Authenticated remote code execution in HPE Networking ClearPass Policy Manager allows an attacker who already holds high-privilege administrative access to the management interface to run arbitrary commands on the underlying operating system, potentially leading to full host compromise. The flaw is remotely reachable (AV:N), requires no user interaction (UI:N) and has low attack complexity (AC:L), but its severity is bounded by the CVSS PR:H prerequisite - only administrator-level accounts can trigger it, so exploitation realistically depends on credential compromise, insider access, or chaining from a separate authentication or privilege-escalation weakness. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); with a base score of 7.2, this is assessed as a moderate-priority issue rather than a top-tier emergency, though the confidentiality, integrity and availability impact on a successful hit is high.
Privilege escalation in the PublishPress Capabilities WordPress plugin (slug capability-manager-enhanced) up to and including version 2.45.0 lets an attacker who already holds an elevated authenticated role use the plugin's role/capability management functions to grant themselves capabilities they should not receive, potentially reaching full site compromise (CVSS 3.1 base 7.2 High, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The dominant risk-limiting factor is the PR:H prerequisite: the actor must already possess a high-privilege role, so sites that reserve such roles for fully trusted administrators face substantially reduced real-world exposure. No public exploit code has been identified at time of analysis, and the flaw is not reported as actively exploited in the provided intelligence.
Privilege escalation in the WebAppick Challan WordPress plugin (published as PDF Invoice for WooCommerce) version 3.7.88 and earlier allows an authenticated WooCommerce Shop Manager to obtain capabilities beyond the intended Shop Manager role, rated CVSS v3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Because the vector carries PR:H, only attackers who already hold valid Shop Manager credentials or control a Shop Manager session can reach the flaw; anonymous visitors and self-registered subscriber-level users cannot use it, and WooCommerce must be active on the site for that role to exist at all. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.
Incorrect authorization in Elasticsearch 8.x and 9.x allows an authenticated, already-privileged user (CVSS PR:H) who has been granted a non-default, delegated role-management privilege to escalate privileges within a cluster. By abusing a role-definition setting that expands the set of indices matched against a delegated index-scoped privilege, the holder can modify their own assigned role and reach indices that should remain restricted, including internal security data, and from there potentially obtain full administrative control of the cluster. Exploitation is only possible when the cluster has the configurable delegated role-management privilege explicitly enabled and granted with a broadly-scoped index pattern; default deployments that never delegate this capability are not affected. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (not in CISA KEV). Vendor-released patches are available in Elasticsearch 8.19.22, 9.4.7, and 9.5.4.
Sensitive data exposure in the Edwiser Bridge WordPress plugin, affecting versions up to and including 4.3.4, allows remote attackers to read information the plugin transmits without any authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). The weakness is classified as CWE-201, information exposure through sent data, meaning the plugin emits sensitive values outward rather than verifying that the requester is entitled to them; the assessed impact is loss of confidentiality only, with no integrity or availability effect, and the exact leaking feature or endpoint is not enumerated in the available advisory. This is a moderate-priority issue rather than an urgent one: no public exploit code has been identified at time of analysis, no confirmed active exploitation (CISA KEV) is reported, and the plugin's narrow, education-sector install base (WordPress sites integrated with Moodle) limits realistic exposure.
Unauthorized action execution in PowerPress Podcasting (≤11.17.9) allows unauthenticated network attackers to bypass access controls with low integrity and availability impact, as the plugin fails to enforce authorization (CWE-862). Affected are WordPress sites running the plugin; the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, but there is no confidentiality impact and only low integrity/availability impact. No public exploit is identified at time of analysis, and the risk is primarily opportunistic mass scanning against internet-facing instances rather than targeted data theft or code execution.
Privilege escalation in the WordPress plugin Import and Export Users and Customers (versions through 2.5.5) allows an authenticated Editor-level account to assign itself or another user the administrator role by abusing the plugin's user import/export functionality, a CWE-266 incorrect privilege assignment flaw rated CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Exploitation is conditional: the attacker needs a pre-existing high-privilege account (Editor or comparable), the plugin installed and active, and no user interaction is required once that session exists. No confirmed active exploitation (CISA KEV) and no publicly available exploit code were identified at time of analysis, so the practical risk is a serious but situational escalation on multi-author or multi-tenant WordPress sites that delegate Editor accounts to less-trusted users rather than a broad internet-facing emergency.
SQL injection in the ClearPass Policy Manager API lets a remote attacker who already holds administrative privileges execute arbitrary database commands against the appliance, putting the confidentiality, integrity, and availability of its configuration and policy data at high risk (CVSS 7.2). The privilege requirement is the decisive constraint: exploitation requires network reachability to the management/API interface plus valid admin-level credentials (PR:H, AV:N, AC:L, UI:N), so realistic exposure is limited to privileged insiders or attackers who have first compromised an administrator account. No public exploit code and no confirmed active exploitation were identified at time of analysis, which keeps this a high-but-not-critical issue whose severity in practice tracks how well admin access and management-plane reachability are controlled.
Improper certificate validation in Dell System Update (DSU) versions prior to 2.3.0.0 lets an authenticated, high-privileged attacker who can occupy a man-in-the-middle position on the update path present DSU with a forged TLS certificate and deliver a malicious update payload, which the vendor describes as leading to remote execution on the affected host. The barriers are substantial: the CVSS vector (AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) requires high privileges, a high-complexity MITM/certificate-spoofing condition, and a user initiating or accepting an update, and the scope change (S:C) reflects impact escaping the update client into the payload it installs. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so despite the genuinely High CVSS 7.6 base score, real-world urgency is tempered by these preconditions rather than driven by observed exploitation.
Stored cross-site scripting in the WordPress plugin Post SMTP (Complete Email Deliverability and SMTP Solution) affects all versions up to and including 4.0.1, allowing an unauthenticated attacker to persist arbitrary script content through the 'user_email' parameter. Exploitation is conditional: it requires a WordPress Multisite installation with public user registration enabled, where WordPress accepts email addresses containing numeric HTML character references that Post SMTP's stricter validator rejects, causing the send to fail and the raw attacker-controlled address to be written verbatim into the email log via the failed-send exception message; the payload then executes when an administrator views the affected email-log page. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the risk is best characterized as conditional rather than broadly urgent because the prerequisite Multisite-plus-open-registration configuration is non-default and the payload is inert until an admin opens the log view. Upgrading to 4.0.2 remediates the issue.
Unauthenticated server-side request forgery in the Instapage WordPress plugin, affecting all versions up to and including 3.7.2, lets any remote attacker who can reach a vulnerable site make the web server issue requests to arbitrary internal or external destinations. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) confirms the attack is network-reachable, requires no credentials and no user interaction, and crosses a security scope boundary, though the Low confidentiality and Low integrity ratings indicate constrained response retrieval and limited write effects rather than full data exfiltration. No public exploit code or in-the-wild exploitation has been identified at time of analysis, and no EPSS or KEV data was supplied; this is a medium-to-high severity, lower-urgency issue whose practical impact depends on what internal services, cloud metadata endpoints, or trusted-network resources are reachable from the affected web server.
Unauthenticated server-side request forgery in the WordPress plugin PDF Smart Viewer for Elementor (versions 1.0.4 and earlier) lets any remote attacker induce the affected site's server to fetch an arbitrary URL of the attacker's choosing, with no authentication (PR:N) and no user interaction (UI:N) required per the assessed CVSS vector. Because the scope is changed (S:C) but confidentiality and integrity impacts are bounded (C:L/I:L), a successful attack typically means using the WordPress host as a request proxy to probe or interact with internal-only services, loopback interfaces, or cloud instance metadata endpoints rather than direct compromise of the plugin itself. Only sites with the plugin installed and active, and whose PDF-fetching functionality is reachable, are exposed; no public exploit code was identified at time of analysis, and exploitation is not confirmed as active in the wild.
Authenticated external-URL upload retrieval in Payload CMS versions after 3.0.0 and before 3.90.0 can leak Payload session cookies to an unintended third-party origin: when a user triggers a server-side fetch of an attacker-influenced file URL, a cross-origin HTTP redirect is followed without re-verifying that the destination is trusted, so authentication data is forwarded to whoever controls the redirect target. Exploitation is conditional and requires an authenticated user (CVSS 4.0 PR:L and the independent 3.1 assessment both indicate PR:L, with UI:A/UI:R), use of the external-URL upload feature, and attacker influence over a redirecting endpoint; only cookies matching the configured cookiePrefix (the Payload session cookies) are exposed. There is no CISA KEV listing and no public exploit identified at time of analysis, and the issue is fixed in version 3.90.0.
Unintended data can be extracted from Arista CloudVision Sensor by authenticated high-privilege users exploiting a path traversal flaw in CloudVision Portal (on-premises) and CloudVision Sensor, though the requirement for high privileges and additional preconditions limits the risk to moderate priority. No public exploit code has been identified, and the vulnerability is not confirmed as actively exploited. The flaw primarily impacts confidentiality, with no integrity or availability impact on the vulnerable component according to the independent assessment.
Broken access control in the WP2LEADS WordPress plugin through version 3.5.7 lets any authenticated user holding a Subscriber-level account invoke plugin functionality that should be reserved for privileged roles, resulting in unauthorized disclosure of confidential data (CVSS 7.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L). The plugin is the lead-capture/CRM-sync extension published by Tobias (@saleswonder.biz); the practical gating factor is account acquisition, so sites that permit open or self-service registration are the most realistically exposed while sites requiring manual account approval are largely shielded. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a genuine but moderate-priority exposure rather than an emergency.
Authorization bypass in the optional Amazon Q Business Lambda hook sample shipped alongside QnABot on AWS 7.0.0 through 7.4.5 lets an authenticated remote user cause the hook to read arbitrary Amazon S3 objects in the deploying AWS account, exposing data the caller should not be able to reach. Only customers who separately and manually deployed the q-business-lambda-hook sample stack on top of an affected QnABot version are exposed; the hook is not installed by default and the impact is limited to confidentiality within that account. Vendor-released patch: 7.4.6, and no public exploit identified at time of analysis. Per the authoritative assessment this is a moderate, conditional risk rather than a widespread emergency, because exploitation depends on the optional component being present, on authenticated access to the hook's request path, and the resulting impact is S3 object read only.
Missing authorization in the Wise Chat WordPress plugin (versions 3.4.1 and earlier) lets an authenticated low-privilege user - a Subscriber or any higher role - invoke functionality that lacks a capability check, allowing limited data modification and a significant availability impact on the affected site. The flaw is rated CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H), meaning exploitation needs a valid low-privilege account (PR:L) but no victim interaction, so sites that allow open Subscriber self-registration are the realistic attack surface; sites with registration disabled and no untrusted low-privilege users are far less exposed. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, though the low attack complexity and broad WordPress install base make timely patching advisable. The vulnerability was reported through Patchstack by security researcher Marcin.
Authenticated Subscriber-level attackers can exploit missing authorization checks in ECPay Ecommerce for WooCommerce versions up to 1.1.2606090 to perform actions that may alter store integrity or cause a high availability impact. The flaw requires only a low-privileged account, which is readily available on sites with open registration, but confidentiality is not affected. No public exploit code has been identified, and the vulnerability is not known to be actively exploited.
SQL injection in the Mooberry Book Manager plugin for WordPress (4.16.2) allows an attacker holding an authenticated Subscriber-level account to inject SQL through plugin input and read data from the underlying WordPress database. Exploitation needs only a low-privilege account and no victim interaction, so sites with open user registration are the most exposed, though the confirmed impact is information disclosure rather than data tampering. No public exploit code has been identified and there is no CISA KEV entry or other indication of active exploitation at the time of analysis, so this is a moderate-priority issue rather than an urgent one.
Information disclosure in Payload CMS allows an authenticated user to read hidden or read-restricted fields from an authentication collection through the token refresh and password reset responses, which returned user documents before applying field-level access control and hidden-field filtering. Affected deployments are npm 'payload' versions >= 3.0.0 and < 3.90.0, plus canary releases >= 4.0.0-canary.0 and < 4.0.0-canary.34; exposure only materializes when an authentication collection actually defines hidden or read-restricted fields, and a valid session/token for that collection is mandatory (CVSS 4.0 PR:L, vendor score 7.1). No public exploit identified at time of analysis; the vendor fixed the flaw in 3.90.0 and 4.0.0-canary.34.
An authenticated user of Payload CMS can overwrite an existing S3 object owned by a different upload collection when the @payloadcms/storage-s3 plugin is used with client uploads enabled across multiple collections that share a single bucket and leave useCompositePrefixes at its default (false or unset). Because the signed-URL generation path did not bind the target object key to the requesting collection, the attacker's upload silently replaces the victim collection's stored file, bypassing that collection's access controls and any prior file-type/size validation. The flaw yields high integrity impact with no confidentiality loss (CVSS 7.1), requires an authenticated session (PR:L) plus the specific shared-bucket client-upload configuration, and no public exploit code or CISA KEV entry was identified at time of analysis.
Unauthenticated cross-site scripting in the WP Cookie Notice for GDPR, CCPA & ePrivacy Consent WordPress plugin affects versions 4.4.6 and earlier, allowing remote attackers to inject script that executes in a victim's browser when that victim interacts with attacker-controlled input. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), no authentication is required and the attacker is remote, but exploitation is gated on user interaction - a site visitor or logged-in administrator must click a crafted link or submit a poisoned request that the plugin renders without proper sanitization; no victim action means no code execution. No public exploit code has been identified at time of analysis and the issue is not reported as actively exploited, so it should be treated as a moderate-severity, moderate-priority plugin hardening issue rather than an emergency, though the scope-change characteristic (S:C) means successful script execution can reach beyond the vulnerable component into the hosting WordPress site's origin.
Reflected cross-site scripting in the WooCommerce Simple Auctions WordPress plugin (versions up to and including 3.0.10) allows an unauthenticated attacker to inject arbitrary JavaScript that executes in the browser of any user tricked into loading a crafted link or input, as reflected by the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (score 7.1). The mandatory user interaction (UI:R) is the primary limiting factor - the attacker must deliver a malicious URL to a victim - while the absence of authentication requirements (PR:N) means any internet-facing WordPress site with the plugin active is reachable. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; the highest-value abuse path would be luring an authenticated administrator to a crafted link to leverage their session privileges.
Unauthenticated cross-site scripting in the WordPress plugin Video Background Block (versions 2.0.3 and earlier) lets remote attackers supply data to the plugin's video-background section rendering that is not properly neutralized before being written into a page, so arbitrary script executes in the browser of any visitor who loads the affected page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) confirms no authentication is required to deliver the payload but that exploitation depends on a victim loading or interacting with the crafted page, and the scope change indicates the injected script can affect resources beyond the vulnerable component. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the advisory as reported does not cite a fixed version, so risk is confined to WordPress sites running this specific bplugins plugin at an unpatched release.
Cross-site scripting (CWE-79) in the Social Rocket WordPress plugin through version 1.3.5 lets an unauthenticated attacker deliver a script payload that executes in a victim's browser session once that victim is enticed to click a crafted link or view attacker-influenced content rendered through the plugin (CVSS 7.1, AV:N/AC:L/PR:N/UI:R/S:C, scope changed). No credentials are required to construct or deliver the payload, but the script only runs with the privileges of the social-engineered user, so real-world impact is bounded by the role and session of whoever is tricked. This is not a CISA KEV entry and no public exploit code has been identified at time of analysis; the disclosure is medium/moderate risk and the underlying advisory does not clarify whether the injection point is reflected or stored, which determines how the lure must be delivered.
VikRentCar WordPress plugin versions up to 1.4.6 contain an unauthenticated reflected cross-site scripting (XSS) vulnerability (CWE-79) that allows remote attackers to inject arbitrary script into a victim's browser session. Exploitation requires the victim to click a crafted link or visit a malicious page (CVSS UI:R), but no authentication is needed (PR:N). With a CVSS score of 7.1, this moderate-severity flaw could lead to session hijacking or defacement limited to the site context; no public exploit code has been identified at time of analysis.
Cross-site scripting in the ARForms WordPress plugin versions up to and including 7.1.2 allows unauthenticated remote attackers to inject script through plugin-handled form input that is rendered without proper output encoding (CVSS 7.1, CWE-79). Exploitation is not zero-click: per the CVSS vector UI:R, a victim must load or view the affected page, and meaningful impact typically depends on the victim being an authenticated user or administrator whose session can be abused. No public exploit code or confirmed active exploitation is identified in the provided data, and the Patchstack advisory is the primary disclosure source.
Unauthenticated reflected cross-site scripting in Midtrans-WooCommerce versions up to and including 2.32.3 allows an attacker to execute arbitrary script in the browser of a victim who interacts with a crafted link or request while the plugin is active on a WordPress site. The flaw is rated CVSS 3.1 7.1 (CWE-79) and requires user interaction (UI:R), so automated wormable exploitation is limited; impact scales if a logged-in administrator is targeted, potentially enabling session theft or unauthorized actions in the site context. No public exploit identified at time of analysis and no CISA KEV entry indicates active exploitation; the vulnerable plugin must be installed and active for exploitation.
Authorization bypass in Elasticsearch's Remote Cluster Security (RCS) 2.0 cross-cluster search path lets an authenticated principal holding a cross-cluster API key for one index send a crafted request that is authorized against that permitted index while actually executing against a different, unauthorized index, exposing that index's document contents, field mappings and other metadata, and in limited cases permitting modification of retention-lease state on it. The flaw is an authenticated authorization-boundary bypass (CVSS 7.1, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), so the real-world risk is concentrated in multi-tenant or shared clusters that issue cross-cluster API keys to less-trusted tenants, while single-tenant clusters without shared cross-cluster keys are not meaningfully exposed. No public exploit code has been identified at time of analysis.
Broken tenant-level authorization in @payloadcms/plugin-multi-tenant for Payload CMS before 3.90.0 (and canary releases before 4.0.0-canary.34) lets an authenticated, low-privilege user in the tenant-managed admin users collection add their own account to tenants they are not members of, granting cross-tenant access. The flaw is a missing-authorization condition (CWE-862) in the plugin's default tenants array field access, so an attacker only needs a valid account (PR:L in the CVSS vector) and network reachability to the affected application; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV). Deployments that override the default behavior with secured tenants arrayFieldAccess.create/update functions, or that rely on userHasAccessToAllTenants, are unaffected, and the vendor has released fixes in 3.90.0 and 4.0.0-canary.34.
Cross-site scripting in the WP Mailster WordPress plugin (all versions up to and including 1.9.0.0) allows an unauthenticated remote attacker to inject script content that executes in the browser of a victim WordPress user, enabling session hijacking, content tampering, redirection to malicious sites, or actions performed with the victim's privileges. Exploitation is not automatic: the attacker must induce a user to click a crafted link or load a page that renders the injected payload (CVSS UI:R), and the target must actually be running the vulnerable plugin, though no attacker authentication is required (PR:N). The CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), no public exploit code has been identified at time of analysis, and the flaw is tracked as CWE-79 with an EUVD record (EUVD-2026-93086) and a Patchstack-issued advisory.
Unauthenticated cross-site scripting in the WordPress plugin Form Block (vendor epiphyt, all versions through 1.8.1) lets remote attackers inject script that executes in a victim's browser, carrying a published CVSS base score of 7.1. No authentication is required (PR:N), but exploitation depends on victim interaction (UI:R) - the targeted user must load or interact with the attacker-controlled content before the payload runs - and the impact is limited to the victim's browser session rather than the server, with the assessed vector narrowing availability impact to A:N. No public exploit code and no confirmed active exploitation (the plugin is not listed in CISA KEV) were identified at the time of analysis.
Unauthenticated cross-site scripting in the picu WordPress plugin (versions up to and including 3.10.1) allows remote attackers to inject malicious scripts that execute in a victim's browser session when they interact with a crafted link or view attacker-controlled content. Exploitation requires victim user interaction, but the attacker needs no authentication, and the vulnerability has a changed scope (S:C) with low confidentiality and integrity impact. This moderate-severity issue (CVSS 7.1) was reported by Patchstack, and no public exploit identified at time of analysis.
Unauthenticated cross-site scripting (XSS) in the Charitable WordPress plugin through version 1.8.12.3 allows remote attackers to inject arbitrary web scripts into pages viewed by victims, potentially leading to session hijacking or defacement. Exploitation requires user interaction (UI:R), such as clicking a crafted link, and impacts the victim's browser session rather than the server (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). No public exploit code or confirmed active exploitation has been identified at time of analysis, making this a moderate-priority issue per independent assessment.
Unauthenticated cross-site scripting in StoreGrowth: Smart Sales Booster for WooCommerce (BOGO, Upsells, Direct Checkout, Quick View, Side Cart) through version 2.0.6 lets remote attackers get script executed in a victim's browser when that user follows a crafted link or loads attacker-influenced input on a WordPress/WooCommerce store running the plugin. The assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (7.1) confirms no attacker authentication is needed but exploitation hinges on victim interaction, and the changed scope reflects that the payload runs in the affected store's origin rather than the attacker's. No public exploit code and no confirmed active exploitation are identified at time of analysis, so practical exposure is limited to sites where this WeDevs plugin is installed and active and the vulnerable parameter is reachable.
Reflected cross-site scripting in the EduMall WordPress theme (versions up to and including 4.5.3, published by ThemeMove) lets remote unauthenticated attackers execute arbitrary JavaScript in the browser of any user who clicks a crafted link - no login, privilege, or non-default configuration is required. Because the payload is reflected rather than stored, exploitation depends on a successful social-engineering lure against a victim (ideally an authenticated administrator) and does not affect all site visitors automatically, keeping this a moderate-priority issue rather than an emergency. No public exploit code was identified and the CVE is not listed in CISA KEV at the time of analysis.
Unauthenticated cross-site scripting in the WordPress plugin Contact Form to DB by BestWebSoft (versions 1.7.6 and earlier) lets remote attackers inject arbitrary client-side script through contact-form handling, which then executes in the browser of a victim who loads or views the crafted or stored content. Exploitation requires no credentials (the reported vector is PR:N) but does depend on victim interaction (UI:R) - typically an administrator opening submitted form data in the WordPress dashboard or a user following a crafted link - so impact is confined to the victim's browser session rather than direct server compromise. Patchstack rates the issue CVSS 3.1 7.1; our independent assessment keeps the same base characteristics except availability (A:N) and confirms the required user-interaction step as the main limiting factor. No public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV.
Unauthenticated cross-site scripting in the WordPress plugin Database for CF7 (vendor code4life) affects all versions up to and including 1.2.6, letting an attacker plant script that executes in the browser of a user - most likely an administrator reviewing stored Contact Form 7 submission data in the plugin's interface. Exploitation is remote and needs no attacker credentials (PR:N), but it does require victim interaction (UI:R) because the payload only fires when the affected page or submission view is rendered; the scope change (S:C) with limited confidentiality, integrity, and availability impact yields a CVSS 3.1 base score of 7.1. No public exploit code was identified and the flaw is not listed in CISA KEV at the time of analysis.
Unauthenticated cross-site scripting (XSS) in the Lumise Product Designer WordPress plugin, versions 2.1.1 and earlier, allows remote attackers to inject arbitrary JavaScript into pages viewed by other users. The vulnerability requires user interaction (e.g., clicking a crafted link) to execute, as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1 High). No public exploit code or active exploitation has been identified at the time of analysis; authentication is not required to craft the payload, but victim interaction is needed for execution.
Cross-site scripting in the WordPress plugin HTTP Requests Manager affects all versions up to and including 1.3.11, allowing an unauthenticated remote attacker to inject script that executes in the browser of a user who interacts with attacker-controlled input (CVSS 3.1 base 7.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). No authentication is required to deliver the payload, but the script only fires when a logged-in victim - most damagingly a site administrator - is socially engineered into clicking a crafted link or loading an attacker-influenced page or parameter handled by the plugin, so this is not an unattended server-side compromise path. No confirmed active exploitation (not in CISA KEV) and no public exploit code was identified at time of analysis, making this a genuine but moderate-priority issue rather than an emergency.
Reflected cross-site scripting in the VibeThemes WPLMS WordPress theme (versions 4.972 and earlier) lets a remote, unauthenticated attacker inject script that executes in a victim's browser session when the victim follows a crafted link to a WPLMS-powered site. Exploitation is not autonomous: it depends on user interaction (CVSS vector UI:R), which tempers real-world exploitability, but the payload runs in the origin of the vulnerable site with a changed scope (S:C), so an authenticated administrator who clicks the link can have their privileged session targeted. There is no CISA KEV listing and no public exploit identified at time of analysis; the flaw was reported through Patchstack and carries a CVSS 3.1 base score of 7.1.
Unauthenticated cross-site scripting in the Mapster WP Maps WordPress plugin through version 2.0.4 lets remote attackers inject script into pages or URLs that render unsanitized map input, executing in a victim's browser when they interact with the crafted content. No authentication is required for injection (CVSS PR:N), but exploitation depends on user interaction (UI:R), and the reported CVSS 3.1 base score is 7.1; the primary risk is session or token theft, forged actions, or UI manipulation in the victim's browser rather than direct server takeover. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.
Unauthenticated cross-site scripting (CWE-79) in the N-Media Frontend File Manager WordPress plugin affects all versions up to and including 23.6, allowing remote attackers to inject arbitrary script that executes in the browser of any user who renders the crafted content. Because the plugin is designed to expose file upload and management functionality to the site frontend, the vulnerable input path is reachable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1), but a victim - typically a logged-in administrator or moderator - must interact with the attacker-supplied link or page for the scope-changing impact to materialize. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, so current risk is driven by the large installed base of a frontend-facing plugin rather than confirmed active exploitation.
Unauthenticated cross-site scripting in SUMO Affiliates Pro 11.7.0 and earlier allows remote attackers to inject malicious scripts into pages viewed by site users because the WordPress plugin does not properly neutralize user-controllable input (CWE-79). Exploitation requires the victim to load or interact with a crafted payload (UI:R), but no attacker authentication is needed (PR:N); the flaw is network-reachable and can alter browser-side scope (S:C). The provided vector scores 7.1 (High), while the independent assessment applies no availability impact (A:N); no public exploit identified at time of analysis and no CISA KEV confirmation is present.
Unauthenticated cross-site scripting in the Smart Forms WordPress plugin (all versions up to and including 2.6.104) allows a remote attacker to have injected JavaScript execute in the browser of a user who interacts with attacker-controlled input - typically by opening a crafted link or viewing a page that reflects or stores the unsanitized value. The attacker needs no credentials (PR:N), but the payload only fires on the victim's side (UI:R), and the most serious outcomes depend on that victim being a logged-in or administrative user; CVSS 3.1 scores this 7.1, with the scope change (S:C) reflecting that script runs in the context of the victim's browsing session. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, making this a genuine but moderate-priority issue rather than an emergency, and patch status is not confirmed from the available data.
Unauthenticated cross-site scripting in WP User Frontend Pro 4.2.13 and earlier allows remote attackers to inject arbitrary script into a victim's browser via a crafted link, requiring the victim to click a link or visit an attacker-controlled page. The vulnerability is unauthenticated (PR:N) but requires user interaction (UI:R), and impact is confined to the browser context of the interacting user. No public exploit code or active exploitation is identified at time of analysis; no EPSS or KEV data was provided.
Reflected/stored cross-site scripting in the WordPress plugin Progressify - Progressive Web App (PWA) at versions 1.6.0 and earlier lets an unauthenticated remote attacker inject script that executes in a victim's browser session, rated CVSS 3.1 base 7.1 with scope change. The vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) confirms no authentication is needed to deliver the payload, but a victim must be induced to click a crafted link or visit a manipulated page before the script runs, which is the main limiting factor; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing). Sites running the affected plugin should treat any page reachable at or below 1.6.0 as exposed until upgraded.
Unauthenticated cross-site scripting in JoomUnited WP Media Folder through version 6.2.2 allows remote attackers to inject JavaScript that executes in a victim's browser when the victim interacts with a crafted page or request. The CVSS v3.1 score is 7.1 with AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating network reachability, no authentication required, required user interaction, and limited confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and this is assessed as a moderate-priority web vulnerability rather than a top-tier emergency.
Remote attackers can bypass system access restrictions and reach a privileged internal page in Google Chrome for Android versions prior to 155.0.8059.39 by way of a confused-deputy weakness in the SignIn component, which performs privileged navigation on behalf of an untrusted caller. Exploitation requires the victim to load attacker-controlled crafted HTML (for example, visiting a malicious or compromised page), needs no authentication or prior privileges, and is limited to the Android build on pre-patch versions. No public exploit code has been identified at time of analysis, EPSS is low at 0.22% (12th percentile), and the issue is not confirmed as actively exploited; a vendor patch (155.0.8059.39) is available, so this is a moderate-priority patch-and-move-on item rather than an emergency.
Field-level write access control in the MongoDB adapter for Payload CMS (@payloadcms/db-mongodb) can be bypassed by an authenticated user who already holds document-update rights, allowing that user to write values into fields their role was explicitly configured to be unable to modify. Only MongoDB-backed deployments running @payloadcms/db-mongodb before 3.87.0, or canary builds before 4.0.0-canary.20, are affected - the Postgres and SQLite adapters are explicitly unaffected. There is no unauthenticated path and no public exploit identified at time of analysis, but the CVSS 3.1 base score is 7.1 (High, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) because the integrity impact of silently rewriting protected fields is severe once an attacker has any update-capable account.