Stored DOM-based cross-site scripting in the WordPress plugin Quiz and Survey Master (QSM) - Quiz Maker & Survey Maker, in all versions up to and including 11.2.6, allows unauthenticated attackers to plant arbitrary JavaScript in the site's quiz submission and audit-trail data through the 'qsm_hidden_questions' parameter, which is stored without adequate sanitization and later rendered without output escaping. The injection is conditional: the attacker must deliberately break the 'mlw_results' INSERT by submitting an over-length or duplicate 'qsm_unique_key' value so that the plugin falls into the audit-trail branch that writes the raw payload into wp_mlw_qm_audit_trail.form_data, and the script only fires when a user - most plausibly an administrator reviewing quiz results or audit data - later loads the affected page. There is confirmed unauthenticated remote reachability (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C) with low confidentiality and integrity impact, but no public exploit code identified at time of analysis and no CISA KEV listing, so this is a conditional, moderate-priority fix rather than an emergency patch.
Stored cross-site scripting in the Presto Player plugin for WordPress (all versions up to and including 4.5.1) lets unauthenticated attackers inject arbitrary JavaScript via comment content that is processed by the <presto-player> tag, with the payload executing in the browser of any user who later views the affected page. The issue is rated 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), with the scope-change metric reflecting that the injected script affects a component beyond the vulnerable plugin itself. Exploitation depends on a single initial comment being approved by a moderator, after which WordPress's default behavior of auto-approving subsequent comments from the same author removes the need for further admin intervention; there is no CISA KEV listing and no public exploit identified at time of analysis, making this a moderate-priority issue that is largely mitigated by upgrading to 4.5.2, disabling comments, or requiring manual approval for every comment.
Stored cross-site scripting in the Post Grid Gutenberg Blocks - PostX WordPress plugin, affecting all versions up to and including 5.1.0, allows an attacker holding a Subscriber-level account to plant JavaScript in the user display_name field that executes for any visitor viewing a page where the plugin renders its Archive Title block. The bypass works because WordPress core's pre_user_display_name filter uses ENT_NOQUOTES, encoding ampersands, angle brackets and greater-than signs but leaving double-quotes intact, so a crafted display_name breaks out of the alt="" attribute at Archive_Title.php:144. Reported by Wordfence with a CVSS v3.1 base score of 7.2; no public exploit identified at time of analysis, though the published CVSS vector claims PR:N while our assessment holds PR:L, since the attack requires an authenticated Subscriber-or-higher account created through open registration or an attacker-controlled low-privilege user.
Authenticated remote code execution in Rank Math SEO before 1.0.280 is possible because the WordPress plugin's settings import feature fails to validate uploaded file types, allowing an administrator to upload a PHP file for server-side execution. The CVSS vector is network-reachable but requires high privileges (PR:H), so an attacker must already hold administrator-level WordPress access; no public exploit was identified at time of analysis, and the vendor has released a patch. While the 7.2 base score looks significant, the administrator prerequisite makes this a comparatively low-real-risk issue for most deployments.
Unauthenticated server-side request forgery in the StreamCast WordPress plugin (versions 2.4.5 and earlier, published by Bplugins) lets a remote attacker coerce the affected WordPress site into issuing attacker-chosen outbound HTTP requests to internal, loopback, or otherwise non-public hosts. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, score 7.2) indicates exploitation requires only network reachability of the plugin endpoint on a default installation - no credentials, no user interaction - with the scope change reflecting impact on systems beyond the WordPress instance itself, though the low confidentiality and integrity ratings mean the practical payoff is internal reconnaissance and limited data disclosure rather than full site compromise. There is no public exploit identified at time of analysis and no evidence of confirmed active exploitation (CISA KEV); real-world attack value depends heavily on what internal services, control-plane APIs, or cloud metadata endpoints the target web server can actually reach.
Stored cross-site scripting in the Easy Digital Downloads WordPress plugin (all versions up to and including 3.6.9) allows unauthenticated attackers to inject arbitrary scripts through PayPal IPN parameters, which are stored without sanitization and later rendered unescaped in the wp-admin 'Gateway Error Logs' reporting table. Although the injection is remote and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, with scope change because the script executes in the privileged wp-admin origin), the payload only runs when a logged-in user - in practice a store administrator - opens the gateway error logs page, and only stores with the PayPal gateway enabled are exposed. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); this is a moderate-priority issue driven mainly by the admin-view precondition.
Server-side request forgery in the Builderius WordPress plugin (versions 1.4 through 1.4-beta) lets an attacker drive the affected site to make arbitrary outbound HTTP requests, potentially reaching internal services, localhost, and cloud instance metadata endpoints. Our independent assessment scores this as network-reachable, low-complexity, and requiring low-privileged authenticated access (PR:L, base 7.2 HIGH), while the vendor-supplied vector claims unauthenticated access (PR:N) that remains unverified; comparable WordPress plugin SSRFs in practice often require a logged-in user. Impact is limited to low confidentiality and integrity with a scope change, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Authentication bypass through an alternate password-recovery channel in the Omegathemes Grocery Shopping Store WordPress theme, versions through 1.3.3, can let a remote attacker with some level of privilege (PR:L per the assessed CVSS vector) manipulate the theme's password recovery/reset flow, with low integrity and high availability impact but no confidentiality impact. The CVSS 3.1 base score is 7.1 (HIGH), with network attack vector, low attack complexity, and no user interaction. No public exploit was identified at the time of analysis, and the provided intelligence does not confirm CISA KEV exploitation; the practical risk is constrained by the theme's narrow deployment footprint and the privilege requirement noted in the vector, which conflicts with the typical pre-auth nature of password-recovery bypasses and should be verified.
Missing authorization in TencentCloud Octop through 1.0.2b6 lets any authenticated low-privileged user retrieve plaintext LLM and voice provider API keys by calling GET /api/providers and GET /api/voice/providers. Those routes validate the caller's JWT but perform no role, tenant, or ownership check, so in multi-user or multi-tenant deployments any account holding a token is sufficient to harvest credentials and abuse the upstream provider accounts; a single-operator install is largely limited to the legitimate owner reading their own keys. Independent assessment rates this as a genuine moderately-high confidentiality flaw bounded by the PR:L prerequisite (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), and the current exploitation status is: no public exploit identified at time of analysis, despite a public technical writeup and upstream pull requests referencing the issue.
AstronRPA through 1.1.6 exposes other tenants' credential-bearing shared variables to any authenticated low-privilege user, because robot-service's get-batch-shared-var endpoint applies no tenant authorization check to caller-supplied shared-variable IDs. An attacker can enumerate sequential IDs, request them in batch, and since the service re-encrypts all-users variables with the caller's own tenant key, the returned ciphertext decrypts to plaintext secrets belonging to other tenants. The provider-assigned CVSS 4.0 score is 7.1, our assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (confidentiality only), exploitation requires a valid account on a multi-tenant deployment, no public exploit identified at time of analysis, and no CISA KEV entry or EPSS data was provided.
Unauthenticated cross-site scripting in the WordPress plugin Barcode Scanner with Inventory & Order Manager up to version 1.13.1 allows remote attackers to execute arbitrary script in a victim's browser when the victim loads a crafted page or link. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (7.1), so no attacker authentication is required but the victim must interact with the payload, and no public exploit has been identified at the time of analysis. Impact can include session theft, content injection, or actions in the victim's authenticated context, and is magnified if the victim is an administrator.
Reflected cross-site scripting in the KuteShop WordPress theme (versions 4.2.9 and earlier) lets remote, unauthenticated attackers inject arbitrary script into a page that executes in a victim's browser once that victim clicks a crafted URL. The attack requires user interaction (UI:R) and a site running the vulnerable theme version, which limits automation; there is no CISA KEV listing and no public exploit code identified at time of analysis, and no EPSS score was provided. Impact scales with the victim's privileges, since a script executing in an administrator's session can be leveraged for session theft or privileged actions, which is why the flaw carries a CVSS 3.1 base score of 7.1.
Reflected cross-site scripting in the Biolife WordPress theme (versions up to and including 3.2.3) allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser by luring them into clicking a crafted link containing a malicious payload. The vulnerability is network-reachable with low attack complexity but requires user interaction (UI:R) and crosses a scope boundary (S:C), resulting in limited confidentiality and integrity impact (C:L/I:L). No public exploit code or active exploitation has been identified at the time of analysis.
Reflected cross-site scripting in the TechOne WordPress theme by Kutethemes, affecting all versions up to and including 3.0.3, lets an unauthenticated attacker run arbitrary JavaScript in a site visitor's browser by luring that visitor to a crafted URL that carries the payload into an unsanitized, reflected input. The flaw carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N per independent assessment); because the payload is reflected rather than stored, the mandatory victim interaction is the key limiting factor and no server-side foothold is obtained. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the issue was reported by Patchstack.
Reflected cross-site scripting in the Armania WordPress theme by KuteThemes, affecting all versions through 1.4.8, allows unauthenticated remote attackers to execute arbitrary script in a victim's browser session if they are induced to open a crafted link. The flaw carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), with the scope change reflecting that the injected script runs in the context of the affected WordPress site rather than the attacker's origin; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV). The practical impact is escalation of the attacker's footprint within the victim's session - most severe when the tricked user is an authenticated administrator - but the attack depends entirely on successful social engineering and does not alter server-side state.
Reflected cross-site scripting in the an-themes Pin WP WordPress theme (versions 7.0 and earlier) allows an unauthenticated remote attacker to execute arbitrary script in a victim's browser by luring them to a specially crafted URL that reflects unsanitized input. Exploitation is gated by mandatory user interaction - no credentials are required, but the payload only fires if the victim clicks the attacker-supplied link - and the impact is worst when that victim is a logged-in site administrator, since the injected script inherits the site's origin (CVSS 7.1, S:C). No CISA KEV entry, no confirmed public exploit code, and no vendor-released patch were present in the available intelligence, so this rates as a moderate-risk, not top-priority, issue that nevertheless warrants prompt attention because of the volume of unauthenticated attackers who could attempt it.
Reflected cross-site scripting in the Ambed WordPress theme (all versions up to and including 1.0.0) allows unauthenticated attackers to inject and execute arbitrary script in a victim's browser by delivering a crafted link that reflects unsanitized input through the theme. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) confirms the attack is network-reachable, low complexity, and requires no privileges to send, but it cannot succeed without convincing a targeted user - typically a logged-in administrator or a site visitor - to click the crafted URL. Only sites actively running the Ambed theme at 1.0.0 or earlier are exposed, there is no confirmed actively exploited status (not in CISA KEV) and no public exploit code identified at time of analysis, and because the vector is reflected rather than stored, the payload must be re-delivered for each victim.
Unauthenticated cross-site scripting in the WordPress plugin Document Embedder (bplugins) at versions up to and including 2.4.0 allows an attacker to have arbitrary JavaScript execute in the browser of a site visitor or administrator who opens a crafted link or page containing malicious embed content; no account on the target WordPress site is required (PR:N), but the victim must interact with attacker-supplied content (UI:R), which is the primary limiting factor. The flaw is a CWE-79 input-neutralization failure in how the plugin renders embedded documents, and carries a CVSS 3.1 base score of 7.1; there is no public exploit identified at time of analysis, and it is not listed as confirmed actively exploited (CISA KEV), although the reporting source is a commercial vulnerability intelligence vendor (Patchstack) that maintains a WordPress-focused advisory database. Because successful script execution occurs in the context of the affected site's origin (scope change, S:C), a compromised administrator session could be leveraged to perform privileged actions, though the low confidentiality and integrity sub-scores reflect limited direct data exposure per request.
Unauthenticated cross-site scripting in the WordPress plugin Before After Image Comparison - Image Comparison for WP (versions 1.1.21 and earlier) allows a remote attacker to deliver a crafted payload that executes JavaScript in a victim's browser, but only after that victim interacts with the attacker-supplied link or page (CVSS 3.1 base 7.1, HIGH). The vulnerable plugin must be installed and active on the target WordPress site for any exploitation to be possible; sites not running it are unaffected. At the time of analysis there is no confirmed in-the-wild exploitation (not in CISA KEV) and no public exploit code identified, and no EPSS score was supplied, so the practical risk is governed mainly by the mandatory user interaction and the need for the specific plugin to be present and reachable.
Unauthenticated cross-site scripting in the Team Section Block WordPress plugin (bPlugins), affecting all versions up to and including 2.0.4, lets a remote attacker supply script-bearing content that executes in a victim's browser when the affected block/page is rendered. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); EPSS data was not provided. The CVSS score of 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects a network-reachable, unauthenticated bug whose practical severity is constrained by the mandatory victim interaction step - the payload only fires once a user (ideally a logged-in administrator) loads the injected content.
Unauthenticated cross-site scripting in the 10Web Photo Gallery plugin for WordPress affects every version up to and including 1.8.47, allowing any remote party to deliver script that executes in the browser of a site user who interacts with the attacker-controlled content. Rated CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), the flaw needs no authentication on the attacker's side, so the only real barriers are the mandatory victim interaction and the requirement that the target site run the vulnerable plugin version - impact scales with the privilege of the victim, and an administrator victim yields the highest payoff since the injected script would run with that user's session privileges. No public exploit code and no CISA KEV entry were identified at the time of analysis; the sole reference is the Patchstack advisory, which does not name the vulnerable parameter/input field or state whether a non-default plugin configuration is required.
Unauthenticated cross-site scripting in the Slider by 10Web WordPress plugin (slider-wd) affects all versions up to and including 1.2.63, allowing remote attackers to inject script that executes in a victim's browser session on the affected site. The CVSS 3.1 base score is 7.1 (High) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L - no privileges are required to originate the payload, but exploitation is not self-propagating: it depends on a human in the loop, since the victim must open an attacker-supplied request or crafted link (UI:R) for the script to run, and the vulnerable code path is only reachable while the plugin is installed and active. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and unauthenticated attack surface make prompt patching or deactivation advisable for sites running the plugin.
Unauthenticated cross-site scripting in the Food Menu - Restaurant Menu & Online Ordering for WooCommerce plugin (versions up to and including 6.0.5) lets attackers inject script that executes in the context of a victim's browser session on an affected WordPress/WooCommerce site. Affected deployments are any WordPress installation running the RadiusTheme plugin at version 6.0.5 or earlier; the attacker needs no credentials (CVSS PR:N) but the payload only fires when a victim loads attacker-influenced content (UI:R), so a privileged user such as an administrator is the highest-value target. There is no CISA KEV entry and no public exploit code identified in the supplied intelligence at time of analysis, and no EPSS score was provided; our independent assessment rates this as a genuine medium-tier issue rather than an emergency, with the vector (scope change S:C, low confidentiality/integrity/availability impact) internally consistent with a script-injection flaw. Patchstack is credited as the reporting source and hosts the reference advisory. Vendor-released patch: no fixed version identified in the available data.
Cross-site scripting in Tutor LMS 4.1.0 and earlier allows unauthenticated remote attackers to inject script into pages viewed by victims, but exploitation requires a victim to interact with attacker-supplied content. Successful attacks execute JavaScript in the victim’s browser context with low confidentiality, integrity, and availability impact, potentially enabling session theft or unauthorized actions on behalf of an administrator or instructor. The provided data identifies no public exploit code and no confirmed active exploitation; the Patchstack advisory is the primary reference.
Unauthenticated cross-site scripting in the FV Player 8 WordPress plugin versions 8.1.8 and earlier lets an attacker inject script that executes in a victim's browser when the victim clicks a crafted link or loads a page containing the payload. The plugin must be installed and active, and the victim must interact with the malicious input, while the attacker needs no authentication. No public exploit code has been identified at time of analysis, and the independent assessment considers this a genuine but moderate-priority issue rather than a critical emergency because impact is confined to the victim's browser context with low confidentiality and integrity impact.
Unauthenticated cross-site scripting in the WordPress plugin Social Share Icons & Social Share Buttons (versions <= 3.7.5) lets remote attackers inject script that executes in the browser of a site visitor or administrator who interacts with the crafted content, scoring CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Because the plugin is embedded on public-facing WordPress pages, any site running an affected version is exposed, and per the CVSS vector the attacker needs no credentials (PR:N) but must convince a victim to take an action such as clicking a crafted link (UI:R), with the scope change (S:C) meaning the injected script can affect resources beyond the vulnerable component. No public exploit code and no confirmed active exploitation were identified at time of analysis, and there is no vendor-released patch version documented in the available references, so sites should treat the plugin's 3.7.5 release line as vulnerable until a fixed version is published.
Unauthenticated cross-site scripting in the Jannah WordPress theme affects all versions up to and including 7.6.5, allowing remote attackers to inject script that executes in a victim's browser within the affected site's origin. Exploitation requires the victim to interact with attacker-controlled input (CVSS UI:R) and no attacker authentication is required (PR:N), but impact is confined to the client-side session rather than the server, so real-world severity depends heavily on whether the victim is a logged-in administrator or an anonymous visitor. No public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); the CVSS 7.1 score reflects the mandatory user interaction and limited confidentiality, integrity, and availability impact, with scope change (S:C) indicating the payload can affect resources beyond the vulnerable component's security realm.
Cross-site scripting in the Qode Real Estate WordPress plugin (all versions up to and including 1.1.7.3) lets unauthenticated attackers deliver crafted input that executes as script in a victim's browser session on the affected site. Exploitation requires no authentication but does require victim interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) - a victim must click a crafted link or load attacker-influenced content before the payload runs, so there is no silent server-side compromise. No public exploit identified at time of analysis and no CISA KEV listing; signals are mixed and lean toward moderate rather than urgent priority, and the exact injectable parameter is not detailed in the available description so the Patchstack advisory should be consulted for the precise entry point.
Qode Music WordPress plugin versions through 2.1.8.2 contain an unauthenticated cross-site scripting (XSS) vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) shows a remote attack with no attacker authentication, but success depends on luring a victim into interacting with a crafted request, so social engineering is required. No public exploit or active exploitation is identified at time of analysis, and the assessed risk is medium-tier rather than top priority.
Unauthenticated cross-site scripting in the Jotform - AI Chatbot WordPress plugin (versions up to and including 3.8.2) allows remote attackers to have attacker-supplied script execute in a victim's browser session within the context of the affected site, since the plugin renders unsanitized input without adequate output encoding. Exploitation requires a victim to interact with attacker-controlled content (UI:R) - for example following a crafted link to, or loading, a page on which the vulnerable plugin output is displayed - while the attacker needs no authentication or privileges on the target (PR:N), making user interaction the primary limiting factor. Rated medium-to-high severity (reported CVSS 7.1, CWE-79, scope-changing client-side impact); there is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was supplied with the source data.
Cross-site scripting (XSS) in the Additional Order Filters for WooCommerce plugin (versions 1.24 and earlier) allows unauthenticated attackers to inject malicious JavaScript into order-filter pages, which executes in the browser of a logged-in shop manager or administrator who interacts with the affected page (UI:R). The assessed impact is confined to the browser/session context (C:L/I:L/A:N), making this a moderate-priority issue rather than a top-tier emergency; no public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated cross-site scripting (XSS) in the WP File Download WordPress plugin (versions up to and including 6.3.6) allows remote attackers to inject malicious scripts into a victim's browser session, potentially leading to session hijacking, data theft, or site defacement, though meaningful impact requires luring a privileged user. The flaw requires user interaction (e.g., clicking a crafted link) and affects any WordPress site using this JoomUnited plugin; no public exploit code has been identified at time of analysis, and the CVSS score is 7.1 (moderate severity).
Reflected cross-site scripting in the Martfury - WooCommerce Marketplace WordPress theme (all versions through 3.3.9) allows unauthenticated remote attackers to have attacker-supplied script execute in the browser of a victim who opens a crafted link or request against a site running the theme. Because the flaw is reflected rather than stored, exploitation requires victim user interaction (CVSS UI:R) and cannot be triggered passively against the server, yet the scope change (S:C) means injected script can act beyond the vulnerable component with low confidentiality, integrity, and availability impact, giving a CVSS 3.1 base score of 7.1. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the vulnerable parameter or endpoint is not disclosed in the available data.
Cross-site scripting in the Educavo WordPress theme through version 3.4.2 lets unauthenticated attackers get malicious script executed in the browser of a victim who is induced to load attacker-influenced content, with the change-of-scope vector (CVSS 7.1) reflecting that the injected code runs in the context of the targeted site. Exploitation requires user interaction, so delivery is effectively targeted (a crafted link or payload aimed at a site visitor or administrator) rather than automated mass compromise, and no public exploit code was identified at time of analysis. This is a moderate-priority issue rather than a critical one, and its reach is further limited to sites that actually run this specific theme.
Reflected cross-site scripting in the ThemeREX Group "Kids Planet" WordPress theme (all versions through 2.2.14.2) lets a remote, unauthenticated attacker lure a victim to a crafted link that causes attacker-controlled script to execute in the victim's browser within the context of the affected site. Because the injected code inherits the browsing context of whoever clicks the link, a logged-in administrator is the highest-value target, where the flaw can enable session or content manipulation; the required user interaction (UI:R) is the key limiting factor and rules out unattended, automatable exploitation. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor score of 7.1 reflects moderate confidentiality, integrity, and availability weighting.
Unauthenticated reflected cross-site scripting in the Designthemes LMS WordPress theme versions 8.3 and earlier allows remote attackers to inject arbitrary script into a victim's browser session if the victim clicks a crafted link or loads an attacker-controlled request that reflects the payload; the flaw is rated CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and was reported by Patchstack. The affected theme must be installed and active on the target WordPress site, and exploitation requires user interaction (UI:R), so it is not exploitable without tricking a user; there is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis.
Reflected cross-site scripting (CWE-79) in the WordPress plugin ThemeStek Extras for LabtechCO Theme, affecting all versions through 8.4, allows an unauthenticated attacker to inject script that executes in a victim's browser when a crafted URL is visited. Exploitation is constrained because the payload is not stored: an attacker must lure a victim into clicking a malicious link (CVSS UI:R), and the target site must have this specific plugin installed and active. The flaw is rated CVSS 7.1 with scope change (S:C) and low confidentiality, integrity and availability impacts; no public exploit code has been identified at time of analysis.
Reflected cross-site scripting (XSS) in the WPAdverts WordPress plugin through version 2.3.4 allows unauthenticated attackers to inject malicious scripts via crafted URLs, which execute in a victim's browser when the link is clicked. The flaw requires user interaction (UI:R) and is non-persistent, making exploitation dependent on social engineering; no public exploit code is identified at time of analysis. Successful attacks can compromise the victim's session or perform actions on their behalf, with heightened risk if the victim is an administrator.
Stored cross-site scripting in the WPAdverts WordPress plugin (all versions through 2.3.4) lets an attacker place crafted script content into advert data that is later rendered without proper neutralization, so the payload executes in the browser of any user who views the affected advert page. The reported base score is 7.1 (moderate); our assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) requires a low-privileged, authenticated submitter plus victim interaction, and the divergence from the published PR:N vector means the true privilege requirement hinges on whether WPAdverts is configured to allow unauthenticated advert submissions. No public exploit was identified at time of analysis, and no patch version is specified in the available intelligence, so the exposure is real but not confirmed actively abused.
Stored cross-site scripting in the Forminator WordPress plugin (WPMU DEV) through version 1.57.3 lets an unauthenticated attacker submit crafted form input that is persisted and later rendered without output encoding, executing script in the browser of whoever views it - typically an administrator reviewing submissions in wp-admin. The injection itself requires no account (CVSS PR:N) but exploitation depends on a victim viewing the stored content (UI:R), and with a changed scope (S:C) the impact is limited to low confidentiality, integrity and availability rather than direct server compromise. No public exploit code has been identified at time of analysis, and the overall assessment rates this a moderate-priority issue rather than an urgent one, though EPSS and KEV signals are absent from the supplied data.
Reflected cross-site scripting in the Bracketweb Zeinet WordPress theme (all versions through 1.0.0) allows an unauthenticated remote attacker to inject script that executes in the browser of a victim who clicks a crafted link. Because attacker-supplied input is reflected into the generated page without neutralization (CWE-79, CVSS 7.1), the injected script runs in the origin of the affected site and can steal session cookies, perform actions as the victim, or operate with administrative privileges if the clicking victim is a logged-in admin. The flaw has not been confirmed as actively exploited (no CISA KEV listing) and no public exploit code has been identified at time of analysis; exploitation hinges on user interaction (CVSS UI:R), which is the primary limiting factor.
Out-of-bounds read in Apache DataSketches C++ (datasketches-cpp) allows an attacker who controls a serialized VarOpt union image to trigger reads of up to 24 bytes past the end of the supplied buffer, causing a crash (denial of service) and potentially leaking adjacent heap memory into the deserialized union's state. Applications are exposed only if they call var_opt_union::deserialize() on data from untrusted sources; affected releases are 2.0.0-incubating through 5.2.0, and the library is not exploitable on its own. No public exploit code has been identified at time of analysis, EPSS is low at 0.24% (14th percentile), and the issue is not listed in CISA KEV, so the practical priority is moderate rather than urgent. The vendor-released fix is version 5.3.0, which also remediates four other deserialization flaws.