Unauthenticated cross-site scripting in the WP Cookie Notice for GDPR, CCPA & ePrivacy Consent WordPress plugin affects versions 4.4.6 and earlier, allowing remote attackers to inject script that executes in a victim's browser when that victim interacts with attacker-controlled input. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), no authentication is required and the attacker is remote, but exploitation is gated on user interaction - a site visitor or logged-in administrator must click a crafted link or submit a poisoned request that the plugin renders without proper sanitization; no victim action means no code execution. No public exploit code has been identified at time of analysis and the issue is not reported as actively exploited, so it should be treated as a moderate-severity, moderate-priority plugin hardening issue rather than an emergency, though the scope-change characteristic (S:C) means successful script execution can reach beyond the vulnerable component into the hosting WordPress site's origin.
Reflected cross-site scripting in the WooCommerce Simple Auctions WordPress plugin (versions up to and including 3.0.10) allows an unauthenticated attacker to inject arbitrary JavaScript that executes in the browser of any user tricked into loading a crafted link or input, as reflected by the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (score 7.1). The mandatory user interaction (UI:R) is the primary limiting factor - the attacker must deliver a malicious URL to a victim - while the absence of authentication requirements (PR:N) means any internet-facing WordPress site with the plugin active is reachable. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; the highest-value abuse path would be luring an authenticated administrator to a crafted link to leverage their session privileges.
Unauthenticated cross-site scripting in the WordPress plugin Video Background Block (versions 2.0.3 and earlier) lets remote attackers supply data to the plugin's video-background section rendering that is not properly neutralized before being written into a page, so arbitrary script executes in the browser of any visitor who loads the affected page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) confirms no authentication is required to deliver the payload but that exploitation depends on a victim loading or interacting with the crafted page, and the scope change indicates the injected script can affect resources beyond the vulnerable component. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the advisory as reported does not cite a fixed version, so risk is confined to WordPress sites running this specific bplugins plugin at an unpatched release.
Cross-site scripting (CWE-79) in the Social Rocket WordPress plugin through version 1.3.5 lets an unauthenticated attacker deliver a script payload that executes in a victim's browser session once that victim is enticed to click a crafted link or view attacker-influenced content rendered through the plugin (CVSS 7.1, AV:N/AC:L/PR:N/UI:R/S:C, scope changed). No credentials are required to construct or deliver the payload, but the script only runs with the privileges of the social-engineered user, so real-world impact is bounded by the role and session of whoever is tricked. This is not a CISA KEV entry and no public exploit code has been identified at time of analysis; the disclosure is medium/moderate risk and the underlying advisory does not clarify whether the injection point is reflected or stored, which determines how the lure must be delivered.
VikRentCar WordPress plugin versions up to 1.4.6 contain an unauthenticated reflected cross-site scripting (XSS) vulnerability (CWE-79) that allows remote attackers to inject arbitrary script into a victim's browser session. Exploitation requires the victim to click a crafted link or visit a malicious page (CVSS UI:R), but no authentication is needed (PR:N). With a CVSS score of 7.1, this moderate-severity flaw could lead to session hijacking or defacement limited to the site context; no public exploit code has been identified at time of analysis.
Cross-site scripting in the ARForms WordPress plugin versions up to and including 7.1.2 allows unauthenticated remote attackers to inject script through plugin-handled form input that is rendered without proper output encoding (CVSS 7.1, CWE-79). Exploitation is not zero-click: per the CVSS vector UI:R, a victim must load or view the affected page, and meaningful impact typically depends on the victim being an authenticated user or administrator whose session can be abused. No public exploit code or confirmed active exploitation is identified in the provided data, and the Patchstack advisory is the primary disclosure source.
Unauthenticated reflected cross-site scripting in Midtrans-WooCommerce versions up to and including 2.32.3 allows an attacker to execute arbitrary script in the browser of a victim who interacts with a crafted link or request while the plugin is active on a WordPress site. The flaw is rated CVSS 3.1 7.1 (CWE-79) and requires user interaction (UI:R), so automated wormable exploitation is limited; impact scales if a logged-in administrator is targeted, potentially enabling session theft or unauthorized actions in the site context. No public exploit identified at time of analysis and no CISA KEV entry indicates active exploitation; the vulnerable plugin must be installed and active for exploitation.
Authorization bypass in Elasticsearch's Remote Cluster Security (RCS) 2.0 cross-cluster search path lets an authenticated principal holding a cross-cluster API key for one index send a crafted request that is authorized against that permitted index while actually executing against a different, unauthorized index, exposing that index's document contents, field mappings and other metadata, and in limited cases permitting modification of retention-lease state on it. The flaw is an authenticated authorization-boundary bypass (CVSS 7.1, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), so the real-world risk is concentrated in multi-tenant or shared clusters that issue cross-cluster API keys to less-trusted tenants, while single-tenant clusters without shared cross-cluster keys are not meaningfully exposed. No public exploit code has been identified at time of analysis.
Broken tenant-level authorization in @payloadcms/plugin-multi-tenant for Payload CMS before 3.90.0 (and canary releases before 4.0.0-canary.34) lets an authenticated, low-privilege user in the tenant-managed admin users collection add their own account to tenants they are not members of, granting cross-tenant access. The flaw is a missing-authorization condition (CWE-862) in the plugin's default tenants array field access, so an attacker only needs a valid account (PR:L in the CVSS vector) and network reachability to the affected application; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV). Deployments that override the default behavior with secured tenants arrayFieldAccess.create/update functions, or that rely on userHasAccessToAllTenants, are unaffected, and the vendor has released fixes in 3.90.0 and 4.0.0-canary.34.
Cross-site scripting in the WP Mailster WordPress plugin (all versions up to and including 1.9.0.0) allows an unauthenticated remote attacker to inject script content that executes in the browser of a victim WordPress user, enabling session hijacking, content tampering, redirection to malicious sites, or actions performed with the victim's privileges. Exploitation is not automatic: the attacker must induce a user to click a crafted link or load a page that renders the injected payload (CVSS UI:R), and the target must actually be running the vulnerable plugin, though no attacker authentication is required (PR:N). The CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), no public exploit code has been identified at time of analysis, and the flaw is tracked as CWE-79 with an EUVD record (EUVD-2026-93086) and a Patchstack-issued advisory.
Unauthenticated cross-site scripting in the WordPress plugin Form Block (vendor epiphyt, all versions through 1.8.1) lets remote attackers inject script that executes in a victim's browser, carrying a published CVSS base score of 7.1. No authentication is required (PR:N), but exploitation depends on victim interaction (UI:R) - the targeted user must load or interact with the attacker-controlled content before the payload runs - and the impact is limited to the victim's browser session rather than the server, with the assessed vector narrowing availability impact to A:N. No public exploit code and no confirmed active exploitation (the plugin is not listed in CISA KEV) were identified at the time of analysis.
Unauthenticated cross-site scripting in the picu WordPress plugin (versions up to and including 3.10.1) allows remote attackers to inject malicious scripts that execute in a victim's browser session when they interact with a crafted link or view attacker-controlled content. Exploitation requires victim user interaction, but the attacker needs no authentication, and the vulnerability has a changed scope (S:C) with low confidentiality and integrity impact. This moderate-severity issue (CVSS 7.1) was reported by Patchstack, and no public exploit identified at time of analysis.
Unauthenticated cross-site scripting (XSS) in the Charitable WordPress plugin through version 1.8.12.3 allows remote attackers to inject arbitrary web scripts into pages viewed by victims, potentially leading to session hijacking or defacement. Exploitation requires user interaction (UI:R), such as clicking a crafted link, and impacts the victim's browser session rather than the server (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). No public exploit code or confirmed active exploitation has been identified at time of analysis, making this a moderate-priority issue per independent assessment.
Unauthenticated cross-site scripting in StoreGrowth: Smart Sales Booster for WooCommerce (BOGO, Upsells, Direct Checkout, Quick View, Side Cart) through version 2.0.6 lets remote attackers get script executed in a victim's browser when that user follows a crafted link or loads attacker-influenced input on a WordPress/WooCommerce store running the plugin. The assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (7.1) confirms no attacker authentication is needed but exploitation hinges on victim interaction, and the changed scope reflects that the payload runs in the affected store's origin rather than the attacker's. No public exploit code and no confirmed active exploitation are identified at time of analysis, so practical exposure is limited to sites where this WeDevs plugin is installed and active and the vulnerable parameter is reachable.
Reflected cross-site scripting in the EduMall WordPress theme (versions up to and including 4.5.3, published by ThemeMove) lets remote unauthenticated attackers execute arbitrary JavaScript in the browser of any user who clicks a crafted link - no login, privilege, or non-default configuration is required. Because the payload is reflected rather than stored, exploitation depends on a successful social-engineering lure against a victim (ideally an authenticated administrator) and does not affect all site visitors automatically, keeping this a moderate-priority issue rather than an emergency. No public exploit code was identified and the CVE is not listed in CISA KEV at the time of analysis.
Unauthenticated cross-site scripting in the WordPress plugin Contact Form to DB by BestWebSoft (versions 1.7.6 and earlier) lets remote attackers inject arbitrary client-side script through contact-form handling, which then executes in the browser of a victim who loads or views the crafted or stored content. Exploitation requires no credentials (the reported vector is PR:N) but does depend on victim interaction (UI:R) - typically an administrator opening submitted form data in the WordPress dashboard or a user following a crafted link - so impact is confined to the victim's browser session rather than direct server compromise. Patchstack rates the issue CVSS 3.1 7.1; our independent assessment keeps the same base characteristics except availability (A:N) and confirms the required user-interaction step as the main limiting factor. No public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV.
Unauthenticated cross-site scripting in the WordPress plugin Database for CF7 (vendor code4life) affects all versions up to and including 1.2.6, letting an attacker plant script that executes in the browser of a user - most likely an administrator reviewing stored Contact Form 7 submission data in the plugin's interface. Exploitation is remote and needs no attacker credentials (PR:N), but it does require victim interaction (UI:R) because the payload only fires when the affected page or submission view is rendered; the scope change (S:C) with limited confidentiality, integrity, and availability impact yields a CVSS 3.1 base score of 7.1. No public exploit code was identified and the flaw is not listed in CISA KEV at the time of analysis.
Unauthenticated cross-site scripting (XSS) in the Lumise Product Designer WordPress plugin, versions 2.1.1 and earlier, allows remote attackers to inject arbitrary JavaScript into pages viewed by other users. The vulnerability requires user interaction (e.g., clicking a crafted link) to execute, as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1 High). No public exploit code or active exploitation has been identified at the time of analysis; authentication is not required to craft the payload, but victim interaction is needed for execution.
Cross-site scripting in the WordPress plugin HTTP Requests Manager affects all versions up to and including 1.3.11, allowing an unauthenticated remote attacker to inject script that executes in the browser of a user who interacts with attacker-controlled input (CVSS 3.1 base 7.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). No authentication is required to deliver the payload, but the script only fires when a logged-in victim - most damagingly a site administrator - is socially engineered into clicking a crafted link or loading an attacker-influenced page or parameter handled by the plugin, so this is not an unattended server-side compromise path. No confirmed active exploitation (not in CISA KEV) and no public exploit code was identified at time of analysis, making this a genuine but moderate-priority issue rather than an emergency.
Reflected cross-site scripting in the VibeThemes WPLMS WordPress theme (versions 4.972 and earlier) lets a remote, unauthenticated attacker inject script that executes in a victim's browser session when the victim follows a crafted link to a WPLMS-powered site. Exploitation is not autonomous: it depends on user interaction (CVSS vector UI:R), which tempers real-world exploitability, but the payload runs in the origin of the vulnerable site with a changed scope (S:C), so an authenticated administrator who clicks the link can have their privileged session targeted. There is no CISA KEV listing and no public exploit identified at time of analysis; the flaw was reported through Patchstack and carries a CVSS 3.1 base score of 7.1.
Unauthenticated cross-site scripting in the Mapster WP Maps WordPress plugin through version 2.0.4 lets remote attackers inject script into pages or URLs that render unsanitized map input, executing in a victim's browser when they interact with the crafted content. No authentication is required for injection (CVSS PR:N), but exploitation depends on user interaction (UI:R), and the reported CVSS 3.1 base score is 7.1; the primary risk is session or token theft, forged actions, or UI manipulation in the victim's browser rather than direct server takeover. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.
Unauthenticated cross-site scripting (CWE-79) in the N-Media Frontend File Manager WordPress plugin affects all versions up to and including 23.6, allowing remote attackers to inject arbitrary script that executes in the browser of any user who renders the crafted content. Because the plugin is designed to expose file upload and management functionality to the site frontend, the vulnerable input path is reachable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1), but a victim - typically a logged-in administrator or moderator - must interact with the attacker-supplied link or page for the scope-changing impact to materialize. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, so current risk is driven by the large installed base of a frontend-facing plugin rather than confirmed active exploitation.
Unauthenticated cross-site scripting in SUMO Affiliates Pro 11.7.0 and earlier allows remote attackers to inject malicious scripts into pages viewed by site users because the WordPress plugin does not properly neutralize user-controllable input (CWE-79). Exploitation requires the victim to load or interact with a crafted payload (UI:R), but no attacker authentication is needed (PR:N); the flaw is network-reachable and can alter browser-side scope (S:C). The provided vector scores 7.1 (High), while the independent assessment applies no availability impact (A:N); no public exploit identified at time of analysis and no CISA KEV confirmation is present.
Unauthenticated cross-site scripting in the Smart Forms WordPress plugin (all versions up to and including 2.6.104) allows a remote attacker to have injected JavaScript execute in the browser of a user who interacts with attacker-controlled input - typically by opening a crafted link or viewing a page that reflects or stores the unsanitized value. The attacker needs no credentials (PR:N), but the payload only fires on the victim's side (UI:R), and the most serious outcomes depend on that victim being a logged-in or administrative user; CVSS 3.1 scores this 7.1, with the scope change (S:C) reflecting that script runs in the context of the victim's browsing session. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, making this a genuine but moderate-priority issue rather than an emergency, and patch status is not confirmed from the available data.
Unauthenticated cross-site scripting in WP User Frontend Pro 4.2.13 and earlier allows remote attackers to inject arbitrary script into a victim's browser via a crafted link, requiring the victim to click a link or visit an attacker-controlled page. The vulnerability is unauthenticated (PR:N) but requires user interaction (UI:R), and impact is confined to the browser context of the interacting user. No public exploit code or active exploitation is identified at time of analysis; no EPSS or KEV data was provided.
Reflected/stored cross-site scripting in the WordPress plugin Progressify - Progressive Web App (PWA) at versions 1.6.0 and earlier lets an unauthenticated remote attacker inject script that executes in a victim's browser session, rated CVSS 3.1 base 7.1 with scope change. The vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) confirms no authentication is needed to deliver the payload, but a victim must be induced to click a crafted link or visit a manipulated page before the script runs, which is the main limiting factor; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing). Sites running the affected plugin should treat any page reachable at or below 1.6.0 as exposed until upgraded.
Unauthenticated cross-site scripting in JoomUnited WP Media Folder through version 6.2.2 allows remote attackers to inject JavaScript that executes in a victim's browser when the victim interacts with a crafted page or request. The CVSS v3.1 score is 7.1 with AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating network reachability, no authentication required, required user interaction, and limited confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and this is assessed as a moderate-priority web vulnerability rather than a top-tier emergency.
Remote attackers can bypass system access restrictions and reach a privileged internal page in Google Chrome for Android versions prior to 155.0.8059.39 by way of a confused-deputy weakness in the SignIn component, which performs privileged navigation on behalf of an untrusted caller. Exploitation requires the victim to load attacker-controlled crafted HTML (for example, visiting a malicious or compromised page), needs no authentication or prior privileges, and is limited to the Android build on pre-patch versions. No public exploit code has been identified at time of analysis, EPSS is low at 0.22% (12th percentile), and the issue is not confirmed as actively exploited; a vendor patch (155.0.8059.39) is available, so this is a moderate-priority patch-and-move-on item rather than an emergency.
Field-level write access control in the MongoDB adapter for Payload CMS (@payloadcms/db-mongodb) can be bypassed by an authenticated user who already holds document-update rights, allowing that user to write values into fields their role was explicitly configured to be unable to modify. Only MongoDB-backed deployments running @payloadcms/db-mongodb before 3.87.0, or canary builds before 4.0.0-canary.20, are affected - the Postgres and SQLite adapters are explicitly unaffected. There is no unauthenticated path and no public exploit identified at time of analysis, but the CVSS 3.1 base score is 7.1 (High, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) because the integrity impact of silently rewriting protected fields is severe once an attacker has any update-capable account.
Kernel slab memory disclosure in the Linux kernel's SMB/CIFS client (cifs.ko) occurs when a malicious or compromised SMB3 server returns a short reply to a snapshot-enumeration ioctl (FSCTL_SRV_ENUMERATE_SNAPSHOTS), causing smb3_enum_snapshots() to set ret_data_len to sizeof(struct smb_snapshot_array) (12 bytes) without validating the server's actual reply length; the subsequent copy_to_user() then reads past the end of the server-sized retbuf and exposes adjacent kernel heap contents to the requesting user-space process. Only Linux systems acting as SMB clients are affected, and exploitation requires the victim to connect outbound to the attacker-controlled server and actively trigger snapshot enumeration (UI:R) while running a kernel with the vulnerable cifs client code, so unauthenticated remote attackers cannot reach an idle host. There is no public proof-of-concept and no evidence of active exploitation at time of analysis; EPSS is 0.21% (11th percentile), and patches are available in stable releases 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4.
Unauthenticated Go pprof debug endpoints exposed on the postgres-exporter metrics listener let any attacker who can reach that port from inside the cluster network read process arguments, full goroutine stacks, and heap memory - potentially leaking database connection strings and credentials - and repeatedly trigger CPU profiling to exhaust resources in a denial-of-service condition. The flaw is tracked as CVE-2026-83550 (CVSS 7.1, AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H per the vendor, C:H for confidentiality in our assessment) and affects postgres-exporter as shipped in Red Hat Multicluster Global Hub, where the CPE covers all tracked versions; exploitation requires adjacent/cluster network reachability rather than internet exposure. No public exploit code has been identified at time of analysis, and no CISA KEV listing indicates active exploitation; risk is best characterized as a real design flaw of moderate priority, with exposure materially reducible through NetworkPolicies that restrict access to the metrics port.
A slab use-after-free read in the Linux kernel's drm/msm driver (Qualcomm Adreno GPUs) allows a local, low-privileged user with access to the DRM device node to leak or corrupt freed kernel memory. The flaw arises because msm_ringbuffer_destroy() and msm_gem_vm_free() call drm_sched_fini() and then free objects that still embed a drm_gpu_scheduler with plain kfree(), while a signalled fence exported to userspace (submit out-fence or VM_BIND fence via sync_file/drm_syncobj) still points at that embedded scheduler; an unprivileged SYNC_IOC_FILE_INFO call then reaches drm_sched_fence_get_timeline_name() and dereferences the freed slab. Rated CVSS 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) with EPSS of only 0.21% (10th percentile) and no public exploit identified at time of analysis; the issue is confined to systems where the msm driver is built and loaded, and is fixed by freeing these scheduler-containing objects with kfree_rcu().
Unauthenticated cross-site scripting in the Fluent Forms Pro Add-On Pack WordPress plugin (versions 6.2.13 and earlier) lets a remote attacker supply script payloads that execute in the browser of any user who renders the affected content, most significantly a logged-in administrator reviewing form submissions or an affected page. Rated CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), the flaw needs no attacker-side credentials but does require victim interaction to fire. No public exploit code and no CISA KEV entry were identified at time of analysis, and the advisory does not name the exact vulnerable parameter or feature.
Unauthenticated cross-site scripting in the CF7 Views - Complete Entry Management for Contact Form 7 WordPress plugin through version 3.2.6 allows an attacker to have injected script execute in a victim's browser session when the victim follows a crafted link or loads attacker-influenced content. Exploitation requires no credentials (PR:N) but is gated by mandatory user interaction (UI:R), and impact is bounded by the victim's privileges on the affected WordPress origin, so maximum damage requires socially engineering a logged-in administrator. Patchstack reports the issue at CVSS 7.1; no public exploit code and no confirmed active exploitation (CISA KEV) are identified in the available data, and no EPSS value was supplied.
Unauthenticated cross-site scripting in the WordPress plugin 'Blog, Posts and Category Filter for Elementor' (versions 2.1.0 and earlier) lets remote attackers inject script that executes in the browser of a victim who loads a crafted request or link. The flaw is scored CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and requires no authentication (PR:N), but exploitation is gated by mandatory victim interaction (UI:R) - typically a logged-in administrator or a site visitor must be lured into opening the attacker-supplied URL for the payload to run. Sites are only exposed if the affected plugin is installed and active; no public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS data was not available for this CVE.
Unauthenticated cross-site scripting in the nicdark Hotel Booking WordPress plugin affects all versions up to and including 3.8, allowing a remote attacker to inject script that executes in a victim's browser within the vulnerable site's origin. Exploitation is network-reachable and requires no authentication (CVSS:3.1/AV:N/AC:L/PR:N), but it is not automatic: per the assessed vector the attack depends on user interaction (UI:R), meaning a victim has to open a crafted link or page for the payload to fire. The assessed impact is browser-scoped (C:L/I:L/A:N with S:C), making this a moderate-risk XSS issue rather than an emergency; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Unauthenticated cross-site scripting in the Document Gallery WordPress plugin (versions 5.1.1 and earlier) allows remote attackers to inject script that executes in the browser of any user who opens a crafted link or views attacker-influenced gallery content, consistent with an assessed CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). No authentication is required (PR:N) and no server-side privileges are needed, but exploitation depends on victim interaction (UI:R), which limits reliable mass exploitation. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; the issue was reported by Patchstack and affects any WordPress site running the vulnerable plugin.
Reflected cross-site scripting in the Youzify WordPress plugin (versions through 1.3.7) lets unauthenticated attackers execute arbitrary JavaScript in the browser of any user who is lured into following a crafted link, carrying a CVSS 3.1 base score of 7.1. No authentication is required of the attacker (PR:N), but successful exploitation depends on victim interaction with an attacker-supplied URL (UI:R), and the script executes with changed scope (S:C) producing low confidentiality, integrity, and availability impact confined to the victim's browser session rather than the server. No public exploit code was identified and the vulnerability is not listed in CISA KEV, so exploitation status is assessed as no public exploit identified at time of analysis.
Reflected cross-site scripting in the Ansar Import - One Click Starter Sites - for Elementor & Themes WordPress plugin (versions up to and including 2.1.2) lets an unauthenticated attacker inject arbitrary script that executes in a victim's browser session once the victim clicks a crafted link or visits a malicious page. The flaw is rated CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N per independent assessment) - no attacker authentication is required, but exploitation depends on convincing a user to interact, and impact is confined to the victim's browser rather than the server. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; Patchstack is credited with the report.
GiveWP versions 4.17.0 and earlier are affected by an unauthenticated cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary JavaScript into a victim's browser when the victim visits a crafted page or link. The attack requires user interaction (UI:R), which limits automated mass exploitation and makes this a moderate-priority issue rather than an emergency. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS score is 7.1.
Unauthenticated cross-site scripting in the LearnPress WordPress plugin through version 4.4.9 allows remote attackers to deliver script payloads that execute in a victim's browser once the victim is induced to interact with attacker-controlled input, typically by clicking a crafted link or rendering injected content produced by the plugin. No authentication is required to reach the vulnerable code (PR:N), but exploitation is not zero-click because it depends on victim interaction (UI:R); any publicly reachable WordPress site running a vulnerable LearnPress release is a candidate target in its default configuration. Patchstack reported the issue as a WordPress plugin XSS, no CISA KEV listing or EPSS score was supplied with the intelligence, and there is no public exploit identified at time of analysis.
Incorrect DMA mmap handling in the Linux kernel's IB/hfi1 Omni-Path driver (PIO_CRED case) lets a local, authenticated user with access to the HFI character device crash the kernel with a corrupted page-table oops or, once only the offset arithmetic is corrected, permanently stall send-PIO transfers. Kernels from 6.3 onward that include the hfi1 driver are affected, but the fault is intermittent-it appears only when the hardware send-context index reaches 64 or 128-and requires Intel Omni-Path 100 hardware plus the PSM2 path to invoke hfi1_file_mmap(). No public exploit code was identified at time of analysis, EPSS is low (0.18%, 6th percentile), and vendor-released fixes exist in 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4; given the local-only vector, mandatory specialized hardware and intermittency, overall risk is assessed as moderate rather than high-priority.
Devolutions Server versions up to 2026.3.7.0 contain a missing authorization flaw in the global vault that allows an authenticated user with only the global vault view permission to modify and delete global contact and folder entries. The issue requires valid credentials and a specific view grant, so it is primarily an insider or compromised-account risk rather than unauthenticated remote exploitation. No public exploit code has been identified, EPSS is low (0.17%), and the vendor has released a patch in version 2026.3.8.
An out-of-bounds read in the Linux kernel's legacy libipw 802.11 stack allows an unauthenticated attacker within wireless range to make affected systems walk roughly 64 KiB past the end of a received management frame buffer. Only machines using the legacy Intel PRO/Wireless ipw2100 or ipw2200 drivers are exposed, because those receive paths validate just the generic 24-byte three-address management header while libipw_process_probe_response() and libipw_network_init() assume the full 36-byte beacon/probe-response prefix; the length arithmetic then underflows and is truncated to 65524. The resulting flaw yields limited information disclosure (C:L) and a high availability impact via kernel crash (A:H) against adjacent-network attackers, though it is sharply constrained by the obsolete hardware requirement. Risk signals are low: EPSS is only 0.17% (6th percentile), there is no CISA KEV listing, and no public exploit has been identified at time of analysis.
Out-of-bounds reads in the Linux kernel's legacy libipw 802.11 management-frame parser, reachable through the ipw2100 and ipw2200 wireless drivers, let an unauthenticated attacker within wireless range crash the kernel by injecting a crafted association response that is shorter than the fixed 30-byte prefix. The root cause is an unsigned integer underflow: stats->len (u16) minus sizeof(*frame) (size_t) is evaluated in size_t and wraps, so the truncated u16 length handed to libipw_parse_info_param becomes a value near 64 KiB and the information-element parser walks well past the receive buffer. Exploitation requires the obsolete Intel PRO/Wireless 2100 or 2200BG hardware and driver stack to be present and processing association responses, so the realistic outcome is a denial-of-service kernel crash with only limited disclosure potential; no public exploit code has been identified at time of analysis, no KEV entry exists, and EPSS is a low 0.17% (6th percentile), while vendor-released patches are available in the 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4 kernels.
Local use-after-free in the Linux kernel's dma-buf/dma-fence subsystem lets a low-privileged local user with access to a fence-exposing interface (DRM/GPU, sync_file, or other DMA-buf consumers) read freed kernel memory when a fence's timeline or driver name string is retrieved concurrently with the fence being signaled. The regression was introduced by an earlier NULL-pointer dereference fix that replaced the signaled-bit check with an ops-pointer check, which is insufficient because many dma_fence implementations never clear the ops pointer on free and thus lose the RCU protection that keeps the returned string alive. Impact is a kernel crash (denial of service) or disclosure of freed heap contents; exploitation requires local device access and winning a narrow race, and no public exploit has been identified at time of analysis (EPSS 0.16%, 5th percentile; no CISA KEV listing).
Integrity and availability tampering in Dell Container Storage Modules before 1.18.0 stems from use of insufficiently random values (CWE-330), allowing a local attacker to corrupt integrity-sensitive data or disrupt availability on a host or Kubernetes node running the modules. Exploitation requires local access (AV:L) and no user interaction; the CVSS 7.1 vector rates integrity and availability impact high while confidentiality is unaffected. No public exploit has been identified at time of analysis - EPSS is 0.16% (4th percentile) and CISA SSVC marks exploitation as none - making this a moderate, low-priority issue; the vendor's 'unauthenticated' wording conflicts with the PR:L vector and should be verified against Dell DSA-2026-448.
Broken access control in Gitea's push-mirror API (CVE-2026-86684) lets an authenticated repository administrator push a repository's refs into an existing Git repository located on the server's local filesystem, using the permissions of the Gitea process rather than the caller's own privilege. Exploitation requires three conditions to hold simultaneously: the instance must be configured with [security] IMPORT_LOCAL_PATHS = true (not a default setting), the attacker must hold repository-administrator rights on a repository whose owner holds the AllowImportLocal permission (the owner's permission is what the flawed check inspected), and a writable Git repository must already exist at the chosen path. The integrity-only impact (CVSS 3.1 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N as independently assessed) and non-default prerequisites mean real-world risk is lower than the headline score implies; no public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is 0.15% (3rd percentile).
Gitea 1.27.3 and earlier misattributes the pushing identity to the repository owner whenever a git push is authenticated with a repository deploy key, causing the pre-receive hook pipeline to evaluate permissions against the owner rather than the deploy key. An attacker holding a write-enabled deploy key can therefore create protected tags despite not being on the tag allow list, or flip repository visibility (for example private to public) through git push options, and pull requests created via the AGit flow are likewise attributed to the owner. Access is gated: a read-only deploy key is insufficient, exploitation requires an authenticated push (CVSS PR:L), no public exploit code has been identified at time of analysis, EPSS is only 0.15% (3rd percentile), and CISA SSVC rates exploitation as none with partial technical impact.
Reflected cross-site scripting in the Tomlister Payflex Payment Gateway WordPress plugin (versions through 2.7.1) lets remote attackers inject script into a page generated by the plugin, which then executes in the browser of any victim who is persuaded to open a crafted URL. The CVSS vector requires user interaction (UI:R) and carries a scope change (S:C), so the practical payoff is theft of session or authentication tokens and manipulation of the rendered payment/admin page rather than any server-side compromise, with the highest value realized when the victim is a privileged WordPress user. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); no EPSS score was provided in the source data.