Stored cross-site scripting in the WordPress plugin WP Ultimate CSV Importer (versions 7.17 up to, but not including, 9.2) allows an authenticated high-privilege user such as an Administrator to upload an archive whose contained files are neither type-validated nor sanitized, and which are then written to a publicly served location where they execute in the browser session of anyone who views them. The most serious configuration is WordPress Multisite, where a subsite Administrator does not hold the unfiltered_html capability, so the injected script can run in the session of a Network Super Administrator and cross a privilege boundary. Exploitation requires an authenticated Administrator-level account plus a victim who views the stored file (UI:R), publicly available exploit code exists, but EPSS is only 0.15% (4th percentile) and there is no CISA KEV confirmation of active exploitation; overall this is a low-severity, low-priority issue, with a vendor patch available in version 9.2.
Stored cross-site scripting (XSS) in the Magic Tooltips For Contact Form 7 plugin for WordPress (versions up to and including 1.0.34) allows unauthenticated attackers to inject arbitrary JavaScript that executes in an administrator's browser when they view the comment moderation screen at wp-admin/edit-comments.php. The flaw exists because the plugin's esc_html filter callback decodes HTML-entity-encoded payloads (e.g., '<tip>') back into live HTML, so an entity-encoded script submitted as a comment author name bypasses sanitize_text_field and is rendered as executable markup. Exploitation requires the site to have comment submission enabled (WordPress default) and a privileged administrator to open the moderation queue; no public exploit code or active exploitation is identified at time of analysis, though the CVSS score of 7.2 (High) reflects the unauthenticated, network-based attack vector and scope change.
Unauthenticated stored cross-site scripting in the Welcart e-Commerce plugin for WordPress (all versions up to and including 2.12.2) lets any remote attacker plant arbitrary JavaScript through the plugin's settlement/IPN notification endpoint, which accepts the 'rel' and 'option' parameters without authentication, nonce validation, or signature verification. Injected payloads are persisted and later rendered unsanitized inside the administrator's settlement error log view in wp-admin, where they execute in the admin's browser session (CVSS 3.1 score 7.2, AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and can be leveraged to hijack an authenticated administrator session or perform privileged actions. No public exploit code or Proof-of-Concept has been identified at time of analysis, and the flaw is not listed in CISA KEV; the independent assessment notes this is a genuinely actionable issue, with the only real limiting factor being that the payload fires when a store administrator opens the settlement error log - a routine operational action rather than an exotic prerequisite.
Stored cross-site scripting in WPC Product Options for WooCommerce 4.0.5 and earlier allows unauthenticated attackers to inject arbitrary JavaScript into WooCommerce order item meta and have it execute in a store administrator's browser session. The injection happens through a guest-checkout path where the malicious payload is placed inside a multipart/form-data Content-Disposition field name prefixed with 'wpcpo-', a technique that bypasses the plugin's sanitization because PHP's RFC1867 parser preserves raw field names byte-for-byte; the script then fires when a privileged user (realistically an admin reviewing the order in wp-admin) opens the affected page. At CVSS 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and with authentication requirements confirmed as unauthenticated (PR:N) by the vector, the injection step is easy to reach on any shop with guest checkout enabled, but the deferred, victim-triggered execution and the need for an admin to view the poisoned order bound the practical impact; no public exploit code was identified at time of analysis and there is no CISA KEV entry.
Stored cross-site scripting in the GD Rating System plugin for WordPress (all versions up to and including 3.7.1) allows an unauthenticated visitor to inject persistent JavaScript through the 'title' and 'url' Render Args processed by the gdrts_live_handler AJAX action. The action's per-item nonce provides no protection here, because the nonce is emitted in plaintext inside the gdrts-rating-data JSON block on every page that displays a rating item, so any anonymous visitor can harvest it; the injected script then runs in the browser of anyone who later views the poisoned page, giving low-impact confidentiality and integrity effects limited to the client. No public exploit code has been identified at time of analysis, and exploitation requires that the site both runs an affected plugin version and publicly renders at least one rating item.
Stored DOM-based cross-site scripting in the WordPress plugin Visitor Traffic Real Time Statistics (all versions up to and including 8.16) allows unauthenticated remote attackers to inject arbitrary web scripts that execute when a victim later loads the plugin's statistics view. The entry point is the plugin's wp_ajax_nopriv_ahcfree_track_visitor AJAX action, which accepts a forged X-Real-IP HTTP header with no authentication, nonce, or capability check and persists the entity-encoded value verbatim in the database; per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C) exploitation is network-reachable and requires no privileges or user interaction at injection time. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing), so risk here is driven primarily by the trivial unauthenticated injection path rather than by demonstrated in-the-wild abuse.
Stored cross-site scripting in the Strong Testimonials WordPress plugin (all versions through 3.3.11) can let unauthenticated attackers inject scripts that execute in visitors' browsers when an affected testimonial page is loaded, but only if an administrator has created custom text fields with the exact internal keys 'platform' and 'platform_user_photo' on a public testimonial submission form. The plugin fails to sanitize and escape those custom-field values (CWE-79), so default installations are not exploitable; the independent assessment notes attack complexity is High because that uncommon field configuration and public form are required. The provided CVSS is 7.2 with changed scope for browser-side execution, and no public exploit was identified at time of analysis.
Stored cross-site scripting in the Ultimate Member WordPress plugin (User Profile, Registration, Login, Member Directory, Content Restriction & Membership) through version 2.13.1 lets unauthenticated attackers inject arbitrary JavaScript into the 'form_id' parameter of a form submission; the payload is persisted unescaped into the registering user's 'submitted' usermeta via update_user_meta() and only executes when an administrator opens that specific user record in the wp-admin Users modal, where the stored value is inserted through jQuery .html(). The CVSS vector (AV:N/AC:L/PR:N, scope-changed) reflects that the script runs in the privileged admin context, but practical exploitation depends on anonymous users being able to reach a UM registration/profile form and on an administrator subsequently viewing the poisoned user record, so it is a conditionally-triggered issue rather than a drive-by compromise. No public exploit code was identified at time of analysis and the issue is not reported as actively exploited; the vendor addressed it in Ultimate Member 2.14.0.
Stored cross-site scripting in the Mail logging - WP Mail Catcher WordPress plugin (all versions up to and including 2.1.12) allows unauthenticated attackers to inject arbitrary web scripts that execute when a privileged user opens the plugin's mail log view in wp-admin. Exploitation is not possible against a default standalone install: it requires a separately installed plugin such as Contact Form 7 that passes unauthenticated user-controlled input into WordPress mail fields, plus a failed outgoing mail that causes PHPMailer to generate a 'wp_mail_failed' error message embedding the attacker's input. No public exploit identified at time of analysis; risk is conditional and mid-tier per independent assessment (assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N).
Stored cross-site scripting in the WordPress plugin Real Cookie Banner: GDPR & ePrivacy Cookie Consent (all versions up to and including 5.3.5) lets unauthenticated commenters plant markup that the plugin's own render-time HTML rewriting later promotes into an executable attribute, running script in the browser of any visitor who loads the injected page. Exploitability is gated by WordPress's standard comment moderation workflow, which is why our assessment conflicts with the vendor-supplied vector: the published CVSS uses AC:L while we assess AC:H (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) because the payload must survive the comment kses filter at save time and be approved for display before the plugin's page-wide regex strips the closing quote delimiter and activates it. No public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV).
Stored cross-site scripting (XSS) in the Transliterator WordPress plugin (versions up to and including 2.5.8) allows unauthenticated attackers to inject arbitrary web scripts into comment content, which execute when a user views the affected page. The flaw exists because the plugin's shortcode markers and predictable {rstr_keep} placeholder are not stripped, letting payloads composed of WordPress core kses-allowed tags (a[title] and code) bypass comment sanitization and later expand into executable script. Sites with the plugin active and public comments enabled are at risk; no public exploit has been identified at time of analysis. The CVSS score is 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), reflecting unauthenticated remote exploitation with scope change.
Stored cross-site scripting in the SEOPress - AI SEO Plugin & On-site SEO for WordPress (all versions up to and including 10.2) lets an attacker inject arbitrary JavaScript that is rendered unescaped inside the plugin's Google Analytics 4 or Matomo tracking script. Two preconditions gate real exploitation: the non-default 'Track Authors' custom dimension must be configured in the plugin's GA4/Matomo settings, and the attacker must be able to publish public singular content (for example a bbPress forum topic) so their controllable author display name reaches the tracking output. Wordfence reports it as CVSS 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N); no public exploit identified at time of analysis, and our own independent assessment rates it lower at AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N because the opt-in analytics setting plus content-publishing access make exploitation conditional rather than trivial.
Arbitrary file read and deletion in Formwork panel versions before 2.3.13 affect authenticated users who hold backup download or backup delete permissions. Exploitation requires a Linux deployment, where PHP basename() fails to treat backslashes as directory separators, allowing a base64-encoded backslash-separated traversal payload to escape the configured backup directory. No public exploit code or CISA KEV confirmation was identified at time of analysis, and the impact is confined to file read and deletion with no code execution.
Information disclosure in LaraDashboard before 1.4.8 allows an authenticated user who holds only the low-privilege settings.view permission to read stored secrets in plaintext by calling GET /api/settings or GET /api/settings/{option_name}, exposing AI provider API keys, mail/SMTP credentials, passwords and tokens. The flaw is an incorrect authorization / masking failure (CWE-863): the settings API policy treats the view permission as sufficient while SettingResource serializes option_value verbatim, so any account granted settings.view sees every configured secret; exposure is conditioned on secrets actually having been saved in settings. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has released 1.4.8, which introduces secret masking, keys hidden from the API, and a dedicated update policy.
Permanent deadlock of the alerting subsystem in Nezha Dashboard 1.8.0 through 2.3.12 allows any authenticated non-admin member to disable monitoring notifications by issuing four crafted notification API calls, and continued blocking requests can then exhaust server memory. The flaw is an improper locking issue (CWE-667) in which a mutex is unlocked non-deferred on a nil-map panic path, leaving the lock permanently held. Exploitation requires a valid low-privilege account (the assessed CVSS:3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), and no public exploit code was identified at time of analysis, so this represents a genuine but bounded availability risk rather than a critical priority.
Signature-verification bypass in Bouncy Castle for Java before 1.86 lets a phantom signer be accepted in BLS12-381 aggregate signature verification. The faulty BLS12_381BasicScheme.keyValidate() trusts the public key's own ECCurve object during the prime-order subgroup check, so an attacker-supplied ECPoint built on a foreign curve that merely shares BLS12-381's field characteristic - with its cofactor forged to 1 - passes validation despite not being a G1 point; in the pairing implementation such a point contributes the identity in the target group, so an aggregate signature verifies even though it contains no signature for that key/message pair. The issue is reachable only where an application constructs an ECPoint on an explicit, non-canonical curve and accepts it as an authority-bearing key, since the standard 48-byte compressed-point decoder always supplies the canonical curve; no public exploit has been identified at time of analysis, and the assessed impact is high integrity compromise without confidentiality or availability loss (CVSS:4.0 base 7.1, network vector, no privileges required).
Reflected cross-site scripting in the Unlimited Elements for Elementor WordPress plugin up to version 2.0.20 allows unauthenticated remote attackers to execute arbitrary scripts in the browser of a victim who clicks a specially crafted link, potentially leading to session hijacking, credential theft, or unauthorized actions performed as the victim. Exploitation requires user interaction and is limited to per-victim social engineering because the payload is not stored; no public exploit code or active exploitation has been identified at time of analysis. The plugin must be installed and active on a WordPress site for the vulnerability to be exploitable.
Unauthenticated attackers can exhaust LaraDashboard's paid email-verification quota through the public forgot-password and reset-password endpoints, causing advanced email validation to fail open across all public forms. Affected releases are 1.4.2 up to but not including 1.4.8, where the ForgotPasswordRequest and ResetPasswordRequest classes apply advanced DNS and AbstractAPI-based checks to arbitrary submitted addresses. Exploitation requires PR:N per the provided CVSS 4.0 vector, meaning no authentication is needed, and no public exploit code or CISA KEV confirmation is present; impact is a low-availability resource-exhaustion condition rather than code execution or data compromise.
Unauthenticated information disclosure in the Kener status-page platform (4.0.0 up to but not including 4.1.6) lets remote attackers retrieve data on hidden or inactive monitors by calling dashboard API handlers - such as monitor-bar and monitor-latency-chart - that omit visibility filters. By supplying a known or guessed monitor tag, an attacker obtains names, descriptions, status, uptime history and latency for monitors that were intentionally concealed, with no authentication or user interaction required (CVSS 4.0 vector shows PR:N/UI:N). There is no public exploit identified at time of analysis, and this is assessed as a moderate-priority confidentiality-only issue whose impact is bounded by the need to already know or guess a valid tag.
Cross-realm session disclosure in OpenAM before 16.1.3 allows an authenticated attacker holding delegated RealmAdmin privileges to bypass authorization on the sessions REST endpoint and read usernames, universal IDs, and session handles from other realms in a multi-tenant deployment. The flaw, tracked as CVE-2026-105120 (CWE-200), requires the attacker to supply a _queryFilter that names a realm outside their own; single-realm installations are effectively unaffected. No public exploit identified at time of analysis, and the CVSS v4.0 score is 6.9 (v3.1: 6.9 medium), reflecting high confidentiality impact but high privilege prerequisites (PR:H).
Authenticated delegated administrators in OpenIdentityPlatform OpenAM deployments prior to 16.1.3 can forcibly terminate user sessions belonging to realms outside their own authority. The flaw is a realm-scoping error in the session-destroy authorization check: because the check is evaluated against the requester's realm rather than the realm owning the target session, any account granted the iplanet-am-session-destroy-sessions attribute can submit an arbitrary session identifier or handle and log out users in other realms. Impact is limited to availability of user sessions (no confidentiality or integrity effect), and exploitation requires a high-privilege authenticated account plus a multi-realm, privilege-delegating configuration; no public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS scoring was not provided.
Key-size validation bypass in Bouncy Castle for Java before 1.86 (and Bouncy Castle for Java FIPS before bcpkix-fips 2.0.13 / 2.1.13) allows a key-transport EnvelopedData or AuthEnvelopedData message whose HKDF-derived content-encryption key does not match the advertised content-encryption algorithm to be accepted even when the application has explicitly enabled org.bouncycastle.cms.jcajce.JceKeyTransRecipient.setKeySizeValidation(true). The defect is confined to messages using RFC 9709 CEK derivation (id-alg-cek-hkdf-sha256); messages with a matching key size, non-HKDF messages, and recipients that never enable validation are unaffected, and the opt-in control is off by default, so this is a medium-severity defense-in-depth failure rather than a direct decryption or key-recovery primitive. Unauthenticated remote attackers who can supply CMS content to an application that has enabled the control can silently defeat the only mechanism the API offers for enforcing recovered key size; no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor-released patch is available.
Unauthenticated attackers can inject and execute arbitrary WordPress shortcodes through the All in One SEO (AIOSEO) plugin in versions up to and including 5.0.2, because an attacker-controllable value is passed to do_shortcode without adequate validation when the plugin renders its breadcrumb trail on the site's search results page. The flaw is only reachable when the AIOSEO breadcrumb is actively displayed on search results via the breadcrumb block, widget, shortcode, or template tag, and the practical impact is bounded by which shortcodes are registered on the target site. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; the issue is rated CVSS 6.5 (Medium), with the independent assessment treating attack complexity as higher than the vendor's vector because of the rendering precondition.
Unauthenticated remote attackers can execute arbitrary registered WordPress shortcodes through the WP Ultimate Review plugin (versions up to and including 2.4.3), because the plugin passes an unvalidated value to do_shortcode and the only nonce gate is emitted to anonymous visitors via the public review form, while submitted reviews auto-publish without administrator approval by default. The CVSS 3.1 base score is 6.5 (Medium) with low confidentiality and integrity impact and no availability impact; the real-world severity depends on which shortcodes exist on the target site. No public exploit code has been identified at time of analysis, and CISA KEV does not list this issue.
Time-based SQL injection in the SupportCandy - AI Customer Support Ticket System & Live Chatbot Agent WordPress plugin, affecting all versions up to and including 3.5.3, lets an authenticated attacker inject SQL through the unsanitized 'sort_by' parameter and use deliberate query delays to extract sensitive data from the site's database. Exploitation is gated by a non-default permission combination: the attacker must hold both a WordPress Subscriber-or-higher account and a SupportCandy Agent account explicitly granted the 'Assign Agents' capability, which confines the realistic threat to trusted-but-malicious or compromised agent accounts rather than anonymous visitors. Per CVSS 3.1 (6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) the impact is confidentiality-only, and no public exploit code was identified at time of analysis, with no CISA KEV listing.
Blind SQL injection in the Beaver Builder Page Builder plugin for WordPress (versions up to and including 2.11.0.5) allows authenticated attackers with Contributor-level access or higher to extract sensitive information from the database. Exploitation requires owning a draft post of a Beaver Builder post type to obtain the fl_ajax_update nonce, and the injection is blind, meaning data must be inferred rather than read directly; no public exploit was identified at time of analysis, and the issue is a genuine but moderate-priority risk rather than a top-tier emergency. The vulnerability is rated CVSS 6.5 with confidentiality impact only (no integrity or availability impact) and is limited to sites that grant untrusted users Contributor privileges.
Stored cross-site scripting in the Rich Showcase for Google Reviews WordPress plugin (widgetpack) affects all versions up to and including 7.1.3 and lets injected JavaScript run for every visitor of any page that renders imported Google reviews. Two delivery paths are confirmed by the available data: a WordPress user with subscriber-level access or above can inject script through the 'reviews[].text' parameter, and - because the plugin's default daily cron auto-imports review content from the connected Google business profile - an unauthenticated attacker can plant the payload by posting a crafted Google review on that business, with no WordPress credentials required; our independent assessment scores this path CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (the vendor's 6.4 uses PR:L for the authenticated path). Once stored, the payload executes on DOMContentLoaded without further user interaction, though exploitation is gated by the daily import cycle, an enabled auto-import feature, an active Google Business connection, and display of the affected review block; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Stored cross-site scripting in the SupportCandy WordPress plugin (all versions up to and including 3.5.3) lets an authenticated attacker holding only subscriber-level access plant arbitrary JavaScript via the 'name' parameter, which then executes in the browser of any administrator or support agent who later renders the affected admin or ticket page. Because the documented exploit chain depends on the 'Register user if not exists' option being disabled - the plugin's default state - most installations sit in the vulnerable configuration, though the attacker still needs a subscriber account and must wait for a privileged victim to view the injected content. Severity is moderate (CVSS 6.4, Medium) and consistent with a routine patch-management item; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV).
Stored cross-site scripting in the EmbedPress WordPress plugin (all versions up to and including 4.6.6) lets authenticated users with contributor-level access or higher inject arbitrary JavaScript that executes for anyone viewing the affected page. The flaw lives in the plugin's Gutenberg block rendering path, where the attacker-controlled 'slidesShow' attribute is interpolated into an unquoted data-carousel-options HTML attribute; a payload containing spaces breaks out of that attribute and injects additional DOM attributes such as onfocus event handlers onto the wrapper element. Exploitation requires a contributor account and a page that renders the EmbedPress block, and no public exploit code or confirmed active exploitation was identified at time of analysis; the Wordfence-sourced CVSS of 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects a moderate-priority issue rather than a critical emergency.
Stored cross-site scripting in the WordPress plugin Twenty20 Image Before-After (all versions up to and including 2.0.5) allows authenticated users with contributor-level access or above to inject arbitrary JavaScript through the 'offset' attribute of the plugin's shortcode; the injected script is stored in a post and executes when another user, such as an editor or administrator, later views that page. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (6.4), reflecting a network-reachable, low-privilege, no-user-interaction attack with changed scope but limited confidentiality and integrity impact, and authentication is mandatory, so sites that restrict contributor accounts or disable open registration materially reduce exposure. No CISA KEV entry or public exploit code was identified at time of analysis, and the plugin's Trac changeset indicates a 2.0.6 tag superseding 2.0.5.
Stored cross-site scripting in the CyberChimps Responsive Plus (Responsive Starter Templates - Elementor Templates & Starter Sites) plugin for WordPress affects all releases up to and including 3.5.3, letting an authenticated user with contributor-level access or higher plant arbitrary JavaScript in page content through shortcode attributes that are not sanitized on input or escaped on output; the script then runs in the browser of any user who loads the injected page. Scored CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), the flaw is not confirmed actively exploited (no CISA KEV listing) and no public exploit code exists at time of analysis, which - combined with the contributor-or-above account prerequisite - keeps it below top-priority status relative to unauthenticated WordPress plugin flaws.
Stored cross-site scripting in the Wp Social Login and Register Social Counter WordPress plugin (all versions up to and including 3.2.1) lets any authenticated account with subscriber-level access or above plant a script payload that executes in the browser of anyone who later views the poisoned avatar. Exploitation is a two-step chain: the attacker first invokes the plugin's nonce-only dismiss_ajax_call AJAX endpoint (the nonce is exposed to subscribers on any wp-admin page) to set the xs_social_profile_image user-meta flag on their own account, then stores a script payload in their display name, which xs_social_get_avatar echoes unescaped into an img alt attribute because WordPress core's ENT_NOQUOTES handling preserves the quotes needed to break out. Scored CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), it is a moderate-severity issue; no public exploit code has been identified at time of analysis and it is not confirmed actively exploited (CISA KEV), and the impact only materializes when a victim - ideally a privileged user such as an administrator - browses a page rendering the attacker's avatar.
Stored cross-site scripting in the Ultra Addons Lite for Elementor WordPress plugin (all versions up to and including 1.3.2) lets an authenticated attacker with contributor-level access or higher inject arbitrary JavaScript through unsanitized attributes of the plugin's Type Out widget; the script is persisted in the page and executes in the browser of any user who subsequently views it, yielding CVSS 6.4 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The flaw is a CWE-79 input-sanitization and output-escaping failure, scoped to sites that have the plugin active and that grant content-authoring accounts to untrusted users; there is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation currently requires deliberate attacker effort with an existing contributor account. No vendor-released patch or fixed version has been identified at time of analysis, leaving site owners dependent on removing or disabling the Type Out widget or removing the plugin until an update ships.
Path traversal in LaraDashboard before 1.4.8 lets unauthenticated remote attackers read arbitrary JSON files from the application by manipulating the {lang} segment of the public /api/translations/{lang} endpoint. Because the route concatenates the user-supplied value into a filesystem path and appends '.json', an attacker on a Windows host can submit URL-encoded backslash sequences such as ..%5C to escape the resources/lang directory and retrieve files like composer.json or version.json, exposing dependency and version metadata. The impact is limited to confidentiality (read-only, JSON files only) with no write or code execution, and no public exploit code was identified at time of analysis; a vendor fix is available in v1.4.8.
Race condition in LaraDashboard 1.4.0 through 1.4.7 allows unauthenticated remote attackers to bypass the per-IP daily registration limit by flooding concurrent registration requests, so that every request passes RegistrationGuardService::hasExceededIpLimit before any recordRegistration call commits. The result is bulk account creation that defeats the product's anti-automation and anti-spam controls, with impact limited to integrity of the registration state (no confidentiality or availability effect). Exploitation requires that public self-registration is enabled and the per-IP cap is active, and it depends on winning a narrow TOCTOU window, so attack complexity is high; there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis. EPSS data was not provided, but the assessed severity is low-to-moderate rather than critical.
Path traversal in Linux Mint Xreader 4.6.5 and earlier can disclose readable local files when a victim opens a crafted EPUB document in the built-in EPUB backend, and publicly available exploit code exists. Exploitation is remote but requires user interaction and no authentication; version 4.6.6 removes the EPUB backend entirely, and the practical impact is limited to low-confidentiality disclosure. This is a low-priority issue despite being remotely reachable.
Path traversal in Linux Mint Xreader up to 4.6.9 allows an attacker-supplied PDF to write an embedded attachment file outside the directory the victim selected, because the attachment filename is passed unsanitized to g_file_get_child in the PDF Attachment Saving Handler (shell/ev-window.c). Exploitation requires the victim to open the crafted PDF and explicitly initiate a save of the embedded attachment; authentication requirements are not confirmed from available data, though the assessed vector is PR:N (no privileges required), and the write occurs only at the victim's own privilege level, so confidentiality and integrity impact is low (VC:L/VI:L/VA:L). Publicly available exploit code exists (a public gist referenced by the vendor record), but there is no CISA KEV listing and no confirmation of active exploitation; the issue remains a modest-priority signal rather than a top-tier emergency.
Reflected cross-site scripting in the WPC Smart Quick View for WooCommerce WordPress plugin, affecting all versions up to and including 4.4.0, lets unauthenticated attackers inject arbitrary JavaScript into a page that executes in the browser of a victim who opens a crafted URL, since the 'woosq-redirect' parameter is neither sanitized on input nor escaped on output (CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Exploitation is configuration-dependent: the WooCommerce 'redirect to cart after add to cart' option must be enabled for the code path that reads the parameter to run, but once it is, the '?quick-view=' auto-open mechanism means no victim interaction beyond loading the link is required, though the attacker must still lure a user into clicking (UI:R) and no attacker authentication is needed (PR:N). No public exploit code was identified at time of analysis and there is no CISA KEV listing, so this should be treated as a routine patch-management priority rather than an emergency.
Reflected DOM-based cross-site scripting in the Calculated Fields Form - AI Form Builder for WordPress plugin (all versions up to and including 5.5.1.5) lets unauthenticated attackers inject arbitrary script into a page via the plugin's url.<name> predefined field values, with the payload executing in the victim's browser once the victim clicks an attacker-supplied crafted link. Exploitation is not possible on default installs: the site must publish a publicly reachable form in which an administrator has bound at least two fields to url.<name> predefined values and used those values together in a concatenation equation, so a successful attack depends on a specific non-universal admin configuration plus victim user interaction. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis, and the independently assessed vector (AC:H, UI:R, scope changed) places this in the moderate-priority range rather than an emergency.
Reflected cross-site scripting in the Photo Gallery by 10Web - Mobile-Friendly Image Gallery WordPress plugin, versions up to and including 1.8.46, lets unauthenticated attackers inject arbitrary JavaScript through the unsanitized 'thumb_url' parameter handled by the editimage_bwg AJAX action. Because that handler performs a capability check but no nonce verification, a payload can be delivered in a plain crafted GET request without any CSRF token, and it executes in the browser of a logged-in WordPress administrator; there is no public exploit identified at time of analysis. The realistic impact is moderate rather than critical: successful exploitation requires the victim to hold the manage_options capability and to be socially engineered into clicking an attacker-supplied link, so this is a genuine but moderate-priority issue, not a top-tier emergency.
Reflected cross-site scripting in the EWWW Image Optimizer plugin for WordPress (all versions up to and including 8.7.7) lets unauthenticated remote attackers inject arbitrary script into a page by supplying a crafted REQUEST_URI parameter key that is reflected without adequate sanitization or escaping into the plugin's HelpScout Beacon script block. Per the CVSS vector (PR:N, UI:R, S:C), no attacker authentication is required, but a victim must be tricked into clicking a crafted link, and the injected script runs only in that victim's browser session - this is a reflected, not stored, issue. Two independent gating factors temper real-world priority: the plugin's enable_help option must be active (the vulnerable beacon block is emitted only when it is), and exploitation depends entirely on user interaction; reflected cross-site scripting is rated 6.1 and no public exploit identified at time of analysis.
Reflected cross-site scripting in the WPFront Notification Bar WordPress plugin (versions up to and including 3.5.1) lets an unauthenticated remote attacker inject arbitrary JavaScript into a victim's browser by reflecting the raw request URI into an inline script block emitted on wp_footer. The attack requires the plugin's non-default debug logging option (write_debug_logs) to be enabled, and it only fires when a victim follows a specially crafted link, so practical exposure is limited to sites that have turned on debug logging; the impact is client-side only, with low confidentiality and integrity effects and no server-side code execution. Wordfence is the reporting source, no public exploit code was identified at time of analysis, and there is no CISA KEV listing; the upstream repository shows a changeset (3722432) addressing the code path, though a tagged patched release is not independently confirmed. Note also that the plugin's own score of 6.1 with AC:L assumes a default configuration, whereas our assessment raises attack complexity (AC:H) because exploitation is gated by the non-default debug-logging setting.
Reflected cross-site scripting (XSS) in the ProfilePress WordPress plugin versions up to and including 4.17.4 allows unauthenticated attackers to inject arbitrary web scripts via a crafted POST request with a malicious ppress_billing_address filename, which executes in a victim's browser when they are tricked into clicking a link. Exploitation requires that the affected site hosts the ProfilePress Tabbed Widget; sites not using this widget are not exposed. This moderate-severity flaw (CVSS 6.1) has no public exploit identified at time of analysis and is not confirmed as actively exploited (CISA KEV).
Reflected cross-site scripting (CWE-79) in the WPC Estimated Delivery Date for WooCommerce plugin, affecting all versions up to and including 4.0.1, allows unauthenticated attackers to inject arbitrary web scripts via the 'rule_data' parameter, which execute in a victim's browser if they are tricked into clicking a crafted link. The vulnerability arises from insufficient input sanitization and output escaping, and although no public exploit code is identified at time of analysis, the CVSS 3.1 base score is 6.1 (Medium) with a user-interaction requirement (UI:R). The primary limiting factor is the need to persuade a victim to perform an action; the scope is changed (S:C) because the script runs in the context of the victim's session.
LearnPress WordPress LMS plugin versions through 4.4.7 reflect unsanitized input from the 'orderby' parameter into the DOM, allowing reflected DOM-based cross-site scripting. An unauthenticated attacker can craft a URL that, when a victim clicks or loads it, executes arbitrary script in the victim's browser session; the CVSS vector confirms PR:N and UI:R, with low confidentiality and integrity impact and no availability impact. This is a moderate-severity, interaction-dependent issue, and no public exploit identified at time of analysis.
Reflected cross-site scripting (XSS) in the Ivory Search - WordPress Search Plugin, affecting all versions up to and including 5.5.18, allows unauthenticated attackers to inject arbitrary web scripts via the 's' search parameter. However, exploitation requires three specific conditions: the non-default 'Highlight Search Terms' option must be enabled by an administrator, the malicious search query must return at least one post result, and a victim must be socially engineered into opening a crafted URL. These factors significantly limit realistic exploitation, and our assessment adjusts attack complexity to High despite the base CVSS score of 6.1 (Medium). No public exploit code is known at this time.
Authenticated non-admin users can deadlock the alerting subsystem in Nezha 1.8.0 through releases before 2.3.13 by racing the notification-group UpdateGroup/DeleteGroup operations against the batch-delete endpoint with oversized id lists, closing an ABBA lock-order inversion that halts alert delivery until the service is restarted. This is an availability-only race condition (CWE-362) that requires a valid low-privileged account and successful timing; independent assessment maps it to CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H and rates it a moderate-severity issue rather than a top-tier priority. No public exploit identified at time of analysis, and no code execution, data access, or integrity impact is assessed.
Bouncy Castle for Java before 1.86 leaks secret-derived information from its HQC post-quantum KEM through two side channels, allowing a local attacker who can observe CPU cache behaviour or precisely measure decapsulation timing to recover information about the HQC private key. Only deployments that actually perform HQC encapsulation or decapsulation on the affected library are exposed, and exploitation requires either code co-resident on the same physical host or many carefully controlled timing measurements, so isolated single-tenant hardware largely neutralises the cache channel. There is no public exploit identified at time of analysis; this is a genuine cryptographic weakness but a comparatively low-urgency operational priority, and a vendor fix is available in version 1.86.
Arbitrary shortcode execution in the WP Ultimate Review WordPress plugin through version 2.4.3 lets any authenticated user with subscriber-level access or higher inject shortcodes that are stored and later executed when review content is rendered. The bypass abuses WordPress core behavior: the plugin passes attacker-controlled data into do_shortcode without validation, and the [[tag]] double-bracket escape is unwrapped to a bare [tag] by strip_shortcodes(), surviving wp_insert_post storage and firing through the_content on the publicly queryable xs_review post type. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV); exploitation requires a low-privilege account, which makes it practically significant on sites with open user registration.
Stored cross-site scripting in Jeg Kit for Elementor (all versions through 3.2.19) allows unauthenticated attackers to plant persistent JavaScript on WordPress sites through the plugin's comment handling path, which then executes in the browser of any user - including administrators - who later views the poisoned page. Attackers submitting from an email address that already has at least one approved comment on the site can achieve immediate persistence without moderator review, which is the precondition behind the High attack complexity rating (CVSS 5.4, AV:N/AC:H/PR:N/UI:N/S:C); other submissions still bypass sanitization but sit in the standard moderation queue. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a moderate-priority patch-and-remediate item rather than an emergency.