Unauthenticated authentication bypass in the SMS Alert WordPress plugin before 4.0.1 lets an attacker log in as any user who has a phone number stored in their profile - including an administrator - by completing an SMS one-time-code challenge on a phone the attacker controls. The plugin validates the code itself but never verifies that the verified code belongs to the account being logged into, so the OTP check can be satisfied for one phone while the resulting session is issued for a different, targeted account. This is a high-severity (CVSS 8.1, CWE-287) issue, but exploitation is constrained: the SMS/OTP login path must be enabled and the target account must have a stored phone number, and no public exploit or confirmed active exploitation has been identified at time of analysis; the vendor has released a fix in 4.0.1.
OS command injection in FusionPBX through 5.6.5 lets unauthenticated attackers inject shell metacharacters into the SIP Caller-ID name or number, which are written into recording filenames when the non-default record_name filename template is enabled, so that arbitrary commands execute as the web-server user once a privileged user exports multiple recordings as a ZIP. The CVSS 4.0 vector (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) rates this 7.7, reflecting network reachability with high attack complexity and mandatory privileged-user interaction rather than an easily weaponized flaw; our independent assessment maps to CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. Exploitation requires the attacker to place calls carrying crafted Caller-ID values and then wait for an authenticated administrator to trigger the ZIP download; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing).
Authenticated subscribers can delete arbitrary files on WordPress sites running PeepSo versions up to 9.0.5.4 due to a path traversal flaw (CWE-22). This high-severity (CVSS 7.7) vulnerability requires only a low-privilege account, which is easily obtained on sites with open registration, and allows deletion of critical files, potentially leading to site compromise or denial of service. No public exploit code has been identified at time of analysis.
Arbitrary file deletion in the ChimpStudio FoodBakery WordPress theme (versions up to and including 4.6) allows an authenticated attacker holding only a Subscriber-level account to delete arbitrary files on the server, with no user interaction required. The underlying path traversal flaw (CWE-22) lets a crafted request escape the intended directory and reach sensitive files such as wp-config.php, so the scope change (S:C) escalates impact beyond availability loss toward full site compromise. Rated CVSS 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H); no public exploit identified at time of analysis, and exploitation is gated by whether the site permits attackers to hold a Subscriber account, which is trivial on sites with open self-registration and meaningfully harder where registration is disabled or restricted.
Cross-site request forgery in OpenRefine through 3.10.1 lets a remote attacker run operating system commands as the OpenRefine user by luring that user's browser into issuing a crafted cross-origin GET to the local get-rows command with a malicious engine parameter that evaluates a Jython facet expression. Exploitation is not drive-by: it requires the victim to have OpenRefine running with a project loaded and an active session and to be induced into visiting an attacker-controlled page, and it depends on the target build bundling the Jython extension that provides the expression-evaluation path. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); the assessed CVSS:3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects high attack complexity and mandatory user interaction offsetting the full confidentiality, integrity and availability impact on the OpenRefine host.
Subscriber-level accounts on WordPress sites running the uListing plugin version 2.2.0 or earlier can invoke a plugin settings-change routine that performs no authorization or capability check, letting the lowest-privileged registered user modify configuration values that should be reserved for administrators (CWE-862, missing authorization). The attack is network-reachable, requires no user interaction and no elevated privilege beyond a valid subscriber session, which is trivial to obtain where open self-registration is enabled - though the CVSS vector (PR:L) confirms an account is a genuine prerequisite. Impact is primarily integrity loss in plugin configuration with some confidentiality and availability exposure (CVSS 3.1 base 7.6 as published; our independent assessment is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L), and the overall picture is a moderate-priority hardening issue rather than an emergency; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis.
Missing authorization in the Pubjet WordPress plugin (versions up to and including 5.4.8) allows an authenticated attacker with subscriber-level privileges to change plugin settings, resulting in a high integrity impact (CVSS 7.6). Exploitation requires the target site to permit user registration or the attacker to obtain valid low-privilege credentials, making open registration a primary exposure factor. No public exploit code has been identified at time of analysis, and the flaw is classified as CWE-862 (Missing Authorization).
SQL injection in WP Ultimate CSV Importer 9.2 and earlier allows an authenticated WordPress Administrator to inject arbitrary SQL through the plugin's import functionality, potentially exposing sensitive database contents. The CVSS 3.1 score is 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L), requiring a high-privileged admin session with no user interaction; no public exploit identified at time of analysis. Real-world risk is limited to malicious administrators, compromised admin credentials, or attackers who first obtain an admin account, making this a high-CVSS but comparatively low-real-risk issue once the privilege requirement is factored in.
SQL injection in the Frontend Admin by DynamiApps WordPress plugin (all versions up to and including 3.29.13) lets an authenticated administrator inject arbitrary SQL through plugin input fields handled without proper sanitization, scored 7.6 under the vendor-published vector. The realistic risk is contained rather than broad: exploitation requires a valid administrator account on the target site (CVSS PR:H), so the practical threat surface is insiders, compromised admin credentials, or deployments that hand admin-level access to lower-trust users, and it is reachable over the network without any victim interaction. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the primary limiting factor remains the administrator privilege prerequisite rather than any technical barrier.
SQL injection in the Leyka WordPress donation plugin (versions 3.32.3 and earlier) allows an authenticated administrator to inject arbitrary SQL through the plugin's admin-facing functionality, potentially exposing sensitive data stored in the underlying WordPress database. Exploitation requires a logged-in account with administrator-level capabilities (CVSS:3.1/AV:N/AC:L/PR:H/UI:N), so the practical risk is confined to insider abuse, compromised or shared admin credentials, or sites that hand admin roles to semi-trusted parties; there is no user-interaction requirement and the attack is delivered over the network. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so this is a high-severity but operationally limited issue whose severity (7.6) is driven mainly by the confidentiality impact on database contents.
Unauthenticated attackers can retrieve any customer's invoice, packing slip, delivery note, dispatch label or shipping label from WordPress sites running the WebToffee WooCommerce PDF Invoices plugin up to and including 5.0.2, exposed via the guest 'print_document_from_the_mail_link' handler. The handler authenticates document access by comparing a base64-encoded 'email' parameter against the order's billing email - a non-secret identifier - rather than the secret WooCommerce order_key, so anyone who knows a target order ID and that order's billing email can pull the full document contents (name, billing/shipping address, phone, products, prices, taxes, invoice metadata). Exploitation requires the site to be configured with guest document access ('wt_pklist_print_button_access_for' != 'logged_in'), so default logged-in-only configurations are not exposed; risk is rated CVSS 7.5 with high confidentiality impact but no integrity or availability impact, and no public exploit code has been identified at time of analysis.
Unauthenticated attackers can delete a limited set of files on WordPress sites running the rtMedia for WordPress, BuddyPress and bbPress plugin through version 4.7.13, because the upload processing routine performs insufficient file path validation and the plugin treats a publicly exposed nonce as an authorization gate. The rtmedia_upload_nonce that guards the deletion path is emitted into frontend JavaScript by any page rendering the rtMedia gallery or upload shortcode, so it can be harvested by any anonymous visitor, although the impact is deliberately limited to files the plugin classifies as 'safe' rather than critical system or configuration files. Affected sites on 4.7.14 or later are not exploitable; no public exploit code was identified at time of analysis and there is no evidence of active exploitation. The assessing vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, reflecting limited integrity and availability loss rather than the higher confidentiality weighting in the originally published CVSS score.
Unauthenticated SQL injection in the LatePoint WordPress plugin (versions up to and including 5.7.2) allows remote attackers to append arbitrary SQL queries via the 'booking[service_id]' parameter, enabling extraction of sensitive data from the database. The vulnerability is easily exploitable (CVSS 7.5) with no authentication or user interaction required, and affects the plugin's core booking functionality. No public exploit code or active exploitation has been identified at time of analysis, but the flaw poses a significant risk due to its low complexity and high confidentiality impact.
Unauthenticated sensitive data exposure in the Contact Form 7 - Dynamic Text Extension WordPress plugin (versions up to and including 5.0.7) lets any remote visitor cause the plugin's dynamic-text rendering to return information that was not meant to be disclosed, with high confidentiality impact and no integrity or availability effect (assessed CVSS 3.1 base 7.5). The assessed vector AV:N/AC:L/PR:N/UI:N means no authentication, user interaction, or special configuration is required beyond having the vulnerable plugin installed, active, and reachable on an internet-facing site. Risk is bounded by plugin presence and by whatever sensitive values a site's dynamic-text fields actually render; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated sensitive data exposure in the Web Plura Backup & Restore Manager plugin for WordPress (versions 0.2.25 and earlier) allows remote attackers to read potentially sensitive backup-related information from affected sites. Exploitation requires only that the plugin is installed and active, per the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirming remote, low-complexity, unauthenticated access with no user interaction; impact is limited to confidentiality (C:H/I:N/A:N). No public exploit identified at time of analysis, and the affected install base is limited to sites running this specific low-footprint plugin.
Unauthenticated code injection in the VillaTheme 'Thank You Page Customizer for WooCommerce' plugin, versions up to and including 1.2.3, lets a remote attacker who can reach a site running the plugin cause arbitrary code to be generated and executed, primarily threatening the integrity of the WordPress installation (CVSS 3.1 base 7.5, vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N per independent assessment). Any store that has both WooCommerce and this specific plugin installed and active is exposed, requires no credentials or user interaction, and is exploitable against default configurations. At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, and no vendor-released fixed version was found in the available data, so the practical risk is bounded by the narrow deployment scope of this relatively uncommon plugin rather than by any mass-exploitation signal.
Unauthenticated attackers can tamper with WordPress sites running the ThemeGoods DK theme at version 3.2.1 or earlier by abusing theme functionality that lacks an authorization check (CWE-862), rated 7.5 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), meaning integrity-only impact with no confidentiality or availability loss. No public exploit code has been identified at time of analysis and no EPSS score was supplied, so this reads as a moderate rather than emergency priority; the dominant limiting factor is product reach, since only sites that installed and activated this specific commercial theme are affected. Neither the vulnerable endpoint nor a patched version is disclosed in the available data, which leaves defenders without a precise target for either exploitation or mitigation.
Unauthenticated attackers can abuse missing authorization checks in the ThemeGoods Grand News WordPress theme (versions 3.4 and earlier) to carry out state-changing actions they should not be permitted to perform, modifying site integrity without valid credentials or any user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) confirms the flaw is network-reachable, low-complexity, and unauthenticated, but its impact is deliberately narrow: integrity only, with no data disclosure or availability loss. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated remote attackers can delete arbitrary plugin-managed content on any WordPress site running the Forminator form-builder plugin at or below version 1.57.3, because the content-deletion action lacks an authorization check (CWE-862 Missing Authorization). The flaw is trivially reachable: our assessment scores it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (published base 7.5), meaning no credentials, no privileges and no user interaction are required - only that the plugin is installed, active and its endpoint is network-reachable. Impact is destructive only (forms/submissions and associated content can be wiped) with no confidentiality disclosure or code execution, and no public exploit code was identified at time of analysis; there is no CISA KEV listing and no EPSS data was supplied. Sites that have upgraded past 1.57.3 or that do not run Forminator are unaffected.
Missing authorization checks in the Bayarcash WooCommerce WordPress plugin (all versions through 4.4.2) let unauthenticated remote attackers reach functionality that should be restricted to privileged users, allowing unauthorized changes to payment-related configuration or transaction state. The flaw carries CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), i.e. network-reachable, low complexity, no credentials and no user interaction, with a pure integrity impact and no confidentiality loss or denial of service. Exposure is bounded by deployment scope rather than configuration: the site must be running the plugin, and because Bayarcash is a Malaysia-focused payment gateway the realistic victim set is merchants using that gateway. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated remote attackers can invoke privileged actions or modify site data in the StylemixThemes Motors WordPress theme (versions through 1.4.108) due to missing authorization checks (CWE-862). The flaw is network-reachable with low complexity and requires no authentication or user interaction, resulting in a high integrity impact while confidentiality and availability are unaffected (CVSS 7.5). No public exploit identified at time of analysis, and there is no indication of active exploitation (CISA KEV).
Memory exhaustion in Perl's ExtUtils::Typemaps::STL::List before version 1.07 allows remote attackers to cause a denial of service via an empty list processed by the OUTPUT typemap, which triggers an integer underflow and a ~32 GiB allocation. This high-severity availability-only vulnerability (CVSS 7.5, C:N/I:N/A:H) requires a compiled XS module that uses the vulnerable typemap and a reachable code path with an empty list. No public exploit code has been identified at time of analysis, and the EPSS score is low (0.18%, percentile 7%).
Configuration injection in 9router 0.4.1 through 0.5.99 lets an authenticated dashboard user with access to the Hermes settings endpoint insert arbitrary keys into the Hermes Agent config.yaml, ultimately enabling shell command execution after an LLM call. The attacker submits a crafted baseUrl containing double quotes and newlines to set hooks_auto_accept and a hooks.post_llm_call command, so Hermes Agent runs the injected command without approval once it makes an LLM call. Exploitation requires high-privilege dashboard access and the agent must subsequently perform an LLM call; no public exploit was identified at time of analysis.
Unauthenticated broken-authentication flaw in the eRoom (Zoom Meetings & Webinar) WordPress plugin through version 1.7.1 lets remote attackers bypass plugin-level authentication checks and obtain limited read, write, and availability impact (CVSS 7.3, C:L/I:L/A:L). Exploitation requires only network reachability to a site with an active vulnerable copy of the plugin - the assessed vector is AV:N/AC:L/PR:N/UI:N, so no credentials, special configuration, or user interaction are needed - while sites on a later release or without the plugin are unaffected. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so the practical risk is bounded by how widely the plugin is deployed and is rated moderate priority.
Unauthenticated broken access control in the WordPress plugin Barcode Scanner with Inventory & Order Manager (versions 1.13.1 and earlier) lets any remote attacker reach plugin endpoints that handle product, inventory, and order functions without holding any WordPress capability or account (CWE-862, CVSS 3.1 7.3). The flaw is network-reachable with low complexity, no authentication (PR:N) and no user interaction (UI:N), so the only practical precondition is that the plugin is installed and active at a vulnerable version; per the assessed vector, the consequence of each exposed action is limited to Low confidentiality, integrity, and availability effects with scope unchanged, meaning the 7.3 reflects broad reachability rather than severe per-request impact. There is no CISA KEV entry and no public exploit identified at time of analysis, and the affected population is bounded to WordPress sites running this specific plugin. Tracking reference: Patchstack advisory for the plugin's 1.13.1 broken access control vulnerability.
Code injection in the Fastcache by Host.it WordPress plugin (all versions up to and including 1.7.4) allows an authenticated administrator-level user to write arbitrary Apache directives into the site's .htaccess file, which can be escalated to full remote code execution by setting php_value auto_prepend_file to load attacker-controlled PHP on every request. Exploitation requires the PR:H vector from the assessed CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H score (7.2), i.e. a logged-in account with administrator privileges, and is further conditioned on the site running Apache with an .htaccess file the plugin can write and an AllowOverride configuration that honors php_value directives - on nginx or Apache with AllowOverride None the injected directives have no effect. No public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV; this is a genuine but access-gated privilege-to-RCE escalation rather than a mass-exploitable perimeter bug.
Stored cross-site scripting in the WPAdverts - Classifieds Plugin for WordPress (all versions up to and including 2.3.4) allows attackers to persist arbitrary JavaScript in the 'adverts_location' advert field, which then executes in the browser of any user - typically an administrator - who views the affected classified listing. Because the plugin stores the field without sanitization and renders it without output escaping in its block-based listing templates, the assessment vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2) treats the attack as unauthenticated, though in practice this holds only on sites that allow anonymous or public ad submission; if registration or pre-publish moderation is enforced, the attacker needs at least a low-privileged account or must rely on an administrator reviewing the pending ad. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so this rates as a moderate, not emergency, priority - the realistic worst case is administrator session compromise when an admin browses the poisoned listing.
PHP Object Injection in YITH WooCommerce Affiliates through version 3.31.0 allows an authenticated attacker who already holds a high-privilege WordPress account to deserialize untrusted input and potentially achieve code execution or otherwise tamper with the site, with high impact to confidentiality, integrity, and availability (CVSS 7.2). The flaw is network-reachable without user interaction, but the PR:H requirement is the key limiter: unprivileged or unauthenticated users cannot reach the vulnerable deserialization path. No public exploit identified at time of analysis and no EPSS score was provided; the primary mitigations are reducing high-privilege accounts and applying a vendor fix once one ships.
Stored cross-site scripting in the WPO365 | Login (Seamless WordPress + Microsoft Integration) plugin for WordPress, affecting all versions up to and including 44.1, lets unauthenticated remote attackers inject arbitrary HTML/JavaScript that is persisted for up to three days. A forged 'id_token' whose base64url-decoded unique_name or iss claim carries malicious markup survives the plugin's token-to-error logging path (Id_Token_Service) and lands in the wpo365_errors transient with no sanitization on input and no escaping on output, so the injected script executes when a WordPress administrator later opens the WPO365 wizard page. Because the assessed vector is PR:N/UI:R, no credentials are needed to plant the payload, but the attacker is dependent on an administrator visiting the affected admin screen inside the transient's roughly three-day window; there is no confirmed active exploitation and no public exploit code identified at time of analysis, though the vendor has shipped a fixed release (45.0). Impact is bounded to low confidentiality and integrity within the WordPress admin context (no availability impact), which makes this a legitimately notable but not emergency-tier issue.
PHP Object Injection in the Bookly (Online Scheduling and Appointment Booking System) WordPress plugin, affecting all versions up to and including 28.2, lets authenticated users with Bookly 'custom-level' access or above pass a serialized payload through the plugin's 'value' parameter, which is then deserialized without validation; a successful chain could yield high confidentiality, integrity and availability impact. The decisive limiting factor is that no known gadget chain is available, so exploitation depends on a compatible gadget existing in another installed plugin, theme, or WordPress core, meaning default installations without such a gadget face injection without a direct exploit path. The flaw is not reachable by anonymous visitors (authentication required), and no public exploit code or CISA KEV entry has been identified at time of analysis.
PHP object injection in WooCommerce Multilingual & Multicurrency 5.5.8 and earlier allows an authenticated user with the shop manager role (or higher) to submit crafted serialized input to a plugin endpoint, potentially leading to high confidentiality, integrity, and availability impact if a usable POP gadget chain is present in the loaded code. The vulnerability carries a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and requires no user interaction beyond the attacker's own authenticated request, but it is not accessible to anonymous visitors or ordinary customers. No public exploit identified at time of analysis.
PHP object injection in the bPlugins Super Video Player WordPress plugin affects all versions through 1.8.13, allowing an authenticated high-privilege user to submit untrusted serialized data that the plugin passes to PHP's deserialization routines. Because the CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (7.2), the weakness is network-reachable and low-complexity but gated behind an administrator-level session in the affected WordPress installation, so anonymous and low-privilege visitors cannot reach the vulnerable path; no public exploit identified at time of analysis, and practical impact depends on the presence of a usable POP gadget chain in WordPress core, the plugin itself, or other installed components.
PHP object injection in the Tainacan WordPress plugin (all versions through 1.3.0) allows an authenticated high-privilege user - per the assessed CVSS vector (PR:H), effectively a WordPress administrator or an equivalent role able to reach the vulnerable input - to pass attacker-controlled serialized data into the plugin's deserialization path and potentially instantiate arbitrary PHP objects. Rated CVSS 3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), the flaw carries high confidentiality and integrity impact but is sharply constrained by the privileged authentication prerequisite and the plugin's niche use as a digital repository/collection management tool for WordPress. No public exploit code or confirmed active exploitation was identified at time of analysis, and object injection would additionally require a usable POP/gadget chain in the loaded codebase to convert into concrete code execution or file manipulation.
Stored DOM-based cross-site scripting in the Molongui Authorship - Author Boxes, Guest Authors & Co-Authors for WordPress plugin (free build, versions up to and including 5.2.12) lets unauthenticated attackers inject arbitrary web scripts via the href attribute inside comment content, which then execute in the browser of any visitor who loads the affected page. The flaw is confined to the free build: because Plugin::has_pro() returns false, the author-filter rewriter never appends its ?m_bm=true marker to plugin-generated anchors, so every href the byline script selects and rewrites is fully attacker-controlled. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (7.2 High) and no public exploit code identified at time of analysis.
Unauthenticated stored cross-site scripting (XSS) in FunnelKit - Funnel Builder for WooCommerce Checkout versions up to and including 3.16.0.5 allows attackers to inject malicious scripts via the 'shipping_first_name' checkout parameter, which are then executed when a user views the affected thank-you page. The vulnerability stems from insufficient input sanitization and output escaping in the plugin's e-commerce tracking code. No public exploit code or active exploitation has been identified at this time, and the risk is considered notable but not top-priority given the need for a victim to view the injected page. This affects any WooCommerce store using the vulnerable plugin with a publicly reachable checkout flow.
Stored cross-site scripting in the WordPress plugin LazyLoad Plugin - Lazy Load Images, Videos, and Iframes (rocket-lazy-load) through version 2.4.0 allows unauthenticated commenters to embed a crafted payload in a comment body that survives WordPress's wp_kses_data sanitization and only becomes an executable event handler when the plugin's render-time markup rewriting runs. Any visitor who subsequently loads the affected page can have arbitrary JavaScript executed in their browser, though exploitation is partly constrained because a site administrator must approve the crafted comment before it is rendered to others. There is no confirmed active exploitation (no CISA KEV) and no public exploit code identified at time of analysis; the CVSS 3.1 base score is 7.2 and our assessment adjusts the user-interaction metric to Required (UI:R) to reflect the moderation approval step. The vendor has released a fixed version (2.4.1).
Unauthenticated attackers can store arbitrary JavaScript in the WordPress 'Real Estate Manager - Property Listing and Agent Management' plugin (all versions up to and including 7.3) by submitting a crafted 'first_name' value through the public agent registration form, with the payload executing when an administrator later opens the Agents admin page where the value is rendered unescaped. The plugin's reCAPTCHA control provides no practical barrier because validation only runs when the g-recaptcha-response parameter is present, so simply omitting that parameter bypasses the check entirely. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited, but the requirement for a privileged user to view the injected page keeps this a moderate-priority rather than emergency issue; version 7.4 fixes it.
Stored DOM-based cross-site scripting in the VillaTheme Photo Reviews for WooCommerce plugin through version 1.2.30 lets unauthenticated visitors inject arbitrary web scripts into review-related comment meta, which execute when a shopper or admin later loads a product page displaying the affected review. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, and the only gate is the publicly emitted `wcpr_image_upload` nonce, so no authentication, capability, or attachment-ownership check is required. No public exploit identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Privilege escalation in WooCommerce 9.8.0 through 11.1.2 lets an attacker who already holds an authenticated high-privilege store account obtain capabilities beyond those legitimately assigned to that role, with full impact to store confidentiality, integrity and availability (CVSS 7.2). The underlying defect is an Incorrect Privilege Assignment (CWE-266) that is reachable over the network with low attack complexity and no user interaction, but the CVSS vector (PR:H) means anonymous internet attackers are excluded - a legitimate elevated account such as a shop manager or other non-administrator role is the prerequisite. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; Patchstack is credited with the report and the realistic attack surface is largest on multi-vendor, multi-staff, or delegated-administration stores.
Stored cross-site scripting in the WP Photo Album Plus WordPress plugin affects all versions up to and including 9.3.03.002 and can be triggered by remote attackers without authentication, since the assessed CVSS vector is AV:N/AC:L/PR:N/UI:N. The plugin records session history derived from REQUEST_URI without adequate sanitization, and because esc_url_raw() strips literal angle brackets while preserving HTML entities, the plugin's own wppaEntityDecode() routine later converts those entities back into live markup that is rendered through jQuery('#wppa-modal-container').html(). The stored script executes only when a victim subsequently loads a page that renders the poisoned modal container, which is the practical limiting factor; the base score of 7.2 (HIGH) reflects scope change with limited confidentiality and integrity impact, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated remote attackers can plant stored cross-site scripting payloads in the Podlove Podcast Publisher plugin for WordPress (all versions up to and including 4.5.6) by sending a POST to the Auphonic webhook endpoint with any status_string value other than the literal string 'Done'; the handler writes the entire raw $_POST superglobal into the plugin log before it ever validates the webhook authkey. The injected script only executes later, when a logged-in administrator opens the plugin's logging/Support page in wp-admin, so successful exploitation is conditional on an admin viewing the poisoned log entry - impact is confined to that administrator's authenticated browser session and is low for confidentiality and integrity with no availability impact. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation; the vendor has shipped an upstream code fix, though an explicitly tagged patched release version is not independently confirmed.
Stored cross-site scripting in the HivePress - Business Directory, Listings & Classified Ads plugin for WordPress (all versions up to and including 1.7.31) allows unauthenticated attackers to inject arbitrary JavaScript into front-end user profiles by supplying a crafted value for a custom text-type user attribute, which then executes whenever a victim - including an administrator - views the injected profile page. Exploitation is gated on two administrator-controlled configuration choices: a text-type custom user attribute must use a display format that places %value% inside an HTML attribute context (the plugin's own documented pattern <a href="%value%">Custom link</a>), and front-end user profiles must be enabled; sites that do not meet both conditions are not exploitable despite the HIGH base score. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and a vendor fix is available in HivePress 1.7.32.
Stored cross-site scripting (XSS) in the WP Meteor Website Speed Optimization Addon for WordPress (versions up to and including 3.4.18) lets unauthenticated attackers inject arbitrary JavaScript through the comment author name field, which executes in any user's browser when the affected page is viewed. The CVSS 3.1 score is 7.2 (High) with vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, reflecting a network-reachable, low-complexity, unauthenticated attack that changes scope through client-side execution. The primary practical limitation is that the malicious comment must pass WordPress's comment moderation queue and be approved before the author name is rendered-a display prerequisite that reduces reliability, though sites that auto-approve comments or attackers with existing approved-commenter access bypass it. No public exploit code and no CISA KEV listing were identified at time of analysis.
Unauthenticated stored cross-site scripting in the 10Web Booster website speed optimization plugin for WordPress (slug tenweb-speed-optimizer) affects all versions up to and including 2.34.8, allowing remote attackers to plant malicious JavaScript through the comment 'author' (Name) field that executes in the browser of any visitor - including logged-in administrators - who loads a page containing the injected image markup. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C (7.2) confirms the issue is network-reachable, low-complexity and requires no authentication, and its scope change reflects that the injected script runs in a different security context than the vulnerable plugin component. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; real-world exploitation is further constrained because comments and author-name rendering must be enabled, comment moderation or spam filtering can block the payload before publication, and the script only fires once a victim actually loads the tainted page.
Stored cross-site scripting in the VikBooking Hotel Booking Engine & PMS WordPress plugin lets unauthenticated attackers submit a crafted 'attachments[name]' value through the plugin's chat/messaging feature, which is then stored and executed in the browser of anyone who later views the injected page - typically a hotel operator or administrator reviewing chat attachments. Affected versions are all releases up to and including 1.8.15, scored CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and reported by Wordfence; no public exploit identified at time of analysis, and the practical trigger is victim page access rather than the injection itself.
Stored DOM-based cross-site scripting in the WordPress plugin Quiz and Survey Master (QSM) - Quiz Maker & Survey Maker, in all versions up to and including 11.2.6, allows unauthenticated attackers to plant arbitrary JavaScript in the site's quiz submission and audit-trail data through the 'qsm_hidden_questions' parameter, which is stored without adequate sanitization and later rendered without output escaping. The injection is conditional: the attacker must deliberately break the 'mlw_results' INSERT by submitting an over-length or duplicate 'qsm_unique_key' value so that the plugin falls into the audit-trail branch that writes the raw payload into wp_mlw_qm_audit_trail.form_data, and the script only fires when a user - most plausibly an administrator reviewing quiz results or audit data - later loads the affected page. There is confirmed unauthenticated remote reachability (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C) with low confidentiality and integrity impact, but no public exploit code identified at time of analysis and no CISA KEV listing, so this is a conditional, moderate-priority fix rather than an emergency patch.
Stored cross-site scripting in the Presto Player plugin for WordPress (all versions up to and including 4.5.1) lets unauthenticated attackers inject arbitrary JavaScript via comment content that is processed by the <presto-player> tag, with the payload executing in the browser of any user who later views the affected page. The issue is rated 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), with the scope-change metric reflecting that the injected script affects a component beyond the vulnerable plugin itself. Exploitation depends on a single initial comment being approved by a moderator, after which WordPress's default behavior of auto-approving subsequent comments from the same author removes the need for further admin intervention; there is no CISA KEV listing and no public exploit identified at time of analysis, making this a moderate-priority issue that is largely mitigated by upgrading to 4.5.2, disabling comments, or requiring manual approval for every comment.
Stored cross-site scripting in the Post Grid Gutenberg Blocks - PostX WordPress plugin, affecting all versions up to and including 5.1.0, allows an attacker holding a Subscriber-level account to plant JavaScript in the user display_name field that executes for any visitor viewing a page where the plugin renders its Archive Title block. The bypass works because WordPress core's pre_user_display_name filter uses ENT_NOQUOTES, encoding ampersands, angle brackets and greater-than signs but leaving double-quotes intact, so a crafted display_name breaks out of the alt="" attribute at Archive_Title.php:144. Reported by Wordfence with a CVSS v3.1 base score of 7.2; no public exploit identified at time of analysis, though the published CVSS vector claims PR:N while our assessment holds PR:L, since the attack requires an authenticated Subscriber-or-higher account created through open registration or an attacker-controlled low-privilege user.
Authenticated remote code execution in Rank Math SEO before 1.0.280 is possible because the WordPress plugin's settings import feature fails to validate uploaded file types, allowing an administrator to upload a PHP file for server-side execution. The CVSS vector is network-reachable but requires high privileges (PR:H), so an attacker must already hold administrator-level WordPress access; no public exploit was identified at time of analysis, and the vendor has released a patch. While the 7.2 base score looks significant, the administrator prerequisite makes this a comparatively low-real-risk issue for most deployments.
Unauthenticated server-side request forgery in the StreamCast WordPress plugin (versions 2.4.5 and earlier, published by Bplugins) lets a remote attacker coerce the affected WordPress site into issuing attacker-chosen outbound HTTP requests to internal, loopback, or otherwise non-public hosts. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, score 7.2) indicates exploitation requires only network reachability of the plugin endpoint on a default installation - no credentials, no user interaction - with the scope change reflecting impact on systems beyond the WordPress instance itself, though the low confidentiality and integrity ratings mean the practical payoff is internal reconnaissance and limited data disclosure rather than full site compromise. There is no public exploit identified at time of analysis and no evidence of confirmed active exploitation (CISA KEV); real-world attack value depends heavily on what internal services, control-plane APIs, or cloud metadata endpoints the target web server can actually reach.