An integer underflow in OpENer's server-side EtherNet/IP ForwardOpen connection-path parser lets an unauthenticated remote attacker crash the affected adapter, causing a denial of service. OpENer v2.3 and commit 76b95cf are affected; exploitation requires only that the ENIP/CIP service (typically TCP 44818) be reachable, since the vector is AV:N/AC:L/PR:N/UI:N with availability-only impact (C:N/I:N/A:H). No public exploit code identified at time of analysis and no KEV listing; EPSS is low at 0.19% (8th percentile), so the practical risk is bounded by how exposed the device's ENIP port is on the network.
Attackers who control the Nginx UI upgrade mirror - or hold a man-in-the-middle position on the path to it - can get arbitrary code installed and executed by Nginx UI 2.0.0 through 2.4.x, because the self-upgrade routine verifies the downloaded binary only against a same-origin digest fetched from that same mirror, leaving no independent trust anchor. Exploitation requires two simultaneous conditions: the attacker's mirror/network position must let them alter BOTH the binary and its digest response, and an operator must manually trigger the self-upgrade, at which point the swapped payload is installed and runs in the Nginx UI process context. The issue is rated CVSS 7.5 (AV:N/AC:H/PR:N/UI:R) and is fixed in 2.5.0, which introduces minisign signature verification; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the high network-position prerequisite plus the required operator action substantially narrow realistic exploitation.
XML signature wrapping in Apache CXF's JAX-RS XML Security module allows remote, unauthenticated attackers to have unsigned content accepted as if it were covered by a trusted XML signature. Only deployments that consume inbound XML through CXF's XML Signature interceptors (XmlSigInHandler, XmlSigInInterceptor, or the streaming XmlSecInInterceptor) are exposed, and the attacker must first hold any XML document signed by a key the target trusts; that signed document can then be wrapped in forged content and repeatedly presented. Fixed versions 4.2.4, 4.1.9, and 3.6.13 address the issue; no public exploit code has been identified and EPSS is low (0.17%, 6th percentile), though integrity impact is rated High (CVSS 7.5).
Trust bypass in Apache CXF's STSTokenValidator allows a remote, unauthenticated attacker to have a forged SAML assertion signed with an untrusted certificate accepted as trusted without the assertion ever being validated by the Security Token Service. Only deployments that use STSTokenValidator to validate SAML tokens while leaving alwaysValidateToSts unset are affected, and exploitation additionally requires a race window in which the result of a concurrent legitimate request's successful trust check is read from shared state. No public exploit code or CISA KEV listing has been identified at time of analysis, EPSS is 0.17% (6th percentile), and vendor fixes are available in Apache CXF 4.2.4, 4.1.9 and 3.6.13.
A remote, unauthenticated attacker can exhaust server heap memory in Apache CXF by submitting a small (kilobyte-scale) DEFLATE payload that inflates to gigabytes when the framework decompresses it without any output-size cap. The flaw is reachable through two deployment-specific paths: JWE decryption when the 'zip=DEF' compression header is present (for example a JoseSessionTokenProvider configured with RSA-OAEP key wrap), and SAML token inflation over the HTTP redirect or POST binding - in both cases decompression occurs before or independently of any trust, signature, or key validation, so no credentials or valid keys are needed. Impact is availability only (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), with confirmed exploitation limited to reachable configurations; EPSS is 0.16% (4th percentile), no CISA KEV listing, and no public exploit identified at time of analysis. Vendor-released patches are available in 4.2.4, 4.1.9, and 3.6.13, which introduce a configurable 10 MiB inflation cap.
Out-of-bounds read in the server-side ForwardOpen connection-path parser of the OpENer EtherNet/IP stack (v2.3, commit 76b95cf) lets unauthenticated remote attackers crash the server, producing a denial-of-service condition. Affected deployments are those that expose the OpENer EtherNet/IP server on TCP/UDP 44818 or UDP 2222 to a reachable network; because these stacks typically sit on segmented OT/ICS networks, realistic exposure depends on attacker access to the industrial segment rather than on any special configuration. Impact per the assessed CVSS 3.1 vector is availability-only (A:H, C:N/I:N); EPSS is 0.14% (3rd percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis.
Cross-site request forgery in Contao CMS's backend action dispatch allows an attacker to make an authenticated backend user silently execute destructive or state-changing backend operations by simply loading an attacker-controlled URL. The flaw exists because RequestTokenListener - the only generic REQUEST_TOKEN validator in Contao - runs on POST requests only, while the GET-side guard is local and declarative and fires solely when an 'act' parameter is present, leaving every backend action dispatched through a different parameter (notably 'key=') with no CSRF protection at all; the CSRF validation added in the fix reads the token from the 'rt' query parameter. The assessed CVSS v3.1 score is only 3.5 (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) because exploitation requires a valid backend session AND user interaction (the victim must be socially engineered into loading the crafted link), and the reachable actions are limited to modules that victim user can already access - the advisory verified only destructive/state-changing actions, not privilege escalation. Vendor-released patch: 5.3.50 and 5.7.12; no public exploit identified at time of analysis.
Unauthenticated account takeover in Vikunja 1.0.0 through 2.3.0 lets an attacker who can obtain an OpenID Connect token carrying a victim's email address log in as that victim with a full session and no victim interaction. The flaw only manifests when an administrator has enabled the non-default per-provider emailfallback option, under which Vikunja resolves an unknown (issuer, subject) pair to a pre-existing local username/password account using the email claim alone - it never inspects email_verified (or Microsoft's xms_edov) and never asks for the matched account's password. Practical exposure is narrow but real: it additionally requires an IdP that will assert a victim's unverified email (a self-service or multi-tenant issuer) and a victim local account that has no TOTP, which the 2.3.0 enforceTOTPIfRequired gate protects; there is no public exploit identified at time of analysis, and no KEV/EPSS signal has been provided, so this is a high-priority fix for the specific vulnerable configuration rather than an ongoing mass-exploitation event.
Unauthenticated remote attackers can read arbitrary files from the underlying web server by exploiting a path traversal flaw in the WordPress plugin PDF for Contact Form 7 (slug pdf-for-contact-form-7) affecting all versions through 7.1.0. Supplying crafted directory-traversal input to the plugin's PDF file-handling/download path lets an attacker escape the intended directory and retrieve files readable by the web server account, a high confidentiality impact with no integrity or availability effect (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N). No public exploit code, CISA KEV listing, or EPSS score was identified in the supplied intelligence, so exploitation has not been confirmed as active and the practical attack surface depends on the plugin being installed and activated; note that WordPress core does not ship this plugin, so exposure is limited to sites running it.
Remote unauthenticated attackers can exploit a missing authorization flaw (CWE-862) in the TMS Amelia WordPress booking plugin versions up to and including 2.4.10, allowing unauthorized modification of data on affected sites (CVSS 7.5, integrity-only impact). The vulnerability stems from an endpoint that fails to enforce proper access control, and no public exploit code has been identified at time of analysis; WordPress installations running the plugin and reachable over the network are at risk.
Payment bypass in GiveWP WordPress plugin through 4.16.8.1 allows unauthenticated remote attackers to have donations accepted without a legitimately cleared payment. This CWE-290 spoofing flaw has a CVSS score of 7.5, but impact is limited to donation/transaction integrity; it does not grant WordPress authentication, admin access, or server control. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, and EPSS data is not provided.
An out-of-bounds read in EIPStackGroup's OpENer EtherNet/IP stack (v2.3 through master commit 76b95cf) allows remote, unauthenticated attackers to crash the service by sending a Common Packet Format message whose optional socket address information item (type 0x8000 or 0x8001) is truncated. The parser routine CreateCommonPacketFormatStructure() then reads a fixed-size sockaddr structure past the end of the supplied buffer, faulting the process - this is an availability-only impact with no confidentiality or integrity effect, consistent with the assessed CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No public exploit code or active exploitation was identified at time of analysis, and practical risk is bounded by the requirement that the attacker reach the EtherNet/IP TCP service on the affected device.
An out-of-bounds read in the server-side CIP SetAttributeList service of EIPStackGroup OpENer allows an unauthenticated remote attacker to crash or destabilize the CIP/EtherNet/IP stack, producing a denial of service; the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) confirms the impact is availability-only and requires no privileges, user interaction, or non-default configuration. Affected builds are OpENer v2.3 and master through commit 76b95cf. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so the practical risk hinges on network reachability to embedded industrial controllers, which are typically deployed on segmented OT networks.
Unauthenticated information disclosure in the Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router (firmware v1.3.241114.024540 and earlier) allows a remote attacker to retrieve sensitive data from the device with no credentials and no user interaction, consistent with the supplied CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (base 7.5, confidentiality-only impact). The weakness is classified as CWE-200 exposure of sensitive information; no public exploit code was identified at time of analysis, no EPSS score was supplied, and the CVE is not listed in CISA KEV, so active exploitation is not confirmed. Practical risk is bounded by deployment exposure: only the specific B11 model and firmware range is affected, and the attacker must be able to reach the router's management/web interface (for example exposed on the WAN side or from the same LAN segment).
Subsite administrators on WordPress multisite networks running the Code Snippets plugin before 3.10.0 can activate, deactivate, and reprioritise network-scoped snippets that execute across every site in the network, because one of the plugin's snippet-management actions omits a capability check and derives the snippet's network scope from the request instead of the stored record. The issue is an authenticated authorization flaw (CWE-862, CVSS 3.1 base 3.3, vector AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L) that only affects multisite deployments with at least one network-scoped snippet already present and an attacker who already holds administrator rights on a subsite. Publicly available exploit code exists for this issue, but EPSS is only 0.13% (2nd percentile) and there is no confirmed actively exploited (CISA KEV) status; practical impact is limited to toggling or reordering existing snippets rather than injecting arbitrary new code.
Docker Desktop for Windows versions prior to 4.92.0 fail to verify the cryptographic signature of packages supplied via the 'Docker Desktop Installer.exe install -package' command-line option. An attacker who can place a crafted package on the target host and convince a user to approve the Docker-signed UAC elevation prompt can execute arbitrary installer actions as LocalSystem, achieving full system compromise. Although the CVSS 4.0 base score is 7.3 (HIGH), exploitation is constrained: it is a local attack requiring an existing low-privileged foothold and active user interaction; no public exploit code has been identified at time of analysis, and the vendor has released a patch in 4.92.0.
Privilege escalation in MariaDB Server affects releases from 10.6.1 up to (but not including) 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, where the view FRM parser fails to safely encode embedded newline characters in an account name. An authenticated attacker who already holds both CREATE USER and CREATE VIEW WITH GRANT OPTION (CVSS vector PR:H, so not an anonymous path) can create a username containing forged view metadata and then create a view, causing the parser to read part of the username as security fields such as definer_host and suid and thereby escalates database privileges. No public exploit code and no confirmed active exploitation have been identified at time of analysis; the 7.2 High base score reflects a conditional, insider-style privilege-boundary bypass rather than a remote unauthenticated attack, and environments that restrict these administrative grants to trusted administrators have substantially reduced exposure.
PHP object injection in the WordPress plugin Product Configurator for WooCommerce through version 1.7.5 allows an authenticated, high-privileged user (typically an administrator or shop manager) to supply crafted serialized data that the plugin passes to unserialize(), potentially enabling object injection and, if a suitable POP gadget chain exists in the plugin, WooCommerce, or WordPress core, arbitrary code execution or similarly severe impact. The flaw is rated CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and requires an active WooCommerce installation; no public exploit code or gadget chain is documented and no confirmed vendor-released fix version appears in the provided references, so no public exploit identified at time of analysis.
Elevation of privilege in Dell Secure Connect Gateway (SCG) Policy Manager (versions prior to the fixed build, reported as 5.34.00.16 in the CVE description and as 5.36.00.16 in ENISA EUVD data) lets an attacker who already holds high-privilege authenticated access to the appliance reach functionality that should be restricted, breaking authorization boundaries rather than authentication itself (CWE-863). The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (7.2 High), so the network path is remote and low-complexity with no user interaction, but the PR:H prerequisite means the attacker must be a malicious or compromised admin/operator account - anonymous or low-privileged users cannot trigger it. There is no CISA KEV listing and no public exploit identified at time of analysis; EPSS is 0.27% (18th percentile) and the CISA SSVC decision is Exploitation: none, Automatable: no, Technical Impact: total, which makes this a moderate, patch-on-normal-cycle item rather than an emergency. A vendor patch is available per Dell's advisory (DSA-2026-385), though the exact minimum fixed version should be verified with Dell given the discrepancy between 5.34.00.16 and 5.36.00.16 across sources.
Stored cross-site scripting in the OceanWP "Ocean Pro Demos" (up to and including 1.5.4) and "Ocean eComm Treasure Box" (up to and including 1.8.0) WordPress plugins allows unauthenticated remote attackers to inject arbitrary JavaScript into a published Gutenberg popup through the Popup Builder's save_popup_content AJAX action, which then executes in the browser of any visitor viewing a page where that popup is configured to display. The CVSS 3.1 base score is 7.2 (High) with vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, reflecting a network-reachable, low-complexity attack requiring no privileges or user interaction, though the scope-changed rating and low confidentiality/integrity impact reflect that payload execution is confined to the victim's browser context. Exploitation is conditional: the site must run an affected premium plugin with a valid premium license active, the Popup Builder module enabled, and at least one published Gutenberg popup configured for display; there is no public exploit identified at time of analysis and the vulnerability is not confirmed actively exploited (no CISA KEV listing), with no EPSS score provided in the source data.
Path traversal in KodExplorer before 4.55 lets an authenticated low-privileged user bypass the archive-extraction sanitizer and write files anywhere on the server by uploading a ZIP archive containing crafted names such as '....//'. Because the overwritten files can include core JavaScript assets, the flaw chains into stored XSS that can lead to administrator account takeover and, ultimately, remote code execution through unrestricted PHP file upload. Exploitation requires a valid low-privileged account and use of the unzip functionality, so this is a credible, actionable priority rather than a drop-everything emergency; no public exploit code has been identified at time of analysis and no CISA KEV entry confirms active exploitation, while a vendor patch is available in release 4.55.
PHP object injection in the WordPress plugin Pay with Vipps for WooCommerce (wp_hosting_as:pay_with_vipps_for_woocommerce, all versions through 6.2.0) allows an attacker to supply crafted serialized data to a plugin code path that deserializes it without validation. Per the assessed CVSS:3.1 vector (7.2 High, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), exploitation requires an authenticated account with high privileges - effectively a WordPress administrator or equivalent capability - on a site where the plugin is installed and active, and it yields high confidentiality, integrity and availability impact; no user interaction is required. Practical exploitation further depends on a usable PHP POP gadget chain being present in WordPress core, WooCommerce or another installed component, and no public exploit code or CISA KEV entry was identified at time of analysis, so the high privilege prerequisite is the primary limiting factor.
Authenticated users can read records belonging to other users in AWS Amplify applications whose GraphQL backend was generated by @aws-amplify/graphql-index-transformer before 3.1.2, due to improper authorization in owner-scoped secondary-index query resolvers (CWE-639). This is a moderate-priority authorization bypass requiring a valid account on the same application (PR:L); no public exploit code has been identified at the time of analysis. The flaw affects applications using owner-authorized @index resolvers, and it is fixed in version 3.1.2 (included in @aws-amplify/data-construct 1.17.4 and @aws-amplify/graphql-api-construct 1.21.4), with redeployment of the backend required.
Malicious or impersonated CoAP servers can cause out-of-bounds reads and denial of service in RIOT OS 2026.07 and earlier nanoCoAP clients through the blockwise slice path. The flaw is in nanocoap_sock_get_slice(): a server-controlled Block2 szx value is not checked against the requested block geometry, so a larger block size with the expected block number makes the derived offset exceed the client slice offset and underflows the buffer-relative calculation in _2buf_slice(). The issue is rated CVSS 4.0 7.1 (High) with AV:N/AC:L/AT:N/PR:N/UI:P, meaning unauthenticated network reachability but requiring the RIOT client to initiate a blockwise request to a server the attacker controls or impersonates; no public exploit was identified at the time of analysis, and an upstream fix is available via PR/commit but no fixed release is confirmed.
Authenticated SQL injection in HortusFox (hortusfox-web) before 6.2 lets any holder of a valid API token read arbitrary database tables, including user password hashes, by supplying a crafted include_info value to the /api/locations/list endpoint. The flaw is in PlantsModel::getSpecificInfo(), which concatenates the caller-supplied include_info string directly into the SQL column list instead of validating column names. Exploitation is limited by the API-token prerequisite (CVSS PR:L, assessed CVSS:3.1 7.1, high confidentiality impact with no integrity or availability impact), the vendor has published a fix commit adding column-name validation, and no public exploit code or CISA KEV active-exploitation record was identified at time of analysis.
Authentication bypass in PHPNuxBill through 2025.3.20 allows attackers on the adjacent network to log in as any customer via MikroTik hotspot or PPPoE CHAP by supplying any incorrect password, provided they know a valid username. This grants unauthorized network access and allows the attacker to consume that customer's plan. No public exploit has been identified at time of analysis, and the vulnerability is rated High severity (CVSS 4.0 base 7.1).
Reflected cross-site scripting (CWE-79) in the bkninja 'Gloria Admin Panel' WordPress plugin, affecting versions through 1.3, allows an attacker to inject script into a page that executes in the browser of a victim who follows a crafted link while holding an active session - this maps to CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (7.1 High) per the supplied vector, with UI:R being the primary limiting factor since the victim must be socially engineered into clicking the link. The flaw is non-persistent (reflected), so the payload must be delivered per-victim rather than stored, and it targets the plugin's admin panel on WordPress installations that have the plugin installed and running version 1.3 or earlier. There is no confirmed active exploitation (CISA KEV not indicated) and no public exploit code identified at time of analysis; no vendor-released patch version was identified in the supplied data, though the Patchstack advisory is the authoritative tracking reference.
Reflected cross-site scripting in the HUSKY - Products Filter Professional for WooCommerce WordPress plugin affects all versions up to and including 1.4.3.2, allowing remote attackers to inject script that executes in the browser of a victim who opens a crafted link. Exploitation is not fully automatic: per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) no authentication is required to craft the request, but the victim must interact with attacker-supplied input, after which unsanitized data is reflected into the generated page and can run in whatever session the victim holds, potentially altering page content or leaking session data. No public exploit code was identified and the plugin is not listed in CISA KEV, so this is a moderate, situational risk concentrated on sites running the affected plugin versions.
Stored cross-site scripting in the KlbTheme Total Donations WordPress plugin affects versions up to and including 2.0.5 and lets an attacker plant persistent JavaScript that runs when a victim views a poisoned donation page, potentially compromising an administrator's browser session. The supplied CVSS score is 7.1, while our independent assessment rates the vector as AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, noting that exploitation requires storing a payload and then having a victim render it; no public exploit was identified at time of analysis and no EPSS data was provided.
Reflected cross-site scripting in the Heateor Support 'Sassy Social Share' WordPress plugin, affecting versions up to and including 3.3.79, lets an unauthenticated attacker inject script that executes in a victim's browser when the victim follows a crafted link or request and interacts with the page (CVSS 3.1 base 7.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Because the payload is reflected rather than stored, it does not persist on the site and each successful attack is per-victim, with impact limited to what the victim's session can reach - highest when the victim is a logged-in administrator. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS data was supplied; the issue was reported by Patchstack, whose advisory should be consulted to confirm the exact vulnerable parameter.
Reflected cross-site scripting in Crocoblock's JetBlog WordPress plugin (all versions through 2.4.10) lets unauthenticated attackers execute arbitrary script in a victim's browser when that victim loads a crafted request or URL containing unsanitized input. The flaw is reflected rather than stored, so each exploitation requires an individually tricked user and the payload does not persist on the site; impact is greatest when the lured user is an authenticated administrator, allowing session or privileged-action abuse. Assessed at CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and reported by Patchstack, with no public exploit identified at time of analysis and no confirmed active exploitation.
Reflected cross-site scripting (XSS) in the UsersWP WordPress plugin through version 1.2.73 allows unauthenticated attackers to inject arbitrary JavaScript into a victim's browser by tricking them into clicking a crafted link. Successful exploitation can lead to session hijacking, data theft, or actions performed on behalf of the victim, especially if the victim has administrative privileges. No public exploit code or confirmed active exploitation exists at time of analysis; the CVSS score is 7.1 with a user-interaction requirement (UI:R).
Reflected cross-site scripting in the Muffingroup Betheme WordPress theme (versions through 28.5.8) lets an unauthenticated attacker deliver a crafted URL that executes attacker-supplied script in a victim's browser once the link is loaded. Because the injection is reflected rather than stored, exploitation depends entirely on user interaction (CVSS 3.1 base 7.1, AV:N/AC:L/PR:N/UI:R/S:C), and impact is greatest when an administrator with an active session is lured into clicking the link, since the script then runs with the victim's privileges on the affected site's origin. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; the flaw was reported through Patchstack.
Stored cross-site scripting in the WordPress plugin Media Library Assistant (versions through 3.41) allows an attacker to persist a crafted script payload into media item metadata or attachment fields that the plugin later renders in the admin interface, where it executes in the browser context of an administrator or editor who loads the affected page. Exploitation is not fully self-contained: it requires user interaction (the victim must view the poisoned page) and, consistent with our assessed vector (PR:L rather than the CVE record's PR:N), realistically requires the attacker to hold some content-submission capability on the target site in order to store the payload. Impact is limited to low confidentiality, integrity, and availability within the victim's browser session, and no public exploit or confirmed active exploitation was identified at time of analysis.
Reflected cross-site scripting in the ShopBuilder - Elementor WooCommerce Builder Addons plugin for WordPress (versions through 3.4.1) lets a remote attacker inject arbitrary script into a page the plugin generates from unvalidated input, so the payload executes in the browser of any user who opens a crafted link. No authentication is required of the attacker (CVSS PR:N), but exploitation depends on victim interaction with an active session (CVSS UI:R), and the impact is greatest when the lured target is a logged-in store administrator because the script then runs inside the WordPress dashboard. The risk is rated CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) by independent assessment; no public exploit identified at time of analysis, and no vendor-released patch version is specified in the available intelligence, so the Patchstack advisory should be monitored for a fixed release.
Jexactyl releases prior to 4.0.5 accept a client-supplied Stripe Checkout Session at POST /api/client/billing/stripe/process based solely on its payment_status being 'paid', without checking amount_total or currency against the referenced order or the panel's configured billing currency. On instances where the optional billing module is enabled and a Stripe secret key is set, an authenticated client can therefore settle an order with an under-valued or mismatched-currency payment and still have the order fulfilled, provisioning, renewing, upgrading, or unsuspending the associated server for less than the required price. The issue is a bounded payment-integrity/business-logic flaw rather than a critical infrastructure risk; it requires authentication plus the non-default billing and Stripe configuration, is fixed in 4.0.5, and no public exploit code or active exploitation has been identified at time of analysis.
Reflected cross-site scripting in the Designthemes 'Whistle - Sports Club' WordPress theme (all versions through 4.2) allows unauthenticated remote attackers to inject and execute arbitrary script in a victim's browser by convincing that victim to open a crafted link; the payload is reflected in the response rather than stored. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) confirms the attack is network-reachable and requires no authentication, but is gated by user interaction, and the non-persistent reflected nature rules out broad automated or drive-by compromise. No confirmed active exploitation (no CISA KEV listing) and no public exploit code were identified at time of analysis.
Reflected cross-site scripting in the Bracketweb 'Voldor' WordPress theme (versions up to and including 1.0.0) lets an unauthenticated remote attacker inject a malicious script into a crafted URL that executes in the browser of any victim who clicks the link while the theme is active. Exploitation requires the victim to follow the attacker-supplied URL (UI:R) and the target site to actually run this specific theme; the payload is reflected rather than stored, so it is non-persistent and limited to the victim's browser context (session or cookie theft, actions performed as the victim). Patchstack assigned CVSS 3.1 7.1 for this flaw; no public exploit code and no confirmed active exploitation were identified at the time of analysis.
Reflected cross-site scripting in WP Associate Post R2 versions up to 5.0.1 allows remote, unauthenticated attackers to inject arbitrary script into a page via a crafted URL, requiring the victim to click a malicious link (UI:R). This moderate-severity (CVSS 7.1) flaw affects the WordPress plugin by Delight Star Inc., and no public exploit or active exploitation has been identified at time of analysis. The scope-changed impact is limited to the victim's browser session, but privileged users such as administrators are at higher risk if lured.
Reflected cross-site scripting in the FiboSearch (ajax-search-for-woocommerce) WordPress plugin, affecting all versions through 1.34.1, allows an unauthenticated attacker to execute arbitrary script in a victim's browser session by convincing them to open a crafted link against an affected WooCommerce store. The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, scored 7.1 by the reporter Patchstack) confirms the attack is network-reachable and needs no attacker-side authentication, but it critically depends on victim interaction and the impact is confined to the victim's session rather than the server; our independent assessment concurs and only differs by rating availability impact as None. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied in the intelligence feed.
Incorrect privilege assignment in Progress Telerik Report Server (versions prior to 12.2.26.1007) lets an authenticated user, including a low-privilege or guest account with a valid bearer token, register as a trusted service agent through the service-agent SignalR hub. On the next server settings-synchronization event, the rogue agent receives storage settings and encryption private keys, enabling disclosure of stored data-source credentials and connection strings, impersonation of legitimate agents, and interference with task dispatch. No public exploit code has been identified at time of analysis, and exploitation requires the attacker to persist until the synchronization event occurs.
Incorrect permission assignment on critical resources in Dell Secure Connect Gateway (SCG) Policy Manager lets an authenticated, low-privileged local user on the SCG host read and modify files or objects that should have been restricted, producing high confidentiality and high integrity impact together with a bypass of the product's own protection mechanisms (CVSS 3.1 base 7.1, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). The practical prerequisite is a pre-existing foothold on the appliance - a local shell or a service account - so the realistic threat actor is an insider or someone who has already compromised the host; there is no remote or unauthenticated path to trigger the flaw and no user interaction is required. No public exploit code identified at time of analysis, EPSS is 0.09% (0th percentile) and CISA's SSVC assessment records exploitation as 'none' with automatable 'no', making this a moderate, non-urgent priority for organizations running the affected versions.
Information disclosure in Dell Secure Connect Gateway (SCG) Policy Manager (CPE cpe:2.3:a:dell:secure_connect_gateway_(scg)_policy_manager) arises from an insecure default initialization of a resource (CWE-1188), meaning affected builds ship or configure a resource in a state that exposes sensitive data out of the box. Exploitation is not remote or anonymous: it requires an attacker who already has local access to the host and a low-privileged authenticated account (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), with no user interaction needed. Risk is moderate and urgency low despite the 7.1 base score: EPSS is only 0.09% (0th percentile), CISA SSVC rates Exploitation 'none' and Automatable 'no', and no public exploit code or confirmed active exploitation was identified at time of analysis.
SQL injection in the WordPress plugin wp-post-author (versions 4.0.0 up to but not including 4.1.0) lets an authenticated, low-privilege user inject arbitrary SQL into plugin queries and read sensitive data from the site's underlying database. Exploitation is network-reachable, requires no user interaction, and is rated CVSS 7.1 (High) with high confidentiality impact but no integrity or availability impact, consistent with read-oriented database exfiltration rather than data tampering or denial of service. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); the primary barrier is the requirement for valid low-privilege credentials on the target WordPress site.
Reflected cross-site scripting in the SpabRice Pond WordPress theme (all versions through 2.6.1) lets a remote, unauthenticated attacker craft a URL containing a script payload that the theme reflects unsanitized into the generated page; the victim must be convinced to open that link (mandatory user interaction), so exploitation cannot occur without social engineering and nothing persists server-side. Impact per the assessed vector is low confidentiality and integrity loss with scope change, with the worst case being a lured authenticated administrator whose browser executes the script in a privileged session; no public exploit and no confirmed active exploitation were identified at time of analysis. Sites running this theme should treat the reflected payload as a phishing/CSRF-assist vector rather than a self-propagating compromise.
Reflected cross-site scripting (XSS) in the ThemeREX Education Center WordPress theme (versions up to and including 3.6.12) allows remote attackers to execute arbitrary JavaScript in a victim's browser when they click a crafted link. The flaw requires user interaction (UI:R) and no authentication (PR:N), and it is reported by Patchstack with a CVSS 3.1 base score of 7.1; however, our assessment indicates no availability impact (A:N), limiting the impact to confidentiality and integrity of the victim's session. No public exploit code or active exploitation has been identified at time of analysis.
Reflected cross-site scripting in the Bracketweb 'Ogency' WordPress theme (versions through 1.0.0) lets an unauthenticated remote attacker craft a URL whose parameter is echoed unsanitized into the rendered page, executing arbitrary JavaScript in the browser of any user who opens that link. The assessed CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L); successful exploitation requires victim interaction and yields no server-side compromise, but can lead to admin session/session-cookie theft or forced administrative actions given WordPress's privileged session model. No public exploit code was identified and the flaw is not in CISA KEV at time of analysis, so risk is driven by the low skill barrier for reflected XSS rather than confirmed active exploitation.
Reflected cross-site scripting in the Bracketweb 'Treck' WordPress theme (all versions through 1.0.0) allows an unauthenticated attacker to run arbitrary JavaScript in a victim's browser by luring them to a specially crafted URL containing a malicious payload in an unsanitized, reflected parameter. The flaw carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), so no authentication or prior access is needed to send the request, but the victim must click the attacker-supplied link for the script to execute; impact is greatest when that victim is a logged-in WordPress administrator, since the injected script then runs inside the admin session. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the theme's low deployment footprint limits real-world exposure.
Cross-site request forgery in the WordPress plugin Dashboard Notes (MIGHTYminnow) affects all versions through 1.0.3, letting an attacker craft a page or link that silently rides an authenticated privileged user's session to perform state-changing plugin actions. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (7.1) reflects that the attacker needs no server-side authentication (PR:N) but must successfully lure a logged-in user with access to the plugin's dashboard functionality into interacting with attacker-controlled content (UI:R); exploitation cannot occur without that victim action. No public exploit code and no confirmed active exploitation were identified at time of analysis, though the low attack complexity and the universal applicability of CSRF to unpatched WordPress plugins keep the practical risk meaningful for sites running 1.0.3 or earlier.
Missing authorization in the ThemeHunk Th Shop Mania WordPress theme (versions through 1.9.1) lets an authenticated low-privilege user invoke theme functionality that lacks a proper capability check, primarily degrading site availability and allowing limited unauthorized changes. Exploitation is remote, requires only a valid low-privileged WordPress account on a site where the theme is installed and active, and needs no user interaction; no public exploit has been identified at time of analysis. The CVSS 3.1 base score is 7.1, driven almost entirely by the high availability impact (A:H) rather than confidentiality (C:N) or broad integrity loss (I:L).