Improper input validation in the NVIDIA GPU Display Driver kernel-mode layer allows a local high-privileged attacker to achieve code execution, denial of service, privilege escalation, information disclosure, or data tampering. Affected products include GeForce, RTX/Quadro/NVS, and Tesla drivers on Windows and Linux. Exploitation requires administrator or root-equivalent access (PR:H), so risk is limited to scenarios where a high-privilege account is already compromised; no public exploit code is identified at time of analysis.
Improper input validation in the kernel-mode layer of the NVIDIA GPU Display Driver on Windows and Linux allows a local attacker who already holds high privileges to execute code, escalate privileges, disclose information, or crash the system. The flaw is not remotely reachable (AV:L) and requires existing HIGH privileges (PR:H) to reach the vulnerable kernel code path, with no user interaction needed; the resulting CVSS 3.1 base score is 6.7. There is no public exploit identified at time of analysis and no EPSS score or KEV listing was provided in the available intelligence, making this a moderate-priority local privilege-escalation/kernel-compromise primitive rather than an internet-facing emergency.
An out-of-bounds write in the firmware component of the NVIDIA GPU Display Driver for Windows and Linux lets a local attacker who already holds administrator or root privileges corrupt memory, with potential outcomes spanning code execution, escalation of privileges, denial of service, information disclosure and data tampering. Rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, CWE-787), the flaw affects GeForce, RTX/Quadro/NVS and Tesla products; exploitation requires local access to the host plus high existing privileges, and no public exploit code was identified at time of analysis, so real-world risk is moderate rather than urgent. No user interaction is required and there is no network attack path, which rules out remote exploitation entirely.
Out-of-bounds write in the NVIDIA GPU Display Driver for Linux kernel mode layer allows a local attacker who already holds high privileges (PR:H) to corrupt kernel memory, potentially achieving code execution, privilege escalation, denial of service, information disclosure, or data tampering. Affected driver branches cover GeForce, RTX/Quadro/NVS, and Tesla products below the fixed versions listed in NVIDIA's advisory, and the attack surface is local-only, so real-world risk is assessed as MODERATE-LOW. No public exploit identified at time of analysis.
Improper validation of an array index in the kernel-mode layer of the NVIDIA GPU Display Driver for Windows and Linux gives a local, already highly privileged attacker a path to full loss of confidentiality, integrity, and availability on the host. The flaw affects driver branches for GeForce, RTX/Quadro/NVS, and Tesla products below the fixed versions published in NVIDIA bulletin 5861, including 580.178.04, 582.78, 595.91.07, 596.86, 610.60, 610.88, 615.71.09 and 616.92 depending on the product line. Exploitation requires local access (AV:L) and pre-existing high privileges (PR:H) to reach the kernel-mode driver interface, with no user interaction and no network vector, so this is a local privilege/kernel-escalation primitive rather than an initial-access vector; no public exploit has been identified at time of analysis. Real-world risk is MODERATE-LOW despite the full-CIA impact assessment, because the attacker must already be highly privileged before the flaw can be touched.
An out-of-bounds write in the kernel-mode layer of the NVIDIA GPU Display Driver for Windows and Linux allows a local attacker who already holds high privileges (PR:H) to corrupt kernel memory, with the potential for code execution, privilege escalation, information disclosure, denial of service, and data tampering. Affected installations are those running GeForce, RTX/Quadro/NVS, or Tesla display drivers at versions below the fixed release for their branch (for example prior to 610.88, 582.78, 616.92, or 580.178.04), on either Windows or Linux. The CVSS 3.1 base score of 6.7 reflects the non-network, high-privilege access prerequisite rather than broad exposure; no public exploit code has been identified at time of analysis.
Improper input validation in the NVIDIA GPU Display Driver kernel-mode layer can be triggered by a locally present attacker who already holds high privileges, potentially yielding kernel code execution, denial of service, privilege escalation, information disclosure, or data tampering on Windows and Linux hosts. The affected code base spans all three major product lines - GeForce, RTX/Quadro/NVS, and Tesla - and NVIDIA has published branch-specific fixed driver versions for each. There is no confirmed active exploitation (the issue is not in CISA KEV) and no public exploit code identified at time of analysis; the dominant real-world constraint is that PR:H means this cannot be used for initial access, only by an actor who has already obtained elevated privileges on the host.
An out-of-bounds read in the NVIDIA GPU Display Driver kernel-mode layer on Windows and Linux lets a locally authenticated attacker who already holds high privileges trigger an unbounded string operation that reads beyond the end of an allocated buffer, with vendor-acknowledged consequences including code execution, denial of service, privilege escalation, information disclosure, and data tampering. The flaw (CWE-125, CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 6.7) affects GeForce, RTX/Quadro/NVS, Tesla, and vGPU guest driver builds below the fixed versions published in NVIDIA's 2026 advisory, and exploitation is strictly local - there is no network vector, no user interaction, and no non-default configuration requirement, only a privileged process on an affected host. Real-world risk is moderate and localized: no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so value to an attacker is mainly as a local privilege-escalation or kernel-tampering primitive after an initial foothold.
Kernel-mode out-of-bounds write in NVIDIA GPU Display Driver for Windows and Linux (GeForce, RTX/Quadro/NVS, Tesla, and vGPU guest drivers) allows a local attacker with high privileges to corrupt kernel memory, potentially leading to code execution, denial of service, privilege escalation, information disclosure, and data tampering. No public exploit has been identified at time of analysis. Affected driver branches include GeForce prior to 595.91.07, RTX/Quadro/NVS prior to 596.86, Tesla prior to 616.92, and vGPU guest drivers prior to vGPU 19.5/20.1, among others.
Authenticated administrators on Kiteworks Core deployments earlier than 9.5.1 can abuse the administrative interface to make the server issue requests to, and interact with, internal network services that should not be reachable through that interface - a server-side request forgery (SSRF) style weakness with a scope change (S:C) that still carries a moderate 6.6 base score. Exploitation is gated behind high privileges (PR:H) and, as the vendor and our assessment both note, does not by itself achieve remote code execution; meaningful impact would require chaining with a separate flaw. No public exploit has been identified at time of analysis, but a vendor patch is available in Kiteworks Core 9.5.1, so the primary risk is to organizations that expose the admin plane to untrusted networks or allow unrestricted egress from the appliance.
PHP Object Injection in the EWWW Image Optimizer WordPress plugin before 8.8.0 allows an authenticated user holding author-level or higher privileges to persist a serialized payload into a post meta field that the plugin unserializes when the post is rendered, which can escalate to remote code execution when a suitable POP gadget chain is reachable in EWWW itself or in another installed plugin or theme. Exploitation is conditional: it requires a valid author (or higher) account, the ability to write the offending meta value, and the affected post being rendered, and without a usable gadget chain the outcome stops at object injection rather than code execution. No public exploit code and no confirmed active exploitation have been identified at time of analysis (CISA SSVC records Exploitation: none and Automatable: no), and our independent assessment characterises this as a genuine but conditional risk.
Authenticated file-write abuse in Kiteworks Email Protection Gateway (versions before 9.5.1) lets an administrator holding only limited, delegated permissions place attacker-controlled content at arbitrary filesystem locations writable by the EPG service account, exceeding the privileges that role is meant to grant. Successful exploitation allows tampering with application files and configuration, or disruption of service availability, but carries no confidentiality impact and does not by itself yield code execution. Exploitation requires a valid delegated-admin account and session (CVSS vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H, base score 6.5), and no public exploit identified at time of analysis.
Path traversal in Mako before 1.4.2 on Windows allows an application that passes attacker-controlled template names or include paths to TemplateLookup.get_template() to read process-readable files outside the configured template directory, and in limited cases to parse and execute a targeted same-volume file as a Mako template. The flaw is unauthenticated per the CVSS vector (AV:N/PR:N) but high-complexity (AC:H) because the malicious URI must reach the lookup un-normalized - realistic channels are query strings, form/JSON bodies, route parameters, and dynamic include expressions - and Windows-only, since Linux/macOS use posixpath consistently; publicly available exploit code exists, with no CISA KEV listing. CISA's SSVC rates exploitation as PoC, automatable: no, technical impact partial, making this a real but conditional issue concentrated in Windows deployments that echo raw user input into template resolution.
Authenticated users of Kiteworks Email Protection Gateway versions before 9.5.1 can read the subject, message body, and attachments of large file exchange packages they neither sent nor received. Exploitation requires a valid account (PR:L) and the optional large file exchange feature to be enabled and in use; no public exploit has been identified at time of analysis. The flaw is rated moderate severity (CVSS 6.5), with confidentiality-only impact and a vendor patch available in 9.5.1.
Kiteworks Core appliances running versions before 9.5.0 leave their setup interface reachable without authentication once initial configuration has completed, so any remote attacker with network access to that interface can read and modify a limited set of setup records - specifically the contact name and email address captured during provisioning. The flaw is state-dependent: authentication is enforced during first-run provisioning but the interface remains exposed afterward, and the exposed data is narrow, with no code execution, no broader configuration control, and no availability impact. No public exploit code has been identified at time of analysis, and there is no evidence of active exploitation; the practical risk is gated by whether the appliance's setup or management plane is reachable from untrusted networks.
Exposure of restricted data in Optimole 4.2.14 and earlier lets authenticated WordPress Subscriber-level users read information they should not access via a broken access control flaw (CWE-862). This is a genuine but moderate-priority issue: exploitation requires a valid Subscriber account or above, no user interaction, and yields confidentiality impact only; mass exploitation is most practical where open user registration or another route to a low-privilege account exists. No public exploit identified at time of analysis, and the Patchstack advisory is the primary reference.
Credential disclosure in JetBrains YouTrack before 2026.2.19197 lets an authenticated user who can edit an existing integration's configuration URL redirect the integration's stored credentials to an attacker-controlled endpoint by simply changing that URL. The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects a network-reachable, low-complexity, low-privilege flaw with high confidentiality impact and no integrity or availability effect, consistent with a credential-theft bug rather than code execution or full takeover; no public exploit identified at time of analysis, and no exploitation status is confirmed by CISA KEV for this CVE.
Authenticated users of JetBrains Hub can send arbitrary emails from the server's trusted address due to a missing authorization check in versions before 2026.2.52366. The flaw requires a valid low-privilege Hub account (PR:L) and network reachability to the instance, but no user interaction; it allows spoofing outbound email, which can damage trust in the organization's sender identity. No public exploit has been identified at time of analysis, and the vendor has released a patch.
Cross-site scripting in the Cool Formkit Lite WordPress plugin (all versions up to and including 2.7.8) allows a user holding a Contributor-level account to supply content that executes as script in the browser of a higher-privileged user who renders it, enabling theft of session data or other scripted actions in the victim's authenticated context. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, 6.5) requires both an existing low-privileged account on the target site and victim interaction, so this is a moderate, not high-priority, issue that does not affect sites where Contributor accounts cannot be obtained or where privileged users never view attacker-controlled input. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and the impact is bounded to low confidentiality, integrity and availability effects scoped to the vulnerable component.
Cross-site scripting in the Strong Testimonials WordPress plugin (versions through 3.3.11) lets an authenticated attacker with Contributor-level privileges on a WordPress site inject content that executes as script when a victim-typically an administrator or editor-views the affected page or admin screen. Exploitation requires both a valid low-privilege account and victim interaction, which materially narrows real-world risk; no public exploit was identified at time of analysis and no CISA KEV listing or EPSS signal accompanies this CVE. The result is a moderate-severity, low-priority issue whose main danger is privilege escalation or session abuse against higher-privileged users on multi-author sites.
Cross-site request forgery in Moodle's XML grade import lets a remote, unauthenticated attacker set or overwrite student grades by luring a user with grade-management permissions (teacher, manager, or administrator) into visiting an attacker-controlled page while their Moodle session is active. The flaw, tracked upstream as MDL-84545 and rated CVSS 6.5, depends on user interaction and affects grade integrity only, with no confidentiality or availability impact, and no public exploit code has been identified at time of analysis. Exploitation is constrained further by the fact that the forged request only succeeds if the victim's browser still transmits Moodle session cookies cross-site, an increasingly limited condition under modern SameSite cookie defaults.
JetBrains Rider versions before 2026.2.1 allow the bundled AI Assistant to silently auto-update third-party skills - downloaded plugin-style capability packages that extend the assistant - without prompting the user or verifying the integrity of the update, enabling an attacker who controls or compromises a skill source the developer already trusts to push malicious skill content into the IDE. Exploitation is constrained: it requires the victim to run an affected Rider build with AI Assistant enabled and at least one third-party skill installed from an attacker-influenceable source, which is why the vector carries high attack complexity (AC:H) and only low confidentiality and integrity impact with no availability impact. No public exploit code has been identified at time of analysis, and no confirmed active exploitation (CISA KEV) applies; a vendor patch is available in Rider 2026.2.1.
Stored cross-site scripting (XSS) in the JetEngine WordPress plugin, versions through 3.8.15.3, allows an authenticated user with low-level privileges to persist malicious JavaScript that executes in the browser of any user who subsequently views the affected page. The flaw carries a CVSS 3.1 base score of 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting a scope change with limited confidentiality and integrity impact. Exploitation requires an existing authenticated account on the target WordPress site plus victim interaction, and no public exploit identified at time of analysis; this is a moderate-severity, low-real-world-priority issue.
Unauthenticated attackers can exploit a broken access control flaw in the Ultimate Maps by Supsystic WordPress plugin through version 1.5.5, allowing network-reachable actions that should be restricted to authorized users. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, base 6.5) indicates low confidentiality and integrity impact with no availability impact, and the provided intelligence contains no CISA KEV entry and no public exploit identified at time of analysis. Sites are affected only if the plugin is installed, active, and its vulnerable endpoint is reachable; the plugin's niche deployment and the lack of a documented privileged action limit, but do not eliminate, mass-exploitation risk.
Stored cross-site scripting in the WordPress plugin User Submitted Posts (all versions through 20260810) allows an attacker who can reach the plugin's user-submission workflow - including a low-privileged authenticated account or an anonymous visitor where front-end submissions are enabled - to persist malicious script content that executes when a victim loads the affected page. Exploitation requires the victim, typically an administrator or editor reviewing submitted content, to interact with the poisoned page (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, 6.5), and because the payload is injected into a rendered page with scope change, a successful attack can act in the victim's session context rather than the attacker's. There is no public exploit identified at time of analysis and the plugin is not listed as confirmed actively exploited (CISA KEV); the exact vulnerable submission field is not identified in the available data.
Authenticated (Subscriber-level) cross-site scripting in WP Photo Album Plus 9.3.02.003 and earlier lets any logged-in user with only Subscriber privileges store script payloads that execute in the browser of a higher-privileged user - typically an administrator - who views the affected page. Because the payload persists in plugin-managed content, the victim must simply load the page (UI:R), and successful execution occurs in the administrator's session context (scope change, S:C), enabling limited confidentiality, integrity, and availability impact. Exploitation requires a valid low-privileged account, so sites with open registration or self-service sign-up are the most exposed; no public exploit code has been identified at time of analysis and there is no CISA KEV listing, making this a genuine but low-to-moderate priority issue.
Stored cross-site scripting (XSS) in the CF7 Views - Complete Entry Management for Contact Form 7 plugin (versions <= 3.2.5) enables an authenticated Contributor-level user to inject malicious scripts that execute in the browser of a higher-privileged victim who views the crafted entry or view. The CVSS v3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting the need for authentication and user interaction, and the potential for limited confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at the time of analysis.
Authenticated stored cross-site scripting in the King Addons for Elementor WordPress plugin (versions up to and including 51.1.86) allows an attacker holding a Contributor-level account to inject a script payload through an insufficiently sanitized addon widget or field, which then executes in the trusted wp-admin origin when a higher-privileged user (editor or administrator) views or previews the affected content. Rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), the flaw requires both an authenticated Contributor account (PR:L) and victim interaction (UI:R), so it is not remotely exploitable by anonymous visitors and does not self-execute. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the vulnerability was reported via Patchstack's WordPress plugin disclosure channel.
Stored cross-site scripting in YITH Tab Manager (YITH WooCommerce Tab Manager) versions up to 2.15.0 allows an authenticated attacker with Author-level privileges to inject persistent JavaScript into tab content that executes when a higher-privileged user views the affected page. The vulnerability is rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) and requires user interaction, meaning a separate victim must view the malicious tab. No public exploit code has been identified at time of analysis, and CISA KEV does not list this CVE.
Cross-site scripting in the WordPress OAuth Server plugin (oauth2-provider) through version 4.5.1 lets an authenticated Contributor-level user inject script that executes in the browser of a higher-privileged victim who views the affected page. Because exploitation requires a valid low-privilege account plus victim interaction, exposure is limited on sites that do not allow untrusted registration or Contributor roles, and the issue is a moderate-severity, low-real-world-priority one (CVSS 6.5). No public exploit code was identified at time of analysis, and the specific vulnerable field or parameter is not documented in the available Patchstack advisory.
Stored cross-site scripting (XSS) in the Polylang WordPress plugin (versions up to and including 3.8.9) allows authenticated attackers with Contributor-level access to inject malicious scripts that execute when a higher-privileged user views the crafted content. Exploitation requires victim interaction, such as viewing a page or post, and no public exploit code or active exploitation has been identified at time of analysis. The CVSS score is 6.5 (moderate), and the risk is assessed as low due to the requirement for a trusted account and user interaction.
Cross-site scripting in the CMB2 WordPress plugin affects all versions up to and including 2.13.0, allowing an attacker with only Subscriber-level access to inject script that executes inside a privileged user's browser session. Successful exploitation requires the target site to permit low-privilege accounts (most impactful where open self-registration is enabled) and requires a victim to view the injected content, matching the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L (6.5 Medium); because the scope changes, injected script runs in the context of the site origin rather than a sandboxed component. No public exploit code or confirmed active exploitation was identified at time of analysis, and the impact is limited to browser-side script execution rather than server-side code execution.
Cross-site scripting (XSS) in the Virtue/Ascend/Pinnacle Toolkit WordPress plugin allows an authenticated Contributor-level user to inject malicious script that executes in a higher-privileged user's browser when they view the crafted content, potentially leading to session theft or unauthorized actions. The vulnerability affects versions up to and including 4.9.12.1 and requires user interaction (UI:R) combined with Contributor access (PR:L), with a CVSS 3.1 base score of 6.5. No public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in the Visual Composer Website Builder WordPress plugin through version 45.16.2 lets an authenticated user with Contributor-level access or higher inject script that executes in the browser of another, typically higher-privileged, user who views or previews the crafted content. Attackers need a valid low-privilege account on the target site and must induce a victim to interact with the poisoned page, which limits practical exposure; the flaw carries a CVSS 3.1 base score of 6.5, and no public exploit code was identified at time of analysis. Sites running the affected plugin version with open contributor registration or untrusted author roles carry the greatest risk.
Unauthenticated attackers can exploit a broken access control flaw in the Blocksy Companion WordPress plugin versions up to and including 2.1.55, allowing them to bypass authorization and access or modify limited site data. The vulnerability is remotely exploitable without authentication or user interaction (CVSS 6.5), and it affects any default WordPress installation with the vulnerable plugin. No public exploit code has been identified at the time of analysis, and the impact is constrained to low confidentiality and integrity effects.
Broken access control in the MCP Content Manager Lite WordPress plugin (versions through 1.1.0) allows an authenticated attacker holding only a Subscriber-level account to modify content that should require higher privileges, with CVSS 6.5 reflecting a high integrity impact but no confidentiality or availability loss. Exploitation is network-remote, low-complexity, and requires no user interaction, but it is gated by the need for a valid low-privileged login (CVSS PR:L), making it most realistic on sites that allow open or self-service user registration; the plugin's niche install base further limits opportunistic abuse. No public exploit code or confirmed active exploitation was identified at time of analysis.
Cross-site scripting in ThemeREX Addons (the trx_addons WordPress plugin) below version 2.45.0 lets an authenticated attacker with only a Subscriber-level account inject script content that executes in the browser of any higher-privileged user who views it, enabling session theft or actions performed in the victim's context. Reaching the vulnerable input requires a Subscriber account - trivially obtainable when open WordPress registration is enabled - and successful exploitation is further gated by victim interaction, so an unauthenticated remote attacker cannot exploit a hardened site with registration disabled. No public exploit code or confirmed active exploitation was identified at time of analysis.
Cross-site scripting in EWWW Image Optimizer 8.7.7 and earlier allows an authenticated WordPress user with Contributor-level permissions to inject script content that executes in a higher-privileged user's browser when that user interacts with the affected page. The flaw has a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), and successful exploitation requires a pre-existing Contributor account plus victim interaction; impact is limited to low confidentiality, integrity, and availability effects in the victim's session. No public exploit code or CISA KEV active-exploitation entry was identified in the provided intelligence.
Stored cross-site scripting in the King Addons for Elementor WordPress plugin (versions through 51.1.85) allows an authenticated attacker with Contributor-level privileges or higher to inject JavaScript that executes in the browser of a higher-privileged user - typically an administrator - who views or previews the crafted content. Exploitation requires an existing low-privilege account plus a separate, subsequent user-interaction step (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), and the scope change (S:C) reflects that the script runs with the victim's privileges rather than the attacker's, enabling session or content tampering in an administrative context. This is a moderate-risk, real-world-low-priority issue: there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis.
GiveWP versions up to and including 4.16.9 expose sensitive donor-related data to any authenticated low-privilege user, because a plugin endpoint performs no authorization check before returning the data. The issue is a broken access control flaw (CWE-862) rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) by Patchstack, meaning an attacker needs only a Subscriber-level account and no user interaction, with confidentiality as the sole impacted metric. Sites that leave WordPress self-registration open are the most exposed, while sites with registration disabled and no attacker-controlled low-privilege accounts are substantially harder to exploit; no public exploit code or confirmed active exploitation was identified at time of analysis.
Cross-site scripting in The Plus Addons for Elementor Page Builder Lite (versions up to and including 6.5.1) lets an authenticated user holding Contributor-level access on a WordPress site inject script that executes when a higher-privileged user views the affected content. Exploitation is not automatic: it requires the victim to render the injected content (UI:R), so the practical impact is script execution in the victim's browser session - session or token theft, content manipulation, or actions taken as the victim - rather than direct server compromise. Scoring CVSS 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), this is a moderate, real-world-low-priority issue, and no public exploit code or confirmed active exploitation (not listed in CISA KEV) was identified at time of analysis.
Authenticated Subscriber-level users can modify other users' booking-related objects in the Bookly WordPress plugin through version 28.2 due to an Insecure Direct Object Reference (IDOR) flaw, enabling unauthorized integrity impact without confidentiality or availability loss. The vulnerability requires a low-privileged account (PR:L) and network access (AV:N) with no user interaction (UI:N), scoring 6.5 on CVSS 3.1. No public exploit or active exploitation is confirmed (CISA KEV absent), and the Patchstack advisory is the primary reference for remediation.
Cross-site scripting in Profile Builder versions through 4.0.2 lets an authenticated Subscriber-level user inject script that executes when another user views the affected page, requiring victim interaction. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L gives a moderate 6.5 severity; no public exploit identified at time of analysis, and the risk is moderate rather than urgent.
Stored cross-site scripting in WooCommerce Pixel Manager through version 1.69.0 allows an authenticated user with at least Contributor-level WordPress access to inject malicious scripts that execute when a higher-privileged user views the affected content. Exploitation requires WooCommerce and the Pixel Manager plugin to be active, and it is not possible anonymously because a Contributor account must first be obtained or already exist. No public exploit code or CISA KEV activity was identified at time of analysis, and the issue is assessed as moderate severity with limited real-world priority.
Stored cross-site scripting in the Safe SVG WordPress plugin through version 2.5.0 allows an authenticated user holding at least the Contributor role to embed script content in an uploaded SVG file, which then executes in the browser of a higher-privileged user (editor or administrator) who views the media item or a post containing it. The vulnerability carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting the requirement for a Contributor-level account and victim interaction, with impact scoped to the privileged user's session. No public exploit code was identified at time of analysis and there is no indication of confirmed active exploitation (CISA KEV); exposure is limited to sites that grant untrusted users Contributor-or-higher accounts or that leave SVG uploads enabled for such users.
Missing authorization checks in the Simply Schedule Appointments WordPress plugin through version 1.6.12.29 let unauthenticated remote users reach plugin functionality that should require a privileged role, exposing and potentially altering appointment-related data. Because the CVSS vector is PR:N/UI:N with AV:N/AC:L, any internet-facing WordPress installation running an affected version of the plugin needs no credentials, no user role, and no victim interaction to be targeted; the assessed impact is bounded to Low confidentiality and Low integrity loss rather than code execution, privilege escalation, or site takeover. There is no CISA KEV listing and no public exploit code identified at time of analysis, and no vendor-released patch version is identified in the available data, so this is a genuine but moderate-priority issue that should be triaged against the actual presence and reachability of the plugin.
Stored cross-site scripting in the Happy Addons for Elementor WordPress plugin (versions up to and including 3.23.1) allows an authenticated user holding the Contributor role or higher to persist malicious script through plugin-supplied input, which then executes in the browser session of a higher-privileged user such as an Editor or Administrator when that user views or previews the injected content. The flaw is rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting a network-reachable, low-complexity attack that nonetheless requires a low-privilege authenticated foothold (PR:L) plus victim interaction (UI:R) and crosses a trust boundary (S:C); impact is limited to low confidentiality, integrity and availability. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is a credential-gated, user-interaction-dependent issue rather than an anonymous remote compromise.
Cross-site scripting in the WordPress plugin Qi Addons for Elementor (versions up to and including 1.11) allows an authenticated user holding at least Contributor privileges to supply content that is later rendered without adequate output encoding, causing arbitrary script to execute in the browser session of whichever higher-privileged user views the affected page or widget. The impact is bounded by the required Contributor account and the victim-interaction (UI:R) prerequisite, and the scope-change flag (S:C) reflects that the script runs in the context of the surrounding administrative interface rather than across a trust boundary of the plugin itself. No public exploit code has been identified at time of analysis and the flaw is not recorded in CISA KEV, so this is a moderate, not high, priority; the exact addon widget, request parameter, and output sink have not been disclosed by the reporter (Patchstack), so the precise injection point still requires vendor confirmation.
Stored cross-site scripting in the Premium Addons for Elementor WordPress plugin (versions 4.11.105 and earlier) allows a Contributor-level account to embed script-bearing content that executes in the browser of a higher-privileged user who later views or renders it, enabling session/token theft or privileged actions in that user's context. Rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, CWE-79), the issue is a genuine but modest-priority risk: it requires an authenticated Contributor account, an active Elementor plus Premium Addons installation, and victim interaction, so it does not affect default installs without contributor-level access or patched versions above 4.11.105. No public exploit identified at time of analysis, and no CISA KEV entry or EPSS signal was provided in the source data.
Authenticated SQL injection in the WP Directory Kit plugin for WordPress (all versions up to and including 1.5.4) lets an attacker who holds the plugin's 'custom-level access' role or higher append arbitrary SQL into an existing query through the 'data_fields_list' parameter, reading sensitive data out of the WordPress database. The issue is network-reachable, low complexity, and requires no user interaction, but it is gated by the authentication/privilege prerequisite (PR:L), so it cannot be mass-exploited without a prior account; impact is limited to confidentiality (C:H) with no integrity or availability effect. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; no EPSS score was supplied with the intelligence.