Unauthenticated SQL injection in the WordPress plugin Unlimited Elements for Elementor (versions 1.5.139 through before 2.0.21) allows remote attackers to read non-public content from the site database by supplying a crafted search value that the plugin mishandles when rewriting an already prepared SQL statement. Exploitation is conditional: a related widget option must be set away from its default value for the vulnerable code path to be reachable, which is why the assessed vector carries AC:H despite PR:N and UI:N, and why impact is limited to confidentiality (C:H) with no integrity or availability effect. Publicly available exploit code exists, but EPSS is low at 0.18% (7th percentile) and there is no KEV listing, so this is a real but conditional, moderate-priority issue rather than a top-tier emergency.
Authenticated arbitrary file read in the MPG WordPress plugin (versions before 4.2.3) allows a user holding the Editor role or higher to supply a local filesystem path in the project import 'dataset source' field, which the plugin copies into the public uploads directory where any unauthenticated visitor can then retrieve it. The issue is a path traversal (CWE-22) rated CVSS 6.8 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N), and publicly available exploit code exists; EPSS is low at 0.16% (5th percentile) and there is no CISA KEV listing for this CVE. Because exploitation requires a privileged account, the practical impact is a high-privilege arbitrary file read whose severity depends on what files the web server process can read, rather than a remote-unauthenticated compromise.
Path traversal in Loco Translate WordPress plugin before 2.8.9 (CVSS 6.8) lets authenticated users who hold the plugin's translator capability read certain file types from arbitrary server paths, including outside the web root. Publicly available exploit code exists, but CISA KEV does not list active exploitation; EPSS is 0.16% (4th percentile) and SSVC rates exploitation as none, making this a real-but-not-urgent issue. Because the attacker must already have the translator capability (PR:H), anonymous and default low-privileged visitors cannot trigger it.
Stored cross-site scripting in the Loco Translate WordPress plugin before 2.8.9 allows an authenticated attacker with the plugin's translator capability or higher to inject unsanitized bundle configuration values that are later rendered in an admin page, executing script in the browser of a high-privilege user such as an administrator who views that page. The vulnerability is tracked as CVE-2026-94239 and publicly available exploit code exists, though EPSS is low at 0.15% (4th percentile) and there is no CISA KEV confirmation of active exploitation. Real-world risk is moderate because exploitation requires a delegated translator-level account and a privileged victim to load the poisoned admin page, making it a second-tier priority rather than an emergency.
Stored cross-site scripting in the Kubio AI Page Builder WordPress plugin (all versions before 2.9.3) lets a user holding the contributor role or higher save a link whose target uses an unvalidated URI scheme - such as javascript: - so that the payload executes in the browser of any person who follows that link, most damagingly an administrator previewing the contributor's unpublished submission. Publicly available exploit code exists, so reproduction is straightforward for anyone with contributor-level access on a site that grants untrusted users that role (self-registration enabled or another route to an account); exploitation additionally requires the admin to preview or click the crafted link, which is why CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no'. EPSS is low at 0.15% (4th percentile) and there is no indication of confirmed active exploitation (no CISA KEV listing), though successful execution against an admin session could yield full site takeover given the privileges at stake.
Authenticated path traversal in the Unlimited Elements for Elementor WordPress plugin before 2.0.21 lets a privileged user (Administrator by default, or Editor when a specific non-default plugin setting is enabled) plant arbitrary files - including executable PHP - outside the intended upload directory, which can escalate to remote code execution. Exploitation requires two conditions to hold simultaneously: the attacker must already hold an account with access to the plugin's asset-management feature, and the target server must not have the PHP zip extension installed, since only the unsanitized fallback extraction path is vulnerable. Publicly available exploit code exists (tracked via WPScan), but EPSS is only 0.22% (11th percentile) and there is no CISA KEV confirmation of active exploitation, so this is a genuine but constrained risk rather than an urgent widespread threat; a vendor patch is available in version 2.0.21.
Stored cross-site scripting in the WordPress plugin WP Ultimate Review affects all versions before 2.4.4, where some review overview settings are written into post output without escaping. An authenticated user holding a role as low as Author can inject a persistent script payload, but only when the plugin's non-default 'author reviews' feature is explicitly enabled and only when another user - an administrator or site visitor - later renders the affected post. Publicly available exploit code exists and the WPScan/WordPress ecosystem has published an advisory, though EPSS is very low at 0.16% (5th percentile) and there is no evidence of active exploitation; this is a moderate, low-priority issue in practice given the required privileges and operator-configured precondition.
Blind SQL injection in the Unlimited Elements for Elementor WordPress plugin (all releases before 2.0.21) allows an authenticated attacker to pass a crafted parameter that is concatenated into a SQL statement without sanitisation or escaping, letting them infer and read arbitrary data from the site database. On versions before 2.0.18 a Subscriber-level account is enough, which is significant on sites that permit open user registration, while versions 2.0.18 through 2.0.20 require a Contributor-level account or higher because 2.0.18 removed the subscriber-accessible code path. Publicly available exploit code exists, but the assessed CVSS is 6.3 with AC:H due to the slow, inference-based blind technique, EPSS is only 0.16 percent (4th percentile), SSVC records no observed exploitation, there is no CISA KEV listing, and a vendor patch (2.0.21) is available, so this is a moderate, authentication-gated risk rather than an emergency.
Unauthenticated attackers can modify or delete other customers' stored abandoned-cart records in the Mailchimp for WooCommerce WordPress plugin versions before 6.3, because the plugin processes cart identifiers supplied in the request without requiring authentication, a nonce, or an ownership check. Any remote actor who can reach the affected endpoint and knows or enumerates a valid cart identifier can tamper with another shopper's saved cart. Publicly available exploit code exists, though no confirmed active exploitation has been reported (CISA SSVC exploitation: none), and EPSS remains low at roughly 0.18% (7th percentile). Impact is bounded to low integrity loss - no confidentiality disclosure or server compromise - yielding a moderate CVSS of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
Unauthenticated information disclosure in the MetForm WordPress plugin before 4.3.1 exposes stored form submission data through the plugin's REST API, allowing anyone who can reach the site's REST endpoints to read submitter information without logging in. Exploitation is trivial - the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N confirms network reachability, low complexity, no authentication and no user interaction - and publicly available exploit code exists, though there is no indication of confirmed active exploitation (not in CISA KEV) and EPSS is low at 0.14% (3rd percentile). Impact is confined to confidentiality: only data that submitters previously entered on forms installed before 4.3.1 can be read, with no integrity or availability effect, making this a genuine but moderate-severity issue rather than a critical priority.
Unauthenticated attackers can exhaust LaraDashboard's paid email-verification quota through the public forgot-password and reset-password endpoints, causing advanced email validation to fail open across all public forms. Affected releases are 1.4.2 up to but not including 1.4.8, where the ForgotPasswordRequest and ResetPasswordRequest classes apply advanced DNS and AbstractAPI-based checks to arbitrary submitted addresses. Exploitation requires PR:N per the provided CVSS 4.0 vector, meaning no authentication is needed, and no public exploit code or CISA KEV confirmation is present; impact is a low-availability resource-exhaustion condition rather than code execution or data compromise.
Unauthenticated information disclosure in the Kener status-page platform (4.0.0 up to but not including 4.1.6) lets remote attackers retrieve data on hidden or inactive monitors by calling dashboard API handlers - such as monitor-bar and monitor-latency-chart - that omit visibility filters. By supplying a known or guessed monitor tag, an attacker obtains names, descriptions, status, uptime history and latency for monitors that were intentionally concealed, with no authentication or user interaction required (CVSS 4.0 vector shows PR:N/UI:N). There is no public exploit identified at time of analysis, and this is assessed as a moderate-priority confidentiality-only issue whose impact is bounded by the need to already know or guess a valid tag.
Cross-realm session disclosure in OpenAM before 16.1.3 allows an authenticated attacker holding delegated RealmAdmin privileges to bypass authorization on the sessions REST endpoint and read usernames, universal IDs, and session handles from other realms in a multi-tenant deployment. The flaw, tracked as CVE-2026-105120 (CWE-200), requires the attacker to supply a _queryFilter that names a realm outside their own; single-realm installations are effectively unaffected. No public exploit identified at time of analysis, and the CVSS v4.0 score is 6.9 (v3.1: 6.9 medium), reflecting high confidentiality impact but high privilege prerequisites (PR:H).
Authenticated delegated administrators in OpenIdentityPlatform OpenAM deployments prior to 16.1.3 can forcibly terminate user sessions belonging to realms outside their own authority. The flaw is a realm-scoping error in the session-destroy authorization check: because the check is evaluated against the requester's realm rather than the realm owning the target session, any account granted the iplanet-am-session-destroy-sessions attribute can submit an arbitrary session identifier or handle and log out users in other realms. Impact is limited to availability of user sessions (no confidentiality or integrity effect), and exploitation requires a high-privilege authenticated account plus a multi-realm, privilege-delegating configuration; no public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS scoring was not provided.
Key-size validation bypass in Bouncy Castle for Java before 1.86 (and Bouncy Castle for Java FIPS before bcpkix-fips 2.0.13 / 2.1.13) allows a key-transport EnvelopedData or AuthEnvelopedData message whose HKDF-derived content-encryption key does not match the advertised content-encryption algorithm to be accepted even when the application has explicitly enabled org.bouncycastle.cms.jcajce.JceKeyTransRecipient.setKeySizeValidation(true). The defect is confined to messages using RFC 9709 CEK derivation (id-alg-cek-hkdf-sha256); messages with a matching key size, non-HKDF messages, and recipients that never enable validation are unaffected, and the opt-in control is off by default, so this is a medium-severity defense-in-depth failure rather than a direct decryption or key-recovery primitive. Unauthenticated remote attackers who can supply CMS content to an application that has enabled the control can silently defeat the only mechanism the API offers for enforcing recovered key size; no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor-released patch is available.
Unauthenticated attackers can inject and execute arbitrary WordPress shortcodes through the All in One SEO (AIOSEO) plugin in versions up to and including 5.0.2, because an attacker-controllable value is passed to do_shortcode without adequate validation when the plugin renders its breadcrumb trail on the site's search results page. The flaw is only reachable when the AIOSEO breadcrumb is actively displayed on search results via the breadcrumb block, widget, shortcode, or template tag, and the practical impact is bounded by which shortcodes are registered on the target site. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; the issue is rated CVSS 6.5 (Medium), with the independent assessment treating attack complexity as higher than the vendor's vector because of the rendering precondition.
Unauthenticated remote attackers can execute arbitrary registered WordPress shortcodes through the WP Ultimate Review plugin (versions up to and including 2.4.3), because the plugin passes an unvalidated value to do_shortcode and the only nonce gate is emitted to anonymous visitors via the public review form, while submitted reviews auto-publish without administrator approval by default. The CVSS 3.1 base score is 6.5 (Medium) with low confidentiality and integrity impact and no availability impact; the real-world severity depends on which shortcodes exist on the target site. No public exploit code has been identified at time of analysis, and CISA KEV does not list this issue.
Time-based SQL injection in the SupportCandy - AI Customer Support Ticket System & Live Chatbot Agent WordPress plugin, affecting all versions up to and including 3.5.3, lets an authenticated attacker inject SQL through the unsanitized 'sort_by' parameter and use deliberate query delays to extract sensitive data from the site's database. Exploitation is gated by a non-default permission combination: the attacker must hold both a WordPress Subscriber-or-higher account and a SupportCandy Agent account explicitly granted the 'Assign Agents' capability, which confines the realistic threat to trusted-but-malicious or compromised agent accounts rather than anonymous visitors. Per CVSS 3.1 (6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) the impact is confidentiality-only, and no public exploit code was identified at time of analysis, with no CISA KEV listing.
Blind SQL injection in the Beaver Builder Page Builder plugin for WordPress (versions up to and including 2.11.0.5) allows authenticated attackers with Contributor-level access or higher to extract sensitive information from the database. Exploitation requires owning a draft post of a Beaver Builder post type to obtain the fl_ajax_update nonce, and the injection is blind, meaning data must be inferred rather than read directly; no public exploit was identified at time of analysis, and the issue is a genuine but moderate-priority risk rather than a top-tier emergency. The vulnerability is rated CVSS 6.5 with confidentiality impact only (no integrity or availability impact) and is limited to sites that grant untrusted users Contributor privileges.
Stored cross-site scripting in the Rich Showcase for Google Reviews WordPress plugin (widgetpack) affects all versions up to and including 7.1.3 and lets injected JavaScript run for every visitor of any page that renders imported Google reviews. Two delivery paths are confirmed by the available data: a WordPress user with subscriber-level access or above can inject script through the 'reviews[].text' parameter, and - because the plugin's default daily cron auto-imports review content from the connected Google business profile - an unauthenticated attacker can plant the payload by posting a crafted Google review on that business, with no WordPress credentials required; our independent assessment scores this path CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (the vendor's 6.4 uses PR:L for the authenticated path). Once stored, the payload executes on DOMContentLoaded without further user interaction, though exploitation is gated by the daily import cycle, an enabled auto-import feature, an active Google Business connection, and display of the affected review block; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Stored cross-site scripting in the SupportCandy WordPress plugin (all versions up to and including 3.5.3) lets an authenticated attacker holding only subscriber-level access plant arbitrary JavaScript via the 'name' parameter, which then executes in the browser of any administrator or support agent who later renders the affected admin or ticket page. Because the documented exploit chain depends on the 'Register user if not exists' option being disabled - the plugin's default state - most installations sit in the vulnerable configuration, though the attacker still needs a subscriber account and must wait for a privileged victim to view the injected content. Severity is moderate (CVSS 6.4, Medium) and consistent with a routine patch-management item; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV).
Stored cross-site scripting in the EmbedPress WordPress plugin (all versions up to and including 4.6.6) lets authenticated users with contributor-level access or higher inject arbitrary JavaScript that executes for anyone viewing the affected page. The flaw lives in the plugin's Gutenberg block rendering path, where the attacker-controlled 'slidesShow' attribute is interpolated into an unquoted data-carousel-options HTML attribute; a payload containing spaces breaks out of that attribute and injects additional DOM attributes such as onfocus event handlers onto the wrapper element. Exploitation requires a contributor account and a page that renders the EmbedPress block, and no public exploit code or confirmed active exploitation was identified at time of analysis; the Wordfence-sourced CVSS of 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects a moderate-priority issue rather than a critical emergency.
Stored cross-site scripting in the WordPress plugin Twenty20 Image Before-After (all versions up to and including 2.0.5) allows authenticated users with contributor-level access or above to inject arbitrary JavaScript through the 'offset' attribute of the plugin's shortcode; the injected script is stored in a post and executes when another user, such as an editor or administrator, later views that page. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (6.4), reflecting a network-reachable, low-privilege, no-user-interaction attack with changed scope but limited confidentiality and integrity impact, and authentication is mandatory, so sites that restrict contributor accounts or disable open registration materially reduce exposure. No CISA KEV entry or public exploit code was identified at time of analysis, and the plugin's Trac changeset indicates a 2.0.6 tag superseding 2.0.5.
Stored cross-site scripting in the CyberChimps Responsive Plus (Responsive Starter Templates - Elementor Templates & Starter Sites) plugin for WordPress affects all releases up to and including 3.5.3, letting an authenticated user with contributor-level access or higher plant arbitrary JavaScript in page content through shortcode attributes that are not sanitized on input or escaped on output; the script then runs in the browser of any user who loads the injected page. Scored CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), the flaw is not confirmed actively exploited (no CISA KEV listing) and no public exploit code exists at time of analysis, which - combined with the contributor-or-above account prerequisite - keeps it below top-priority status relative to unauthenticated WordPress plugin flaws.
Stored cross-site scripting in the Wp Social Login and Register Social Counter WordPress plugin (all versions up to and including 3.2.1) lets any authenticated account with subscriber-level access or above plant a script payload that executes in the browser of anyone who later views the poisoned avatar. Exploitation is a two-step chain: the attacker first invokes the plugin's nonce-only dismiss_ajax_call AJAX endpoint (the nonce is exposed to subscribers on any wp-admin page) to set the xs_social_profile_image user-meta flag on their own account, then stores a script payload in their display name, which xs_social_get_avatar echoes unescaped into an img alt attribute because WordPress core's ENT_NOQUOTES handling preserves the quotes needed to break out. Scored CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), it is a moderate-severity issue; no public exploit code has been identified at time of analysis and it is not confirmed actively exploited (CISA KEV), and the impact only materializes when a victim - ideally a privileged user such as an administrator - browses a page rendering the attacker's avatar.
Stored cross-site scripting in the Ultra Addons Lite for Elementor WordPress plugin (all versions up to and including 1.3.2) lets an authenticated attacker with contributor-level access or higher inject arbitrary JavaScript through unsanitized attributes of the plugin's Type Out widget; the script is persisted in the page and executes in the browser of any user who subsequently views it, yielding CVSS 6.4 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The flaw is a CWE-79 input-sanitization and output-escaping failure, scoped to sites that have the plugin active and that grant content-authoring accounts to untrusted users; there is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation currently requires deliberate attacker effort with an existing contributor account. No vendor-released patch or fixed version has been identified at time of analysis, leaving site owners dependent on removing or disabling the Type Out widget or removing the plugin until an update ships.
Path traversal in LaraDashboard before 1.4.8 lets unauthenticated remote attackers read arbitrary JSON files from the application by manipulating the {lang} segment of the public /api/translations/{lang} endpoint. Because the route concatenates the user-supplied value into a filesystem path and appends '.json', an attacker on a Windows host can submit URL-encoded backslash sequences such as ..%5C to escape the resources/lang directory and retrieve files like composer.json or version.json, exposing dependency and version metadata. The impact is limited to confidentiality (read-only, JSON files only) with no write or code execution, and no public exploit code was identified at time of analysis; a vendor fix is available in v1.4.8.
Race condition in LaraDashboard 1.4.0 through 1.4.7 allows unauthenticated remote attackers to bypass the per-IP daily registration limit by flooding concurrent registration requests, so that every request passes RegistrationGuardService::hasExceededIpLimit before any recordRegistration call commits. The result is bulk account creation that defeats the product's anti-automation and anti-spam controls, with impact limited to integrity of the registration state (no confidentiality or availability effect). Exploitation requires that public self-registration is enabled and the per-IP cap is active, and it depends on winning a narrow TOCTOU window, so attack complexity is high; there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis. EPSS data was not provided, but the assessed severity is low-to-moderate rather than critical.
Reflected cross-site scripting in the WPC Smart Quick View for WooCommerce WordPress plugin, affecting all versions up to and including 4.4.0, lets unauthenticated attackers inject arbitrary JavaScript into a page that executes in the browser of a victim who opens a crafted URL, since the 'woosq-redirect' parameter is neither sanitized on input nor escaped on output (CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Exploitation is configuration-dependent: the WooCommerce 'redirect to cart after add to cart' option must be enabled for the code path that reads the parameter to run, but once it is, the '?quick-view=' auto-open mechanism means no victim interaction beyond loading the link is required, though the attacker must still lure a user into clicking (UI:R) and no attacker authentication is needed (PR:N). No public exploit code was identified at time of analysis and there is no CISA KEV listing, so this should be treated as a routine patch-management priority rather than an emergency.
Reflected DOM-based cross-site scripting in the Calculated Fields Form - AI Form Builder for WordPress plugin (all versions up to and including 5.5.1.5) lets unauthenticated attackers inject arbitrary script into a page via the plugin's url.<name> predefined field values, with the payload executing in the victim's browser once the victim clicks an attacker-supplied crafted link. Exploitation is not possible on default installs: the site must publish a publicly reachable form in which an administrator has bound at least two fields to url.<name> predefined values and used those values together in a concatenation equation, so a successful attack depends on a specific non-universal admin configuration plus victim user interaction. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis, and the independently assessed vector (AC:H, UI:R, scope changed) places this in the moderate-priority range rather than an emergency.
Reflected cross-site scripting in the Photo Gallery by 10Web - Mobile-Friendly Image Gallery WordPress plugin, versions up to and including 1.8.46, lets unauthenticated attackers inject arbitrary JavaScript through the unsanitized 'thumb_url' parameter handled by the editimage_bwg AJAX action. Because that handler performs a capability check but no nonce verification, a payload can be delivered in a plain crafted GET request without any CSRF token, and it executes in the browser of a logged-in WordPress administrator; there is no public exploit identified at time of analysis. The realistic impact is moderate rather than critical: successful exploitation requires the victim to hold the manage_options capability and to be socially engineered into clicking an attacker-supplied link, so this is a genuine but moderate-priority issue, not a top-tier emergency.
Reflected cross-site scripting in the EWWW Image Optimizer plugin for WordPress (all versions up to and including 8.7.7) lets unauthenticated remote attackers inject arbitrary script into a page by supplying a crafted REQUEST_URI parameter key that is reflected without adequate sanitization or escaping into the plugin's HelpScout Beacon script block. Per the CVSS vector (PR:N, UI:R, S:C), no attacker authentication is required, but a victim must be tricked into clicking a crafted link, and the injected script runs only in that victim's browser session - this is a reflected, not stored, issue. Two independent gating factors temper real-world priority: the plugin's enable_help option must be active (the vulnerable beacon block is emitted only when it is), and exploitation depends entirely on user interaction; reflected cross-site scripting is rated 6.1 and no public exploit identified at time of analysis.
Reflected cross-site scripting in the WPFront Notification Bar WordPress plugin (versions up to and including 3.5.1) lets an unauthenticated remote attacker inject arbitrary JavaScript into a victim's browser by reflecting the raw request URI into an inline script block emitted on wp_footer. The attack requires the plugin's non-default debug logging option (write_debug_logs) to be enabled, and it only fires when a victim follows a specially crafted link, so practical exposure is limited to sites that have turned on debug logging; the impact is client-side only, with low confidentiality and integrity effects and no server-side code execution. Wordfence is the reporting source, no public exploit code was identified at time of analysis, and there is no CISA KEV listing; the upstream repository shows a changeset (3722432) addressing the code path, though a tagged patched release is not independently confirmed. Note also that the plugin's own score of 6.1 with AC:L assumes a default configuration, whereas our assessment raises attack complexity (AC:H) because exploitation is gated by the non-default debug-logging setting.
Reflected cross-site scripting (XSS) in the ProfilePress WordPress plugin versions up to and including 4.17.4 allows unauthenticated attackers to inject arbitrary web scripts via a crafted POST request with a malicious ppress_billing_address filename, which executes in a victim's browser when they are tricked into clicking a link. Exploitation requires that the affected site hosts the ProfilePress Tabbed Widget; sites not using this widget are not exposed. This moderate-severity flaw (CVSS 6.1) has no public exploit identified at time of analysis and is not confirmed as actively exploited (CISA KEV).
Reflected cross-site scripting (CWE-79) in the WPC Estimated Delivery Date for WooCommerce plugin, affecting all versions up to and including 4.0.1, allows unauthenticated attackers to inject arbitrary web scripts via the 'rule_data' parameter, which execute in a victim's browser if they are tricked into clicking a crafted link. The vulnerability arises from insufficient input sanitization and output escaping, and although no public exploit code is identified at time of analysis, the CVSS 3.1 base score is 6.1 (Medium) with a user-interaction requirement (UI:R). The primary limiting factor is the need to persuade a victim to perform an action; the scope is changed (S:C) because the script runs in the context of the victim's session.
LearnPress WordPress LMS plugin versions through 4.4.7 reflect unsanitized input from the 'orderby' parameter into the DOM, allowing reflected DOM-based cross-site scripting. An unauthenticated attacker can craft a URL that, when a victim clicks or loads it, executes arbitrary script in the victim's browser session; the CVSS vector confirms PR:N and UI:R, with low confidentiality and integrity impact and no availability impact. This is a moderate-severity, interaction-dependent issue, and no public exploit identified at time of analysis.
Reflected cross-site scripting (XSS) in the Ivory Search - WordPress Search Plugin, affecting all versions up to and including 5.5.18, allows unauthenticated attackers to inject arbitrary web scripts via the 's' search parameter. However, exploitation requires three specific conditions: the non-default 'Highlight Search Terms' option must be enabled by an administrator, the malicious search query must return at least one post result, and a victim must be socially engineered into opening a crafted URL. These factors significantly limit realistic exploitation, and our assessment adjusts attack complexity to High despite the base CVSS score of 6.1 (Medium). No public exploit code is known at this time.
Authenticated non-admin users can deadlock the alerting subsystem in Nezha 1.8.0 through releases before 2.3.13 by racing the notification-group UpdateGroup/DeleteGroup operations against the batch-delete endpoint with oversized id lists, closing an ABBA lock-order inversion that halts alert delivery until the service is restarted. This is an availability-only race condition (CWE-362) that requires a valid low-privileged account and successful timing; independent assessment maps it to CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H and rates it a moderate-severity issue rather than a top-tier priority. No public exploit identified at time of analysis, and no code execution, data access, or integrity impact is assessed.
Bouncy Castle for Java before 1.86 leaks secret-derived information from its HQC post-quantum KEM through two side channels, allowing a local attacker who can observe CPU cache behaviour or precisely measure decapsulation timing to recover information about the HQC private key. Only deployments that actually perform HQC encapsulation or decapsulation on the affected library are exposed, and exploitation requires either code co-resident on the same physical host or many carefully controlled timing measurements, so isolated single-tenant hardware largely neutralises the cache channel. There is no public exploit identified at time of analysis; this is a genuine cryptographic weakness but a comparatively low-urgency operational priority, and a vendor fix is available in version 1.86.
Arbitrary shortcode execution in the WP Ultimate Review WordPress plugin through version 2.4.3 lets any authenticated user with subscriber-level access or higher inject shortcodes that are stored and later executed when review content is rendered. The bypass abuses WordPress core behavior: the plugin passes attacker-controlled data into do_shortcode without validation, and the [[tag]] double-bracket escape is unwrapped to a bare [tag] by strip_shortcodes(), surviving wp_insert_post storage and firing through the_content on the publicly queryable xs_review post type. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV); exploitation requires a low-privilege account, which makes it practically significant on sites with open user registration.
Stored cross-site scripting in Jeg Kit for Elementor (all versions through 3.2.19) allows unauthenticated attackers to plant persistent JavaScript on WordPress sites through the plugin's comment handling path, which then executes in the browser of any user - including administrators - who later views the poisoned page. Attackers submitting from an email address that already has at least one approved comment on the site can achieve immediate persistence without moderator review, which is the precondition behind the High attack complexity rating (CVSS 5.4, AV:N/AC:H/PR:N/UI:N/S:C); other submissions still bypass sanitization but sit in the standard moderation queue. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a moderate-priority patch-and-remediate item rather than an emergency.
Stored cross-site scripting in the WPMobile.App - Android and iOS App Builder plugin for WordPress (all versions up to and including 11.84) allows unauthenticated attackers to inject arbitrary JavaScript that is persisted and later executed in the browser of any user who opens the affected page. Exploitation is gated by configuration: the site's content mode must be set to 'webview' (i.e., the 'speed' option is not '1'), a still-supported but no longer default mode, and a victim must subsequently load the poisoned page, which is why the assessed vector carries High attack complexity and Scope Change (CVSS 5.4). At time of analysis no public exploit code has been identified and there is no indication of confirmed active exploitation (CISA KEV); the plugin's public source, however, makes the injection path independently reviewable.
Local privilege escalation in OpenLiteSpeed before 1.9.3 lets an attacker who already controls the low-privileged 'nobody' web-server process escalate to root by exploiting a time-of-check/time-of-use race in the admin/misc/lsup.sh auto-update script, which fetches, extracts and executes update packages as root from the nobody-writable /usr/local/lsws/autoupdate/ directory with no integrity verification. Realistic exploitation requires three preconditions together - existing code execution as 'nobody', an administrator-triggered update, and winning the race to replace the package before root runs its install.sh - so the flaw is genuine but conditional rather than remotely weaponizable; no public exploit code has been identified at time of analysis (no CISA KEV entry). The vendor fix in 1.9.3 adds SHA-256 checksum verification of downloaded packages, a mode-0700 update directory that refuses symlinks, HTTPS-only downloads with redirects refused, and a proper lock file.
Unauthenticated attackers can read, create, update, clone, and delete the email notification flows of the WPCafe - Restaurant Menu, Online Food Ordering & Table Booking System WordPress plugin in all versions up to and including 3.0.19, because the plugin fails to verify that a caller is authorized before processing flow-management requests (CWE-862). The exposed endpoints require no authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), no user interaction, and no special configuration, since Email_Automation_Service_Provider::is_enable() unconditionally returns true and five pre-configured email flows ship with the plugin on activation; the practical result is attacker-controlled reservation confirmation, cancellation, and admin alert emails sent from the site's legitimate address, plus outright destruction of those flows. No public exploit code identified at time of analysis and no confirmed active exploitation (not listed in CISA KEV); the supplied assessment rates impact as low across confidentiality, integrity, and availability and constrains the damage to the plugin's email notification subsystem rather than the wider WordPress site.
Sensitive customer data disclosure in WPZOOM Connect through 4.7.3 allows an authenticated low-privilege WooCommerce customer/subscriber to retrieve full customer card data for any arbitrary victim email, including names, WordPress user IDs, order histories, totals, purchased products, payment method labels, and EDD Software Licensing license keys with status and activation counts. The issue is caused by the 'x-yamidoo-signature' printed by inline_js() being forgeable: an attacker registers a crafted email whose local part encodes the target timestamp and victim email, making verify_request() accept the signature; share_customer_data and identify_logged_in are enabled by default, so no non-default configuration is required. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating high confidentiality impact but no integrity/availability impact, and no public exploit code or CISA KEV active exploitation was identified at time of analysis.
Denial of service in Bouncy Castle for Java (bc-java before 1.86 and bc-lts-java before 2.73.13) arises because the legacy PBES1 (PKCS#5 scheme 1) and PKCS#12 PBE families derive keys using an iteration count read from untrusted input without upper or lower bounds, so a tiny amount of attacker-controlled data can force an unbounded amount of CPU work before any validation occurs. Unauthenticated remote attackers can trigger the condition by supplying crafted PKCS12PBEParams/PBEParameter encodings or a PKCS#12 PBE-protected private key that the application processes through the raw JCA provider, including the common javax.crypto.EncryptedPrivateKeyInfo.getKeySpec() path; impact is availability-only (CPU/time exhaustion) with no confidentiality or integrity effect, and the assessed severity is moderate (CVSS 3.1 5.3, A:L). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV) information for this issue.
Open redirect in LaraDashboard before 1.4.8 allows remote attackers to steer an authenticated user who holds email-template permissions to an attacker-controlled phishing site after that user saves an email template. The flaw lives in the EmailTemplateController builder and builderEdit endpoints, which accepted a redirect_url query parameter and used it verbatim as the post-save navigation target, with the same raw value also flowing into the React LaraBuilder front end via the mount element's data-redirect-url attribute. Exploitation requires passive user interaction (UI:P); the attacker needs no authentication of their own against the endpoint (PR:N), but the victim must be a logged-in user with email-template rights who opens a crafted builder link and then triggers a save. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the impact is bounded to redirection-based phishing rather than direct compromise of the application, consistent with a medium-severity (CVSS 4.0 base 5.3; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) rating.
Server-side request forgery in Open Identity Platform OpenAM before 16.1.3 allows an authenticated attacker holding the privilege to register or modify OAuth 2.0 / OpenID Connect clients to make the OpenAM server fetch arbitrary internal resources through an unvalidated client jwks_uri. The vulnerable dereference occurs on the OIDC client-authentication and ID-token validation paths, so the resulting fetches are made by OpenAM itself and can be aimed at internal hosts, cloud metadata endpoints or local files, or abused to consume request threads for a low-impact denial of service. Exploitation requires PR:L per the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L (CVSS 4.0 base 5.3); no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Stored cross-site scripting in W (wcms) through 3.18.0 lets unauthenticated attackers plant persistent JavaScript that executes in the browser session of an administrator or editor. Two injection paths are present: the username submitted with a failed login is stored and later rendered unescaped in the adminlog.php log viewer, and a visitor-supplied comment website URL is echoed unescaped into an href attribute in editrightbar.php. The payload only fires when a privileged user opens the affected admin page (CVSS 4.0 UI:P; our independent assessment agrees with AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), and no public exploit code or confirmed active exploitation was identified at time of analysis.
An insecure direct object reference (IDOR) in the UVdesk support-center-bundle before version 1.1.3.3 lets any authenticated customer submit or overwrite the satisfaction rating on tickets owned by other customers by supplying arbitrary ticket IDs to the rateTicket action. The flaw is limited to rating tampering: it grants no read access to other customers' ticket content, no account takeover, and no code execution, which is why it is assessed as medium severity (CVSS 3.1 base 5.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Exploitation requires a valid, low-privileged customer account and knowledge or enumeration of target ticket IDs; no public exploit code was identified at time of analysis, and the issue is fixed upstream in 1.1.3.3.