An out-of-bounds read in the server-side CIP SetAttributeList service of EIPStackGroup OpENer allows an unauthenticated remote attacker to crash or destabilize the CIP/EtherNet/IP stack, producing a denial of service; the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) confirms the impact is availability-only and requires no privileges, user interaction, or non-default configuration. Affected builds are OpENer v2.3 and master through commit 76b95cf. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so the practical risk hinges on network reachability to embedded industrial controllers, which are typically deployed on segmented OT networks.
Docker Desktop for Windows versions prior to 4.92.0 fail to verify the cryptographic signature of packages supplied via the 'Docker Desktop Installer.exe install -package' command-line option. An attacker who can place a crafted package on the target host and convince a user to approve the Docker-signed UAC elevation prompt can execute arbitrary installer actions as LocalSystem, achieving full system compromise. Although the CVSS 4.0 base score is 7.3 (HIGH), exploitation is constrained: it is a local attack requiring an existing low-privileged foothold and active user interaction; no public exploit code has been identified at time of analysis, and the vendor has released a patch in 4.92.0.
Privilege escalation in MariaDB Server affects releases from 10.6.1 up to (but not including) 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, where the view FRM parser fails to safely encode embedded newline characters in an account name. An authenticated attacker who already holds both CREATE USER and CREATE VIEW WITH GRANT OPTION (CVSS vector PR:H, so not an anonymous path) can create a username containing forged view metadata and then create a view, causing the parser to read part of the username as security fields such as definer_host and suid and thereby escalates database privileges. No public exploit code and no confirmed active exploitation have been identified at time of analysis; the 7.2 High base score reflects a conditional, insider-style privilege-boundary bypass rather than a remote unauthenticated attack, and environments that restrict these administrative grants to trusted administrators have substantially reduced exposure.
PHP object injection in the WordPress plugin Product Configurator for WooCommerce through version 1.7.5 allows an authenticated, high-privileged user (typically an administrator or shop manager) to supply crafted serialized data that the plugin passes to unserialize(), potentially enabling object injection and, if a suitable POP gadget chain exists in the plugin, WooCommerce, or WordPress core, arbitrary code execution or similarly severe impact. The flaw is rated CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and requires an active WooCommerce installation; no public exploit code or gadget chain is documented and no confirmed vendor-released fix version appears in the provided references, so no public exploit identified at time of analysis.
Elevation of privilege in Dell Secure Connect Gateway (SCG) Policy Manager (versions prior to the fixed build, reported as 5.34.00.16 in the CVE description and as 5.36.00.16 in ENISA EUVD data) lets an attacker who already holds high-privilege authenticated access to the appliance reach functionality that should be restricted, breaking authorization boundaries rather than authentication itself (CWE-863). The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (7.2 High), so the network path is remote and low-complexity with no user interaction, but the PR:H prerequisite means the attacker must be a malicious or compromised admin/operator account - anonymous or low-privileged users cannot trigger it. There is no CISA KEV listing and no public exploit identified at time of analysis; EPSS is 0.27% (18th percentile) and the CISA SSVC decision is Exploitation: none, Automatable: no, Technical Impact: total, which makes this a moderate, patch-on-normal-cycle item rather than an emergency. A vendor patch is available per Dell's advisory (DSA-2026-385), though the exact minimum fixed version should be verified with Dell given the discrepancy between 5.34.00.16 and 5.36.00.16 across sources.
Stored cross-site scripting in the OceanWP "Ocean Pro Demos" (up to and including 1.5.4) and "Ocean eComm Treasure Box" (up to and including 1.8.0) WordPress plugins allows unauthenticated remote attackers to inject arbitrary JavaScript into a published Gutenberg popup through the Popup Builder's save_popup_content AJAX action, which then executes in the browser of any visitor viewing a page where that popup is configured to display. The CVSS 3.1 base score is 7.2 (High) with vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, reflecting a network-reachable, low-complexity attack requiring no privileges or user interaction, though the scope-changed rating and low confidentiality/integrity impact reflect that payload execution is confined to the victim's browser context. Exploitation is conditional: the site must run an affected premium plugin with a valid premium license active, the Popup Builder module enabled, and at least one published Gutenberg popup configured for display; there is no public exploit identified at time of analysis and the vulnerability is not confirmed actively exploited (no CISA KEV listing), with no EPSS score provided in the source data.
Path traversal in KodExplorer before 4.55 lets an authenticated low-privileged user bypass the archive-extraction sanitizer and write files anywhere on the server by uploading a ZIP archive containing crafted names such as '....//'. Because the overwritten files can include core JavaScript assets, the flaw chains into stored XSS that can lead to administrator account takeover and, ultimately, remote code execution through unrestricted PHP file upload. Exploitation requires a valid low-privileged account and use of the unzip functionality, so this is a credible, actionable priority rather than a drop-everything emergency; no public exploit code has been identified at time of analysis and no CISA KEV entry confirms active exploitation, while a vendor patch is available in release 4.55.
PHP object injection in the WordPress plugin Pay with Vipps for WooCommerce (wp_hosting_as:pay_with_vipps_for_woocommerce, all versions through 6.2.0) allows an attacker to supply crafted serialized data to a plugin code path that deserializes it without validation. Per the assessed CVSS:3.1 vector (7.2 High, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), exploitation requires an authenticated account with high privileges - effectively a WordPress administrator or equivalent capability - on a site where the plugin is installed and active, and it yields high confidentiality, integrity and availability impact; no user interaction is required. Practical exploitation further depends on a usable PHP POP gadget chain being present in WordPress core, WooCommerce or another installed component, and no public exploit code or CISA KEV entry was identified at time of analysis, so the high privilege prerequisite is the primary limiting factor.
Authenticated users can read records belonging to other users in AWS Amplify applications whose GraphQL backend was generated by @aws-amplify/graphql-index-transformer before 3.1.2, due to improper authorization in owner-scoped secondary-index query resolvers (CWE-639). This is a moderate-priority authorization bypass requiring a valid account on the same application (PR:L); no public exploit code has been identified at the time of analysis. The flaw affects applications using owner-authorized @index resolvers, and it is fixed in version 3.1.2 (included in @aws-amplify/data-construct 1.17.4 and @aws-amplify/graphql-api-construct 1.21.4), with redeployment of the backend required.
Malicious or impersonated CoAP servers can cause out-of-bounds reads and denial of service in RIOT OS 2026.07 and earlier nanoCoAP clients through the blockwise slice path. The flaw is in nanocoap_sock_get_slice(): a server-controlled Block2 szx value is not checked against the requested block geometry, so a larger block size with the expected block number makes the derived offset exceed the client slice offset and underflows the buffer-relative calculation in _2buf_slice(). The issue is rated CVSS 4.0 7.1 (High) with AV:N/AC:L/AT:N/PR:N/UI:P, meaning unauthenticated network reachability but requiring the RIOT client to initiate a blockwise request to a server the attacker controls or impersonates; no public exploit was identified at the time of analysis, and an upstream fix is available via PR/commit but no fixed release is confirmed.
Authenticated SQL injection in HortusFox (hortusfox-web) before 6.2 lets any holder of a valid API token read arbitrary database tables, including user password hashes, by supplying a crafted include_info value to the /api/locations/list endpoint. The flaw is in PlantsModel::getSpecificInfo(), which concatenates the caller-supplied include_info string directly into the SQL column list instead of validating column names. Exploitation is limited by the API-token prerequisite (CVSS PR:L, assessed CVSS:3.1 7.1, high confidentiality impact with no integrity or availability impact), the vendor has published a fix commit adding column-name validation, and no public exploit code or CISA KEV active-exploitation record was identified at time of analysis.
Authentication bypass in PHPNuxBill through 2025.3.20 allows attackers on the adjacent network to log in as any customer via MikroTik hotspot or PPPoE CHAP by supplying any incorrect password, provided they know a valid username. This grants unauthorized network access and allows the attacker to consume that customer's plan. No public exploit has been identified at time of analysis, and the vulnerability is rated High severity (CVSS 4.0 base 7.1).
Reflected cross-site scripting (CWE-79) in the bkninja 'Gloria Admin Panel' WordPress plugin, affecting versions through 1.3, allows an attacker to inject script into a page that executes in the browser of a victim who follows a crafted link while holding an active session - this maps to CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (7.1 High) per the supplied vector, with UI:R being the primary limiting factor since the victim must be socially engineered into clicking the link. The flaw is non-persistent (reflected), so the payload must be delivered per-victim rather than stored, and it targets the plugin's admin panel on WordPress installations that have the plugin installed and running version 1.3 or earlier. There is no confirmed active exploitation (CISA KEV not indicated) and no public exploit code identified at time of analysis; no vendor-released patch version was identified in the supplied data, though the Patchstack advisory is the authoritative tracking reference.
Reflected cross-site scripting in the HUSKY - Products Filter Professional for WooCommerce WordPress plugin affects all versions up to and including 1.4.3.2, allowing remote attackers to inject script that executes in the browser of a victim who opens a crafted link. Exploitation is not fully automatic: per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) no authentication is required to craft the request, but the victim must interact with attacker-supplied input, after which unsanitized data is reflected into the generated page and can run in whatever session the victim holds, potentially altering page content or leaking session data. No public exploit code was identified and the plugin is not listed in CISA KEV, so this is a moderate, situational risk concentrated on sites running the affected plugin versions.
Stored cross-site scripting in the KlbTheme Total Donations WordPress plugin affects versions up to and including 2.0.5 and lets an attacker plant persistent JavaScript that runs when a victim views a poisoned donation page, potentially compromising an administrator's browser session. The supplied CVSS score is 7.1, while our independent assessment rates the vector as AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, noting that exploitation requires storing a payload and then having a victim render it; no public exploit was identified at time of analysis and no EPSS data was provided.
Reflected cross-site scripting in the Heateor Support 'Sassy Social Share' WordPress plugin, affecting versions up to and including 3.3.79, lets an unauthenticated attacker inject script that executes in a victim's browser when the victim follows a crafted link or request and interacts with the page (CVSS 3.1 base 7.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Because the payload is reflected rather than stored, it does not persist on the site and each successful attack is per-victim, with impact limited to what the victim's session can reach - highest when the victim is a logged-in administrator. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS data was supplied; the issue was reported by Patchstack, whose advisory should be consulted to confirm the exact vulnerable parameter.
Reflected cross-site scripting in Crocoblock's JetBlog WordPress plugin (all versions through 2.4.10) lets unauthenticated attackers execute arbitrary script in a victim's browser when that victim loads a crafted request or URL containing unsanitized input. The flaw is reflected rather than stored, so each exploitation requires an individually tricked user and the payload does not persist on the site; impact is greatest when the lured user is an authenticated administrator, allowing session or privileged-action abuse. Assessed at CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and reported by Patchstack, with no public exploit identified at time of analysis and no confirmed active exploitation.
Reflected cross-site scripting (XSS) in the UsersWP WordPress plugin through version 1.2.73 allows unauthenticated attackers to inject arbitrary JavaScript into a victim's browser by tricking them into clicking a crafted link. Successful exploitation can lead to session hijacking, data theft, or actions performed on behalf of the victim, especially if the victim has administrative privileges. No public exploit code or confirmed active exploitation exists at time of analysis; the CVSS score is 7.1 with a user-interaction requirement (UI:R).
Reflected cross-site scripting in the Muffingroup Betheme WordPress theme (versions through 28.5.8) lets an unauthenticated attacker deliver a crafted URL that executes attacker-supplied script in a victim's browser once the link is loaded. Because the injection is reflected rather than stored, exploitation depends entirely on user interaction (CVSS 3.1 base 7.1, AV:N/AC:L/PR:N/UI:R/S:C), and impact is greatest when an administrator with an active session is lured into clicking the link, since the script then runs with the victim's privileges on the affected site's origin. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; the flaw was reported through Patchstack.
Stored cross-site scripting in the WordPress plugin Media Library Assistant (versions through 3.41) allows an attacker to persist a crafted script payload into media item metadata or attachment fields that the plugin later renders in the admin interface, where it executes in the browser context of an administrator or editor who loads the affected page. Exploitation is not fully self-contained: it requires user interaction (the victim must view the poisoned page) and, consistent with our assessed vector (PR:L rather than the CVE record's PR:N), realistically requires the attacker to hold some content-submission capability on the target site in order to store the payload. Impact is limited to low confidentiality, integrity, and availability within the victim's browser session, and no public exploit or confirmed active exploitation was identified at time of analysis.
Reflected cross-site scripting in the ShopBuilder - Elementor WooCommerce Builder Addons plugin for WordPress (versions through 3.4.1) lets a remote attacker inject arbitrary script into a page the plugin generates from unvalidated input, so the payload executes in the browser of any user who opens a crafted link. No authentication is required of the attacker (CVSS PR:N), but exploitation depends on victim interaction with an active session (CVSS UI:R), and the impact is greatest when the lured target is a logged-in store administrator because the script then runs inside the WordPress dashboard. The risk is rated CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) by independent assessment; no public exploit identified at time of analysis, and no vendor-released patch version is specified in the available intelligence, so the Patchstack advisory should be monitored for a fixed release.
Jexactyl releases prior to 4.0.5 accept a client-supplied Stripe Checkout Session at POST /api/client/billing/stripe/process based solely on its payment_status being 'paid', without checking amount_total or currency against the referenced order or the panel's configured billing currency. On instances where the optional billing module is enabled and a Stripe secret key is set, an authenticated client can therefore settle an order with an under-valued or mismatched-currency payment and still have the order fulfilled, provisioning, renewing, upgrading, or unsuspending the associated server for less than the required price. The issue is a bounded payment-integrity/business-logic flaw rather than a critical infrastructure risk; it requires authentication plus the non-default billing and Stripe configuration, is fixed in 4.0.5, and no public exploit code or active exploitation has been identified at time of analysis.
Reflected cross-site scripting in the Designthemes 'Whistle - Sports Club' WordPress theme (all versions through 4.2) allows unauthenticated remote attackers to inject and execute arbitrary script in a victim's browser by convincing that victim to open a crafted link; the payload is reflected in the response rather than stored. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) confirms the attack is network-reachable and requires no authentication, but is gated by user interaction, and the non-persistent reflected nature rules out broad automated or drive-by compromise. No confirmed active exploitation (no CISA KEV listing) and no public exploit code were identified at time of analysis.
Reflected cross-site scripting in the Bracketweb 'Voldor' WordPress theme (versions up to and including 1.0.0) lets an unauthenticated remote attacker inject a malicious script into a crafted URL that executes in the browser of any victim who clicks the link while the theme is active. Exploitation requires the victim to follow the attacker-supplied URL (UI:R) and the target site to actually run this specific theme; the payload is reflected rather than stored, so it is non-persistent and limited to the victim's browser context (session or cookie theft, actions performed as the victim). Patchstack assigned CVSS 3.1 7.1 for this flaw; no public exploit code and no confirmed active exploitation were identified at the time of analysis.
Reflected cross-site scripting in WP Associate Post R2 versions up to 5.0.1 allows remote, unauthenticated attackers to inject arbitrary script into a page via a crafted URL, requiring the victim to click a malicious link (UI:R). This moderate-severity (CVSS 7.1) flaw affects the WordPress plugin by Delight Star Inc., and no public exploit or active exploitation has been identified at time of analysis. The scope-changed impact is limited to the victim's browser session, but privileged users such as administrators are at higher risk if lured.
Reflected cross-site scripting in the FiboSearch (ajax-search-for-woocommerce) WordPress plugin, affecting all versions through 1.34.1, allows an unauthenticated attacker to execute arbitrary script in a victim's browser session by convincing them to open a crafted link against an affected WooCommerce store. The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, scored 7.1 by the reporter Patchstack) confirms the attack is network-reachable and needs no attacker-side authentication, but it critically depends on victim interaction and the impact is confined to the victim's session rather than the server; our independent assessment concurs and only differs by rating availability impact as None. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied in the intelligence feed.
Incorrect privilege assignment in Progress Telerik Report Server (versions prior to 12.2.26.1007) lets an authenticated user, including a low-privilege or guest account with a valid bearer token, register as a trusted service agent through the service-agent SignalR hub. On the next server settings-synchronization event, the rogue agent receives storage settings and encryption private keys, enabling disclosure of stored data-source credentials and connection strings, impersonation of legitimate agents, and interference with task dispatch. No public exploit code has been identified at time of analysis, and exploitation requires the attacker to persist until the synchronization event occurs.
Incorrect permission assignment on critical resources in Dell Secure Connect Gateway (SCG) Policy Manager lets an authenticated, low-privileged local user on the SCG host read and modify files or objects that should have been restricted, producing high confidentiality and high integrity impact together with a bypass of the product's own protection mechanisms (CVSS 3.1 base 7.1, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). The practical prerequisite is a pre-existing foothold on the appliance - a local shell or a service account - so the realistic threat actor is an insider or someone who has already compromised the host; there is no remote or unauthenticated path to trigger the flaw and no user interaction is required. No public exploit code identified at time of analysis, EPSS is 0.09% (0th percentile) and CISA's SSVC assessment records exploitation as 'none' with automatable 'no', making this a moderate, non-urgent priority for organizations running the affected versions.
Information disclosure in Dell Secure Connect Gateway (SCG) Policy Manager (CPE cpe:2.3:a:dell:secure_connect_gateway_(scg)_policy_manager) arises from an insecure default initialization of a resource (CWE-1188), meaning affected builds ship or configure a resource in a state that exposes sensitive data out of the box. Exploitation is not remote or anonymous: it requires an attacker who already has local access to the host and a low-privileged authenticated account (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), with no user interaction needed. Risk is moderate and urgency low despite the 7.1 base score: EPSS is only 0.09% (0th percentile), CISA SSVC rates Exploitation 'none' and Automatable 'no', and no public exploit code or confirmed active exploitation was identified at time of analysis.
SQL injection in the WordPress plugin wp-post-author (versions 4.0.0 up to but not including 4.1.0) lets an authenticated, low-privilege user inject arbitrary SQL into plugin queries and read sensitive data from the site's underlying database. Exploitation is network-reachable, requires no user interaction, and is rated CVSS 7.1 (High) with high confidentiality impact but no integrity or availability impact, consistent with read-oriented database exfiltration rather than data tampering or denial of service. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); the primary barrier is the requirement for valid low-privilege credentials on the target WordPress site.
Reflected cross-site scripting in the SpabRice Pond WordPress theme (all versions through 2.6.1) lets a remote, unauthenticated attacker craft a URL containing a script payload that the theme reflects unsanitized into the generated page; the victim must be convinced to open that link (mandatory user interaction), so exploitation cannot occur without social engineering and nothing persists server-side. Impact per the assessed vector is low confidentiality and integrity loss with scope change, with the worst case being a lured authenticated administrator whose browser executes the script in a privileged session; no public exploit and no confirmed active exploitation were identified at time of analysis. Sites running this theme should treat the reflected payload as a phishing/CSRF-assist vector rather than a self-propagating compromise.
Reflected cross-site scripting (XSS) in the ThemeREX Education Center WordPress theme (versions up to and including 3.6.12) allows remote attackers to execute arbitrary JavaScript in a victim's browser when they click a crafted link. The flaw requires user interaction (UI:R) and no authentication (PR:N), and it is reported by Patchstack with a CVSS 3.1 base score of 7.1; however, our assessment indicates no availability impact (A:N), limiting the impact to confidentiality and integrity of the victim's session. No public exploit code or active exploitation has been identified at time of analysis.
Reflected cross-site scripting in the Bracketweb 'Ogency' WordPress theme (versions through 1.0.0) lets an unauthenticated remote attacker craft a URL whose parameter is echoed unsanitized into the rendered page, executing arbitrary JavaScript in the browser of any user who opens that link. The assessed CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L); successful exploitation requires victim interaction and yields no server-side compromise, but can lead to admin session/session-cookie theft or forced administrative actions given WordPress's privileged session model. No public exploit code was identified and the flaw is not in CISA KEV at time of analysis, so risk is driven by the low skill barrier for reflected XSS rather than confirmed active exploitation.
Reflected cross-site scripting in the Bracketweb 'Treck' WordPress theme (all versions through 1.0.0) allows an unauthenticated attacker to run arbitrary JavaScript in a victim's browser by luring them to a specially crafted URL containing a malicious payload in an unsanitized, reflected parameter. The flaw carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), so no authentication or prior access is needed to send the request, but the victim must click the attacker-supplied link for the script to execute; impact is greatest when that victim is a logged-in WordPress administrator, since the injected script then runs inside the admin session. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the theme's low deployment footprint limits real-world exposure.
Cross-site request forgery in the WordPress plugin Dashboard Notes (MIGHTYminnow) affects all versions through 1.0.3, letting an attacker craft a page or link that silently rides an authenticated privileged user's session to perform state-changing plugin actions. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (7.1) reflects that the attacker needs no server-side authentication (PR:N) but must successfully lure a logged-in user with access to the plugin's dashboard functionality into interacting with attacker-controlled content (UI:R); exploitation cannot occur without that victim action. No public exploit code and no confirmed active exploitation were identified at time of analysis, though the low attack complexity and the universal applicability of CSRF to unpatched WordPress plugins keep the practical risk meaningful for sites running 1.0.3 or earlier.
Missing authorization in the ThemeHunk Th Shop Mania WordPress theme (versions through 1.9.1) lets an authenticated low-privilege user invoke theme functionality that lacks a proper capability check, primarily degrading site availability and allowing limited unauthorized changes. Exploitation is remote, requires only a valid low-privileged WordPress account on a site where the theme is installed and active, and needs no user interaction; no public exploit has been identified at time of analysis. The CVSS 3.1 base score is 7.1, driven almost entirely by the high availability impact (A:H) rather than confidentiality (C:N) or broad integrity loss (I:L).
Reflected cross-site scripting (XSS) in the AcyMailing SMTP Newsletter WordPress plugin, versions through 11.1.0, allows unauthenticated remote attackers to inject malicious script into a generated web page that executes in a victim's browser when they are tricked into following a crafted link (CVSS 7.1, PR:N, UI:R). Because the payload is reflected and not stored server-side, exploitation hinges on luring a user - ideally an authenticated WordPress administrator - into triggering the request; no public exploit code or confirmed active exploitation has been identified at time of analysis. This is a moderate-severity flaw (CWE-79) reported by Patchstack, with the specific vulnerable parameter or feature not named in the available description.
Reflected cross-site scripting in the ThemeGoods Grand Restaurant WordPress theme (all versions before 7.0.11) lets an unauthenticated remote attacker craft a URL that, once a victim clicks it, executes attacker-supplied script in the context of the victim's WordPress site session. The vulnerability is rated CVSS 7.1 via vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, with scope change (S:C) reflecting that the injected code runs in the victim's browser rather than affecting only the vulnerable component, and exploitation depends on social engineering because user interaction is required; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV. Only sites running this specific commercial theme below version 7.0.11 are exposed, which constrains the risk to targeted rather than automated mass attacks.
Reflected cross-site scripting in the WordPress plugin Kubio AI Page Builder (Extend Themes) affects every release through 2.9.3 and lets a remote, unauthenticated attacker craft a URL that causes the plugin's request-handling endpoint to echo attacker-supplied input back into the generated page without proper neutralization; the payload then executes in the browser of any user who is lured into opening that link, with the scope-change flag indicating the injected script can reach beyond the plugin's own security context (for example, an authenticated WordPress administrator's session). Exploitation requires victim interaction (UI:R) - a targeted user must click the crafted link, and the impact is most meaningful against logged-in or privileged users - while no privileges are needed on the attacker side (PR:N) and complexity is low (AC:L), giving an assessed CVSS 3.1 base score of 7.1 (High). At the time of analysis no public exploit code and no confirmed active exploitation were identified, and no EPSS data was supplied; sites running a release later than 2.9.3 are not affected.
Reflected cross-site scripting in the Basix NEX-Forms WordPress plugin (through version 9.3.1) allows remote attackers to inject script into a page that executes in a victim's browser when that victim opens a crafted link, with user interaction required per the CVSS vector (UI:R) and no authentication required to trigger the flaw (PR:N). Successful exploitation can lead to theft of session cookies or authentication tokens and, because the vulnerable component scores S:C, the resulting script runs in the security context of the affected WordPress site - making a lured privileged administrator a particularly valuable target. The consequences are limited in scope: the payload is not stored and only affects users who follow the attacker's specific link, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Reflected cross-site scripting in the 'Simple Payment' WordPress plugin (yalla ya!, versions through 2.5.4) lets an unauthenticated remote attacker inject script into a page generated by the plugin, which then executes in the browser of any user who clicks an attacker-crafted link while the plugin is active. Because the payload is reflected rather than stored, every victim must be individually social-engineered into following a malicious URL, and the resulting impact is limited to what is accessible within that victim's browser session (CVSS 3.1 base 7.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). No public exploit code was identified at time of analysis and the flaw has not been reported as confirmed actively exploited (CISA KEV), so the practical near-term risk is opportunistic rather than mass-exploitation driven.
Reflected cross-site scripting in the Salon Booking System WordPress plugin (all versions through 10.31.5) lets remote, unauthenticated attackers inject and execute arbitrary script by luring a victim to a crafted URL or request. Exploitation requires the victim to load the malicious request (UI:R), so it cannot be triggered silently or server-to-server; the resulting script runs in the victim's browser session and can enable cookie/session theft, credential phishing, or actions performed as the victim. Patchstack rates it CVSS 7.1 (High), while the independent assessment lands at CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N because the impact is browser-scoped rather than server-scoped; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Reflected cross-site scripting (CWE-79) in the BlockStrap Page Builder 'Bootstrap Blocks' plugin for WordPress lets an unauthenticated attacker (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) inject script into a page response by persuading a victim to click a crafted link or load an attacker-controlled request against a vulnerable plugin endpoint. All plugin versions up to and including 0.1.58 are affected; the malicious payload executes in the victim's browser within the victim site's origin, enabling session/token theft, forced actions, or content manipulation on the affected site. Exploitation requires user interaction, so there is no automatic or wormable propagation, and no public exploit code or confirmed active exploitation was identified at time of analysis; the risk is concentrated in sites that run the outdated plugin with untrusted visitors.
Reflected cross-site scripting (XSS) in the UpSolution Core (us-core) WordPress plugin through version 8.44 allows unauthenticated remote attackers to inject arbitrary JavaScript into a victim's browser session when they click a crafted link, enabling session theft or page defacement. Exploitation requires the plugin to be active and the victim to interact with the malicious URL (UI:R); no public exploit code is identified at time of analysis. The independent assessment rates this as medium severity (CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), with no availability impact.
Reflected cross-site scripting (CWE-79) in the Welcart e-Commerce WordPress plugin (usc-e-shop) affects all versions up to and including 2.12.3, allowing a remote unauthenticated attacker to inject script that executes in a victim's browser session. Exploitation depends on user interaction (UI:R): an attacker must lure a user - realistically a logged-in WordPress administrator or shop operator - into clicking a crafted link or visiting a page that reflects the malicious parameter, at which point the injected script can act with that user's privileges and, per the CVSS scope change (S:C), potentially affect resources beyond the vulnerable component. The vulnerability carries a CVSS 3.1 base score of 7.1; no public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor-released patched version was confirmed from the available data.
Reflected cross-site scripting in the codepeople 'Search in Place' WordPress plugin, versions up to and including 1.5.5, lets remote attackers supply input through the plugin's search handling that is echoed back into the generated page without proper neutralization. Because the assessed vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, no attacker authentication is needed, but the payload only executes when a victim follows a crafted link or visits a malicious page; targeting a logged-in administrator maximizes impact since the script runs in the site's origin. No public exploit identified at time of analysis, and the issue is not reported as confirmed actively exploited (CISA KEV); exploitation is limited by the user-interaction requirement.
Reflected cross-site scripting in the VikBooking Hotel Booking Engine & PMS WordPress plugin (all versions through 1.8.14) allows a remote attacker to inject script into a page rendered by the target site, which then executes in the browser of any user who follows a crafted link. According to the independent assessment, exploitation is gated by user interaction (CVSS UI:R, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), meaning the attacker must deliver the link to a victim and have it loaded in that victim's browser - impact is greatest when the victim is a logged-in administrator, whose session could be abused under the changed-scope condition. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied; the reporter (Patchstack) rates the issue 7.1.
Zephyr RTOS running on ARM64 with CONFIG_USERSPACE can lose memory-domain isolation: after an application creates more than 255 memory domains over its lifetime, the bare round-robin ASID allocator in arch_mem_domain_init() wraps and hands the same non-global ASID to two live domains, allowing a user-mode thread in one domain to read and write memory belonging to another domain's partitions and thread stacks using that domain's permissions. Exploitation is constrained rather than trivial - k_mem_domain_init() and k_mem_domain_deinit() are supervisor-only APIs with no syscall surface, so an unprivileged thread cannot drive the counter itself and the vulnerable application must itself create enough domains to wrap the allocator, and the ASID duplication must additionally coincide with a scheduling path that skips the TLB flush in z_arm64_swap_ptables() (for example the A->B->C three-domain sequence, or two aliased domains resident on separate CPUs under SMP). No public exploit code identified at time of analysis, and a vendor fix is available upstream, so this registers as moderate rather than urgent risk.
Unbounded memory allocation in Apache CXF's multipart/MTOM attachment part-header parser lets a remote, unauthenticated attacker exhaust server memory and cause a denial of service by sending a single crafted multipart request. The parser applies attachment-max-header-size (default 300 characters) only per physical line and enforces attachment-headers-max-count (default 500) against distinct header names rather than total header lines, so folded continuation lines or a repeated header name slip past both limits and inflate the parsed value without bound. Affected are CXF 4.2.0 through 4.2.3, 4.0.0 through 4.1.8, and all releases before 3.6.13 that expose a multipart/MTOM-accepting endpoint; fixed releases are 4.2.4, 4.1.9 and 3.6.13. Exploitation requires no authentication (CVSS PR:N/UI:N) and no non-default configuration, but it is limited to availability impact only; EPSS is low at 0.24% (14th percentile) and no public exploit code or confirmed active exploitation was identified at time of analysis.
Concurrent token-exchange requests against Apache CXF's JPA-backed OAuth2 authorization code grant provider can redeem a single authorization code more than once, yielding multiple valid access tokens from one code. Only deployments running the JPA authorization code provider that persists codes to a shared relational database under READ_COMMITTED isolation and that expose the token endpoint to remote callers are affected; versions below 3.6.13, 4.0.0 through 4.1.8, and 4.2.0 through 4.2.3 are in scope. Exploitation is unauthenticated per the CVSS vector (PR:N) but carries a high attack-complexity rating because the attacker must already hold one unredeemed code and win a timing race, so success is probabilistic; EPSS is low at 0.22% (11th percentile) and no public exploit identified at time of analysis, making this a real-but-conditional risk rather than a mass-exploitation emergency.