Stored cross-site scripting in the Easy Digital Downloads WordPress plugin (all versions up to and including 3.6.9) allows unauthenticated attackers to inject arbitrary scripts through PayPal IPN parameters, which are stored without sanitization and later rendered unescaped in the wp-admin 'Gateway Error Logs' reporting table. Although the injection is remote and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, with scope change because the script executes in the privileged wp-admin origin), the payload only runs when a logged-in user - in practice a store administrator - opens the gateway error logs page, and only stores with the PayPal gateway enabled are exposed. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); this is a moderate-priority issue driven mainly by the admin-view precondition.
Server-side request forgery in the Builderius WordPress plugin (versions 1.4 through 1.4-beta) lets an attacker drive the affected site to make arbitrary outbound HTTP requests, potentially reaching internal services, localhost, and cloud instance metadata endpoints. Our independent assessment scores this as network-reachable, low-complexity, and requiring low-privileged authenticated access (PR:L, base 7.2 HIGH), while the vendor-supplied vector claims unauthenticated access (PR:N) that remains unverified; comparable WordPress plugin SSRFs in practice often require a logged-in user. Impact is limited to low confidentiality and integrity with a scope change, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Authentication bypass through an alternate password-recovery channel in the Omegathemes Grocery Shopping Store WordPress theme, versions through 1.3.3, can let a remote attacker with some level of privilege (PR:L per the assessed CVSS vector) manipulate the theme's password recovery/reset flow, with low integrity and high availability impact but no confidentiality impact. The CVSS 3.1 base score is 7.1 (HIGH), with network attack vector, low attack complexity, and no user interaction. No public exploit was identified at the time of analysis, and the provided intelligence does not confirm CISA KEV exploitation; the practical risk is constrained by the theme's narrow deployment footprint and the privilege requirement noted in the vector, which conflicts with the typical pre-auth nature of password-recovery bypasses and should be verified.
Missing authorization in TencentCloud Octop through 1.0.2b6 lets any authenticated low-privileged user retrieve plaintext LLM and voice provider API keys by calling GET /api/providers and GET /api/voice/providers. Those routes validate the caller's JWT but perform no role, tenant, or ownership check, so in multi-user or multi-tenant deployments any account holding a token is sufficient to harvest credentials and abuse the upstream provider accounts; a single-operator install is largely limited to the legitimate owner reading their own keys. Independent assessment rates this as a genuine moderately-high confidentiality flaw bounded by the PR:L prerequisite (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), and the current exploitation status is: no public exploit identified at time of analysis, despite a public technical writeup and upstream pull requests referencing the issue.
AstronRPA through 1.1.6 exposes other tenants' credential-bearing shared variables to any authenticated low-privilege user, because robot-service's get-batch-shared-var endpoint applies no tenant authorization check to caller-supplied shared-variable IDs. An attacker can enumerate sequential IDs, request them in batch, and since the service re-encrypts all-users variables with the caller's own tenant key, the returned ciphertext decrypts to plaintext secrets belonging to other tenants. The provider-assigned CVSS 4.0 score is 7.1, our assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (confidentiality only), exploitation requires a valid account on a multi-tenant deployment, no public exploit identified at time of analysis, and no CISA KEV entry or EPSS data was provided.
Unauthenticated cross-site scripting in the WordPress plugin Barcode Scanner with Inventory & Order Manager up to version 1.13.1 allows remote attackers to execute arbitrary script in a victim's browser when the victim loads a crafted page or link. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (7.1), so no attacker authentication is required but the victim must interact with the payload, and no public exploit has been identified at the time of analysis. Impact can include session theft, content injection, or actions in the victim's authenticated context, and is magnified if the victim is an administrator.
Reflected cross-site scripting in the KuteShop WordPress theme (versions 4.2.9 and earlier) lets remote, unauthenticated attackers inject arbitrary script into a page that executes in a victim's browser once that victim clicks a crafted URL. The attack requires user interaction (UI:R) and a site running the vulnerable theme version, which limits automation; there is no CISA KEV listing and no public exploit code identified at time of analysis, and no EPSS score was provided. Impact scales with the victim's privileges, since a script executing in an administrator's session can be leveraged for session theft or privileged actions, which is why the flaw carries a CVSS 3.1 base score of 7.1.
Reflected cross-site scripting in the Biolife WordPress theme (versions up to and including 3.2.3) allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser by luring them into clicking a crafted link containing a malicious payload. The vulnerability is network-reachable with low attack complexity but requires user interaction (UI:R) and crosses a scope boundary (S:C), resulting in limited confidentiality and integrity impact (C:L/I:L). No public exploit code or active exploitation has been identified at the time of analysis.
Reflected cross-site scripting in the TechOne WordPress theme by Kutethemes, affecting all versions up to and including 3.0.3, lets an unauthenticated attacker run arbitrary JavaScript in a site visitor's browser by luring that visitor to a crafted URL that carries the payload into an unsanitized, reflected input. The flaw carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N per independent assessment); because the payload is reflected rather than stored, the mandatory victim interaction is the key limiting factor and no server-side foothold is obtained. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the issue was reported by Patchstack.
Reflected cross-site scripting in the Armania WordPress theme by KuteThemes, affecting all versions through 1.4.8, allows unauthenticated remote attackers to execute arbitrary script in a victim's browser session if they are induced to open a crafted link. The flaw carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), with the scope change reflecting that the injected script runs in the context of the affected WordPress site rather than the attacker's origin; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV). The practical impact is escalation of the attacker's footprint within the victim's session - most severe when the tricked user is an authenticated administrator - but the attack depends entirely on successful social engineering and does not alter server-side state.
Reflected cross-site scripting in the an-themes Pin WP WordPress theme (versions 7.0 and earlier) allows an unauthenticated remote attacker to execute arbitrary script in a victim's browser by luring them to a specially crafted URL that reflects unsanitized input. Exploitation is gated by mandatory user interaction - no credentials are required, but the payload only fires if the victim clicks the attacker-supplied link - and the impact is worst when that victim is a logged-in site administrator, since the injected script inherits the site's origin (CVSS 7.1, S:C). No CISA KEV entry, no confirmed public exploit code, and no vendor-released patch were present in the available intelligence, so this rates as a moderate-risk, not top-priority, issue that nevertheless warrants prompt attention because of the volume of unauthenticated attackers who could attempt it.
Reflected cross-site scripting in the Ambed WordPress theme (all versions up to and including 1.0.0) allows unauthenticated attackers to inject and execute arbitrary script in a victim's browser by delivering a crafted link that reflects unsanitized input through the theme. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) confirms the attack is network-reachable, low complexity, and requires no privileges to send, but it cannot succeed without convincing a targeted user - typically a logged-in administrator or a site visitor - to click the crafted URL. Only sites actively running the Ambed theme at 1.0.0 or earlier are exposed, there is no confirmed actively exploited status (not in CISA KEV) and no public exploit code identified at time of analysis, and because the vector is reflected rather than stored, the payload must be re-delivered for each victim.
Unauthenticated cross-site scripting in the WordPress plugin Document Embedder (bplugins) at versions up to and including 2.4.0 allows an attacker to have arbitrary JavaScript execute in the browser of a site visitor or administrator who opens a crafted link or page containing malicious embed content; no account on the target WordPress site is required (PR:N), but the victim must interact with attacker-supplied content (UI:R), which is the primary limiting factor. The flaw is a CWE-79 input-neutralization failure in how the plugin renders embedded documents, and carries a CVSS 3.1 base score of 7.1; there is no public exploit identified at time of analysis, and it is not listed as confirmed actively exploited (CISA KEV), although the reporting source is a commercial vulnerability intelligence vendor (Patchstack) that maintains a WordPress-focused advisory database. Because successful script execution occurs in the context of the affected site's origin (scope change, S:C), a compromised administrator session could be leveraged to perform privileged actions, though the low confidentiality and integrity sub-scores reflect limited direct data exposure per request.
Unauthenticated cross-site scripting in the WordPress plugin Before After Image Comparison - Image Comparison for WP (versions 1.1.21 and earlier) allows a remote attacker to deliver a crafted payload that executes JavaScript in a victim's browser, but only after that victim interacts with the attacker-supplied link or page (CVSS 3.1 base 7.1, HIGH). The vulnerable plugin must be installed and active on the target WordPress site for any exploitation to be possible; sites not running it are unaffected. At the time of analysis there is no confirmed in-the-wild exploitation (not in CISA KEV) and no public exploit code identified, and no EPSS score was supplied, so the practical risk is governed mainly by the mandatory user interaction and the need for the specific plugin to be present and reachable.
Unauthenticated cross-site scripting in the Team Section Block WordPress plugin (bPlugins), affecting all versions up to and including 2.0.4, lets a remote attacker supply script-bearing content that executes in a victim's browser when the affected block/page is rendered. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); EPSS data was not provided. The CVSS score of 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects a network-reachable, unauthenticated bug whose practical severity is constrained by the mandatory victim interaction step - the payload only fires once a user (ideally a logged-in administrator) loads the injected content.
Unauthenticated cross-site scripting in the 10Web Photo Gallery plugin for WordPress affects every version up to and including 1.8.47, allowing any remote party to deliver script that executes in the browser of a site user who interacts with the attacker-controlled content. Rated CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), the flaw needs no authentication on the attacker's side, so the only real barriers are the mandatory victim interaction and the requirement that the target site run the vulnerable plugin version - impact scales with the privilege of the victim, and an administrator victim yields the highest payoff since the injected script would run with that user's session privileges. No public exploit code and no CISA KEV entry were identified at the time of analysis; the sole reference is the Patchstack advisory, which does not name the vulnerable parameter/input field or state whether a non-default plugin configuration is required.
Unauthenticated cross-site scripting in the Slider by 10Web WordPress plugin (slider-wd) affects all versions up to and including 1.2.63, allowing remote attackers to inject script that executes in a victim's browser session on the affected site. The CVSS 3.1 base score is 7.1 (High) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L - no privileges are required to originate the payload, but exploitation is not self-propagating: it depends on a human in the loop, since the victim must open an attacker-supplied request or crafted link (UI:R) for the script to run, and the vulnerable code path is only reachable while the plugin is installed and active. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and unauthenticated attack surface make prompt patching or deactivation advisable for sites running the plugin.
Unauthenticated cross-site scripting in the Food Menu - Restaurant Menu & Online Ordering for WooCommerce plugin (versions up to and including 6.0.5) lets attackers inject script that executes in the context of a victim's browser session on an affected WordPress/WooCommerce site. Affected deployments are any WordPress installation running the RadiusTheme plugin at version 6.0.5 or earlier; the attacker needs no credentials (CVSS PR:N) but the payload only fires when a victim loads attacker-influenced content (UI:R), so a privileged user such as an administrator is the highest-value target. There is no CISA KEV entry and no public exploit code identified in the supplied intelligence at time of analysis, and no EPSS score was provided; our independent assessment rates this as a genuine medium-tier issue rather than an emergency, with the vector (scope change S:C, low confidentiality/integrity/availability impact) internally consistent with a script-injection flaw. Patchstack is credited as the reporting source and hosts the reference advisory. Vendor-released patch: no fixed version identified in the available data.
Cross-site scripting in Tutor LMS 4.1.0 and earlier allows unauthenticated remote attackers to inject script into pages viewed by victims, but exploitation requires a victim to interact with attacker-supplied content. Successful attacks execute JavaScript in the victim’s browser context with low confidentiality, integrity, and availability impact, potentially enabling session theft or unauthorized actions on behalf of an administrator or instructor. The provided data identifies no public exploit code and no confirmed active exploitation; the Patchstack advisory is the primary reference.
Unauthenticated cross-site scripting in the FV Player 8 WordPress plugin versions 8.1.8 and earlier lets an attacker inject script that executes in a victim's browser when the victim clicks a crafted link or loads a page containing the payload. The plugin must be installed and active, and the victim must interact with the malicious input, while the attacker needs no authentication. No public exploit code has been identified at time of analysis, and the independent assessment considers this a genuine but moderate-priority issue rather than a critical emergency because impact is confined to the victim's browser context with low confidentiality and integrity impact.
Unauthenticated cross-site scripting in the WordPress plugin Social Share Icons & Social Share Buttons (versions <= 3.7.5) lets remote attackers inject script that executes in the browser of a site visitor or administrator who interacts with the crafted content, scoring CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Because the plugin is embedded on public-facing WordPress pages, any site running an affected version is exposed, and per the CVSS vector the attacker needs no credentials (PR:N) but must convince a victim to take an action such as clicking a crafted link (UI:R), with the scope change (S:C) meaning the injected script can affect resources beyond the vulnerable component. No public exploit code and no confirmed active exploitation were identified at time of analysis, and there is no vendor-released patch version documented in the available references, so sites should treat the plugin's 3.7.5 release line as vulnerable until a fixed version is published.
Unauthenticated cross-site scripting in the Jannah WordPress theme affects all versions up to and including 7.6.5, allowing remote attackers to inject script that executes in a victim's browser within the affected site's origin. Exploitation requires the victim to interact with attacker-controlled input (CVSS UI:R) and no attacker authentication is required (PR:N), but impact is confined to the client-side session rather than the server, so real-world severity depends heavily on whether the victim is a logged-in administrator or an anonymous visitor. No public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); the CVSS 7.1 score reflects the mandatory user interaction and limited confidentiality, integrity, and availability impact, with scope change (S:C) indicating the payload can affect resources beyond the vulnerable component's security realm.
Cross-site scripting in the Qode Real Estate WordPress plugin (all versions up to and including 1.1.7.3) lets unauthenticated attackers deliver crafted input that executes as script in a victim's browser session on the affected site. Exploitation requires no authentication but does require victim interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) - a victim must click a crafted link or load attacker-influenced content before the payload runs, so there is no silent server-side compromise. No public exploit identified at time of analysis and no CISA KEV listing; signals are mixed and lean toward moderate rather than urgent priority, and the exact injectable parameter is not detailed in the available description so the Patchstack advisory should be consulted for the precise entry point.
Qode Music WordPress plugin versions through 2.1.8.2 contain an unauthenticated cross-site scripting (XSS) vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) shows a remote attack with no attacker authentication, but success depends on luring a victim into interacting with a crafted request, so social engineering is required. No public exploit or active exploitation is identified at time of analysis, and the assessed risk is medium-tier rather than top priority.
Unauthenticated cross-site scripting in the Jotform - AI Chatbot WordPress plugin (versions up to and including 3.8.2) allows remote attackers to have attacker-supplied script execute in a victim's browser session within the context of the affected site, since the plugin renders unsanitized input without adequate output encoding. Exploitation requires a victim to interact with attacker-controlled content (UI:R) - for example following a crafted link to, or loading, a page on which the vulnerable plugin output is displayed - while the attacker needs no authentication or privileges on the target (PR:N), making user interaction the primary limiting factor. Rated medium-to-high severity (reported CVSS 7.1, CWE-79, scope-changing client-side impact); there is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was supplied with the source data.
Cross-site scripting (XSS) in the Additional Order Filters for WooCommerce plugin (versions 1.24 and earlier) allows unauthenticated attackers to inject malicious JavaScript into order-filter pages, which executes in the browser of a logged-in shop manager or administrator who interacts with the affected page (UI:R). The assessed impact is confined to the browser/session context (C:L/I:L/A:N), making this a moderate-priority issue rather than a top-tier emergency; no public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated cross-site scripting (XSS) in the WP File Download WordPress plugin (versions up to and including 6.3.6) allows remote attackers to inject malicious scripts into a victim's browser session, potentially leading to session hijacking, data theft, or site defacement, though meaningful impact requires luring a privileged user. The flaw requires user interaction (e.g., clicking a crafted link) and affects any WordPress site using this JoomUnited plugin; no public exploit code has been identified at time of analysis, and the CVSS score is 7.1 (moderate severity).
Reflected cross-site scripting in the Martfury - WooCommerce Marketplace WordPress theme (all versions through 3.3.9) allows unauthenticated remote attackers to have attacker-supplied script execute in the browser of a victim who opens a crafted link or request against a site running the theme. Because the flaw is reflected rather than stored, exploitation requires victim user interaction (CVSS UI:R) and cannot be triggered passively against the server, yet the scope change (S:C) means injected script can act beyond the vulnerable component with low confidentiality, integrity, and availability impact, giving a CVSS 3.1 base score of 7.1. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the vulnerable parameter or endpoint is not disclosed in the available data.
Cross-site scripting in the Educavo WordPress theme through version 3.4.2 lets unauthenticated attackers get malicious script executed in the browser of a victim who is induced to load attacker-influenced content, with the change-of-scope vector (CVSS 7.1) reflecting that the injected code runs in the context of the targeted site. Exploitation requires user interaction, so delivery is effectively targeted (a crafted link or payload aimed at a site visitor or administrator) rather than automated mass compromise, and no public exploit code was identified at time of analysis. This is a moderate-priority issue rather than a critical one, and its reach is further limited to sites that actually run this specific theme.
Reflected cross-site scripting in the ThemeREX Group "Kids Planet" WordPress theme (all versions through 2.2.14.2) lets a remote, unauthenticated attacker lure a victim to a crafted link that causes attacker-controlled script to execute in the victim's browser within the context of the affected site. Because the injected code inherits the browsing context of whoever clicks the link, a logged-in administrator is the highest-value target, where the flaw can enable session or content manipulation; the required user interaction (UI:R) is the key limiting factor and rules out unattended, automatable exploitation. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor score of 7.1 reflects moderate confidentiality, integrity, and availability weighting.
Unauthenticated reflected cross-site scripting in the Designthemes LMS WordPress theme versions 8.3 and earlier allows remote attackers to inject arbitrary script into a victim's browser session if the victim clicks a crafted link or loads an attacker-controlled request that reflects the payload; the flaw is rated CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and was reported by Patchstack. The affected theme must be installed and active on the target WordPress site, and exploitation requires user interaction (UI:R), so it is not exploitable without tricking a user; there is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis.
Reflected cross-site scripting (CWE-79) in the WordPress plugin ThemeStek Extras for LabtechCO Theme, affecting all versions through 8.4, allows an unauthenticated attacker to inject script that executes in a victim's browser when a crafted URL is visited. Exploitation is constrained because the payload is not stored: an attacker must lure a victim into clicking a malicious link (CVSS UI:R), and the target site must have this specific plugin installed and active. The flaw is rated CVSS 7.1 with scope change (S:C) and low confidentiality, integrity and availability impacts; no public exploit code has been identified at time of analysis.
Reflected cross-site scripting (XSS) in the WPAdverts WordPress plugin through version 2.3.4 allows unauthenticated attackers to inject malicious scripts via crafted URLs, which execute in a victim's browser when the link is clicked. The flaw requires user interaction (UI:R) and is non-persistent, making exploitation dependent on social engineering; no public exploit code is identified at time of analysis. Successful attacks can compromise the victim's session or perform actions on their behalf, with heightened risk if the victim is an administrator.
Stored cross-site scripting in the WPAdverts WordPress plugin (all versions through 2.3.4) lets an attacker place crafted script content into advert data that is later rendered without proper neutralization, so the payload executes in the browser of any user who views the affected advert page. The reported base score is 7.1 (moderate); our assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) requires a low-privileged, authenticated submitter plus victim interaction, and the divergence from the published PR:N vector means the true privilege requirement hinges on whether WPAdverts is configured to allow unauthenticated advert submissions. No public exploit was identified at time of analysis, and no patch version is specified in the available intelligence, so the exposure is real but not confirmed actively abused.
Stored cross-site scripting in the Forminator WordPress plugin (WPMU DEV) through version 1.57.3 lets an unauthenticated attacker submit crafted form input that is persisted and later rendered without output encoding, executing script in the browser of whoever views it - typically an administrator reviewing submissions in wp-admin. The injection itself requires no account (CVSS PR:N) but exploitation depends on a victim viewing the stored content (UI:R), and with a changed scope (S:C) the impact is limited to low confidentiality, integrity and availability rather than direct server compromise. No public exploit code has been identified at time of analysis, and the overall assessment rates this a moderate-priority issue rather than an urgent one, though EPSS and KEV signals are absent from the supplied data.
Reflected cross-site scripting in the Bracketweb Zeinet WordPress theme (all versions through 1.0.0) allows an unauthenticated remote attacker to inject script that executes in the browser of a victim who clicks a crafted link. Because attacker-supplied input is reflected into the generated page without neutralization (CWE-79, CVSS 7.1), the injected script runs in the origin of the affected site and can steal session cookies, perform actions as the victim, or operate with administrative privileges if the clicking victim is a logged-in admin. The flaw has not been confirmed as actively exploited (no CISA KEV listing) and no public exploit code has been identified at time of analysis; exploitation hinges on user interaction (CVSS UI:R), which is the primary limiting factor.
Authentication bypass in iFlytek AstronRPA through 1.1.6 allows unauthenticated, network-positioned attackers to reach the /api/resource/ and /api/rpa-ai-service/ API route families by presenting an arbitrary Bearer token, because the OpenResty gateway's auth_handler.lua accepts any value without validating it. Beyond simply getting past the gate, an attacker can spoof the X-User-Id or user_id header to impersonate any user of the platform, yielding low-level read and write access to those API routes. There is no public exploit identified at time of analysis, the issue is not confirmed actively exploited (no CISA KEV listing), and no vendor-released patch has been identified at time of analysis; the practical impact ceiling is the two affected route families on a gateway reachable by the attacker, not full system compromise.
AniWorld Downloader versions before 5.3.0 ship a WebUI whose /login POST handler permits unlimited, unthrottled password guessing and leaks which usernames exist, letting unauthenticated remote attackers enumerate accounts and brute-force credentials on any instance whose web interface is reachable. The exposure is a compound weakness rather than a single primitive: verify_user in the web database layer only performed a password hash comparison when a matching user row existed, so the differing response time distinguished valid from invalid usernames, while the absence of any per-IP or per-account failure cap allowed unlimited attempts against the confirmed names. This is a genuine but moderate-severity weakness, not a critical priority - exploitation still requires the WebUI to be network-exposed (a local-only or firewalled deployment is not reachable) and successful takeover still depends on a guessable or weak password, so strong unique credentials blunt the attack. No confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis; the underlying issue and its fix are documented in the upstream issue tracker and a public technical write-up, and the vendor patched the flaw in v5.3.0.
Missing authorization in VillaTheme GIFT4U (gift4u-gift-cards-all-in-one-for-woo) versions 1.1.3 and earlier allows unauthenticated remote attackers to tamper with limited gift-card-related data on WordPress/WooCommerce sites where the plugin is active. The flaw (CWE-862) stems from the plugin failing to enforce an access-control check on a restricted function, and per the CVSS vector (PR:N/UI:N) no authentication or user interaction is required. No public exploit code or active exploitation has been identified at time of analysis, and the impact is limited to integrity (VI:L) with no confidentiality or availability impact, resulting in a medium-severity rating.
Server-side request forgery in PDFMathTranslate (pdf2zh) through 1.9.11 lets unauthenticated remote attackers force the server to fetch arbitrary URLs supplied through the Gradio web GUI's Link (translate-from-URL) input, reaching internal services and cloud metadata endpoints with the fetched content returned inside the generated PDF. The flaw exists because the translate_file handler forwards user-controlled URLs to download_with_limit without validating the URL scheme or destination address, and the CVSS vector confirms no privileges (PR:N) and no user interaction (UI:N) are needed. Exploitation is gated primarily by exposure: the Gradio interface must be network-reachable and able to route to internal or link-local addresses, and impact is confined to information disclosure (VC:L, no integrity or availability effect) - there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis.
Pingvin Share X before 1.22.0 ships with an ineffective authentication rate limiter, because throttler TTL values written in seconds are interpreted by NestJS as milliseconds - collapsing intended 60-second and 5-minute windows into roughly 60 ms and 5 ms. This allows unauthenticated remote attackers to send effectively unthrottled requests to /api/auth/signIn, /api/auth/signIn/totp and /api/auth/resetPassword, enabling brute-force attempts against user passwords and 6-digit TOTP codes; no public exploit code has been identified at time of analysis and there is no KEV entry, and the flaw is assessed as a moderate authentication-hardening failure rather than a direct code-execution or data-leak issue. Because the weakness only removes rate limiting, successful compromise still depends on guessing a valid password or a valid TOTP value within its short validity window, so strong unique passwords and the limited TOTP lifetime materially reduce real-world risk.
Heap buffer overflow in Apache DataSketches C++ (versions 1.0.0-incubating through 5.2.0) allows an unauthenticated remote attacker who can supply a crafted HLL sketch for deserialization to write up to 988 bytes past a fixed 8-entry internal heap buffer, corrupting memory, crashing the process, and potentially enabling further exploitation. The vulnerable code is a library routine with no network listener of its own, so real-world exposure hinges on whether the consuming application deserializes sketch images from untrusted byte buffers or streams; services that only process trusted or internally generated sketches are not realistically exposed despite the AV:N vector. No public exploit code has been identified at time of analysis, and EPSS is low at 0.21% (11th percentile), while the assessed CVSS 3.1 base of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the worst case for applications that do accept untrusted sketches, meaning the high score and low observed exploitation signal must be weighed together.
Out-of-bounds read and write in the CPC sketch deserialization path of Apache DataSketches C++ (datasketches-cpp) - specifically cpc_sketch::deserialize() called on a byte buffer or a stream - allows a crafted serialized sketch to corrupt heap memory: the decompressor reads past the end of the compressed data because the read position was only checked after decoding finished, and in the hybrid flavor it writes outside an internal heap buffer because decoded row indices were not validated, crashing the process with potential for further exploitation. All releases from 2.0.0-incubating before 5.3.0 are affected, and the CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating remote, unauthenticated impact, but reachability is conditional: only applications that deserialize CPC sketches from untrusted sources are exposed, since the flaw lives in a C++ library whose attack surface depends on the embedding application. Exploitation signals are mixed and should be weighed carefully - EPSS is only 0.19% (8th percentile), there is no CISA KEV entry, and no public exploit identified at time of analysis.
A rate-limiting bypass in Pingvin Share X before 1.22.0 lets unauthenticated remote attackers defeat per-IP throttling on the sign-in, TOTP, and password-reset endpoints by rotating spoofed X-Forwarded-For headers. Because backend/src/main.ts calls app.set('trust proxy', true) unconditionally, any client-supplied forwarding header is believed, so attackers can brute-force passwords or TOTP codes at unrestricted speed and poison IP-based logging with forged client addresses. Exploitation requires only network reachability of the auth API and the ability to send arbitrary headers - no special configuration - though real account compromise still depends on weak credentials or low-entropy codes. No public exploit code or confirmed active exploitation was identified at time of analysis, and vendor-patched version 1.22.0 is available (CWE-348, CVSS 4.0 base 6.9 / assessed CVSS 3.1 6.5).
Unbounded memory allocation in the ericmj/decimal Elixir library lets an attacker who controls the 'places' argument of Decimal.round/2 or Decimal.round/3 exhaust host memory and get the BEAM VM killed; all releases from 0.1.0 up to (but not including) 3.1.2 are affected. The function materialises the entire rounded result before the 34-digit default context precision is applied, so a single call such as Decimal.round(Decimal.new("1.5"), -50_000_000) allocates roughly 5.5 GB, while the oldest releases instead spin one loop iteration per decimal place and burn CPU in proportion to the argument. The official CVSS 4.0 base score is 6.9 (availability-only, VC:N/VI:N/VA:H), our independent assessment rates it CVSS 3.1 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, and no public exploit code or confirmed active exploitation was identified at time of analysis. Exposure is conditional: the vulnerability is only reachable when a consuming application forwards an unbounded, user-supplied scale or decimal-place count into round/2 or round/3 - the input limits previously added for CVE-2026-32686 explicitly do not cover the places argument.
Arbitrary file deletion in the WordPress plugin Presto Player Pro (versions 3.0.1 and earlier) lets an authenticated account with at least Author-level privileges supply a traversal path to a plugin file-handling function and delete files outside the intended scope, including files elsewhere in the WordPress installation. Patchstack scores it CVSS 6.8 with high availability impact and no confidentiality or integrity impact, and no publicly available exploit code or active exploitation was identified at time of analysis. The realistic exposure is gated by the privilege requirement: sites that do not host untrusted Author accounts or allow open author-tier self-registration are substantially less exposed.
Privilege escalation in the Bookly WordPress plugin (versions up to and including 28.4) allows authenticated attackers with subscriber-level access to overwrite the WordPress user binding of any Bookly staff record, including those owned by administrators, by manipulating the 'id' and 'wp_user_id' parameters in the staff-edit AJAX endpoint. Exploitation requires the attacker to have a subscriber account and to be linked to at least one Bookly staff record, a condition present by default on fresh installs where the bookly_gen_allow_staff_edit_profile option is enabled. No public exploit code has been identified and CISA KEV does not list this vulnerability; the assessed CVSS is 6.8 with high attack complexity (AC:H) due to the prerequisite of a staff-linked subscriber account.
Stored cross-site scripting in the Gallery PhotoBlocks WordPress plugin before 1.3.6 allows authenticated users with Contributor-level access or higher to save JavaScript into one of the plugin's gallery settings, which is then written into an HTML attribute without sanitization or escaping, so the payload executes in the browser of any user - including an administrator - who views a page containing the gallery. Exploitation is not self-triggering: an attacker needs at least a Contributor account plus a victim who loads the affected page (UI:R), and sites that do not grant untrusted users posting roles are largely unaffected. No public exploit code has been identified at time of analysis and no EPSS score was supplied in the available intelligence; the vendor has released a fix, and our independent reassessment rates the issue MEDIUM (CVSS 3.1 base reflecting PR:L, S:C, C:L/I:L/A:N), which is lower in privilege prerequisite but broader in scope than NVD's published 6.8 vector.
Local unprivileged users on a host running GenOffice's HTTP MCP server can read other users' uploaded documents and AI-converted outputs, because every version through 0.11.505 stages those files in a genoffice-mcp-http directory under the system temporary directory with world-readable permissions. The HTTP bearer token is irrelevant to the attack: an attacker simply lists and opens the temp-directory contents at the filesystem layer, so the bearer token that normally guards the MCP HTTP endpoint provides no protection at all. The issue is strictly local (CVSS 4.0 score 6.8, AV:L/PR:L with high confidentiality impact and no integrity or availability impact), read-only, and bounded to files currently staged in the temp directory; no public exploit code or active exploitation has been identified at time of analysis, and single-user hosts with no other local accounts are effectively not exploitable.
Authenticated directory traversal in the SiteOrigin Widgets Bundle WordPress plugin (all versions up to and including 1.74.3) allows contributor-level users and above to read arbitrary files on the server through the get_instance_css function, exposing sensitive data such as wp-config.php secrets. Exploitation requires only a low-privilege contributor account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), needs no user interaction, and is limited to read-only information disclosure with no direct write or code-execution impact; there is no public exploit identified at time of analysis and the issue is not confirmed actively exploited. Overall this is a credible but moderate-priority issue rather than a top-tier emergency, with risk concentrated on sites that grant contributor access broadly.