Stored cross-site scripting in the Kubio AI Page Builder WordPress plugin before 2.9.3 lets unauthenticated attackers submit HTML markup that passes the plugin's content filtering and is later executed by the plugin's own front-end script in the browser of any site visitor, or of an administrator reviewing the still-unapproved submission. The flaw is one of scope: the widened HTML element allowlist the plugin applies for its editor context is also applied when filtering content submitted by unauthenticated users, so markup that should never survive sanitisation does. Publicly available exploit code exists (referenced by WPScan), but EPSS is only 0.17% (6th percentile) and CISA's SSVC assessment records no exploitation and no automatable path, so this is a moderate-priority patch rather than an emergency; the vendor-published CVSS of 8.8 (S:U) is more severe than our independently assessed vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, and the difference is largely scope and impact rating rather than exploitability.
Authenticated users holding editor privileges on wcms through 3.18.0 can turn the media upload API into a remote code execution primitive: the [*:path] parameter of POST /api/v0/media/upload/ is not validated, so an editor can write .php files into a web-served location (including outside the media directory via encoded ../ sequences) and have the web server execute them. The same unvalidated path on DELETE /api/v0/media/[*:path] additionally allows arbitrary file deletion, and the underlying flaw is an unrestricted upload of a dangerous file type (CWE-434) rated CVSS 4.0 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H). Exploitation is not anonymous - a valid editor account is mandatory (PR:L) and code execution further depends on the written PHP landing in a directory the web server executes; at time of analysis there is no CISA KEV entry and no public exploit identified at time of analysis.
Improper privilege management in LaraDashboard before 1.4.8 lets an authenticated Admin-tier user who holds the role.edit permission escalate to Superadmin by renaming or editing roles, or by granting themselves user.login_as rights, which then exposes account takeover and the core-upgrade and module-installation functions needed for code execution. The pre-patch guard in RoleController only refused Superadmin role tampering when the application ran with demo_mode enabled and the role name was literally 'Superadmin', so ordinary production deployments are exposed to any role-management holder by default. Exploitation is access-gated rather than anonymous: it requires a pre-existing Admin account with role.edit, no user interaction is needed, and no public exploit has been identified at time of analysis; the vendor has released the 1.4.8 patch.
Unauthenticated SQL injection in the SaveTo Wishlist Lite WordPress plugin before 1.1.5 allows remote attackers to append arbitrary SQL queries to the ORDER BY clause of a database query, enabling extraction of sensitive information from the WordPress database. Publicly available exploit code exists, though EPSS is low (0.17%, 6th percentile) and there is no indication of active exploitation (CISA KEV not listed). The vendor has released a patch in version 1.1.5.
Unauthenticated attackers can seize a privileged point-of-sale session on WordPress sites running the TillKit plugin before 1.0.5, letting them read customer and site-user personal data and modify store records. On activation the plugin creates a privileged POS account protected by a hard-coded, publicly known PIN that it never forces administrators to change, and its public POS login endpoint authenticates on that PIN alone with no identity or capability check (CWE-287); the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N confirms this is remotely reachable with no credentials and no user interaction. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV) and EPSS is low at 0.14% (3rd percentile), so real-world urgency depends on whether TillKit is actually deployed and whether the default PIN is still in place.
TOTP replay in the WP 2FA WordPress plugin (versions before 4.1.0) allows an attacker who already knows an account's password and can capture a valid time-based one-time passcode within its ~30-second validity window to reuse that same code and complete login without ever knowing the second factor - including on administrator accounts. The defect (CWE-287, improper authentication) is that consumed codes are never invalidated, so replays succeed while the code is still live; this does not allow bypass from scratch, since it requires prior credential compromise plus real-time observation of a code via phishing, a proxy, MITM, or logging. Exploitation is conditional and targeted rather than scalable, consistent with the assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N (7.5) and the very low EPSS of 0.19% (8th percentile); publicly available exploit code exists, but there is no CISA KEV evidence of active exploitation. The vendor has released a fix in WP 2FA 4.1.0, and the issue is tracked as EUVD-2026-91934.
Stored cross-site scripting in the WP Ultimate Review WordPress plugin before 2.4.4 lets unauthenticated visitors inject script through the plugin's public review form, which then runs in the browser of any user - including administrators - who later views the front-end page rendering that review. Publicly available exploit code exists, but the issue is not in CISA KEV and EPSS is only 0.17% (6th percentile), indicating low predicted exploitation activity. Consistent with the independent assessment (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), exploitation is not automatic: the plugin's user-review feature must be enabled and a victim must actively view the poisoned review page, making this a moderate rather than emergency priority.
Unauthenticated attackers can persistently disable affected pages on WordPress sites running the WP Ultimate Review plugin before 2.4.4 by submitting crafted review content that is stored and then triggers a fatal error on every subsequent page load. Confirmed exploitation conditions require the plugin to be installed and its review display settings to have never been saved (default unconfigured state); no authentication, user interaction, or non-default toggles are needed, and the impact is availability-only with no data compromise. Publicly available exploit code exists (documented by WPScan), and a vendor-released patch is available in version 2.4.4, so the practical exposure is limited to sites that have not yet saved their review display settings; EPSS is low at 0.16% (4th percentile), indicating a genuine but moderate-severity availability issue rather than a top-tier emergency.
Unauthenticated visitors can persistently break front-end page rendering on WordPress sites running the WP Ultimate Review plugin before version 2.4.4 whenever the plugin's user-review submission feature is enabled. A submitted review rating that is not a valid number is stored without validation and later fed into numeric operations during review rendering, producing a PHP fatal error that blocks the affected content for every visitor until an administrator deletes the offending review. Exploitation is trivial and publicly available exploit code exists via the WPScan advisory, but the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and the assessed profile confine impact to availability, and EPSS is only 0.16% (4th percentile), so this is a moderate, not critical, operational priority - configuration-gated, low-severity-per-event, and fully reversible by removing the injected review.
Unauthenticated SQL injection in the WordPress plugin Unlimited Elements for Elementor (versions 1.5.139 through before 2.0.21) allows remote attackers to read non-public content from the site database by supplying a crafted search value that the plugin mishandles when rewriting an already prepared SQL statement. Exploitation is conditional: a related widget option must be set away from its default value for the vulnerable code path to be reachable, which is why the assessed vector carries AC:H despite PR:N and UI:N, and why impact is limited to confidentiality (C:H) with no integrity or availability effect. Publicly available exploit code exists, but EPSS is low at 0.18% (7th percentile) and there is no KEV listing, so this is a real but conditional, moderate-priority issue rather than a top-tier emergency.
Authenticated arbitrary file read in the MPG WordPress plugin (versions before 4.2.3) allows a user holding the Editor role or higher to supply a local filesystem path in the project import 'dataset source' field, which the plugin copies into the public uploads directory where any unauthenticated visitor can then retrieve it. The issue is a path traversal (CWE-22) rated CVSS 6.8 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N), and publicly available exploit code exists; EPSS is low at 0.16% (5th percentile) and there is no CISA KEV listing for this CVE. Because exploitation requires a privileged account, the practical impact is a high-privilege arbitrary file read whose severity depends on what files the web server process can read, rather than a remote-unauthenticated compromise.
Path traversal in Loco Translate WordPress plugin before 2.8.9 (CVSS 6.8) lets authenticated users who hold the plugin's translator capability read certain file types from arbitrary server paths, including outside the web root. Publicly available exploit code exists, but CISA KEV does not list active exploitation; EPSS is 0.16% (4th percentile) and SSVC rates exploitation as none, making this a real-but-not-urgent issue. Because the attacker must already have the translator capability (PR:H), anonymous and default low-privileged visitors cannot trigger it.
Stored cross-site scripting in the Loco Translate WordPress plugin before 2.8.9 allows an authenticated attacker with the plugin's translator capability or higher to inject unsanitized bundle configuration values that are later rendered in an admin page, executing script in the browser of a high-privilege user such as an administrator who views that page. The vulnerability is tracked as CVE-2026-94239 and publicly available exploit code exists, though EPSS is low at 0.15% (4th percentile) and there is no CISA KEV confirmation of active exploitation. Real-world risk is moderate because exploitation requires a delegated translator-level account and a privileged victim to load the poisoned admin page, making it a second-tier priority rather than an emergency.
Stored cross-site scripting in the Kubio AI Page Builder WordPress plugin (all versions before 2.9.3) lets a user holding the contributor role or higher save a link whose target uses an unvalidated URI scheme - such as javascript: - so that the payload executes in the browser of any person who follows that link, most damagingly an administrator previewing the contributor's unpublished submission. Publicly available exploit code exists, so reproduction is straightforward for anyone with contributor-level access on a site that grants untrusted users that role (self-registration enabled or another route to an account); exploitation additionally requires the admin to preview or click the crafted link, which is why CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no'. EPSS is low at 0.15% (4th percentile) and there is no indication of confirmed active exploitation (no CISA KEV listing), though successful execution against an admin session could yield full site takeover given the privileges at stake.
Authenticated path traversal in the Unlimited Elements for Elementor WordPress plugin before 2.0.21 lets a privileged user (Administrator by default, or Editor when a specific non-default plugin setting is enabled) plant arbitrary files - including executable PHP - outside the intended upload directory, which can escalate to remote code execution. Exploitation requires two conditions to hold simultaneously: the attacker must already hold an account with access to the plugin's asset-management feature, and the target server must not have the PHP zip extension installed, since only the unsanitized fallback extraction path is vulnerable. Publicly available exploit code exists (tracked via WPScan), but EPSS is only 0.22% (11th percentile) and there is no CISA KEV confirmation of active exploitation, so this is a genuine but constrained risk rather than an urgent widespread threat; a vendor patch is available in version 2.0.21.
Stored cross-site scripting in the WordPress plugin WP Ultimate Review affects all versions before 2.4.4, where some review overview settings are written into post output without escaping. An authenticated user holding a role as low as Author can inject a persistent script payload, but only when the plugin's non-default 'author reviews' feature is explicitly enabled and only when another user - an administrator or site visitor - later renders the affected post. Publicly available exploit code exists and the WPScan/WordPress ecosystem has published an advisory, though EPSS is very low at 0.16% (5th percentile) and there is no evidence of active exploitation; this is a moderate, low-priority issue in practice given the required privileges and operator-configured precondition.
Blind SQL injection in the Unlimited Elements for Elementor WordPress plugin (all releases before 2.0.21) allows an authenticated attacker to pass a crafted parameter that is concatenated into a SQL statement without sanitisation or escaping, letting them infer and read arbitrary data from the site database. On versions before 2.0.18 a Subscriber-level account is enough, which is significant on sites that permit open user registration, while versions 2.0.18 through 2.0.20 require a Contributor-level account or higher because 2.0.18 removed the subscriber-accessible code path. Publicly available exploit code exists, but the assessed CVSS is 6.3 with AC:H due to the slow, inference-based blind technique, EPSS is only 0.16 percent (4th percentile), SSVC records no observed exploitation, there is no CISA KEV listing, and a vendor patch (2.0.21) is available, so this is a moderate, authentication-gated risk rather than an emergency.
Unauthenticated spacecraft command injection and telemetry exfiltration in NASA-AMMOS AIT-Core through 3.1.1: the ait-server ZeroMQ telemetry and command broker binds its XSUB (TCP 5559) and XPUB (TCP 5560) sockets to all network interfaces by default with no authentication or transport security, so any unauthenticated remote attacker with a network path to the ground bus can publish onto internal topics including __commands__, push forged commands through command_stream onto the command-uplink UDP path, subscribe to live command and telemetry traffic, or disrupt the bus outright. The assessed CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting unauthenticated, low-complexity remote exploitation that fully compromises confidentiality, integrity, and availability of the command and telemetry path; no public exploit code has been identified at time of analysis, and this CVE is not in CISA KEV. The exposure is conditional on the shipped default configuration - exploitation requires network reachability to ports 5559 and/or 5560, which is typically an isolated or segmented mission network rather than the public internet - and the fix is AIT-Core 3.1.2, which rebinds these ZeroMQ sockets to loopback by default.
Authenticated low-privileged users of ConvertX before 0.19.0 can execute arbitrary Python code on the server by submitting a crafted Calibre recipe file to the conversion workflow. The flaw resides in converters/calibre.ts, which passes .recipe and .downloaded_recipe files to Calibre's ebook-convert without blocking executable recipe code (CWE-829), leading to high confidentiality, integrity, and availability impact; severity depends on the account running the conversion (root before 0.19.0, reducible with the new PUID/PGID setting). No public exploit was identified at time of analysis, and the vendor has released a fix in v0.19.0 as documented in advisory GHSA-m4hh-rqmf-c8hw.
Unauthenticated attackers can modify or delete other customers' stored abandoned-cart records in the Mailchimp for WooCommerce WordPress plugin versions before 6.3, because the plugin processes cart identifiers supplied in the request without requiring authentication, a nonce, or an ownership check. Any remote actor who can reach the affected endpoint and knows or enumerates a valid cart identifier can tamper with another shopper's saved cart. Publicly available exploit code exists, though no confirmed active exploitation has been reported (CISA SSVC exploitation: none), and EPSS remains low at roughly 0.18% (7th percentile). Impact is bounded to low integrity loss - no confidentiality disclosure or server compromise - yielding a moderate CVSS of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
Unauthenticated information disclosure in the MetForm WordPress plugin before 4.3.1 exposes stored form submission data through the plugin's REST API, allowing anyone who can reach the site's REST endpoints to read submitter information without logging in. Exploitation is trivial - the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N confirms network reachability, low complexity, no authentication and no user interaction - and publicly available exploit code exists, though there is no indication of confirmed active exploitation (not in CISA KEV) and EPSS is low at 0.14% (3rd percentile). Impact is confined to confidentiality: only data that submitters previously entered on forms installed before 4.3.1 can be read, with no integrity or availability effect, making this a genuine but moderate-severity issue rather than a critical priority.
Unauthenticated arbitrary file deletion in the VikAppointments Services Booking Calendar WordPress plugin (all versions up to and including 1.2.21) lets a remote attacker specify a server file path that the plugin will remove without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, 9.1), which can escalate to full site takeover when a critical file such as wp-config.php is deleted. Exploitation is conditional: the site must have published at least one File-type custom field on the confirmation-page shortcode, a configuration that is not created by default during plugin installation, so stock deployments are not directly reachable. No public exploit code was identified and the issue is not listed in CISA KEV at time of analysis, but the low complexity and unauthenticated reachability make prompt patching important on any site that uses custom File-type booking fields. Reported by Wordfence via the CVE program.
Bouncy Castle for Java's Messaging Layer Security (MLS, RFC 9420) implementation before 1.86 fails to bind an X.509 credential to a LeafNode's signature_key, allowing an unauthenticated remote attacker to present a victim's certificate while signing the LeafNode and KeyPackage with an unrelated key and be accepted under the victim's identity. In an MLS deployment that uses X.509 credentials and admits external commits without an independent credential-admission check, the attacker can be admitted as the victim, evict the victim via resynchronization (which compares whole credentials rather than signing keys), derive the current epoch, decrypt subsequent group messages, and send messages accepted as the victim. The flaw is rated CVSS 9.2 (CVSS:4.0) / 9.2-equivalent high impact with the vendor patch available in 1.86; no public exploit code or confirmed active exploitation was identified at time of analysis, and deployments using only basic credentials are explicitly unaffected. Note the assessed attack complexity is High because the MLS/X.509 path must be in use and the application must lack its own credential-admission validation.
Arbitrary shortcode execution in the Beaver Builder Page Builder - Drag and Drop Website Builder plugin for WordPress (all versions up to and including 2.11.0.5) lets unauthenticated attackers run attacker-chosen shortcodes on a target site, which in a typical WordPress install with shortcode-extending plugins can escalate to code injection and full site compromise (CWE-94). Exploitation is not automatic: it is gated on the site publishing a Beaver Builder page whose Sidebar module contains a widget rendering attacker-controllable text - the advisory names the core Recent Comments widget - and on either comments being auto-approved (moderation disabled) or the attacker's comment having been approved by a moderator, which makes this a content- and configuration-dependent attack rather than a universally reachable one; the flaws assessed vector therefore carries AC:H rather than the initial AC:L. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor advisory (Wordfence threat ID 794e6d9b-ac07-4261-a60d-81c474973005, mirrored as ENISA EUVD-2026-91966) is the authoritative source for patch rollout.
Sensitive information exposure in the ProfilePress WordPress plugin (wp-user-avatar), affecting all versions up to and including 4.17.4, allows an authenticated attacker with subscriber-level access or above to read other users' email addresses, login names, and registration dates by supplying attacker-controlled base64 payloads to the [pp-custom-html] shortcode that invoke [profile-email], [profile-username], and [profile-date-registered] through the Member Directory's per-row user rebinding logic in get_user_profile_structure. When WordPress self-registration is enabled (users_can_register), the same leak becomes reachable without authentication, because the plugin's registration handler processes the reg_nickname and reg_bio fields without a nonce check and can carry the split shortcode fragments. Impact is confidentiality-only - the exposed data is limited to emails, usernames, and registration timestamps, not passwords or session material - and neither CISA KEV listing nor public exploit code has been identified at time of analysis; the Wordfence advisory is the primary vendor-adjacent reference.
Privilege escalation in the Groundhogg - CRM, Newsletters, and Marketing Automation plugin for WordPress versions up to and including 4.9 allows an authenticated Sales Representative-level user who holds both the add_contacts and send_emails capabilities to rebind a contact record to an Administrator's WordPress user ID, then use the v4 email-test endpoint to mint an {auto_login_url} key and obtain a fully authenticated Administrator session. This is a genuine high-priority issue rather than a CVSS-inflated one, but the practical risk is contingent on a site having delegated those non-administrator Groundhogg roles to the attacker; no public exploit identified at time of analysis, and the vendor has released a fix in version 4.9.1.
Unauthenticated remote attackers can instantiate arbitrary Java classes in OpenIdentityPlatform OpenAM before 16.1.3 through the legacy JAX-RPC SOAP interface, leading to server crashes, classpath probing, and potential code execution via gadget chains. The vulnerability requires the JAX-RPC endpoint to be present and network-reachable at /jaxrpc/*, but no authentication or user interaction is needed because the session identifier is accepted without validation. No public exploit code has been identified at time of analysis; the CVSS 4.0 score is 8.8, and the independent assessment rates it as a credible high-priority issue rather than an inflated score.
Authenticated SQL injection in the Smart Manager - Advanced WooCommerce Bulk Edit & Inventory Management plugin (Pro edition) affects all versions up to and including 8.97.0, letting any account at subscriber level or above append arbitrary SQL to an existing query through the 'access_privileges' parameter and read sensitive data from the WordPress database. Exploitation is not unconditional: the site must also be in a non-default state where an administrator has saved a role-based deny-list Access Privilege configuration that does not explicitly block the internal 'access-privilege' module, which causes the authorization filter to implicitly permit low-privilege users to reach the vulnerable handler. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); note that while the supplied CVSS 3.1 vector is 8.8 High (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), our independent assessment rates effective severity lower (AC:H, I:L, A:N) because default installations and correctly configured deny-lists are not exploitable, valid authentication is mandatory, and only Pro-edition sites are in scope.
Privilege escalation in the Ultimate Member WordPress plugin affects all versions through 2.13.1, allowing an authenticated attacker to manipulate a user-controlled key that the plugin fails to bind to the requester's own account or privileges, thereby elevating a low-privilege account to a higher role such as administrator. The flaw requires an authenticated account (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base score 8.8), but because Ultimate Member supplies front-end user registration, an attacker can typically self-register on sites with open registration enabled - the common deployment mode - lowering the practical barrier to entry; sites that disable open registration require a pre-existing credential. Exploitation status at time of analysis: no public exploit identified at time of analysis, and the vulnerability is not confirmed actively exploited (CISA KEV), though the low attack complexity and high confidentiality, integrity, and availability impact make rapid patching a priority, with no EPSS score supplied in the available intelligence.
Unauthenticated remote denial of service in Mooncake Transfer Engine before 0.3.12 lets any host that can reach the peer-to-peer handshake socket crash the hosting process - including an SGLang inference server - by sending a single eight-byte handshake frame carrying a zero-length string field. The root cause is an out-of-bounds read (CWE-125) in the readString helper in include/common.h, rated 8.7 under CVSS 4.0 and independently assessed as CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N), with impact confined to availability: no code execution, no data disclosure. Exploitation needs nothing more than network reachability to the handshake port, which the advisory states listens on all interfaces by default; there is no public exploit identified at time of analysis, the issue is not in CISA KEV, and the only limiting factor is whether that port is firewalled or bound to loopback/trusted interfaces.
Bouncy Castle for Java before 1.86 fails to tie a Remove proposal in an MLS (RFC 9420) external commit to the joining party, allowing any holder of the group's public GroupInfo to evict an arbitrary member and take over that member's slot in the ratchet tree. Exploitation requires only that an application use the library's MLS module and accept external commits through the public Group.externalJoin / Group.handle API on an affected version; no group membership, credential, or user interaction is needed, and the missing credential check existed only in the gRPC interop harness, protecting none of the other API callers. The vendor rates this 8.7 (CVSS 4.0 AV:N/AC:L/AT:N/PR:N/UI:N), and there is no public exploit identified at time of analysis, though the flaw is trivially reachable by anyone who legitimately receives GroupInfo.
Certificate-validation bypass in Bouncy Castle for Java lets a PKIXCertPathReviewer accept an end-entity certificate that violates a NameConstraints extension imposed by its own issuing CA, causing isValidCertPath() to return true with an empty error list for a chain the real PKIX validator rejects. Affected are BC-Java before 1.86, BC-LTS-Java before 2.73.13, and BC-FJA (bcpkix-fips) before 1.0.13 / 2.0.13 / 2.1.13; exploitation requires an application that uses org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer (or the legacy org.bouncycastle.x509 copy) to make the trust decision rather than the unaffected CertPathValidator "PKIX"/"BC", and a chain whose leaf actually breaches the CA's permitted or excluded subtrees. No public exploit code has been identified at time of analysis, the vulnerability is unauthenticated (CVSS PR:N) per the vendor vector, and the vendor scores it CVSS 4.0 8.7 (High) for high integrity impact; note that an independent assessment rates attack complexity higher (CVSS 3.1 AV:N/AC:H) because the exposure depends entirely on non-default application architecture rather than on anything the attacker controls.
Improper validation of the digestAlgorithm/authAttrs pairing in Bouncy Castle's CMS AuthenticatedData handling lets a man-in-the-middle make the parser return authenticated attributes that the message MAC never covered, in Bouncy Castle for Java before 1.86, Bouncy Castle LTS before 2.73.13, and the BC-FJA/FIPS releases (bcpkix-fips before 1.0.13/2.0.13/2.1.13 and bcutil-fips before 2.0.8/2.1.8). Because the streaming CMSAuthenticatedDataParser picks in its constructor whether the MAC covers the DER encoding of authAttrs or the eContent OCTET STRING based solely on whether digestAlgorithm is present - a field that precedes authAttrs in the SEQUENCE - a message crafted with digestAlgorithm absent but authAttrs present passes the genuine content-MAC check and then exposes attacker-chosen attributes through getAuthAttrs(). Exploitation is unauthenticated at the network layer (CVSS:4.0 PR:N, no keys of either the key-encryption or content-MAC type are needed) but requires an in-transit tampering position and a victim application that makes an authorization, routing, or labelling decision from those attributes; the eContent payload itself remains MAC-bound, no public exploit has been identified at time of analysis, and signals conflict on whether this merits urgent prioritization (vendor CVSS 4.0 8.7 with AC:L versus an independent CVSS 3.1 assessment of AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).
Information disclosure in Backdrop CMS before 1.35.1 allows remote, unauthenticated attackers to download full-site configuration export archives that users with the 'synchronize configuration' permission have generated: before the fix, the config.tar.gz written to the temporary:// scheme was not reliably deleted after transfer and could be fetched without any authorization check, exposing the complete site configuration including sensitive settings. Exploitation is conditional, not on-demand - the attacker must find a leftover archive rather than cause one to be created, which is consistent with the vendor's CVSS 4.0 Attack Requirements: Present and AC:H rating, so installations that never perform a configuration export are not exposed. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, no EPSS score was supplied, and the vendor-released fix is 1.35.1.
In-place encryption over a secret key buffer in Bouncy Castle for Java LTS before 2.73.13 can silently replace freshly produced ciphertext with the raw AES key, because native one-shot packet ciphers release read-only input arrays with JNI mode 0 and a later copy-back overwrites the output. The trigger is narrow and application-dependent-it requires the non-default pattern of passing the same Java array as both input and destination (for example, encrypting over KeyParameter.getKey()) on a JVM that copies rather than pins JNI array elements-so real-world exploitability is far lower than the 8.2 base score implies; bcprov, pure-Java packet ciphers, and native streaming modes are unaffected. No public exploit identified at time of analysis.
Improper input validation in the Themeum Kirki WordPress plugin through version 6.3.1 allows unauthenticated remote attackers to access functionality not properly constrained by ACLs, yielding high confidentiality impact and low integrity impact with no availability impact. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N (base 8.2) confirms network exploitation without privileges or user interaction, so any WordPress site running Kirki from initial release through 6.3.1 is exposed. No public exploit identified at time of analysis, though the Patchstack reference URL labels the issue as arbitrary code execution; the authoritative assessment aligns with CWE-1284 broken access control rather than a confirmed RCE outcome.
Bouncy Castle for Java 1.81 through 1.85.2 fails to verify that a third-party OpenPGP signature was issued by a component key actually granted certification authority, so the high-level certificate API will attribute an attacker-made certification or trust delegation to the certificate's offline primary key. An attacker must already hold the private key of a restricted subkey (one bound only with SIGN_DATA, or a legacy RSA encryption subkey whose algorithm can still sign) that lacks the RFC 9580 sec. 5.2.3.29 CERTIFY_OTHER flag; they can then issue a positive User ID certification or a full-trust depth-one direct-key delegation that getCertificationBy()/getDelegationBy() report as a valid chain, and any application treating isValid() as an identity or trusted-introducer decision will accept the forged assertion at the primary key's authority. The flaw is a privilege promotion of an already-compromised subkey rather than a key-recovery attack, no public exploit code has been identified at time of analysis, and vendor fixes are available in 1.86.
Truncated OpenPGP messages are silently accepted by Bouncy Castle for Java's OpenPGP decryption streams, letting an attacker who can deliver or truncate a message strip trailing packets and, on the SEIPD version 1 path, suppress the modification detection code check entirely, so recipients are handed unauthenticated CFB-decrypted plaintext. The AEAD route (SEIPD v2 and the version 5 AEAD packet) fails open when a literal data packet ends exactly on an AEAD chunk boundary and the consumer reads in increments smaller than one chunk, while the more severe SEIPDv1 route affects only the high-level org.bouncycastle.openpgp.api present in bc-java, not the LTS or FIPS editions. The vendor rates this CVSS 4.0 8.2 (VI:H, with no confidentiality or availability impact), and the fix is released in bc-java 1.86, bc-lts-java 2.73.13, and bcpg-fips 1.0.14 / 2.0.14.1 / 2.1.14; no public exploit identified at time of analysis.
Signature misattribution in the high-level OpenPGP API of Bouncy Castle for Java before 1.86 lets an attacker who holds a third party's public signing subkey - entirely public material - graft that subkey onto their own primary key with a Subkey Binding signature that omits both the Key Flags subpacket and the embedded Primary Key Binding (cross-certification) signature. Because OpenPGPCertificate.isSigningKey() and verifyEmbeddedPrimaryKeyBinding() resolved the subkey's key flags two different ways, the grafted subkey was treated as signing-capable while being exempt from the cross-certification requirement, so OpenPGPSignature.OpenPGPDocumentSignature.isValid() returned true for a message the subkey genuinely signed and reported the attacker's certificate as its issuer; GnuPG rejects the identical certificate and message. This yields misattribution of an existing genuine signature under an attacker-chosen, self-asserted identity - no private key is recovered and no new signature can be forged - and only affects relying parties that pin trust on the subkey's fingerprint or key ID while taking the signer identity from the enclosing certificate. The vendor rates it 8.2 (CVSS 4.0) with integrity-only impact; an independent assessment scores it CVSS 3.1 8.2-equivalent integrity-only (AC:H, PR:N, UI:N), no public exploit code and no confirmed active exploitation (not in CISA KEV) were identified at time of analysis.
Unauthenticated attackers can permanently delete arbitrary posts, pages, products, and media attachments on any WordPress site running the Photo Reviews for WooCommerce plugin through version 1.2.30. The plugin accepts attacker-controlled post IDs in the public wcpr_image_upload_id parameter of a review submission and stores them as the review's 'reviews-images' comment meta without verifying that those IDs belong to attachments owned by the submitter; when the review is later deleted, the delete_reviews_image() handler unconditionally calls wp_delete_post( $id, true ) on every stored ID. Because the trigger is a privileged action - an administrator deleting the planted review, or WordPress's built-in wp_scheduled_delete cron emptying the comment trash roughly 30 days after the review is trashed - this is a credible high-integrity, high-availability issue rather than an instantly weaponizable one, and no public exploit code or CISA KEV entry was identified at time of analysis.
Nelio Content 4.5.0 and earlier for WordPress fails to verify authorization in its reusable-message REST controller, allowing authenticated users with contributor-level access or higher to permanently delete any nc_reusable_social post, including reusable social messages authored by administrators or other privileged users. Exploitation requires an authenticated contributor account on a site running the plugin with its reusable social message feature active, so anonymous internet attackers cannot trigger it. No public exploit identified at time of analysis; the independent assessment rates this as a moderate-priority issue rather than a top-tier emergency, despite the original 8.1 High CVSS rating, because impact is limited to reusable social messages and requires contributor-level access.
Unauthenticated attackers can read sensitive HubSpot API response data - including correlation identifiers and cookies - from WordPress sites running the MetForm plugin before 4.3.1, because the plugin writes a debug file into the web root on every form submission whenever its HubSpot Forms integration is enabled and does not restrict access to that file. Exploitation requires the non-default HubSpot integration to be active, at least one prior form submission to populate the file, and discovery of the file's location, which is why the assessed vector is AV:N/AC:H/PR:N/UI:N with confidentiality-only impact and a low base score of 3.7. Publicly available exploit code exists, but there is no confirmed active exploitation, the SSVC assessment records exploitation as 'none' and automation as 'no', and EPSS is very low at 0.14% (3rd percentile).
Unauthenticated information disclosure in the WP Ultimate CSV Importer WordPress plugin (versions before 9.2) lets remote attackers retrieve import-log files that contain the personal data of users previously imported from a CSV file, because the plugin derives the log storage path under the uploads directory without any site-specific secret and does not block direct web access to those files. Impact is bounded to low confidentiality (CVSS 3.1 base 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N): no write or administrative access is obtained, and only data that was actually imported and written to still-present log files can be exposed. Publicly available exploit code exists, but EPSS is only 0.14% (3rd percentile) and the practical attack requires knowing or guessing the non-random file path and depends on a prior sensitive import having occurred; the vendor has released a fix in version 9.2.
Unauthenticated information disclosure in the Pie Register WordPress plugin (versions before 3.8.4.14) lets any remote visitor who knows a valid invitation code retrieve the usernames and email addresses of every user who registered with that code. The flaw is an access-control gap in the plugin's invitation-code report, which lacks a capability or ownership check before returning registration data (CWE-200). Exploitation is constrained by the requirement to already know a valid invitation code - the reason CVSS assigns AC:H and a low base score of 3.7 - and although publicly available exploit code exists, there is no confirmed active exploitation (not in CISA KEV) and EPSS is only 0.14% (3rd percentile).
Local file inclusion in the WPCafe restaurant menu, online ordering and table booking plugin for WordPress affects all versions up to and including 3.0.18, allowing an authenticated user with contributor-level privileges or higher to manipulate the template-scope parameter that the plugin passes into a PHP include, causing arbitrary local files on the server to be read or, under the right conditions, executed. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.5) confirms the low-privileged authenticated prerequisite, while the high attack complexity reflects a second precondition: to reach code execution the attacker must also be able to place a .php file on the server for the vulnerable include to pull in, making full RCE conditional rather than guaranteed. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so real-world risk is tempered by the need for a valid contributor account plus a separate file-placement primitive.
OAuth 2.0 PKCE enforcement bypass in OpenAM before 16.1.3 allows an attacker who intercepts an authorization code issued through OpenID Connect hybrid flows to redeem it for a public client's tokens using any non-empty code_verifier, because PKCE is applied only when response_type is exactly code. The attack is remote and unauthenticated from the token endpoint perspective but requires user interaction and the ability to intercept the code; deployments not using hybrid flows are not affected. No public exploit identified at time of analysis, and a vendor fix is available in OpenAM 16.1.3; this is a credible mid-tier priority rather than a drop-everything emergency.
Unauthenticated attackers can read privacy-restricted member profile field data in the WordPress plugin Ultimate Member (all versions up to and including 2.13.1) by calling the publicly reachable AJAX endpoint wp_ajax_nopriv_um_get_members, which fails to verify that the requester is authorized to see fields marked owner-only, members-only, or role-restricted. The endpoint's supposed protection, the 'um-frontend-nonce' token, is published to every anonymous visitor through wp_localize_script, so it provides no real access control and any anonymous visitor can satisfy the endpoint's checks; this yields a high-confidentiality, no-integrity/no-availability impact (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). No public exploit code has been identified at time of analysis and there is no CISA KEV entry, but the attack surface is default-configuration and remote, so the only practical prerequisite is that the site actually has privacy-restricted profile fields containing sensitive values. The vendor addressed the issue in Ultimate Member 2.14.0, whose release notes explicitly credit Wordfence for reporting CVE-2026-93428.
SQL injection in the GeoDirectory WordPress plugin (all versions up to and including 2.8.186) allows an attacker holding a Subscriber-level account or higher to store a crafted payload in a listing's latitude/longitude coordinate fields and then trigger it through the public wp_ajax_nopriv_geodir_widget_listings AJAX handler, resulting in arbitrary SQL being appended to existing queries and disclosure of sensitive database contents. Successful exploitation requires the attacker to create and own a listing (pending state) whose coordinates are saved without numeric validation or escaping, then request the handler with set_post=<their-listings-id> and sort_by=distance_asc; no victim interaction is needed. No public exploit code has been identified at the time of analysis, and the practical risk is conditional: sites that disable open user registration, thereby preventing attackers from obtaining Subscriber accounts, are substantially protected.
Unauthenticated attackers can redirect activation and registration-complete emails to an arbitrary address in Simple Membership (WordPress plugin) versions up to and including 4.8.3, leading to disclosure of a pending member's username and plaintext password, and can activate that member's account without consent. The flaw resides in the resend-activation and email-activation endpoints, which are invoked on frontend init without authentication, nonce, capability, or ownership checks, and accept a recipient address from attacker-controlled POST data. Exploitation requires the target site to have at least one pending, unactivated member account; no public exploit code has been identified at time of analysis.
Unauthenticated SQL injection in the WP Visitor Statistics (Real Time Traffic) WordPress plugin through 8.7 lets any remote client poison the wp_logVisit table by submitting a crafted referrer URL to the wmcTrack tracking endpoint; the injected SQL then fires inside the session of an administrator who opens the Traffic Sources dashboard, allowing extraction of sensitive data such as user password hashes and stored configuration secrets. The impact is confidentiality-only - no integrity or availability effect was assessed - and the attack is second-order, so it remains dormant until a privileged user views the affected report. This is a genuine but conditional risk rather than an emergency: no public exploit code and no confirmed active exploitation were identified at time of analysis, and the assessed vector (UI:R) reflects that a privileged victim must open the dashboard for the payload to execute.