Unauthenticated attackers can read sensitive HubSpot API response data - including correlation identifiers and cookies - from WordPress sites running the MetForm plugin before 4.3.1, because the plugin writes a debug file into the web root on every form submission whenever its HubSpot Forms integration is enabled and does not restrict access to that file. Exploitation requires the non-default HubSpot integration to be active, at least one prior form submission to populate the file, and discovery of the file's location, which is why the assessed vector is AV:N/AC:H/PR:N/UI:N with confidentiality-only impact and a low base score of 3.7. Publicly available exploit code exists, but there is no confirmed active exploitation, the SSVC assessment records exploitation as 'none' and automation as 'no', and EPSS is very low at 0.14% (3rd percentile).
Unauthenticated information disclosure in the WP Ultimate CSV Importer WordPress plugin (versions before 9.2) lets remote attackers retrieve import-log files that contain the personal data of users previously imported from a CSV file, because the plugin derives the log storage path under the uploads directory without any site-specific secret and does not block direct web access to those files. Impact is bounded to low confidentiality (CVSS 3.1 base 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N): no write or administrative access is obtained, and only data that was actually imported and written to still-present log files can be exposed. Publicly available exploit code exists, but EPSS is only 0.14% (3rd percentile) and the practical attack requires knowing or guessing the non-random file path and depends on a prior sensitive import having occurred; the vendor has released a fix in version 9.2.
Unauthenticated information disclosure in the Pie Register WordPress plugin (versions before 3.8.4.14) lets any remote visitor who knows a valid invitation code retrieve the usernames and email addresses of every user who registered with that code. The flaw is an access-control gap in the plugin's invitation-code report, which lacks a capability or ownership check before returning registration data (CWE-200). Exploitation is constrained by the requirement to already know a valid invitation code - the reason CVSS assigns AC:H and a low base score of 3.7 - and although publicly available exploit code exists, there is no confirmed active exploitation (not in CISA KEV) and EPSS is only 0.14% (3rd percentile).
Stored cross-site scripting in the WordPress plugin WP Ultimate CSV Importer (versions 7.17 up to, but not including, 9.2) allows an authenticated high-privilege user such as an Administrator to upload an archive whose contained files are neither type-validated nor sanitized, and which are then written to a publicly served location where they execute in the browser session of anyone who views them. The most serious configuration is WordPress Multisite, where a subsite Administrator does not hold the unfiltered_html capability, so the injected script can run in the session of a Network Super Administrator and cross a privilege boundary. Exploitation requires an authenticated Administrator-level account plus a victim who views the stored file (UI:R), publicly available exploit code exists, but EPSS is only 0.15% (4th percentile) and there is no CISA KEV confirmation of active exploitation; overall this is a low-severity, low-priority issue, with a vendor patch available in version 9.2.
Path traversal in Linux Mint Xreader 4.6.5 and earlier can disclose readable local files when a victim opens a crafted EPUB document in the built-in EPUB backend, and publicly available exploit code exists. Exploitation is remote but requires user interaction and no authentication; version 4.6.6 removes the EPUB backend entirely, and the practical impact is limited to low-confidentiality disclosure. This is a low-priority issue despite being remotely reachable.
Path traversal in Linux Mint Xreader up to 4.6.9 allows an attacker-supplied PDF to write an embedded attachment file outside the directory the victim selected, because the attachment filename is passed unsanitized to g_file_get_child in the PDF Attachment Saving Handler (shell/ev-window.c). Exploitation requires the victim to open the crafted PDF and explicitly initiate a save of the embedded attachment; authentication requirements are not confirmed from available data, though the assessed vector is PR:N (no privileges required), and the write occurs only at the victim's own privilege level, so confidentiality and integrity impact is low (VC:L/VI:L/VA:L). Publicly available exploit code exists (a public gist referenced by the vendor record), but there is no CISA KEV listing and no confirmation of active exploitation; the issue remains a modest-priority signal rather than a top-tier emergency.
Open redirect in OpenIdentityPlatform OpenAM deployments prior to 16.1.3 lets unauthenticated attackers bounce victims from a trusted OpenAM host to a post-logout URI registered to a named realm client. The /oauth2/connect/endSession endpoint consumes the id_token_hint JWT without verifying its cryptographic signature (CWE-347), so an attacker can forge a hint that names any existing OAuth2/OIDC client in a realm and steer the logout response toward that client's registered post_logout_redirect_uri, producing phishing links that inherit the OpenAM server's trust. Exploitation requires victim user interaction (a clicked crafted link), carries high attack complexity with a present attack requirement, and is constrained because the destination must already be registered to the abused client; no public exploit code has been identified at time of analysis, and no KEV entry exists. Independent assessment rates this as a genuinely low-priority, internally consistent issue, consistent with the low CVSS 4.0 base score of 2.3.
ImageMagick 7.x before 7.1.2-32 and 6.x before 6.9.13-57 silently discard the entire contents of a deployment's security policy when policy.xml carries a DOCTYPE declaration whose syntax does not end in ']>', so every restriction the administrator intended (e.g. blocking coders, delegates, or resource-heavy formats) is ignored and the previously forbidden operations succeed. Exploitation is local and privileged: the CVSS 4.0 vector scores it 1.8 (AV:L/AC:H/AT:P/PR:H/UI:N), meaning an actor with high privileges who can write or influence the privileged policy.xml file - or an administrator who authors a non-conforming DOCTYPE by accident - is the trigger, and the bug has no effect on default installations that ship no restrictive policy. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV; vendor patches are available in 7.1.2-32 and 6.9.13-57, so this is assessed as a genuinely low-priority hardening issue rather than an urgent remote threat.