Stored cross-site scripting in the Kubio AI Page Builder WordPress plugin before 2.9.3 lets unauthenticated attackers submit HTML markup that passes the plugin's content filtering and is later executed by the plugin's own front-end script in the browser of any site visitor, or of an administrator reviewing the still-unapproved submission. The flaw is one of scope: the widened HTML element allowlist the plugin applies for its editor context is also applied when filtering content submitted by unauthenticated users, so markup that should never survive sanitisation does. Publicly available exploit code exists (referenced by WPScan), but EPSS is only 0.17% (6th percentile) and CISA's SSVC assessment records no exploitation and no automatable path, so this is a moderate-priority patch rather than an emergency; the vendor-published CVSS of 8.8 (S:U) is more severe than our independently assessed vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, and the difference is largely scope and impact rating rather than exploitability.
Authenticated users holding editor privileges on wcms through 3.18.0 can turn the media upload API into a remote code execution primitive: the [*:path] parameter of POST /api/v0/media/upload/ is not validated, so an editor can write .php files into a web-served location (including outside the media directory via encoded ../ sequences) and have the web server execute them. The same unvalidated path on DELETE /api/v0/media/[*:path] additionally allows arbitrary file deletion, and the underlying flaw is an unrestricted upload of a dangerous file type (CWE-434) rated CVSS 4.0 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H). Exploitation is not anonymous - a valid editor account is mandatory (PR:L) and code execution further depends on the written PHP landing in a directory the web server executes; at time of analysis there is no CISA KEV entry and no public exploit identified at time of analysis.
Improper privilege management in LaraDashboard before 1.4.8 lets an authenticated Admin-tier user who holds the role.edit permission escalate to Superadmin by renaming or editing roles, or by granting themselves user.login_as rights, which then exposes account takeover and the core-upgrade and module-installation functions needed for code execution. The pre-patch guard in RoleController only refused Superadmin role tampering when the application ran with demo_mode enabled and the role name was literally 'Superadmin', so ordinary production deployments are exposed to any role-management holder by default. Exploitation is access-gated rather than anonymous: it requires a pre-existing Admin account with role.edit, no user interaction is needed, and no public exploit has been identified at time of analysis; the vendor has released the 1.4.8 patch.
Unauthenticated SQL injection in the SaveTo Wishlist Lite WordPress plugin before 1.1.5 allows remote attackers to append arbitrary SQL queries to the ORDER BY clause of a database query, enabling extraction of sensitive information from the WordPress database. Publicly available exploit code exists, though EPSS is low (0.17%, 6th percentile) and there is no indication of active exploitation (CISA KEV not listed). The vendor has released a patch in version 1.1.5.
Unauthenticated attackers can seize a privileged point-of-sale session on WordPress sites running the TillKit plugin before 1.0.5, letting them read customer and site-user personal data and modify store records. On activation the plugin creates a privileged POS account protected by a hard-coded, publicly known PIN that it never forces administrators to change, and its public POS login endpoint authenticates on that PIN alone with no identity or capability check (CWE-287); the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N confirms this is remotely reachable with no credentials and no user interaction. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV) and EPSS is low at 0.14% (3rd percentile), so real-world urgency depends on whether TillKit is actually deployed and whether the default PIN is still in place.
TOTP replay in the WP 2FA WordPress plugin (versions before 4.1.0) allows an attacker who already knows an account's password and can capture a valid time-based one-time passcode within its ~30-second validity window to reuse that same code and complete login without ever knowing the second factor - including on administrator accounts. The defect (CWE-287, improper authentication) is that consumed codes are never invalidated, so replays succeed while the code is still live; this does not allow bypass from scratch, since it requires prior credential compromise plus real-time observation of a code via phishing, a proxy, MITM, or logging. Exploitation is conditional and targeted rather than scalable, consistent with the assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N (7.5) and the very low EPSS of 0.19% (8th percentile); publicly available exploit code exists, but there is no CISA KEV evidence of active exploitation. The vendor has released a fix in WP 2FA 4.1.0, and the issue is tracked as EUVD-2026-91934.
Stored cross-site scripting in the WP Ultimate Review WordPress plugin before 2.4.4 lets unauthenticated visitors inject script through the plugin's public review form, which then runs in the browser of any user - including administrators - who later views the front-end page rendering that review. Publicly available exploit code exists, but the issue is not in CISA KEV and EPSS is only 0.17% (6th percentile), indicating low predicted exploitation activity. Consistent with the independent assessment (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), exploitation is not automatic: the plugin's user-review feature must be enabled and a victim must actively view the poisoned review page, making this a moderate rather than emergency priority.
Unauthenticated attackers can persistently disable affected pages on WordPress sites running the WP Ultimate Review plugin before 2.4.4 by submitting crafted review content that is stored and then triggers a fatal error on every subsequent page load. Confirmed exploitation conditions require the plugin to be installed and its review display settings to have never been saved (default unconfigured state); no authentication, user interaction, or non-default toggles are needed, and the impact is availability-only with no data compromise. Publicly available exploit code exists (documented by WPScan), and a vendor-released patch is available in version 2.4.4, so the practical exposure is limited to sites that have not yet saved their review display settings; EPSS is low at 0.16% (4th percentile), indicating a genuine but moderate-severity availability issue rather than a top-tier emergency.
Unauthenticated visitors can persistently break front-end page rendering on WordPress sites running the WP Ultimate Review plugin before version 2.4.4 whenever the plugin's user-review submission feature is enabled. A submitted review rating that is not a valid number is stored without validation and later fed into numeric operations during review rendering, producing a PHP fatal error that blocks the affected content for every visitor until an administrator deletes the offending review. Exploitation is trivial and publicly available exploit code exists via the WPScan advisory, but the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and the assessed profile confine impact to availability, and EPSS is only 0.16% (4th percentile), so this is a moderate, not critical, operational priority - configuration-gated, low-severity-per-event, and fully reversible by removing the injected review.
Sensitive information exposure in the ProfilePress WordPress plugin (wp-user-avatar), affecting all versions up to and including 4.17.4, allows an authenticated attacker with subscriber-level access or above to read other users' email addresses, login names, and registration dates by supplying attacker-controlled base64 payloads to the [pp-custom-html] shortcode that invoke [profile-email], [profile-username], and [profile-date-registered] through the Member Directory's per-row user rebinding logic in get_user_profile_structure. When WordPress self-registration is enabled (users_can_register), the same leak becomes reachable without authentication, because the plugin's registration handler processes the reg_nickname and reg_bio fields without a nonce check and can carry the split shortcode fragments. Impact is confidentiality-only - the exposed data is limited to emails, usernames, and registration timestamps, not passwords or session material - and neither CISA KEV listing nor public exploit code has been identified at time of analysis; the Wordfence advisory is the primary vendor-adjacent reference.
Privilege escalation in the Groundhogg - CRM, Newsletters, and Marketing Automation plugin for WordPress versions up to and including 4.9 allows an authenticated Sales Representative-level user who holds both the add_contacts and send_emails capabilities to rebind a contact record to an Administrator's WordPress user ID, then use the v4 email-test endpoint to mint an {auto_login_url} key and obtain a fully authenticated Administrator session. This is a genuine high-priority issue rather than a CVSS-inflated one, but the practical risk is contingent on a site having delegated those non-administrator Groundhogg roles to the attacker; no public exploit identified at time of analysis, and the vendor has released a fix in version 4.9.1.
Unauthenticated remote attackers can instantiate arbitrary Java classes in OpenIdentityPlatform OpenAM before 16.1.3 through the legacy JAX-RPC SOAP interface, leading to server crashes, classpath probing, and potential code execution via gadget chains. The vulnerability requires the JAX-RPC endpoint to be present and network-reachable at /jaxrpc/*, but no authentication or user interaction is needed because the session identifier is accepted without validation. No public exploit code has been identified at time of analysis; the CVSS 4.0 score is 8.8, and the independent assessment rates it as a credible high-priority issue rather than an inflated score.
Authenticated SQL injection in the Smart Manager - Advanced WooCommerce Bulk Edit & Inventory Management plugin (Pro edition) affects all versions up to and including 8.97.0, letting any account at subscriber level or above append arbitrary SQL to an existing query through the 'access_privileges' parameter and read sensitive data from the WordPress database. Exploitation is not unconditional: the site must also be in a non-default state where an administrator has saved a role-based deny-list Access Privilege configuration that does not explicitly block the internal 'access-privilege' module, which causes the authorization filter to implicitly permit low-privilege users to reach the vulnerable handler. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); note that while the supplied CVSS 3.1 vector is 8.8 High (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), our independent assessment rates effective severity lower (AC:H, I:L, A:N) because default installations and correctly configured deny-lists are not exploitable, valid authentication is mandatory, and only Pro-edition sites are in scope.
Privilege escalation in the Ultimate Member WordPress plugin affects all versions through 2.13.1, allowing an authenticated attacker to manipulate a user-controlled key that the plugin fails to bind to the requester's own account or privileges, thereby elevating a low-privilege account to a higher role such as administrator. The flaw requires an authenticated account (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base score 8.8), but because Ultimate Member supplies front-end user registration, an attacker can typically self-register on sites with open registration enabled - the common deployment mode - lowering the practical barrier to entry; sites that disable open registration require a pre-existing credential. Exploitation status at time of analysis: no public exploit identified at time of analysis, and the vulnerability is not confirmed actively exploited (CISA KEV), though the low attack complexity and high confidentiality, integrity, and availability impact make rapid patching a priority, with no EPSS score supplied in the available intelligence.
Unauthenticated remote denial of service in Mooncake Transfer Engine before 0.3.12 lets any host that can reach the peer-to-peer handshake socket crash the hosting process - including an SGLang inference server - by sending a single eight-byte handshake frame carrying a zero-length string field. The root cause is an out-of-bounds read (CWE-125) in the readString helper in include/common.h, rated 8.7 under CVSS 4.0 and independently assessed as CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N), with impact confined to availability: no code execution, no data disclosure. Exploitation needs nothing more than network reachability to the handshake port, which the advisory states listens on all interfaces by default; there is no public exploit identified at time of analysis, the issue is not in CISA KEV, and the only limiting factor is whether that port is firewalled or bound to loopback/trusted interfaces.
Bouncy Castle for Java before 1.86 fails to tie a Remove proposal in an MLS (RFC 9420) external commit to the joining party, allowing any holder of the group's public GroupInfo to evict an arbitrary member and take over that member's slot in the ratchet tree. Exploitation requires only that an application use the library's MLS module and accept external commits through the public Group.externalJoin / Group.handle API on an affected version; no group membership, credential, or user interaction is needed, and the missing credential check existed only in the gRPC interop harness, protecting none of the other API callers. The vendor rates this 8.7 (CVSS 4.0 AV:N/AC:L/AT:N/PR:N/UI:N), and there is no public exploit identified at time of analysis, though the flaw is trivially reachable by anyone who legitimately receives GroupInfo.
Certificate-validation bypass in Bouncy Castle for Java lets a PKIXCertPathReviewer accept an end-entity certificate that violates a NameConstraints extension imposed by its own issuing CA, causing isValidCertPath() to return true with an empty error list for a chain the real PKIX validator rejects. Affected are BC-Java before 1.86, BC-LTS-Java before 2.73.13, and BC-FJA (bcpkix-fips) before 1.0.13 / 2.0.13 / 2.1.13; exploitation requires an application that uses org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer (or the legacy org.bouncycastle.x509 copy) to make the trust decision rather than the unaffected CertPathValidator "PKIX"/"BC", and a chain whose leaf actually breaches the CA's permitted or excluded subtrees. No public exploit code has been identified at time of analysis, the vulnerability is unauthenticated (CVSS PR:N) per the vendor vector, and the vendor scores it CVSS 4.0 8.7 (High) for high integrity impact; note that an independent assessment rates attack complexity higher (CVSS 3.1 AV:N/AC:H) because the exposure depends entirely on non-default application architecture rather than on anything the attacker controls.
Improper validation of the digestAlgorithm/authAttrs pairing in Bouncy Castle's CMS AuthenticatedData handling lets a man-in-the-middle make the parser return authenticated attributes that the message MAC never covered, in Bouncy Castle for Java before 1.86, Bouncy Castle LTS before 2.73.13, and the BC-FJA/FIPS releases (bcpkix-fips before 1.0.13/2.0.13/2.1.13 and bcutil-fips before 2.0.8/2.1.8). Because the streaming CMSAuthenticatedDataParser picks in its constructor whether the MAC covers the DER encoding of authAttrs or the eContent OCTET STRING based solely on whether digestAlgorithm is present - a field that precedes authAttrs in the SEQUENCE - a message crafted with digestAlgorithm absent but authAttrs present passes the genuine content-MAC check and then exposes attacker-chosen attributes through getAuthAttrs(). Exploitation is unauthenticated at the network layer (CVSS:4.0 PR:N, no keys of either the key-encryption or content-MAC type are needed) but requires an in-transit tampering position and a victim application that makes an authorization, routing, or labelling decision from those attributes; the eContent payload itself remains MAC-bound, no public exploit has been identified at time of analysis, and signals conflict on whether this merits urgent prioritization (vendor CVSS 4.0 8.7 with AC:L versus an independent CVSS 3.1 assessment of AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).
Information disclosure in Backdrop CMS before 1.35.1 allows remote, unauthenticated attackers to download full-site configuration export archives that users with the 'synchronize configuration' permission have generated: before the fix, the config.tar.gz written to the temporary:// scheme was not reliably deleted after transfer and could be fetched without any authorization check, exposing the complete site configuration including sensitive settings. Exploitation is conditional, not on-demand - the attacker must find a leftover archive rather than cause one to be created, which is consistent with the vendor's CVSS 4.0 Attack Requirements: Present and AC:H rating, so installations that never perform a configuration export are not exposed. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, no EPSS score was supplied, and the vendor-released fix is 1.35.1.
In-place encryption over a secret key buffer in Bouncy Castle for Java LTS before 2.73.13 can silently replace freshly produced ciphertext with the raw AES key, because native one-shot packet ciphers release read-only input arrays with JNI mode 0 and a later copy-back overwrites the output. The trigger is narrow and application-dependent-it requires the non-default pattern of passing the same Java array as both input and destination (for example, encrypting over KeyParameter.getKey()) on a JVM that copies rather than pins JNI array elements-so real-world exploitability is far lower than the 8.2 base score implies; bcprov, pure-Java packet ciphers, and native streaming modes are unaffected. No public exploit identified at time of analysis.
Improper input validation in the Themeum Kirki WordPress plugin through version 6.3.1 allows unauthenticated remote attackers to access functionality not properly constrained by ACLs, yielding high confidentiality impact and low integrity impact with no availability impact. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N (base 8.2) confirms network exploitation without privileges or user interaction, so any WordPress site running Kirki from initial release through 6.3.1 is exposed. No public exploit identified at time of analysis, though the Patchstack reference URL labels the issue as arbitrary code execution; the authoritative assessment aligns with CWE-1284 broken access control rather than a confirmed RCE outcome.
Bouncy Castle for Java 1.81 through 1.85.2 fails to verify that a third-party OpenPGP signature was issued by a component key actually granted certification authority, so the high-level certificate API will attribute an attacker-made certification or trust delegation to the certificate's offline primary key. An attacker must already hold the private key of a restricted subkey (one bound only with SIGN_DATA, or a legacy RSA encryption subkey whose algorithm can still sign) that lacks the RFC 9580 sec. 5.2.3.29 CERTIFY_OTHER flag; they can then issue a positive User ID certification or a full-trust depth-one direct-key delegation that getCertificationBy()/getDelegationBy() report as a valid chain, and any application treating isValid() as an identity or trusted-introducer decision will accept the forged assertion at the primary key's authority. The flaw is a privilege promotion of an already-compromised subkey rather than a key-recovery attack, no public exploit code has been identified at time of analysis, and vendor fixes are available in 1.86.
Truncated OpenPGP messages are silently accepted by Bouncy Castle for Java's OpenPGP decryption streams, letting an attacker who can deliver or truncate a message strip trailing packets and, on the SEIPD version 1 path, suppress the modification detection code check entirely, so recipients are handed unauthenticated CFB-decrypted plaintext. The AEAD route (SEIPD v2 and the version 5 AEAD packet) fails open when a literal data packet ends exactly on an AEAD chunk boundary and the consumer reads in increments smaller than one chunk, while the more severe SEIPDv1 route affects only the high-level org.bouncycastle.openpgp.api present in bc-java, not the LTS or FIPS editions. The vendor rates this CVSS 4.0 8.2 (VI:H, with no confidentiality or availability impact), and the fix is released in bc-java 1.86, bc-lts-java 2.73.13, and bcpg-fips 1.0.14 / 2.0.14.1 / 2.1.14; no public exploit identified at time of analysis.
Signature misattribution in the high-level OpenPGP API of Bouncy Castle for Java before 1.86 lets an attacker who holds a third party's public signing subkey - entirely public material - graft that subkey onto their own primary key with a Subkey Binding signature that omits both the Key Flags subpacket and the embedded Primary Key Binding (cross-certification) signature. Because OpenPGPCertificate.isSigningKey() and verifyEmbeddedPrimaryKeyBinding() resolved the subkey's key flags two different ways, the grafted subkey was treated as signing-capable while being exempt from the cross-certification requirement, so OpenPGPSignature.OpenPGPDocumentSignature.isValid() returned true for a message the subkey genuinely signed and reported the attacker's certificate as its issuer; GnuPG rejects the identical certificate and message. This yields misattribution of an existing genuine signature under an attacker-chosen, self-asserted identity - no private key is recovered and no new signature can be forged - and only affects relying parties that pin trust on the subkey's fingerprint or key ID while taking the signer identity from the enclosing certificate. The vendor rates it 8.2 (CVSS 4.0) with integrity-only impact; an independent assessment scores it CVSS 3.1 8.2-equivalent integrity-only (AC:H, PR:N, UI:N), no public exploit code and no confirmed active exploitation (not in CISA KEV) were identified at time of analysis.
Unauthenticated attackers can permanently delete arbitrary posts, pages, products, and media attachments on any WordPress site running the Photo Reviews for WooCommerce plugin through version 1.2.30. The plugin accepts attacker-controlled post IDs in the public wcpr_image_upload_id parameter of a review submission and stores them as the review's 'reviews-images' comment meta without verifying that those IDs belong to attachments owned by the submitter; when the review is later deleted, the delete_reviews_image() handler unconditionally calls wp_delete_post( $id, true ) on every stored ID. Because the trigger is a privileged action - an administrator deleting the planted review, or WordPress's built-in wp_scheduled_delete cron emptying the comment trash roughly 30 days after the review is trashed - this is a credible high-integrity, high-availability issue rather than an instantly weaponizable one, and no public exploit code or CISA KEV entry was identified at time of analysis.
Nelio Content 4.5.0 and earlier for WordPress fails to verify authorization in its reusable-message REST controller, allowing authenticated users with contributor-level access or higher to permanently delete any nc_reusable_social post, including reusable social messages authored by administrators or other privileged users. Exploitation requires an authenticated contributor account on a site running the plugin with its reusable social message feature active, so anonymous internet attackers cannot trigger it. No public exploit identified at time of analysis; the independent assessment rates this as a moderate-priority issue rather than a top-tier emergency, despite the original 8.1 High CVSS rating, because impact is limited to reusable social messages and requires contributor-level access.
Local file inclusion in the WPCafe restaurant menu, online ordering and table booking plugin for WordPress affects all versions up to and including 3.0.18, allowing an authenticated user with contributor-level privileges or higher to manipulate the template-scope parameter that the plugin passes into a PHP include, causing arbitrary local files on the server to be read or, under the right conditions, executed. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.5) confirms the low-privileged authenticated prerequisite, while the high attack complexity reflects a second precondition: to reach code execution the attacker must also be able to place a .php file on the server for the vulnerable include to pull in, making full RCE conditional rather than guaranteed. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so real-world risk is tempered by the need for a valid contributor account plus a separate file-placement primitive.
OAuth 2.0 PKCE enforcement bypass in OpenAM before 16.1.3 allows an attacker who intercepts an authorization code issued through OpenID Connect hybrid flows to redeem it for a public client's tokens using any non-empty code_verifier, because PKCE is applied only when response_type is exactly code. The attack is remote and unauthenticated from the token endpoint perspective but requires user interaction and the ability to intercept the code; deployments not using hybrid flows are not affected. No public exploit identified at time of analysis, and a vendor fix is available in OpenAM 16.1.3; this is a credible mid-tier priority rather than a drop-everything emergency.
Unauthenticated attackers can read privacy-restricted member profile field data in the WordPress plugin Ultimate Member (all versions up to and including 2.13.1) by calling the publicly reachable AJAX endpoint wp_ajax_nopriv_um_get_members, which fails to verify that the requester is authorized to see fields marked owner-only, members-only, or role-restricted. The endpoint's supposed protection, the 'um-frontend-nonce' token, is published to every anonymous visitor through wp_localize_script, so it provides no real access control and any anonymous visitor can satisfy the endpoint's checks; this yields a high-confidentiality, no-integrity/no-availability impact (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). No public exploit code has been identified at time of analysis and there is no CISA KEV entry, but the attack surface is default-configuration and remote, so the only practical prerequisite is that the site actually has privacy-restricted profile fields containing sensitive values. The vendor addressed the issue in Ultimate Member 2.14.0, whose release notes explicitly credit Wordfence for reporting CVE-2026-93428.
SQL injection in the GeoDirectory WordPress plugin (all versions up to and including 2.8.186) allows an attacker holding a Subscriber-level account or higher to store a crafted payload in a listing's latitude/longitude coordinate fields and then trigger it through the public wp_ajax_nopriv_geodir_widget_listings AJAX handler, resulting in arbitrary SQL being appended to existing queries and disclosure of sensitive database contents. Successful exploitation requires the attacker to create and own a listing (pending state) whose coordinates are saved without numeric validation or escaping, then request the handler with set_post=<their-listings-id> and sort_by=distance_asc; no victim interaction is needed. No public exploit code has been identified at the time of analysis, and the practical risk is conditional: sites that disable open user registration, thereby preventing attackers from obtaining Subscriber accounts, are substantially protected.
Unauthenticated attackers can redirect activation and registration-complete emails to an arbitrary address in Simple Membership (WordPress plugin) versions up to and including 4.8.3, leading to disclosure of a pending member's username and plaintext password, and can activate that member's account without consent. The flaw resides in the resend-activation and email-activation endpoints, which are invoked on frontend init without authentication, nonce, capability, or ownership checks, and accept a recipient address from attacker-controlled POST data. Exploitation requires the target site to have at least one pending, unactivated member account; no public exploit code has been identified at time of analysis.
Unauthenticated SQL injection in the WP Visitor Statistics (Real Time Traffic) WordPress plugin through 8.7 lets any remote client poison the wp_logVisit table by submitting a crafted referrer URL to the wmcTrack tracking endpoint; the injected SQL then fires inside the session of an administrator who opens the Traffic Sources dashboard, allowing extraction of sensitive data such as user password hashes and stored configuration secrets. The impact is confidentiality-only - no integrity or availability effect was assessed - and the attack is second-order, so it remains dormant until a privileged user views the affected report. This is a genuine but conditional risk rather than an emergency: no public exploit code and no confirmed active exploitation were identified at time of analysis, and the assessed vector (UI:R) reflects that a privileged victim must open the dashboard for the payload to execute.
Stored cross-site scripting (XSS) in the Magic Tooltips For Contact Form 7 plugin for WordPress (versions up to and including 1.0.34) allows unauthenticated attackers to inject arbitrary JavaScript that executes in an administrator's browser when they view the comment moderation screen at wp-admin/edit-comments.php. The flaw exists because the plugin's esc_html filter callback decodes HTML-entity-encoded payloads (e.g., '<tip>') back into live HTML, so an entity-encoded script submitted as a comment author name bypasses sanitize_text_field and is rendered as executable markup. Exploitation requires the site to have comment submission enabled (WordPress default) and a privileged administrator to open the moderation queue; no public exploit code or active exploitation is identified at time of analysis, though the CVSS score of 7.2 (High) reflects the unauthenticated, network-based attack vector and scope change.
Unauthenticated stored cross-site scripting in the Welcart e-Commerce plugin for WordPress (all versions up to and including 2.12.2) lets any remote attacker plant arbitrary JavaScript through the plugin's settlement/IPN notification endpoint, which accepts the 'rel' and 'option' parameters without authentication, nonce validation, or signature verification. Injected payloads are persisted and later rendered unsanitized inside the administrator's settlement error log view in wp-admin, where they execute in the admin's browser session (CVSS 3.1 score 7.2, AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and can be leveraged to hijack an authenticated administrator session or perform privileged actions. No public exploit code or Proof-of-Concept has been identified at time of analysis, and the flaw is not listed in CISA KEV; the independent assessment notes this is a genuinely actionable issue, with the only real limiting factor being that the payload fires when a store administrator opens the settlement error log - a routine operational action rather than an exotic prerequisite.
Stored cross-site scripting in WPC Product Options for WooCommerce 4.0.5 and earlier allows unauthenticated attackers to inject arbitrary JavaScript into WooCommerce order item meta and have it execute in a store administrator's browser session. The injection happens through a guest-checkout path where the malicious payload is placed inside a multipart/form-data Content-Disposition field name prefixed with 'wpcpo-', a technique that bypasses the plugin's sanitization because PHP's RFC1867 parser preserves raw field names byte-for-byte; the script then fires when a privileged user (realistically an admin reviewing the order in wp-admin) opens the affected page. At CVSS 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and with authentication requirements confirmed as unauthenticated (PR:N) by the vector, the injection step is easy to reach on any shop with guest checkout enabled, but the deferred, victim-triggered execution and the need for an admin to view the poisoned order bound the practical impact; no public exploit code was identified at time of analysis and there is no CISA KEV entry.
Stored cross-site scripting in the GD Rating System plugin for WordPress (all versions up to and including 3.7.1) allows an unauthenticated visitor to inject persistent JavaScript through the 'title' and 'url' Render Args processed by the gdrts_live_handler AJAX action. The action's per-item nonce provides no protection here, because the nonce is emitted in plaintext inside the gdrts-rating-data JSON block on every page that displays a rating item, so any anonymous visitor can harvest it; the injected script then runs in the browser of anyone who later views the poisoned page, giving low-impact confidentiality and integrity effects limited to the client. No public exploit code has been identified at time of analysis, and exploitation requires that the site both runs an affected plugin version and publicly renders at least one rating item.
Stored DOM-based cross-site scripting in the WordPress plugin Visitor Traffic Real Time Statistics (all versions up to and including 8.16) allows unauthenticated remote attackers to inject arbitrary web scripts that execute when a victim later loads the plugin's statistics view. The entry point is the plugin's wp_ajax_nopriv_ahcfree_track_visitor AJAX action, which accepts a forged X-Real-IP HTTP header with no authentication, nonce, or capability check and persists the entity-encoded value verbatim in the database; per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C) exploitation is network-reachable and requires no privileges or user interaction at injection time. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing), so risk here is driven primarily by the trivial unauthenticated injection path rather than by demonstrated in-the-wild abuse.
Stored cross-site scripting in the Strong Testimonials WordPress plugin (all versions through 3.3.11) can let unauthenticated attackers inject scripts that execute in visitors' browsers when an affected testimonial page is loaded, but only if an administrator has created custom text fields with the exact internal keys 'platform' and 'platform_user_photo' on a public testimonial submission form. The plugin fails to sanitize and escape those custom-field values (CWE-79), so default installations are not exploitable; the independent assessment notes attack complexity is High because that uncommon field configuration and public form are required. The provided CVSS is 7.2 with changed scope for browser-side execution, and no public exploit was identified at time of analysis.
Stored cross-site scripting in the Ultimate Member WordPress plugin (User Profile, Registration, Login, Member Directory, Content Restriction & Membership) through version 2.13.1 lets unauthenticated attackers inject arbitrary JavaScript into the 'form_id' parameter of a form submission; the payload is persisted unescaped into the registering user's 'submitted' usermeta via update_user_meta() and only executes when an administrator opens that specific user record in the wp-admin Users modal, where the stored value is inserted through jQuery .html(). The CVSS vector (AV:N/AC:L/PR:N, scope-changed) reflects that the script runs in the privileged admin context, but practical exploitation depends on anonymous users being able to reach a UM registration/profile form and on an administrator subsequently viewing the poisoned user record, so it is a conditionally-triggered issue rather than a drive-by compromise. No public exploit code was identified at time of analysis and the issue is not reported as actively exploited; the vendor addressed it in Ultimate Member 2.14.0.
Stored cross-site scripting in the Mail logging - WP Mail Catcher WordPress plugin (all versions up to and including 2.1.12) allows unauthenticated attackers to inject arbitrary web scripts that execute when a privileged user opens the plugin's mail log view in wp-admin. Exploitation is not possible against a default standalone install: it requires a separately installed plugin such as Contact Form 7 that passes unauthenticated user-controlled input into WordPress mail fields, plus a failed outgoing mail that causes PHPMailer to generate a 'wp_mail_failed' error message embedding the attacker's input. No public exploit identified at time of analysis; risk is conditional and mid-tier per independent assessment (assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N).
Stored cross-site scripting in the WordPress plugin Real Cookie Banner: GDPR & ePrivacy Cookie Consent (all versions up to and including 5.3.5) lets unauthenticated commenters plant markup that the plugin's own render-time HTML rewriting later promotes into an executable attribute, running script in the browser of any visitor who loads the injected page. Exploitability is gated by WordPress's standard comment moderation workflow, which is why our assessment conflicts with the vendor-supplied vector: the published CVSS uses AC:L while we assess AC:H (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) because the payload must survive the comment kses filter at save time and be approved for display before the plugin's page-wide regex strips the closing quote delimiter and activates it. No public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV).
Stored cross-site scripting (XSS) in the Transliterator WordPress plugin (versions up to and including 2.5.8) allows unauthenticated attackers to inject arbitrary web scripts into comment content, which execute when a user views the affected page. The flaw exists because the plugin's shortcode markers and predictable {rstr_keep} placeholder are not stripped, letting payloads composed of WordPress core kses-allowed tags (a[title] and code) bypass comment sanitization and later expand into executable script. Sites with the plugin active and public comments enabled are at risk; no public exploit has been identified at time of analysis. The CVSS score is 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), reflecting unauthenticated remote exploitation with scope change.
Stored cross-site scripting in the SEOPress - AI SEO Plugin & On-site SEO for WordPress (all versions up to and including 10.2) lets an attacker inject arbitrary JavaScript that is rendered unescaped inside the plugin's Google Analytics 4 or Matomo tracking script. Two preconditions gate real exploitation: the non-default 'Track Authors' custom dimension must be configured in the plugin's GA4/Matomo settings, and the attacker must be able to publish public singular content (for example a bbPress forum topic) so their controllable author display name reaches the tracking output. Wordfence reports it as CVSS 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N); no public exploit identified at time of analysis, and our own independent assessment rates it lower at AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N because the opt-in analytics setting plus content-publishing access make exploitation conditional rather than trivial.
Arbitrary file read and deletion in Formwork panel versions before 2.3.13 affect authenticated users who hold backup download or backup delete permissions. Exploitation requires a Linux deployment, where PHP basename() fails to treat backslashes as directory separators, allowing a base64-encoded backslash-separated traversal payload to escape the configured backup directory. No public exploit code or CISA KEV confirmation was identified at time of analysis, and the impact is confined to file read and deletion with no code execution.
Information disclosure in LaraDashboard before 1.4.8 allows an authenticated user who holds only the low-privilege settings.view permission to read stored secrets in plaintext by calling GET /api/settings or GET /api/settings/{option_name}, exposing AI provider API keys, mail/SMTP credentials, passwords and tokens. The flaw is an incorrect authorization / masking failure (CWE-863): the settings API policy treats the view permission as sufficient while SettingResource serializes option_value verbatim, so any account granted settings.view sees every configured secret; exposure is conditioned on secrets actually having been saved in settings. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has released 1.4.8, which introduces secret masking, keys hidden from the API, and a dedicated update policy.
Permanent deadlock of the alerting subsystem in Nezha Dashboard 1.8.0 through 2.3.12 allows any authenticated non-admin member to disable monitoring notifications by issuing four crafted notification API calls, and continued blocking requests can then exhaust server memory. The flaw is an improper locking issue (CWE-667) in which a mutex is unlocked non-deferred on a nil-map panic path, leaving the lock permanently held. Exploitation requires a valid low-privilege account (the assessed CVSS:3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), and no public exploit code was identified at time of analysis, so this represents a genuine but bounded availability risk rather than a critical priority.
Signature-verification bypass in Bouncy Castle for Java before 1.86 lets a phantom signer be accepted in BLS12-381 aggregate signature verification. The faulty BLS12_381BasicScheme.keyValidate() trusts the public key's own ECCurve object during the prime-order subgroup check, so an attacker-supplied ECPoint built on a foreign curve that merely shares BLS12-381's field characteristic - with its cofactor forged to 1 - passes validation despite not being a G1 point; in the pairing implementation such a point contributes the identity in the target group, so an aggregate signature verifies even though it contains no signature for that key/message pair. The issue is reachable only where an application constructs an ECPoint on an explicit, non-canonical curve and accepts it as an authority-bearing key, since the standard 48-byte compressed-point decoder always supplies the canonical curve; no public exploit has been identified at time of analysis, and the assessed impact is high integrity compromise without confidentiality or availability loss (CVSS:4.0 base 7.1, network vector, no privileges required).
Reflected cross-site scripting in the Unlimited Elements for Elementor WordPress plugin up to version 2.0.20 allows unauthenticated remote attackers to execute arbitrary scripts in the browser of a victim who clicks a specially crafted link, potentially leading to session hijacking, credential theft, or unauthorized actions performed as the victim. Exploitation requires user interaction and is limited to per-victim social engineering because the payload is not stored; no public exploit code or active exploitation has been identified at time of analysis. The plugin must be installed and active on a WordPress site for the vulnerability to be exploitable.