A remote, unauthenticated attacker can cause a denial-of-service condition on NetScaler ADC and NetScaler Gateway appliances running versions prior to the fixed builds (14.1-73.41, 13.1-64.28, 13.1-37.282, and 14.1-73.41 FIPS for ADC; 14.1-73.41 and 13.1-64.28 for Gateway). The vulnerability is network-reachable with low attack complexity and requires no user interaction, making internet-facing Gateway deployments the primary risk surface. No public exploit code or CISA KEV entry was identified at time of analysis, though the CVSS 4.0 base score of 8.7 reflects high severity for the availability-only impact.
Cross-site request forgery in the CoCart WordPress plugin before 4.9.7 lets an unauthenticated remote attacker create a new administrator account on a victim site by luring a currently logged-in administrator to an attacker-controlled page. Because the plugin's REST API authentication filter is not scoped to its own endpoints, it disables WordPress core's REST nonce protection for every /wp-json/ route once the plugin is active (versions 4.9.0 through 4.9.6), so the forged write rides the administrator's live cookie session (CVSS:3.1/AV:N/AC:L/PR:N/UI:R, base 8.8). Publicly available exploit code exists and successful exploitation yields full site takeover, though EPSS is only 0.11% (1st percentile) and the attack cannot be automated against anonymous visitors - it is gated on an active admin session plus social-engineering interaction.
ZITADEL 4.x before 4.17.1 fails to check an organization's inactive state during Login V2 authentication, allowing users of a deactivated organization to continue signing in, create sessions, and obtain or refresh tokens if they already possess valid credentials, an existing session, or a refresh token. This authenticated access-control bypass primarily impacts offboarding and deprovisioning workflows, as it does not allow an arbitrary external attacker to gain access without prior valid credentials. No public exploit has been identified at time of analysis, and the flaw does not affect active organizations or bypass per-user deactivation.
Unauthenticated remote attackers who know a valid user's login name can enroll attacker-controlled multi-factor authentication factors - including TOTP, OTP-SMS, OTP-Email, and U2F - and overwrite the victim's verified phone number in ZITADEL deployments that expose the legacy hosted Login V1 UI. Affected versions are 3.x before 3.4.15 and 4.x before 4.17.1. The flaw resides in second-factor enrollment and initialization handlers that act on an identify-only session before any primary factor is verified, and it also lets attackers enumerate valid usernames through discrepant error responses. No public exploit code has been identified at time of analysis, but this is a genuine high-priority risk given the low prerequisite (only a login name) and high integrity impact (CVSS 8.8; assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/C:L/I:H/A:N).
Regular expression denial of service in mammoth.js 1.3.0 through 1.12.2 lets unauthenticated remote attackers stall the Node.js event loop by feeding a crafted .docx whose embedded style map contains an unterminated single-quoted string built from repeated backslash escape sequences. The flaw lives in the style-map tokeniser and triggers catastrophic regex backtracking, so any service that converts untrusted documents to HTML becomes trivially exhaustible, though exploitation is only realistic when the style map is drawn from attacker-supplied document content rather than static developer configuration. A vendor patch is available in 1.12.3; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Account takeover in ZITADEL affects deployments using the hosted Login V1 or V2 UI on versions 3.x before 3.4.14 and 4.x before 4.16.2. Unauthenticated attackers who know a valid login name can enroll an attacker-controlled passkey or other authenticator during an identify-only session, before any primary factor is verified, and then log in as the victim, bypassing passwords and MFA. No public exploit code has been identified at time of analysis, but the vulnerability is rated high risk due to its unauthenticated nature and low complexity.
Session hijacking and theft of external IdP tokens in ZITADEL 4.x before 4.17.3 and ZITADEL 3.x through 3.4.15 stem from IdP intent tokens that are encrypted without integrity protection, so an authenticated user (CVSS PR:L) can tamper with a token issued for their own login intent and have it accepted for another user's intent. An attacker who correctly predicts a victim's in-flight intent identifier and wins a timing race while the victim is completing an external IdP login can call /v2/idp_intents or /v2/sessions to steal the victim's IdP tokens or take over the resulting session. The impact is genuine but conditional rather than a mass-exploitable issue: it requires a valid authenticated account, an actively logging-in victim, correct identifier prediction, and a narrow race window (AC:H and AT:P in the assessed vector), and no public exploit identified at time of analysis; upgrading to 4.17.3 (or the corresponding fixed 3.x release) removes the condition.
Code execution as the logged-in user results when someone running the Twine 2 desktop (Electron) application on version 2.12.0 or earlier imports a crafted story file. The importStories() routine renders untrusted markup from the imported file inside the editor window, and a script smuggled in that markup can reach the twineElectron openWithScratchFile IPC bridge to write and then open a .bat file, yielding arbitrary code execution in the user's context. No public exploit code has been identified at time of analysis, and although no authentication is required (CVSS vector PR:N), exploitation depends on the victim actively importing the attacker's file, so delivery is a social-engineering problem; the CVSS 4.0 base score is 8.5 (High) with high confidentiality, integrity, and availability impact on the local host only.
Unauthenticated information disclosure in the StylemixThemes Cost Calculator Builder WordPress plugin (all versions through 4.0.17) lets remote attackers retrieve sensitive data that the plugin embeds in the responses it sends to clients. The independent assessment rates the issue CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - network-reachable, low complexity, unauthenticated and requiring no user interaction, with confidentiality impact limited to Low - which is lower than the 7.5 feed-reported score and should be treated as the authoritative view. No public exploit code exists and no confirmed active exploitation has been observed (no public exploit identified at time of analysis), and the available data identifies no fixed version, so the only prerequisite is that the vulnerable plugin be installed and active at 4.0.17 or earlier.
Reflected cross-site scripting in the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin, affecting all versions from the initial release through 2.0.20, allows a remote unauthenticated attacker to run arbitrary script in a victim's browser by tricking that victim into opening a crafted URL containing a malicious payload (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, PR:N so no attacker authentication, UI:R so victim interaction is mandatory). Patchstack scores this 7.1; our independent assessment concurs on the reflected, interaction-dependent nature of the flaw but rates availability impact as none rather than low. There is no CISA KEV entry and no public exploit code identified at time of analysis, and no EPSS score was supplied; the practical risk is highest when the induced victim is an authenticated WordPress administrator, because the injected script then executes inside an authenticated session.
Stored cross-site scripting in the Cozmoslabs TranslatePress WordPress plugin (versions up to and including 3.3.6) lets an attacker persist malicious script through a TranslatePress input field that is not neutralized when the translated page is generated, so the payload executes in the browser of any user who later views that rendered page. Exploitation is constrained by the required victim interaction (UI:R) and by the fact that the specific injection point and the role needed to store the payload are not identified in the available data; Patchstack scores it CVSS 7.1 with PR:N, while our independent assessment uses PR:L, reflecting that persistence typically requires at least low-privileged authenticated access such as a translator or editor account. Impact is limited to Low confidentiality, integrity, and availability with a scope change, and no public exploit identified at time of analysis.
Reflected cross-site scripting in VeronaLabs WP Statistics through 14.16.14 lets unauthenticated remote attackers inject script that executes in a victim's browser when the victim clicks a crafted link. Exploitation requires user interaction and runs in the victim's session context, so impact is greatest when an authenticated administrator is lured into triggering the payload; there is no public exploit identified at time of analysis. The independent assessment rates confidentiality and integrity impact as low and availability impact as none, with scope change, consistent with a social-engineering-gated reflected XSS flaw rather than silent remote compromise.
Stored cross-site scripting in the Kadence Blocks WordPress plugin (Gutenberg Blocks by Kadence Blocks, versions from n/a through 3.7.11.1) allows a low-privileged content author to persist malicious script inside a Kadence/Gutenberg block, which then executes in the browser of any user who views the affected page or post - including an administrator. Patchstack rates it CVSS 7.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L; the independent assessment refines this to AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, because reaching the vulnerable editing surface realistically requires an account with post/page authoring capability, and no public exploit code has been identified at time of analysis. Impact is bounded to script execution in the victim's browser (session theft, admin-side actions via the victim's session, defacement) rather than direct server compromise, and it depends on the plugin being installed and active.