SQL injection in the Code Snippets WordPress plugin before version 3.10.0 allows a site Administrator - on a WordPress Multisite network that means a subsite Administrator, not a network Super Admin - to run UNION-based queries against shared network tables via the plugin's snippet-migration import endpoints, exposing network-wide data such as other users' password hashes. The flaw requires an authenticated account with site-administration capabilities (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N, base 6.8), so there is no anonymous exploitation path; publicly available exploit code exists and the WPScan advisory documents the vector, but EPSS is low (0.16%, 4th percentile) and CISA SSVC records no observed exploitation. Real-world impact is concentrated in multi-tenant Multisite networks where subsite admins are untrusted, since on a single-site install the acting administrator already has legitimate database access.
SQL injection in Testimonials by BestWebSoft WordPress plugin through 1.0.8 lets unauthenticated remote attackers append SQL to a database query and read data from the underlying WordPress database. Publicly available exploit code exists (reported by WPScan), with no CISA KEV confirmation of active exploitation. The independent assessment rates this as a moderate-priority, network-reachable, low-complexity issue with no authentication or user interaction and confidentiality-only impact; the supplied CVSS vector's AC:H and S:C are not supported by the description and should be treated cautiously.
Unauthenticated attackers can permanently delete product variations and read their details on WooCommerce stores running the SKU Error Fixer for WooCommerce plugin through version 1.0, because two of the plugin's AJAX actions lack both capability and nonce checks. Publicly available exploit code exists, and the deletions leave no recoverable copy behind, although the impact is scoped to variations the plugin itself classifies as obsolete rather than arbitrary products or site data. EPSS is low at 0.14% (3rd percentile) and there is no confirmed active exploitation (CISA KEV), so this rates as genuine but low-priority.
Unauthenticated attackers can manipulate arbitrary WooCommerce-style orders handled by the Livees Checkout WordPress plugin through version 7.0.2, because the order confirmation page processes request parameters without any capability, nonce, or order-key validation. This lets remote attackers change order statuses, inject arbitrary data and notes into orders, and recover order keys, degrading data integrity and leaking order information. Publicly available exploit code exists and WPScan has published the vulnerability, but there is no confirmed active exploitation (CISA KEV) at time of analysis; the assessed CVSS is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), with impact bounded by the need to know or enumerate valid order identifiers and no code execution or availability loss.
Unauthenticated path traversal in the Contao CMS ImagesController lets remote attackers read files from the project directory by supplying encoded parent-directory segments in the image route's {path} parameter. Affected versions are Contao 5.0.0 through 5.3.49 and 5.7.11 (fixed in 5.3.50 and 5.7.12), with impact constrained by the fact that a returned file must carry an extension listed in contao.image.valid_extensions and files below the upload directory were not demonstrated to be readable, making this extension-restricted disclosure plus path-existence probing rather than arbitrary file read. The CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), no public exploit code or confirmed active exploitation has been identified at time of analysis, and the independent assessment rates the issue as moderate rather than critical.
Information disclosure in Contao CMS allows unauthenticated front-end visitors to read the titles, URLs, and indexed text snippets of protected pages through the ModuleSearch search module. The exposure only occurs on sites that previously enabled contao.search.index_protected (so protected pages were written into the tl_search index with per-row authorization metadata) and then disabled that setting without purging the stale index rows; the affected versions are 4.0.0 through the 5.3.x branch before 5.3.50 and 5.7.x before 5.7.12, with fixes released in 5.3.50 and 5.7.12. Exploitation is unauthenticated and requires no user interaction, but there is no public exploit identified at time of analysis, the underlying protected pages still enforce their own authorization checks, and the real-world risk is genuinely low because it depends on that specific configuration transition.
Unauthenticated email-flooding and user-enumeration in Contao CMS: a POST to any page containing the registration module reaches ModuleRegistration::compile()'s follow-up registration branch without validating FORM_SUBMIT or the preceding captcha, so resendActivationMail() invokes OptInToken::send() with no rate limit. An attacker can therefore repeatedly trigger activation emails to an address that has a pending registration and, via the observable difference in response, determine whether that pending registration exists. Affected versions run from 4.1.0 up to (but not including) 5.3.50 and 5.7.12, and exploitation requires reg_activate to be enabled plus target-side pending-registration state, which keeps this at a modest severity (CVSS 5.3, PR:N/UI:N, confidentiality-only impact); no public exploit identified at time of analysis.
Authenticated users of ruoyi-ai 3.0.0 through 3.1.0 can delete workflows owned by other accounts by issuing POST /workflow/del/{uuid} with a UUID harvested from the GET /workflow/search listing, because WorkflowService.softDelete() never calls PrivilegeUtil.checkAndGetByUuid() to confirm ownership before removing the record. The bug is a classic CWE-862 missing-authorization flaw: any valid account at any privilege level (PR:L) is enough, no user interaction or non-default configuration is required, and publicly available exploit code exists, although there is no CISA KEV confirmation of active exploitation and the impact is confined to integrity and availability of workflow objects on multi-user or multi-tenant deployments. Independent assessment rates this as a moderate-severity broken-access-control issue rather than an urgent one, since a single-user instance has nothing to cross-delete and no data disclosure is possible.
Authenticated non-admin users of ruoyi-ai 3.0.0 through 3.1.0 can enumerate other users' enabled private workflows through the GET /workflow/search endpoint, which performs no owner or is_public filtering and returns workflow UUIDs together with full node and edge definitions. The exposure is confined to the caller's own tenant and to workflows that are both enabled and private, so disabled items and cross-tenant data remain hidden, but any holder of a low-privileged account can harvest sensitive automation logic belonging to colleagues. Proof-of-concept code is publicly available (a HackMD write-up linked from the CVE record), no confirmed in-the-wild exploitation or CISA KEV listing has been reported, and the CVSS 4.0 base score is 5.3 (CVSS:3.1 equivalent AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), reflecting a confidentiality-only, authorization-boundary defect rather than data tampering or service disruption.
Unauthenticated remote attackers can read newsletter sending logs - including recipient email addresses - from any WordPress site running the SendPress Newsletters plugin through version 1.26.1.20, because the logging endpoint is gated by a single hardcoded token that is identical across every installation and therefore effectively a public secret. The issue is present in default configurations with no prerequisite beyond the plugin being installed and the endpoint being reachable, and publicly available exploit code exists (documented by WPScan), though there is no confirmation of active exploitation (not in CISA KEV). Impact is limited to confidentiality of log data - no write access, no authentication bypass to broader site functions, and no code execution - with EPSS at 0.14% (3rd percentile), consistent with a genuine but modest-severity information disclosure best triaged as low-to-moderate priority.
Unauthenticated attackers can overwrite arbitrary options in the Social Web Suite WordPress plugin through version 4.1.12 by abusing a settings-write endpoint that performs no authorization check, with the most damaging target being the shared secret that guards the plugin's own privileged endpoints. Because the CVSS vector is PR:N/UI:N, no credentials, privileges, or user interaction are required; the only precondition is that the plugin be installed and active on an internet-reachable WordPress site, and default configurations are affected. Impact is confined to integrity (C:N/I:L/A:N, base 5.3) rather than direct code execution or data disclosure, but public exploit code exists in the form of the WPScan proof-of-concept, so weaponization by opportunistic scanners is plausible. EPSS is low at 0.14% (3rd percentile), and there is no indication of confirmed active exploitation in CISA KEV; treat this as a moderate-priority stepping-stone issue rather than a catastrophic flaw.
Unauthenticated payment-status forgery in the UnitechPay WordPress plugin (through version 1.0.6.3) allows remote attackers to mark orders as paid without any payment being made and to force other orders into a failed state. The plugin's payment-notification handler consumes incoming notifications without verifying their authenticity, so a forged callback reaches the affected site with no credentials and no user interaction (CVSS 3.1 5.3, AV:N/AC:L/PR:N/UI:N, integrity-only impact of C:N/I:L/A:N, CWE-862). Publicly available exploit code exists, but the issue is not listed as confirmed actively exploited (CISA KEV) and EPSS is low at 0.14% (3rd percentile), so the signals are consistent and point to a moderate, not critical, priority for sites that actually run and rely on this plugin for checkout.
Forging payment webhook signatures in the Super Payments WordPress plugin (before 1.43.1) allows unauthenticated remote attackers to mark arbitrary WooCommerce orders as paid without payment, because the plugin ships with an empty signature-validation signing key by default. The medium-severity (CVSS 5.3) integrity flaw has business impact that exceeds its raw score; publicly available exploit code exists, though no confirmed active exploitation has been observed (not listed in CISA KEV). Affected sites are those using the vulnerable plugin with WooCommerce and exposed webhook endpoints, and the default configuration itself is the enabling condition.
Unauthenticated attackers can permanently delete shipment records belonging to arbitrary orders on WordPress sites running the Shipping for Nova Poshta plugin through version 1.19.8, and can additionally cause the store to fire the carrier's waybill-deletion request using the store's own stored Nova Poshta API credentials. The vulnerable AJAX action is registered for unauthenticated users and performs no authorization, nonce, or ownership validation, so no login, user interaction, or non-default configuration is required - the only friction is that the attacker must supply a target order identifier, which may require enumeration. Publicly available exploit code exists (reported via WPScan); there is no confirmation of active exploitation (not in CISA KEV), and the practical exposure is bounded to stores that have this specific plugin installed and active.
Unauthenticated access to the STTP-based data publisher in Grid Protection Alliance openPDC, the openPDC Docker image, and openHistorian default configurations allows remote attackers to connect to the interface and exchange data without credentials, resulting in a confidentiality exposure scored CVSS 5.3 (C:L, I:N, A:N). Exploitation requires the STTP listener to be network-reachable and authentication/TLS to remain disabled, and impact is limited to data access/exchange with no stated ability to alter measurements or disrupt availability. No public exploit identified at time of analysis, and the expected OT network segmentation around these systems is a key mitigating factor.
Physical access to a Red Lion 700 Series managed switch (HMS Networks / Red Lion Controls) lets an attacker boot the device from factory settings without authentication, log in with the default administrative credentials, and then save configuration changes so they survive the next normal reboot. The result is a persistent administrative compromise of the switch: confidentiality impact is limited, but integrity impact is high because routing, VLAN, and access-control configurations can be altered at will. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, and the practical risk is strongly constrained because the attack requires hands-on access to the hardware (CVSS AV:P) and the default credentials must still be valid on first factory boot.
Unauthenticated visitors can execute shortcodes registered on a WordPress site running Kirki before 6.3.2 by submitting a comment, and can read private custom fields of the page being viewed, because the plugin renders shortcodes held in comment text and displays comments regardless of their moderation status. The vulnerability carries a CVSS 3.1 base score of 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N), with the high attack complexity reflecting that real-world impact depends on which shortcodes a site has registered and whether comments are enabled; publicly available exploit code exists, though there is no CISA KEV listing confirming active exploitation at time of analysis. A vendor patch is available in Kirki 6.3.2.
Improper access control in the SendPress Newsletters WordPress plugin (through 1.26.1.20) lets any authenticated subscriber-level user synchronise the entire site user base into a mailing list and drive the newsletter send queue, because several newsletter-management actions omit capability checks. It is scored CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), so the bar is only a low-privilege account - realistic where the site permits self-registration or the attacker otherwise holds a subscriber credential - and publicly available exploit code exists. EPSS is 0.13% (2nd percentile), indicating low observed exploitation likelihood at time of analysis; no CISA KEV entry is associated with this CVE.
Missing CSRF protection in the GDPR Data Request Form WordPress plugin through 1.7.1 allows a remote attacker to change one plugin setting if they can trick a logged-in administrator into clicking a crafted link. Publicly available exploit code exists, but exploitation is targeted and requires an authenticated admin session plus user interaction, with impact limited to integrity of that single setting and no confidentiality or availability effect. This matches the assessed low-to-moderate real-world risk despite the CVSS 4.3 score.
Server-side request forgery in the Kirki WordPress plugin before 6.3.2 allows authenticated users holding editor-level privileges or above to supply a URL that the WordPress server then fetches without validating the target host, letting them probe internal-only services and infer from the responses which of those hosts are live. The issue is rated CVSS 4.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N), so impact is confined to information disclosure with no write, code execution, or denial-of-service capability, and exploitation requires a trusted privileged account rather than anonymous access. Publicly available exploit code exists and WPScan is credited as the reporting source, but there is no CISA KEV confirmation of active exploitation; combined with the high privilege prerequisite, the signals converge on a modest, non-urgent priority appropriate for routine patching alongside other plugin updates.
A heap out-of-bounds read in Open5GS 2.8.0 and earlier (ogs_pfcp_parse_dropped_dl_traffic_threshold() in lib/pfcp/types.c) lets remote unauthenticated attackers send malformed PFCP Session Establishment or Modification Requests to the UPF on UDP port 8805, using a Dropped DL Traffic Threshold IE with the DLPA and DLBY flags set but a too-short IE length, causing the parser to read past the end of the IE buffer and potentially crash the UPF. The assessed impact is availability-only (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L; vendor score 6.9 under CVSS 4.0), so this is a medium-severity denial-of-service issue rather than a top-tier priority. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, though the practical risk depends on exposure of the internal N4 interface.
Unauthenticated path traversal in the bookmark-restore handler of Shiny for Python 1.4.0 through 1.6.3 lets a remote attacker supply a crafted _state_id_ query-string value containing parent-directory ('..') segments or an absolute path, causing the server to join it into the server-side shiny_bookmarks directory and open input.json and values.json from outside the bookmark store. On default applications - including those configured with bookmark_store='disable' - this requires no authentication and no opt-in configuration and yields a limited-confidentiality probe of file existence and JSON validity, but when an application is configured with bookmark_store='server' and uses ui.input_file(), the file-input restore handler can copy and expose an attacker-selected file from an attacker-selected directory. The issue is fixed in 1.6.4, and no public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated remote request flooding against MongoDB Ops Manager's monitoring HTTP endpoints can temporarily slow other traffic served by the same process, because those endpoints perform costly work and are not rate limited (CWE-770). Only deployments whose Ops Manager web port is reachable by an attacker are exposed, and exploitation requires no credentials, user interaction, or special configuration per the supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N). The effect is bounded: impact is limited to low availability degradation (VA:L) with no confidentiality or integrity loss and no crash or permanent denial, so an attacker must sustain a continuous request flood to produce any noticeable effect; no public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV).
Recursive deletion of arbitrary user-writable directories is possible in the LobsterAI desktop application (NetEase Youdao) versions 2026.5.27 through 2026.9.23 because the skills:delete IPC handler trusts the openclawSourceDir path supplied in a skill's _meta.json during uninstall instead of confining cleanup to the skill's own directory. An attacker who persuades a user to install a crafted skill package - the bundled security scanner never inspects _meta.json, so the package passes vetting - can have the victim's home directory or another user-writable location wiped when that skill is later uninstalled, causing high integrity and availability impact (assessed CVSS:3.1 AV:L/AC:L/PR:N/UI:R, vendor CVSS:4.0 6.9, PR:N/UI:P). The attack is not remotely exploitable and requires user interaction twice (install plus uninstall), and no public exploit code has been identified at time of analysis; the issue is patched upstream (commit 82fdfe10d1b85d0ff734aa720e18c866b4be2406) with the fix adding regression tests that confirm bystander and OpenClaw-sourced directories are no longer touched.
Open5GS through 2.8.0 contains a heap out-of-bounds read that lets remote unauthenticated attackers crash the SMF by sending a crafted PFCP Session Report Request to UDP port 8805 carrying a Volume Measurement IE whose flag bits are all set while the IE body is too short to hold the declared fields. The parser in lib/pfcp/types.c walks past the end of the IE buffer by as much as 48 bytes, producing availability-only impact (CVSS 4.0 base 6.9, CWE-125); the over-read bytes are not returned to the attacker, so this is a denial-of-service condition rather than a data leak. No public exploit code has been identified at time of analysis, and practical exploitation presupposes that the attacker can reach the internal N4/PFCP control-plane interface between SMF and UPF, which is not intended to be internet-facing.
Sensitive information disclosure in QA Analytics WordPress plugin versions through 5.3.0.0 allows unauthenticated remote attackers to retrieve embedded sensitive data sent to clients. This medium-severity flaw (CVSS 4.0 6.9, CWE-201) affects sites with the plugin's heatmap/analytics data-collection feature active, and no public exploit has been identified at time of analysis.
Privilege escalation in the Redux Framework WordPress plugin through version 4.5.11 lets an authenticated attacker with only Subscriber-level access escalate to any role, including Administrator, by writing an arbitrary role value during a profile update. The flaw is conditionally exploitable: it only triggers on sites where an active plugin or theme has integrated Redux user-profile fields via Redux_Users::set_profile/set_section/set_field, which is a non-default integration requirement, so having the plugin installed alone is not sufficient. Wordfence rates this 6.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), the attack requires no victim interaction and is network-reachable, and no public exploit code has been identified at time of analysis; the practical limiting factor is the required third-party profile-field integration.
Server-side request forgery in Dell Secure Connect Gateway (SCG) Policy Manager affects versions prior to 5.34.00.16, letting an attacker who already holds high-privilege access to the management interface coerce the appliance into issuing requests to attacker-chosen destinations. Because the CVSS vector carries PR:H, this is not reachable by anonymous or low-privileged users, and the impact is limited to information disclosure (C:H) with no integrity or availability effect; scope is changed (S:C), so the server can be pivoted toward internal or backend resources outside its own security boundary. No public exploit code or confirmed active exploitation was identified at time of analysis, and the underlying high-privilege prerequisite keeps this a moderate-severity, low-urgency issue rather than a top remediation priority.
Kernel memory exhaustion in the illumos name service cache daemon (nscd) lets any local, unprivileged user - including one confined to a non-global zone - drive the daemon's file descriptor table to grow without bound. The nscd door at /var/run/name_service_door accepts passed file descriptors from any user in its zone, and switcher() in nscd_frontend.c never releases descriptors that a request does not consume, so a loop of door_call() invocations against the daemon slowly starves kernel memory and can render processes in every zone on the host unresponsive. Impact is availability-only with no confidentiality or integrity loss, and it is confirmed to affect illumos-gate and OmniOS builds predating illumos-gate commit af810a72, which caps in-flight descriptors and closes unused ones; no CISA KEV listing or public exploit code is documented in the supplied references, and the defect has been latent in the illumos codebase since a 2006 commit (cb5caa98).
Host denial-of-service in illumos bhyve allows a privileged guest user to panic the host by executing a REP-prefixed MOVS or STOS instruction targeting kernel-emulated MMIO regions such as the local APIC. The flaw has existed since 2020 and affects illumos-gate and OmniOS builds prior to commit 696ecf8d, stemming from a failure to clear the VIES_REPEAT flag that leads to a VERIFY assertion in vie_advance_pc(). Publicly available exploit code exists, but no active exploitation has been confirmed.
Code execution and unauthorized filesystem access in Dell Secure Connect Gateway (SCG) Policy Manager are achievable when a locally positioned, highly privileged attacker supplies directory-traversal sequences to a Policy Manager file-path handling feature (CWE-22), with exploitation additionally requiring user interaction and non-trivial conditions to line up (CVSS 6.3, CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H). Despite the HIGH confidentiality, integrity, and availability impacts in the vector, this is a moderate-severity, low-urgency issue: there is no remote or network vector, an authenticated high-privileged application account on the host is a prerequisite, user interaction is mandatory, and attack complexity is high, so practical risk is largely confined to insider or already-compromised-host scenarios. No public exploit identified at time of analysis, and a vendor patch is available via Dell DSA-2026-385, though the exact fixed version must be confirmed because the CVE description cites 5.34.00.16 while EUVD lists 5.36.00.16.
Cleartext IAM user Management Console passwords can be captured into PowerShell transcripts and other log artifacts by AWS Tools for PowerShell versions prior to 5.0.306, letting a local user who already has read access to those files recover live console credentials. Exploitation requires three conditions to coincide: an operator runs a pre-5.0.306 cmdlet that generates or returns an IAM user's cleartext console password, that command output is written to a persistent artifact such as a Start-Transcript file or redirected log store, and the attacker already holds a local foothold with read rights on the host - conditions that keep this at CVSS 5.9 (AV:L/AC:L/PR:L/UI:R) and make it a moderate-priority, defense-in-depth issue rather than an urgent threat. There is no public exploit identified at time of analysis; the vendor has released 5.0.306 and advises reviewing existing transcripts and rotating any IAM console passwords that may have been exposed.
Out-of-bounds read of up to roughly 64 KiB in Zephyr's ITE IT8xxx2 SHI host-command backend allows an attacker who drives the SPI host controller to disclose adjacent embedded-controller SRAM to the host, or to fault the controller by reading past the end of SRAM. The root cause is a race: the 8-byte host-command header is copied from the SPI Rx FIFO directly into the shared in_msg buffer before the protocol version and derived packet length are validated, so a second transaction carrying data_len = 0xFFFF can deposit its header into a buffer that verify_rx() has already accepted; if those bytes land before the host-command thread assigns args.input_buf_size = rx_header->data_len, a registered handler is handed a 65535-byte length over a 256-byte buffer. Exploitation requires local control of the inter-processor SHI bus (a compromised host OS driving chip select and clock, or physical access to the SPI lines) plus a timing race the host can retry indefinitely, and is unauthenticated per the CVSS vector (PR:N); no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in pyLoad (pyload-ng) prior to 0.5.0b3.dev101 allows an authenticated API user to crash the server by uploading an oversized file to the /api/rpc endpoint. The rpc handler in api_blueprint.py reads the entire multipart/form-data payload into memory with file.read() before any size check is applied, so a multi-gigabyte upload exhausts available RAM and the process is killed by the kernel OOM killer, interrupting all active downloads and tasks. Exploitation requires an authenticated session or a valid X-API-Key (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5), and no public exploit was identified at time of analysis, though the upstream advisory documents full reproduction steps; the flaw is rated moderate severity because it affects availability only and can be contained at the reverse-proxy layer on unpatched hosts.
Missing authorization in the codemstory SimplePay for WooCommerce payment plugin (slug pgall-for-woocommerce, marketed in Korean as 워드프레스 결제 심플페이) up to and including version 5.5.17 lets unauthenticated remote attackers change the plugin's payment gateway configuration - the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N confirms no login and no user interaction are required. Rated CVSS 3.1 base 6.5 (Medium) with impact sub-scores C:N/I:L/A:L, so the realistic harm is tampering with settings and disruption of the checkout/payment flow rather than data disclosure or code execution, and the plugin's narrow, Korea-focused deployment further limits exposure; no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Missing authorization in WP Rocket for WordPress before 3.23.5 exposes plugin actions that lack proper capability checks, allowing attackers to reach functionality they should not be permitted to use. The reported CVSS vector lists network access with no privileges or user interaction, but the CWE-862 classification and independent assessment indicate the realistic barrier is possession of a valid low-privilege WordPress account, such as Subscriber, which is the key limiter on exploitability. No public exploit code was identified at time of analysis, the issue is moderate risk rather than emergency priority, and it is resolved by updating to 3.23.5 or later.
Stored cross-site scripting in the Crocoblock JetReviews WordPress plugin (versions through 3.1.2) lets an authenticated low-privilege user persist malicious script inside review content, which then executes in the browser of any visitor who later views the affected review page. Successful exploitation requires a valid account with permission to submit JetReviews content plus a victim who loads the poisoned page, so sites that do not allow untrusted users to post reviews are not exposed in practice. CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L); no public exploit code was identified and the flaw is not confirmed as actively exploited (not in CISA KEV).
Stored cross-site scripting (XSS) in the FolioVision FV Flowplayer Video Player plugin for WordPress, affecting all versions through 7.5.54.7212, lets an attacker with sufficient privileges to store content in the plugin (CVSS PR:L) inject JavaScript that later executes in the browser of a second user - typically an administrator or editor - who views the affected page or admin view (CVSS UI:R). Rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, CWE-79), impact is confined to the victim's browser session rather than direct server compromise, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. The report originates from Patchstack and the exact input field serving as the injection vector is not specified in the available advisory.
Stored cross-site scripting in the bPlugins HTML5 Audio Player WordPress plugin (versions through 2.8.8) lets an authenticated low-privileged user - for example a contributor or author able to submit content the plugin stores - plant script payloads in plugin-handled data. The injected code persists and executes in the browser of any user who later views the affected page, such as an editor or administrator reviewing content, which can lead to session or credential theft and arbitrary actions in the victim's context; the CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). No public exploit code has been identified at time of analysis, no confirmed active exploitation (CISA KEV) has been reported, and exploitation requires both an authenticated account on the target site and a victim who loads the tainted content, so sites that limit untrusted user registration are substantially less exposed.
Denial of service in OpenPrinting CUPS before 2.4.20 lets an actor holding @SYSTEM-level class-management privileges crash the cupsd scheduler by triggering a double-free in printer-class handling. The actor submits a CUPS-Add-Modify-Class request that replaces an existing class's member list and then fails subsequent validation, leaving pclass->printers as a dangling pointer, then issues a CUPS-Delete-Class request so cupsdDeletePrinter() frees the same allocation a second time. Impact is confined to availability (scheduler crash) with no confidentiality or integrity effect, and no public exploit identified at time of analysis - the @SYSTEM privilege prerequisite (PR:H) is the dominant limiting factor, keeping overall risk low even though the assessed vector is network-reachable (AV:N/AC:H) when the CUPS listener is exposed.
Authenticated SQL injection in ProcessMaker's task listing API (GET /api/1.0/tasks) allows any low-privilege user with a valid session to inject a malicious column name through the order_by parameter and extract data from the underlying database using blind, time-based queries. All ProcessMaker builds prior to 2026.14.3 that expose the default core REST API are affected (CPE cpe:2.3:a:processmaker:processmaker:*:*:*:*:*:*:*:*); because the injection is blind and extraction is bounded by the privileges of the ProcessMaker database account, this is assessed as a genuine but moderate-priority issue rather than an urgent one. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, though the vulnerability is trivially reachable once credentials are obtained and does not require user interaction or non-default configuration.
Stored cross-site scripting in the WPFunnels WordPress plugin, affecting all versions through 3.13.3, lets an authenticated low-privileged user persist malicious JavaScript into funnel content that then executes in the browser of any higher-privileged user who later views the affected page. The flaw is rated CVSS 6.5 (Medium) under vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, indicating an authenticated attack path (PR:L) with a required victim interaction (UI:R) and a scope change (S:C) but only low confidentiality, integrity and availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis; exploitation is realistically limited to sites that grant untrusted or low-privileged accounts the ability to write to WPFunnels funnel fields.
Missing authorization in the Magepeople 'Deposits and Partial Payments for WooCommerce' plugin (CWE-862) through version 4.0.1 lets an authenticated low-privilege user - such as a registered customer or subscriber on a store with self-registration enabled - invoke plugin functionality that should be restricted to higher-privileged roles, resulting in a high integrity impact while confidentiality and availability are unaffected (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Exploitation requires only a valid low-privilege session and needs no user interaction, making it practical on typical storefronts where customer accounts are freely creatable. No public exploit code and no confirmed active exploitation were identified for this CVE at time of analysis; the flaw is reported by Patchstack and tracked in the EU ENISA database as EUVD-2026-95623.
Stored cross-site scripting in the Classified Listing WordPress plugin through version 6.1.2 allows an authenticated attacker with listing-creation privileges to inject persistent JavaScript that executes when an administrator or other user views the affected listing. Exploitation requires a low-privileged account (PR:L) and victim interaction (UI:R), and no public exploit code or active exploitation has been identified at time of analysis. This is a moderate-risk, low-urgency issue; practical impact depends on whether untrusted users can submit listings and whether those listings are rendered to privileged viewers.
Missing authorization in the ProfilePress (wp-user-avatar) WordPress plugin through 4.17.3 allows an authenticated user with only low privileges to perform state-changing actions that should require higher-level capabilities, resulting in unauthorized modification of site data. The flaw is exploitable remotely over the network with low complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base score 6.5), with impact confined to integrity; confidentiality and availability are unaffected per the assessed vector. No public exploit code and no active exploitation have been identified at time of analysis, and exposure is meaningfully reduced on sites that restrict or disable open user registration, since the attacker must first hold a valid low-privilege WordPress account.
Stored cross-site scripting in Crocoblock's JetBlocks For Elementor WordPress plugin (all versions through 1.5.2.1) allows an authenticated user with low-level privileges to plant persistent JavaScript inside plugin widget content, which then executes in the browser of any administrator or other viewer who loads the affected page - CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). Because the payload is stored rather than reflected, a single successful injection can fire for every subsequent visitor until the content is cleaned, though it requires both a plugin-reachable account to inject (PR:L) and a victim to view the poisoned page (UI:R), so it does not self-propagate. No public exploit code and no confirmed active exploitation were identified in the available data; severity is driven mainly by the scope change (S:C) and the low-complexity, network-reachable attack path.
Authenticated database users can trigger a heap out-of-bounds read in the MariaDB Server qc_info plugin (information_schema.query_cache_info), potentially disclosing adjacent process memory or crashing the server. The flaw affects MariaDB releases from 10.6.1 up to the fixed versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, and requires the optional qc_info plugin to be loaded plus an enabled query cache before a query containing embedded null bytes is cached and the query_cache_info table is then read. Rated 6.4 (Medium) with CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L; there is no public exploit identified at time of analysis and the impact is limited to partial memory disclosure or denial of service rather than code execution.
Privilege confusion in MariaDB Server (10.6.1 through the 10.6.x, 10.11.x, 11.4.x, 11.8.x, 12.x and 13.0.x lines prior to the fixed releases) allows an authenticated attacker who already holds the CREATE USER privilege to create a principal whose name collides with an existing role or localhost user in the database-privilege ACL cache, then exercise database privileges belonging to that other account. Because roles and localhost users were both cached with an empty IP component, the cache key could resolve to the wrong principal once the legitimate account's database privileges had already been cached through normal use, matching the assessed CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N (high confidentiality and integrity impact, no availability impact). Exploitation is not reachable by unauthenticated or low-privilege users and depends on non-trivial account-naming collisions plus ACL-cache timing state, so the practical risk is concentrated in privileged insiders or already-compromised administrative accounts. Vendor-released fixes are available in 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2; no public exploit identified at time of analysis.
Double-release of pooled decompression buffers in Xerial snappy-java 1.1.7.4 through 1.1.10.9 lets a crafted Snappy framed stream corrupt or expose data belonging to another, concurrently active stream. An attacker-supplied frame that declares an oversized chunk length forces the replacement buffer allocation to fail with OutOfMemoryError, after which the failed path still treats the already-released pooled buffer as live and returns it to the pool a second time, so the same backing array can be handed to a second stream. The flaw is remote and unauthenticated (CVSS:4.0 vector PR:N) but opportunistic rather than deterministic, requires the target to decompress untrusted framed input through SnappyFramedInputStream while drawing from a shared buffer pool, and carries no public exploit identified at time of analysis; overall risk is medium severity rather than urgent emergency.
Local privilege escalation and arbitrary code execution in the BusyBox tar applet (CVE-2026-108119) allow an attacker who supplies a crafted tar archive to create or replace files outside the extraction directory when the archive is extracted with elevated privileges. The flaw is a CWE-59 link-following issue in the applet's deferred symlink/hardlink creation path, with a CVSS 3.1 base score of 6.3 (AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H), affecting BusyBox as shipped in Red Hat Enterprise Linux 6 and Red Hat Hardened Images. No public exploit identified at time of analysis; exploitation requires a privileged user or process to actively extract the malicious archive, and the specific archive construction plus directory-reuse timing makes this high-complexity and local-only.