitrary file manipulation, data disclosure, or remote code execution if a suitable property-oriented programming gadget chain exists in the loaded codebase. The flaw carries a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so it is network-reachable without user interaction but is firmly privilege-gated behind high-privilege store management access rather than anonymous exploitation. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical ceiling of impact depends on which gadget chains are present alongside the plugin.
PHP object injection in the Responsive Slider Gallery WordPress plugin (versions up to and including 1.5.5) lets an authenticated Editor-level user pass crafted serialized data into an unsafe unserialize() call, potentially triggering arbitrary object instantiation and, given a usable POP gadget chain, file manipulation or remote code execution. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2) confirms network reachability and full confidentiality, integrity, and availability impact, but the high-privilege prerequisite excludes anonymous or subscriber-level attackers. No public exploit code has been identified at time of analysis and the vulnerability is not reported as actively exploited (no CISA KEV entry); the plugin's limited deployment footprint further narrows the exposed population.
PHP object injection in Cost of Goods for WooCommerce versions up to 3.5.2 allows an authenticated attacker with the WooCommerce Shop Manager role to submit crafted data that is unsafely deserialized, potentially achieving full confidentiality, integrity, and availability impact. The issue is rated CVSS 7.2 (High) and requires PR:H, so exploitation is limited to trusted staff or attackers who already control a Shop Manager account; no public exploit code or CISA KEV entry is present in the provided data. Successful exploitation further depends on a reachable POP gadget chain in the plugin, WooCommerce, WordPress core, or another installed plugin.
PHP object injection in the Minimum and Maximum Quantity for WooCommerce plugin (versions up to and including 2.1.2) lets an authenticated user holding Author-level privileges or higher feed attacker-controlled serialized data into an unsafe PHP deserialization path on WordPress sites that also run WooCommerce. Per the assessed CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2), impact is rated full across confidentiality, integrity and availability, but the high-privilege prerequisite (PR:H) excludes anonymous visitors and typical subscriber/customer accounts, and meaningful impact additionally depends on a usable PHP object-injection gadget chain being present in the plugin, WooCommerce, or WordPress core. No public exploit identified at time of analysis, and the issue is not confirmed actively exploited (not in CISA KEV).
PHP object injection in the Music Player for WooCommerce WordPress plugin (versions 1.9.1 and earlier) lets an authenticated user who holds the WooCommerce 'Shop manager' capability pass attacker-controlled serialized data into PHP's object deserialization path, which under the right conditions can lead to full compromise of the site's confidentiality, integrity, and availability. The issue requires WooCommerce to be installed and active, and the CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) is driven by the complete C/I/A impact typical of exploitable object injection but is tempered by the elevated PR:H role requirement and by the practical need for a reachable PHP gadget chain. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not listed in CISA KEV), so real-world risk is concentrated on sites where shop-manager accounts are broadly distributed or not tightly controlled.
Concurrent monitoring requests against CODESYS control runtimes are not synchronized, letting an authenticated remote client that already holds monitoring rights corrupt internal memory structures and produce incorrect data processing or a denial-of-service condition. Affected components span the CODESYS soft-PLC family - Control RTE (SL) and Control RTE (for Beckhoff CX) SL, Control Win (SL), Runtime Toolkit, Safety SIL2, HMI (SL), Development System 3, and the Control for Linux, Linux ARM, Raspberry Pi, BeagleBone, PFC100, PFC200, PLCnext, IOT2000, emPC-A/iMX6, WAGO Touch Panels 600 and Virtual Control SL variants. Network reachable with only low privileges (PR:L), no user interaction and no non-default configuration, the race yields high integrity and availability impact but no confidentiality exposure (CVSS 4.0 base 7.2; CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H); no publicly available exploit code and no confirmed active exploitation were identified at time of analysis, and a vendor patch is available.
Stored cross-site scripting in the Post Views Stats Counter WordPress plugin (all versions up to and including 1.1.7) allows unauthenticated remote attackers to inject arbitrary JavaScript into a site by placing a payload in the User-Agent request header, which the plugin records without sanitization and later renders without escaping. The plugin's only defense is a substring blacklist for common bot signatures such as 'bot', 'spider' and 'crawler', which is trivially bypassed by omitting those strings, so any site with the plugin active and reachable is exposed with no authentication, user interaction, or non-default configuration needed for the injection step. Execution of the stored script is deferred until a user - typically an administrator loading the plugin's statistics page - views the affected page; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Stored DOM-based cross-site scripting in FPSM Lite through 1.3.4 lets unauthenticated attackers inject arbitrary scripts via the post_content parameter when the site has enabled guest post submission through the [fpsm] shortcode. The flaw is rooted in insufficient input sanitization and output escaping reaching a client-side data-label DOM sink, so the injected script executes when a victim views the affected page. No public exploit code has been identified, but exploitation is conditional on the shortcode-driven guest submission path being active; upgrading to 1.3.5 fixes the issue.
Silent capture of screen contents, webcam images, and device geolocation is possible in OpenClaw Windows Node before 2026.7.1-3 because the NodeService capture handlers performed these operations without the one-time consent gate that screen.record and camera.clip already enforced. An attacker who is, or who controls, a gateway or agent already connected to the node's WebSocket interface can invoke screen.snapshot, camera.snap, and location.get to covertly screenshot the desktop, photograph the user, and read physical location - for camera.snap and location.get without even a user-visible indicator - requiring no interaction from the victim. This is a genuine but moderate-severity privacy vulnerability affecting only pre-2026.7.1-3 builds; authentication is required in the sense that the attacker must already hold node-agent/gateway connectivity (CVSS:4.0 PR:L), and no public exploit code was identified at time of analysis.
Second-order SQL injection in Kiteworks Secure Data Forms (versions below 9.5.1) allows an authenticated, low-privilege user to influence a value derived from their stored account data that is later concatenated into a database query without sanitization, potentially exposing or manipulating data behind the application. Exploitation is condition-gated: the attacker needs a valid session, and only deployments where a specific optional feature is enabled are affected, so installs without that feature are not exploitable. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), which keeps this a mid-severity, moderate-priority issue; the vendor has released a fix in 9.5.1.
Incorrect authorization in JetBrains YouTrack before 2026.2.18991 lets a user who holds only read-only access to a project overwrite that project's notification templates, an action that should require higher project privileges. The attack is network-reachable and needs no user interaction, but it does require an authenticated account (CVSS PR:L) that already has visibility into the target project, and the effect is scoped to a single project's notification configuration. Severity is moderate (vendor score 7.1; independently assessed impact limited to integrity, with no confidentiality or availability effect), EPSS is low at 0.31% (22nd percentile), CISA SSVC rates exploitation as none and non-automatable, and no public exploit code has been identified at time of analysis. JetBrains has released a fix.
Unauthenticated cross-site scripting in the CURCY (Woo Multi Currency) plugin for WordPress, affecting all versions up to and including 2.2.16, allows remote attackers to inject and execute arbitrary script in the context of a victim's browsing session. Exploitation is network-reachable and low-complexity and requires no authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 7.1), but it does require victim user interaction - the target must click a crafted link or otherwise render attacker-controlled content - and it only affects WordPress sites where the vulnerable plugin is installed and active. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; the practical exposure is therefore driven by user interaction and by how many sites still run CURCY at or below 2.2.16.
Reflected cross-site scripting in the If-So Dynamic Content Personalization plugin for WordPress (versions up to and including 1.10.1) lets unauthenticated remote attackers inject and execute arbitrary JavaScript in a victim's browser session. Exploitation is conditional on victim interaction - an administrator or site visitor must click a crafted link or load an attacker-influenced page - so there is no server-side compromise without that step; the assessed CVSS 3.1 score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). There is no CISA KEV listing and no public exploit identified at time of analysis, so this is a moderate-severity, broadly applicable WordPress plugin risk rather than a confirmed active campaign.
Reflected cross-site scripting in the WordPress plugin Quiz And Survey Master (slug quiz-master-next) through version 11.2.6 allows unauthenticated attackers to inject script that executes in a victim's browser after the victim clicks a crafted link or submits attacker-controlled input that the plugin then reflects. The issue is scored CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and independent assessment characterizes it as a genuine but moderate-priority web vulnerability: per the assessed vector, no authentication is required but successful exploitation depends on user interaction, and impact stays within the victim's browser/site security context rather than yielding direct server compromise. Risk is elevated when the lured victim is an authenticated administrator, because the injected script then runs with that user's privileges; no public exploit identified at time of analysis, and no KEV listing or product-specific EPSS estimate was supplied.
Unauthenticated cross-site scripting in the JetEngine WordPress plugin (versions 3.8.14.3 and earlier) allows a remote attacker to have attacker-controlled script execute in a victim's browser context once that victim loads an attacker-influenced page or crafted URL. Per the assessed vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, CVSS 7.1), no authentication is needed to deliver the payload, but exploitation requires victim interaction and the exact vulnerable feature or parameter is not disclosed in the advisory summary; impact scales with the privilege of the user who triggers it, making an administrator the highest-value target. Reported by Patchstack, this flaw has no public exploit code and no CISA KEV entry identified at time of analysis, and no EPSS signal was supplied.
Heap-based buffer overflow in RPM's package-header parsing lets a crafted, unsigned RPM overwrite memory when a victim merely inspects it with rpm2cpio, rpm2archive, or 'rpm -qlvp', giving an attacker-controlled heap write past a one-byte allocation (CWE-122, assessed CVSS 3.1 7.1). Affected code ships with RPM as distributed in Red Hat Enterprise Linux 6, 7, 8, 9, and 10 as well as Red Hat Hardened Images, so build farms, CI pipelines, package mirrors, and malware-analysis hosts that routinely open untrusted packages are the realistic exposure surface. Exploitation is local (AV:L), low complexity (AC:L), and unauthenticated (PR:N) but requires user interaction (UI:R) to invoke an rpm tool against the malicious file; signature verification is no barrier because the overflow happens during header decoding. No public exploit identified at time of analysis.
Memory exhaustion in OpenClaw Windows Node versions before 2026.7.1 lets a connected gateway peer crash the node process by streaming an unbounded sequence of WebSocket continuation frames that never set the EndOfMessage flag, driving limitless growth of the inbound message accumulation buffer until the process dies. The vulnerability is authenticated (CVSS PR:L) because the attacker must already hold a gateway session on the node's gateway WebSocket transport rather than merely reach an exposed port, and the impact is confined to availability - a process crash with no code execution, privilege escalation, or data exposure. No public exploit code has been identified at time of analysis, and the vendor has shipped 2026.7.1, which caps accumulated inbound messages at 32M UTF-16 characters and closes offending sockets with a MessageTooBig status.
Cross-site scripting in the JetFormBuilder WordPress plugin through version 3.6.5.4 allows unauthenticated attackers to supply crafted JavaScript that executes in the browser of any user who views or interacts with the affected page or link; the reported vector (PR:N/UI:R/S:C, CWE-79) means no login is needed to deliver the payload, but a victim must still be lured into triggering it, and the scope change indicates the script runs with the authority of the host WordPress site rather than an isolated context. This is a moderate-severity web vulnerability rather than a critical, mass-exploitable one: the attacker gains no server-side code execution, only the ability to act within the victim's browser session, and there is no public exploit code and no confirmed active exploitation (CISA KEV) identified at time of analysis. The limiting factors are the mandatory user interaction and the low-impact, browser-context nature of the flaw.
Cross-site scripting in the Branda WordPress white-labeling plugin (versions up to and including 3.4.32) allows a low-privileged Subscriber-level account to plant JavaScript that then executes in the browser of a higher-privileged user, such as an administrator, who views the affected content - potentially enabling session or administrative actions in that victim's context. The flaw is tracked as CVE-2026-102376 (EUVD-2026-90222), reported by Patchstack, with a published CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L); our assessment revises the privilege requirement to PR:L because the 'Subscriber' attack path assumes at least an authenticated low-privileged account, while impact remains confined to the browser JavaScript context (low confidentiality, integrity and availability). No public exploit identified at time of analysis, and there is no CISA KEV entry confirming active exploitation.
Unauthenticated cross-site scripting (XSS) in the BoldGrid Post and Page Builder WordPress plugin (versions <= 1.27.14) allows remote attackers to inject malicious scripts into pages viewed by victims, potentially leading to cookie theft or session hijacking in the victim's browser. Exploitation requires user interaction (UI:R) and the vulnerable plugin to be active, with impact confined to the browser context. No public exploit identified at time of analysis, and no active exploitation has been confirmed.
Unauthenticated cross-site scripting in the Photonic Gallery & Lightbox for Flickr, SmugMug & Others WordPress plugin at versions up to and including 3.36 lets an attacker inject script that executes in a victim's browser within the context of the affected WordPress site, with a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Because the vector is PR:N but UI:R, no credentials are needed to deliver the payload, yet the attack only lands if a victim loads attacker-supplied content or a crafted link that reaches the vulnerable plugin output path; impact is bounded to the client/browser scope (S:C) rather than direct server compromise, with meaningful damage requiring a targeted administrator session. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the plugin must be installed and actively rendering the affected gallery/lightbox functionality on a reachable page for exploitation to be possible.
Denial of service and kernel memory disclosure in the NVIDIA GPU Display Driver for Windows and Linux let a local, low-privileged user who already holds an interactive session on the host force the kernel-mode component to dereference an untrusted pointer, crashing the driver or leaking kernel memory. The flaw is scored CVSS 3.1 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) - a local-only, low-complexity attack requiring low-privilege authenticated access with no user interaction, delivering high confidentiality and availability impact but no integrity or write primitive, so it cannot by itself be chained into privilege escalation or code execution. No public exploit code has been identified and there is no confirmed active exploitation (no CISA KEV listing); the most exposed deployments are multi-user, VDI, and cloud-GPU hosts where untrusted users share a GPU, since the attacker must first obtain code execution or an interactive session on the GPU host.
Authenticated low-privileged local users can bypass cryptographic signature verification in the kernel-mode layer of the NVIDIA GPU Display Driver for Linux when the system is under memory pressure, leading to data tampering and denial of service. The flaw affects GeForce, RTX/Quadro/NVS, and Tesla driver branches on Linux; no public exploit code has been identified at time of analysis. Our assessment rates this as a genuine but bounded-priority local issue because the attacker must reliably induce a low-memory kernel state at the moment of verification, making exploitation opportunistic rather than dependable.
Unauthenticated reflected cross-site scripting (XSS) in Popup by Supsystic versions 1.13.1 and earlier allows remote attackers to inject malicious scripts that execute in a victim's browser when they interact with a crafted link or page. This affects WordPress sites with the plugin active, potentially leading to session hijacking, defacement, or data theft. The CVSS 3.1 score is 7.1 (High), and no public exploit code or active exploitation has been identified at the time of analysis.
Reflected cross-site scripting in the Ultimate Maps by Supsystic WordPress plugin (all versions through 1.5.5) lets remote, unauthenticated attackers execute arbitrary JavaScript in the browser of any user who is socially engineered into clicking an attacker-crafted link. The flaw is an output-encoding failure of class CWE-79 rated CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L); the attacker needs no credentials, but a victim with an active session on an affected site must be lured to the malicious page, and the resulting script runs in that site's origin. Impact is bounded to the browser context - script execution, possible session/token theft or content manipulation on the affected site - and does not by itself grant server-side code execution; there is no public exploit identified at time of analysis and no CISA KEV record for this CVE.
Unauthenticated cross-site scripting in the Easy Google Maps WordPress plugin (Supsystic, versions up to and including 1.14.6) allows remote attackers to inject and execute arbitrary script in a victim's browser session on any site where the plugin is installed and active. Exploitation requires the victim to interact - typically by clicking a crafted link or visiting an attacker-influenced page (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) - and the advisory does not disclose the specific vulnerable parameter or sink, which limits precise targeting but not the underlying flaw. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so this is a genuine but moderate-priority issue rather than an urgent one; impact escalates materially only when the interacting victim holds elevated privileges such as an administrator, where a single successful injection can lead to full site compromise.
Unauthenticated cross-site scripting in the WordPress plugin Ninja Forms (versions 3.15.3 and earlier) allows a remote attacker to have crafted script content rendered in a victim's browser session, with a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Exploitation requires the attacker to induce a victim - typically a logged-in administrator or a site visitor - to click a crafted link or load a malicious page, since the vector mandates user interaction (UI:R); no credentials are required (PR:N). Impact is confined to the victim's browser context (C:L/I:L/A:L) rather than server compromise, and no public exploit code or confirmed active exploitation was identified in the available data; the Patchstack report is the sole intelligence source provided, and the exact vulnerable parameter or endpoint is not specified, which limits precise targeting by defenders or attackers.
Unauthenticated cross-site scripting in Premmerce Permalink Manager for WooCommerce (versions 2.3.13 and earlier) allows remote attackers to inject script that executes in the context of a victim's browser when the crafted content is rendered. Because the CVSS vector carries PR:N with UI:R, no attacker credentials are required, but successful exploitation depends on a victim - typically a logged-in WordPress administrator - interacting with the attacker-influenced page, which is the primary limiting factor; the S:C scope-change flag means the injected script runs in a different security context (the admin session/browser) than the vulnerable plugin itself. No public exploit code or confirmed active exploitation was identified at time of analysis, and the site must be running WooCommerce with this specific plugin installed and active for exposure.
Unauthenticated cross-site scripting in the WPFunnels WordPress plugin at versions 3.13.1 and earlier allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser within the target site's origin once the victim loads or clicks a crafted link or request. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) confirms no authentication is required but that victim interaction is necessary, and the Changed scope means the injected script can affect resources beyond the vulnerable plugin while confidentiality, integrity, and availability impacts remain partial. No public exploit code and no active exploitation were identified at time of analysis, and the provided intelligence contains no CISA KEV listing and no EPSS score.
Reflected cross-site scripting in the Kreatura LayerSlider WordPress plugin (versions through 8.4.0) allows an unauthenticated remote attacker to inject script into a page response by luring a victim to a crafted URL that carries malicious input in a plugin request parameter; the payload is reflected back without proper output encoding. Because the CVSS vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, exploitation does not require authentication on the attacker's side but does require victim interaction (a click on the attacker-supplied link), and impact is confined to the victim's browser session within the target site's origin rather than the server. There is no public exploit identified at time of analysis and no CISA KEV listing, and the plugin is widely deployed across WordPress sites, so the practical risk lies in mass opportunistic scanning and targeted phishing rather than confirmed active exploitation.
Unauthenticated cross-site scripting in the WordPress Geo Mashup plugin affects all versions up to and including 1.13.21, allowing a remote attacker who can convince a logged-in or visiting user to follow a crafted link or submit crafted input to execute arbitrary script in that user's browser context. No authentication is required to reach the vulnerable code (CVSS vector PR:N), and the scope change (S:C) means injected script can act against the wider WordPress site rather than just the vulnerable plugin component, though exploitation is not autonomous because it depends on victim interaction (UI:R). No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the plugin's relatively niche deployment footprint plus the required social-engineering step are the main practical limiters on real-world risk.
Reflected cross-site scripting in the ThemeREX Addons WordPress plugin affects all versions below 2.45.0, allowing an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser within the affected site's origin. Exploitation requires user interaction (CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base score 7.1): the attacker must lure a victim to a crafted link or attacker-influenced page that triggers the injected payload, and success also depends on the site lacking a WAF or the patched plugin. There is no public exploit code identified at time of analysis and no confirmed active exploitation; impact is confined to the victim's browser session (low confidentiality, integrity and availability) rather than direct server compromise.
Unauthenticated cross-site scripting (XSS) in the Ad Inserter WordPress plugin through version 2.8.18 allows remote attackers to execute arbitrary script in a victim's browser via a crafted request, provided the victim is tricked into clicking a link or visiting an attacker-influenced page (CVSS 3.1 base 7.1 High, AV:N/AC:L/PR:N/UI:R/S:C). The flaw is network-reachable and requires no authentication, but the UI:R dependency limits mass exploitation; no public exploit code or confirmed active exploitation was identified at time of analysis. The specific injectable parameter is not named in the available data and should be confirmed from the Patchstack advisory.
Unauthenticated cross-site scripting in the Happyforms WordPress plugin affects every release through version 1.26.15, allowing an attacker to inject script that executes in a victim's browser when they view attacker-influenced content. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (7.1, High) confirms no authentication is required (PR:N) and no non-default configuration beyond an active plugin, but exploitation depends on a victim loading the crafted content (UI:R), so the attacker cannot compromise a site autonomously and impact stays within the browser/session context rather than server-side code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis; the only scoring signal available is the Patchstack-assigned CVSS 3.1 score, and the specific vulnerable form field or parameter has not been published.
Reflected cross-site scripting in the Parsi Date (wp-parsidate) WordPress plugin, affecting all versions up to and including 6.3, allows an unauthenticated remote attacker to inject script into a victim's browser by getting that user to load a crafted URL or request. Tracked as CVE-2026-96836 with a CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), the flaw carries low confidentiality, integrity and availability impacts because execution is limited to client-side script in the victim's session rather than server-side code execution, and exploitation requires victim user interaction (UI:R) since the target must click or load the malicious link. No public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (CISA KEV), though as a broadly deployed WordPress plugin it presents an attractive mass-scanning target for unauthenticated request campaigns.
Unauthenticated reflected cross-site scripting in GiveWP 4.16.9 and earlier allows remote attackers to inject arbitrary script into a victim's browser through crafted input that the WordPress plugin fails to properly output-encode. Exploitation requires the victim to interact with the attacker-controlled request (UI:R), and the CVSS 3.1 score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), so the attacker needs no credentials but must lure a user, ideally a privileged GiveWP administrator. The provided intelligence contains no CISA KEV entry and no public exploit code; no public exploit identified at time of analysis.
Stored/reflected cross-site scripting in the Awesome Support WordPress plugin (versions 6.3.9 and earlier) allows a low-privileged subscriber-level account to inject script that executes in the browser of an administrator or support agent who views the crafted content, enabling session theft, credential harvesting, or privileged actions performed in the victim's authenticated context. Rated CVSS 3.1 7.1 (HIGH), the flaw requires victim user interaction (UI:R) and, per the vulnerability description, a subscriber account to plant the payload, meaning sites that do not permit public registration are substantially less exposed; exploitation is scope-changing (S:C) because the script runs in the victim's session rather than the plugin's own context. No public exploit identified at time of analysis; there is no CISA KEV listing and no exploit code was observed in the supplied intelligence. Note that the published CVSS vector claims PR:N while the description and our assessment indicate a subscriber (authenticated) injection path - authentication requirements are therefore not fully confirmed from available data.