Unauthenticated remote code execution in the Anton Extensions WordPress plugin (versions ≤1.2.2) allows attackers to upload arbitrary PHP files to attacker-chosen paths, because the plugin omits capability checks, nonce verification, and file-type validation in its file upload handler. Publicly available exploit code exists according to WPScan, and exploitation requires only that the plugin be installed and active on a reachable WordPress site. The CVSS score of 9.8 reflects critical severity with no authentication required.
Unauthenticated attackers can update and delete arbitrary WordPress options through the AI Content Generator Marketing plugin (versions through 1.0.0), a capability that typically enables full site takeover by, for example, flipping the default new-user role to administrator and enabling open registration. The plugin's AJAX handlers perform neither a nonce check nor a capability check, and because the CVSS vector is AV:N/AC:L/PR:N/UI:N with C/I/A all High, no authentication, user interaction, or non-default configuration is required - only that the plugin be installed and active and its endpoints reachable. Publicly available exploit code exists (ratings from WPScan), making opportunistic mass scanning realistic; there is no CISA KEV confirmation of active exploitation and no EPSS score was supplied, so this should be treated as high-severity, readily exploitable, but not yet confirmed as exploited in the wild. All available signals point to genuinely high risk.
Authentication bypass in the Freeton WP WordPress plugin through version 1.0.0 lets unauthenticated attackers log in as any existing user, including administrators, using only that user's email address, because the plugin does not correctly validate the activation code used during authentication. The flaw is rated 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-287) and requires no credentials and no user interaction; publicly available exploit code exists (referenced from the WPScan entry), and no CISA KEV listing indicates confirmed active exploitation. Exposure is limited to WordPress sites where the plugin is installed and active - an important qualifier given the plugin's small footprint - but for those sites the practical barrier is only knowledge of a valid account email, which is commonly obtainable through WordPress author enumeration.
Authentication bypass in the Mindstien Quick Login WordPress plugin through version 1.0 allows unauthenticated remote attackers to obtain an administrator session on any affected site where the plugin is active and configured with an administrator account. The flaw (CWE-287) stems from the plugin failing to validate a request-supplied value against the visitor's own session before authenticating them, yielding a CVSS 3.1 base score of 9.8. Publicly available exploit code exists, and while the vulnerability is not confirmed as actively exploited (CISA KEV), the low attack complexity and lack of required authentication make immediate remediation critical.
Unauthenticated option manipulation in the click5 CRM add-on to Contact Form 7 (versions through 1.0.4) lets remote attackers rewrite arbitrary WordPress options without authorization, a nonce, or any user interaction, which is sufficient to enable user registration and create a new administrator account for full site takeover. The flaw carries a 9.8 CVSS score (AV:N/AC:L/PR:N/UI:N), and publicly available exploit code exists, making this a realistic and high-priority target for mass scanning against any WordPress site that has this specific add-on installed and active; Contact Form 7 alone, or WordPress without the add-on, is not affected. No CISA KEV entry was provided, so active exploitation is not independently confirmed, but the combination of unauthenticated reachability, trivial preconditions, and published exploit code warrants urgent triage and removal or blocking of the vulnerable endpoint.
Unauthenticated option manipulation in the click5 CRM add-on to Gravity Forms (versions up to and including 1.0.3) lets any remote attacker rewrite arbitrary WordPress blog options and escalate to complete site takeover by enabling open registration with an administrator default role, thereby creating a new admin account. The flaw is a missing authorization/CSRF class issue exposed through a REST endpoint that neither checks the caller's capabilities nor verifies that the targeted option belongs to the add-on, so no credentials, nonce token, or user interaction are required against a default configuration. Publicly available exploit code exists, and the only real prerequisite is that the affected add-on be installed and active on a reachable WordPress site; no CISA KEV entry was present in the supplied intelligence, so active exploitation is not confirmed.
Unauthenticated attackers can take over any WordPress site running the click5 CRM add-on for WPForms (versions through 1.0.3) by abusing a REST endpoint that updates blog options without authorization, CSRF validation, or any check that the targeted option belongs to the add-on. Because the endpoint accepts arbitrary option names, an attacker can set registration-related options and a default administrator role to create a new admin account, or otherwise alter site configuration, leading to full site compromise. The flaw carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), publicly available exploit code exists, and exploitation requires only that this niche add-on be installed and active.
Unauthenticated option overwrite in the click5 CRM add-on to Ninja Forms allows any remote attacker to write arbitrary WordPress blog options on sites running the add-on at version 1.0.1 or earlier, a primitive that can be chained into creating a rogue administrator account and complete site takeover. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact (9.8), so the CVSS vector confirms no authentication and no user interaction are required against default configurations that simply have the add-on active. Publicly available exploit code exists, tracked by WPScan and mirrored in ENISA EUVD as EUVD-2026-96753, while there is no confirmed actively exploited (CISA KEV) status at time of analysis; exposure is bounded by the add-on's niche deployment rather than by any authentication or non-default configuration requirement.
Unauthenticated attackers can reach every Wukong_HRM API endpoint and operate with HR administrator privileges, because the platform's ParamAspect authorization component treats an absent AUTH-TOKEN header as an implicit pass instead of a denial. Exploitation requires nothing more than network reachability to the HRM API on a build at or before commit 186115e - no credentials, token, configuration change, or user interaction - and it exposes payslips, salary history, and employee personal data, permits attachment downloads, and allows modification or deletion of company-wide HR records. Publicly available exploit code exists (multiple proof-of-concept scripts published alongside the VulnCheck advisory), the CVSS 4.0 base score is 9.3, and no confirmed active exploitation (CISA KEV) has been reported; the risk is nevertheless genuine rather than CVSS-inflated, since the bypass is triggered by simply omitting a request header.
Databasement instances before 1.8.2 allow an authenticated user to achieve remote code execution by injecting path-redirecting client options (such as mariadb-dump --result-file, -r, --tab, pg_dump --file, mongodump --out, or redis-cli --rdb/--eval) into the arguments passed to the backup dump binary. Shell quoting prevents classic OS command injection, but argument injection alone is sufficient: by directing the dump output to a web-served, PHP-executing path such as /app/public/index.php, the attacker writes code that the web server later executes. Authentication is required (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), publicly available exploit code exists, and success depends on the chosen output path being both web-accessible and interpretable as code; no evidence of confirmed active exploitation was provided.
Unauthenticated remote attackers can delete arbitrary WordPress options in sites running the Insurify WordPress plugin through version 1.0, due to missing authorization and nonce checks on an AJAX action, potentially taking the site offline and stripping every user of their role. Publicly available exploit code exists, and the vulnerability is remotely exploitable with no authentication required (CVSS 9.1). Any site with the vulnerable plugin active is at risk.
Unauthenticated remote attackers can rewrite arbitrary WordPress site settings through an AJAX action exposed by the Quick Quotes plugin through version 1.0.0, which performs no capability or nonce validation on the request. Successful abuse allows an attacker to change site-wide options - including those that can render the site unreachable - with no authentication, no user interaction, and no non-default configuration required, yielding an assessed CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H). Publicly available exploit code exists per the WPScan disclosure, though the plugin's obscure deployment footprint limits the broader blast radius; there is no indication of confirmed active exploitation (not in CISA KEV) and no vendor-released patch was identified at time of analysis.
Unauthenticated remote attackers can overwrite arbitrary WordPress options on any site running the Insurify plugin through version 1.0, because one of the plugin's AJAX actions performs neither a capability (authorization) check nor a nonce/CSRF check - a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) reflects high integrity and availability impact with no privileges or user interaction required. Exploitation can rewrite site-critical options, take the site offline, and deactivate the plugin itself, and publicly available exploit code exists (per the WPScan report and its exploit-tagged reference); there is no indication of confirmed active exploitation (not listed in CISA KEV). The practical constraint is the plugin's limited deployment footprint, not any technical barrier.
Unauthenticated remote attackers can seize control of the payment configuration on WordPress stores running the Fundiin cho WooCommerce plugin through 3.4.0, because several of its REST API routes enforce authorization only through a credential that is hardcoded identically in every installation. Exploiting this yields disclosure of the store's payment gateway credentials and customer order data, allows the gateway configuration to be rewritten so that payments are credited to an attacker-controlled destination, and permits unpaid orders to be marked as paid; the same missing authorization additionally allows script to be stored and rendered unescaped on the classic WooCommerce checkout, producing unauthenticated stored XSS. CVSS 3.1 scores this 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and publicly available exploit code exists per the WPScan report, while no CISA KEV entry was present in the supplied intelligence.
OS command injection in the open-source OpenSpug Spug operations platform (affected versions through 3.4.0 and 4.0.1) allows an authenticated, low-privileged remote user to execute arbitrary operating-system commands on the host by sending crafted input to the /exec/transfer endpoint of the File Transfer component. Exploitation is low-complexity and requires no user interaction, but it does require a valid session against the Spug web interface (CVSS PR:L), so exposure is limited to attackers who already hold a low-privileged account rather than anonymous internet users. Publicly available exploit code exists (published rating E:P) and there is no CISA KEV entry indicating confirmed active exploitation, while the vendor was contacted and did not respond, leaving no vendor-released patch identified at time of analysis.
Unauthenticated attackers can plant persistent JavaScript that executes in the browser of every visitor to a WordPress site running the Adwised Web Push Notification plugin through version 2.5.7, because several state-changing plugin operations lack authorization checks and the plugin's secret-comparison routine can be defeated on installations where a secret key was never configured. Publicly available exploit code exists (WPScan published a proof-of-concept write-up), though there is no KEV confirmation of active exploitation. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) shows a network-reachable, unauthenticated attack that requires a victim visitor to load an affected page, so real-world impact is bounded by the unconfigured-secret precondition, and hardened installs that have set a secret are not affected.
Stored cross-site scripting in the WordPress plugin Web Vitals Tracking (versions through 5.4.2) allows unauthenticated visitors to inject arbitrary script content by submitting unvalidated, unescaped performance measurements that the plugin persists and later renders inside a script context on an administrative reporting page. The attack is remote and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R), but the payload only executes when a logged-in administrator loads the affected admin page, so exploitation depends on administrator activity rather than firing automatically; publicly available exploit code exists and the issue is tracked by WPScan as well as EUVD-2026-96769. Our independent assessment rates the impact more conservatively than the vendor/NVD score (scope-changed XSS with low confidentiality and integrity impact and no availability impact), so this should be treated as a credible, medium-to-high priority issue rather than a top-tier emergency.
Unauthenticated stored cross-site scripting in the HootBoard WordPress plugin (all versions through 3.1.4) lets any remote attacker inject arbitrary JavaScript through the plugin's REST endpoints, which lack authorization checks and store values without escaping before rendering them on a public page. The injected script executes in the browser of any visitor to that page - most dangerously a logged-in administrator, which is the path to full site compromise - but it requires the victim to view the poisoned page, so the impact is client-side and conditional rather than direct server takeover. Publicly available exploit code exists (the WPScan disclosure entry doubles as an exploit reference) and no vendor patch has been confirmed; our independent vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) rates this below the 8.8 vendor score, reflecting the interaction requirement and the typically low-severity confidentiality/integrity effect on the victim's browser session alone. No EPSS or CISA KEV data is present in the feed, so this should be treated as an actionable priority rather than a confirmed active exploitation event.
Stored cross-site scripting in the WordPress plugin KeyWord Collector through version 1.4 allows an unauthenticated remote attacker to POST arbitrary values directly to the plugin's settings-save routine, which enforces neither a capability/authorization check nor a nonce (CSRF) check, and the stored values are then rendered without output escaping. The injected JavaScript executes when a logged-in administrator later opens the plugin settings page, or when any site visitor loads a front-end page that displays the plugin's output; publicly available exploit code exists for this issue. Our independent assessment scores the flaw 6.1 under CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, which is more conservative than the 8.8 figure circulated elsewhere: exploitation is unauthenticated and requires no non-default configuration, but it is constrained by user interaction (UI:R) and the demonstrated consequence is script execution in a victim's browser session rather than direct server-side compromise.
WordPress sites running the Topcontent plugin through version 1.2.1 are exposed to stored cross-site scripting when the plugin's API key has never been configured, because an unauthenticated request handler lacks authorization and stores submitted content as posts without HTML sanitization. Publicly available exploit code exists, and a victim must load the malicious post for the injected JavaScript to execute. The issue is rated 8.8 by the input CVSS but the independent assessment assigns a more limited impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting that exploitation requires an unconfigured API key and user interaction; it is not confirmed as actively exploited in CISA KEV.
Stored cross-site scripting in the BuddyPress Instant Chat WordPress plugin (versions through 1.6) lets remote, unauthenticated users inject persistent JavaScript into a chat conversation they do not belong to, because the plugin neither verifies that the message sender is a participant in the target conversation nor escapes message content when rendering it. The injected script stays dormant until a legitimate member - potentially an administrator or other privileged user - loads and views that conversation, which is why exploitation requires user interaction rather than being fully automatic. WPScan has published a proof-of-concept advisory, so publicly available exploit code exists, and although the vendor/NVD score is 8.8, the realistic impact is more contained: script execution within a member's authenticated WordPress session in the context of the affected site, with no direct server-side compromise shown.
The Disable Users WordPress plugin (versions through 1.0.5) fails to apply its account-disabling control consistently across all authentication paths, so an attacker who holds the credentials of an account an administrator has disabled can still log in and operate with that account's original privileges. Exploitation requires pre-existing valid credentials for a previously disabled account (CVSS PR:L, base score 8.8), and the regained access is bounded by the role that account held - but where the disabled user was an administrator, the result is full site compromise (C:H/I:H/A:H). Publicly available exploit code exists per the WPScan disclosure; there is no indication of confirmed active exploitation (no CISA KEV entry in the provided data).
Unauthenticated file-upload handling in the Piotnet Forms WordPress plugin through 1.0.30 lets an attacker store a browser-renderable file (HTML, SVG or similar) inside the site's own origin, so that opening the file executes arbitrary JavaScript - a stored XSS condition. The storage step requires no account and no special configuration, only a publicly reachable form that exposes an upload field; execution is not self-triggering and depends on a victim, typically an administrator reviewing a submission or any user following the file's direct URL, opening the payload (UI:R), with the highest impact when that opener holds an authenticated admin session in the same origin. Publicly available exploit code exists per the WPScan disclosure, and while the vendor-classified score is 8.8, our independent assessment scores the realistic vector lower (S:C, C:L/I:L) because the write and the execution are separated by user interaction and the observable impact depends on who opens the file.
Stored cross-site scripting in the click5 CRM add-on for Contact Form 7 (all versions up to and including 1.0.4) lets unauthenticated attackers submit crafted content through the plugin's submission endpoint, which is stored and later rendered into an administrative page without sanitisation or escaping, so the injected script executes in the browser of a high-privilege user such as an administrator. Publicly available exploit code exists, and the add-on must be installed and active for exposure, but the attack is not autonomous: it succeeds only when a logged-in privileged user subsequently opens the poisoned admin screen. No confirmed active exploitation (CISA KEV) has been reported, and an independent reassessment rates the realistic severity considerably lower than the headline CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), with the required admin interaction as the primary limiting factor.
Stored cross-site scripting in the click5 CRM add-on to Gravity Forms (all versions through 1.0.3) lets an unauthenticated attacker plant script into CRM content submitted through the plugin's public, unauthenticated content-submission endpoint; the input is neither sanitised on entry nor escaped on output, so the payload executes when a high-privilege user - typically an administrator - later opens the admin page that renders the stored CRM data. Publicly available exploit code exists (WPScan published a proof-of-concept reference), but there is no CISA KEV entry or other confirmation of active exploitation. Although the bundled score of 8.8 implies severe impact, our independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, because exploitation is conditional: the plugin must be installed with its submission endpoint reachable, and an administrator must subsequently review the poisoned entry before the script fires.
Stored cross-site scripting (XSS) in the click5 CRM add-on to the WordPress plugin WPForms through version 1.0.3 lets an unauthenticated attacker plant a persistent script payload through the add-on's public submission endpoint; the payload is later rendered without sanitisation or escaping on an administrative page, so it executes in the browser session of a high-privilege user such as an administrator who views that page - a UI:R condition that gates actual code execution. Publicly available exploit code exists (WPScan published the vulnerability entry), but there is no confirmed active exploitation (no CISA KEV listing) and no EPSS figure was supplied; the risk is further bounded by the add-on's niche deployment and by the fact that the script runs in an admin browser rather than on the server. Our independent assessment rates this lower than the input's 8.8 (High), using a scope-changed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), which keeps the exploit prerequisites - installed and active add-on, unauthenticated submission, and administrator interaction - central to any real-world prioritisation.
Stored cross-site scripting in the click5 CRM add-on for Ninja Forms (all versions through 1.0.1) allows an unauthenticated attacker to submit crafted content through the add-on's public form endpoint and have it persisted without sanitisation, so the payload executes in the browser of any high-privilege user - typically an administrator - who later opens the admin page that renders those submissions. Exploitation requires no credentials to plant the payload (CVSS vector PR:N), but it does require user interaction (UI:R), meaning an administrator must actually view the poisoned submission for the script to fire; publicly available exploit code exists and the bug was reported by WPScan, though there is no confirmed active exploitation (CISA KEV) at time of analysis. Scored 8.8 under the NVD/A:H/C:H/I:H vector, but our independent assessment rebases it to CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (scope change, limited confidentiality and integrity, no availability impact), making this a moderate rather than top-tier priority that is bounded by whether admins routinely review unfiltered submission data.
Privilege escalation in the Mobile Builder WordPress plugin (versions through 1.4.2) allows any authenticated low-privilege user - including a self-registered customer account - to grant themselves the administrator role by writing unrestricted user meta keys through one of the plugin's REST routes. The flaw requires only a valid low-privilege account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) and no administrator interaction, and publicly available exploit code exists according to WPScan. Sites with open user self-registration enabled are the easiest to attack, but any existing low-privilege user can still exploit the vulnerable route; CISA's SSVC rates technical impact as total while noting no observed exploitation and no known automatable exploitation at this time.
Stored cross-site scripting in the Prenotazioni WordPress plugin (all versions up to and including 1.7.5) lets an unauthenticated attacker write arbitrary JavaScript into plugin settings that are saved without any capability or CSRF check and then rendered without output escaping. The payload persists in the site database and executes in the browser of any administrator opening the affected settings screen or any visitor viewing the affected front-end rendering, so impact is scoped to the privileges of the victim's own session rather than to the server itself. A public proof-of-concept/write-up is available (WPScan), while SSVC records exploitation status as 'none' and non-automatable; no EPSS score was supplied. Note the discrepancy between the researcher-assigned 8.8 (S:U/C:H/I:H/A:H) and our independent assessment (S:C/C:L/I:L/A:N), which treats confidentiality and integrity impact as limited because execution requires a page view (UI:R) and only affects the victim's browser session.
Stored cross-site scripting in the SmugMug Embed WordPress plugin through 3.13 allows unauthenticated remote users to store arbitrary gallery data via an AJAX action that lacks authorization and CSRF checks, with the payload executing when a logged-in administrator views the plugin's settings screen. Publicly available exploit code exists, but the independent assessment keeps impact limited: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, requiring administrator interaction and yielding low confidentiality and integrity impact. There is no CISA KEV confirmation in the provided data, so this should be treated as exploitable via public PoC rather than confirmed actively exploited.
Missing authorization in Wukong HRM (all versions through commit 186115e) lets any authenticated employee, including the lowest-privileged role, read company-wide payslips, salary records, bank card details and personal data, edit bank cards, and delete employees, departments and contracts. The defect is structural: the HR administrator role is unconditionally assigned to every caller and data-scope checks return the entire employee set instead of the caller's permitted scope, so both horizontal and vertical privilege boundaries collapse for any valid session. Publicly available exploit code exists - two PoC scripts targeting salary archive history and payroll card/Social Security data - so anyone with valid low-privilege employee credentials and network reach to the HRM web application can exploit this reliably; no KEV listing or confirmed active exploitation is present in the available data.
Unauthenticated SQL injection in the ASPL Product Quotation WordPress plugin through version 1.1.0 allows remote attackers to read arbitrary data from the site's database without credentials or user interaction. Publicly available exploit code exists (reported via the WPScan vulnerability entry), but the flaw is not flagged as confirmed actively exploited (CISA KEV). Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 8.6), impact is confidentiality-only - injected queries can disclose data but do not modify it or affect site availability.
Unauthenticated SQL injection in the Tcard WP WordPress plugin (all versions through 1.8.0) allows remote attackers to inject arbitrary SQL through one of the plugin's AJAX actions, exposing data from the underlying WordPress database. Exploitation requires no authentication, no user interaction, and no non-default configuration - only that the plugin be installed and active - and publicly available exploit code exists, though there is no confirmed actively exploited (CISA KEV) signal. The assessed impact is read-oriented (high confidentiality, no integrity or availability impact), so the practical risk is sensitive-data disclosure rather than site takeover, with real-world exposure bounded by how widely this low-footprint plugin is deployed.
Unauthenticated SQL injection in the Mobile builder WordPress plugin (all versions through 1.4.2) lets any remote attacker inject arbitrary SQL into the site's backend database and read data the application can access. The assessed vector (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms no authentication, no user interaction and no special configuration are required, with the sole precondition being that this non-default plugin is installed and active, and impact is confined to confidentiality. Publicly available exploit code exists (published via the WPScan vulnerability entry), and while this is not confirmed actively exploited (CISA KEV), the unauthenticated reachability and low skill barrier make it a genuine priority for any site running the plugin.
Unauthenticated SQL injection in the WordPress plugin Post Voting System 1.0 and earlier allows remote attackers to inject arbitrary SQL through a request parameter that is passed into a database query without sanitization or escaping, exposing the contents of the site's WordPress database. Every installation with the plugin active is potentially reachable, because exploitation requires no authentication, no user interaction, and no non-default configuration - publicly available exploit code exists, and WPScan has published the vulnerability, so mass scanning is plausible. The practical risk is bounded by deployment: the plugin is niche, and the impact is confined to confidentiality (database read), since the assessed vector is S:U with C:H and no integrity or availability effect; no fixed version is confirmed at the time of analysis, so removal or virtual patching is the current mitigation.
Unauthenticated SQL injection in the WP Verify API WordPress plugin through version 1.0.0 lets remote attackers supply malicious input to a parameter used directly in a SQL query, allowing extraction of database contents. Publicly available exploit code exists, while no EPSS score or CISA KEV entry was provided; the input CVSS is 8.6 (network, low complexity, no privileges or user interaction), and the independent assessment keeps scope unchanged and rates confidentiality impact high with no integrity or availability impact. The practical prerequisite is that a target WordPress site has this specific plugin installed and the vulnerable endpoint reachable.
Unauthenticated SQL injection in the Loja Automática WordPress plugin (versions through 1.0.0) allows remote attackers to read data from a site's backend database by supplying crafted input to a parameter that is not sanitized or escaped before being placed in a SQL query, resulting in a high confidentiality impact per the assessed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 8.6 as published). No authentication, privileges, or user interaction are required, and publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been reported; realistic exposure is limited almost entirely by how rarely this obscure plugin is installed and active. WPScan reported the issue, which is tracked as EUVD-2026-96788.
Unauthenticated SQL injection in the Datalist it WordPress plugin through version 0.0.3 allows anonymous attackers to execute arbitrary database queries and read sensitive data from the underlying WordPress database. Publicly available exploit code exists, and the provided CVSS score is high, though the independent assessment scopes confirmed impact to unauthorized database reads under unchanged scope; real-world exposure is likely limited by the plugin's apparent small install base and requires only that the plugin be active and reachable on a WordPress site.
Unauthenticated SQL injection in the WpCues Basic Quiz WordPress plugin through version 1.6.5 allows remote attackers to read arbitrary data from the site's database. Publicly available exploit code exists, but no confirmed active exploitation (CISA KEV) is reported. The independent assessment rates confidentiality impact as High with no integrity or availability impact and scope unchanged, so the practical risk is data disclosure for sites running the vulnerable plugin.
Unauthenticated SQL injection in the Llavero.io WordPress plugin (versions through 0.1.4) allows remote attackers to inject arbitrary SQL through an unsanitized parameter and read data from the site's WordPress database. Exploitation requires no authentication and no user interaction (CVSS PR:N/UI:N), and publicly available exploit code exists via the WPScan disclosure, though CISA KEV does not list this as confirmed actively exploited. Based on the independent assessment, impact is confined to confidentiality (read-only data disclosure, C:H/I:N/A:N), and the practical exposure is limited by the plugin's niche, early-version footprint.
Unauthenticated SQL injection in the Site Setup Wizard WordPress plugin through 1.5.8 allows any remote attacker who can reach a site running the plugin to inject arbitrary SQL through an improperly sanitised parameter and read data from the site's database, including potentially password hashes, user records and stored configuration secrets. Exploitation requires no authentication, no user interaction and no special configuration - only that the plugin be installed and active at version 1.5.8 or earlier - and publicly available exploit code exists. The flaw is read-only in effect (Confidentiality High, Integrity None, Availability None per our assessed vector), so it does not by itself permit data modification or full site takeover, and there is no indication of confirmed active exploitation (CISA KEV).
Unauthenticated SQL injection in the Social Web Suite WordPress plugin through 4.1.12 lets remote attackers read arbitrary data from the site's database, because the plugin accepts requests supposedly authorized by its shared secret before ever requiring that secret to be configured, and then passes an unsanitized parameter directly into an SQL statement. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that no authentication, privileges, or user interaction are needed: any internet-facing WordPress installation running a vulnerable version in the unconfigured state is directly exploitable. Publicly available exploit code exists, and while the primary limiting factor is the deployment footprint of this specific plugin (and the unset-secret prerequisite), the high confidentiality impact makes this a credible, actionable priority rather than a theoretical high-CVSS issue.
Unauthenticated SQL injection in the WP-Partner WordPress plugin (all versions through 1.2.1) allows remote attackers to append arbitrary SQL to an existing query and exfiltrate data from the underlying WordPress database, including user credentials, hashes, and other sensitive site content. The flaw carries a CVSS v3.1 base score of 8.6 (the independent assessment re-scores it as AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, i.e. high confidentiality impact with no direct integrity or availability effect), requires no authentication or user interaction, and publicly available exploit code exists - though there is no confirmation of active exploitation (no CISA KEV listing). Risk is concentrated on sites that actually run this specific, low-footprint plugin; any such site exposing the vulnerable endpoint over HTTP(S) is directly exploitable with default configuration.
Unauthenticated SQL injection in the Recordbrowser WordPress plugin (all versions through 1.1.7) allows remote attackers to append arbitrary SQL to plugin-issued database queries and read sensitive data from the underlying WordPress database. The vulnerable endpoint requires no authentication, no privileges and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), so any reachable site with the plugin installed and active is exposed; publicly available exploit code exists, and the flaw is not currently listed in CISA KEV, so confirmed active exploitation has not been established. The practical risk is limited mainly by deployment footprint - the plugin must be present and its vulnerable parameter reachable - but for sites that do run it, this is a genuine priority.
Unauthenticated attackers can reset, overwrite, or replace the post password of every published post on any WordPress site running the WP Posts Password Batch Manager plugin through version 1.1, because the plugin's bulk post-password handler is registered on an always-loaded admin handler and performs neither a capability check nor a nonce check. Successful exploitation with a single crafted request gives the attacker either disclosure of all password-protected post content (by clearing or resetting known/blank passwords) or a denial-of-service/lockout condition by setting every published post behind an attacker-chosen password, matching the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L (high integrity impact, low confidentiality and availability impact). Publicly available exploit code exists (the WPScan entry is tagged as an exploit reference), and no CISA KEV entry is associated with this CVE, so this is not confirmed as actively exploited; the practical risk is concentrated in the narrow set of sites that actually have this low-prevalence plugin installed and active, with published, password-protected content.
Stored cross-site scripting in the Adwised Web Push Notification WordPress plugin through version 2.5.7 allows any authenticated user - including a low-privileged subscriber - to overwrite the plugin's site-wide configuration and plant JavaScript that executes for every visitor of every front-end page, administrators included. The plugin performs no capability or nonce check on the configuration-update action and prints the stored settings unescaped inside an inline script block, so exploitation is trivial on any site with open user registration. Publicly available exploit code exists (WPScan reference), no CISA KEV listing has been recorded, and successful abuse yields session theft, administrator account takeover, and persistent compromise of the front end; no vendor-released patch was identified at time of analysis.
Memory exhaustion denial of service in WooCommerce Bookings (versions before 3.11.0) allows unauthenticated remote attackers to take a WordPress site offline with a single crafted request, because one of the plugin's unauthenticated AJAX actions feeds a user-supplied value directly into a memory allocation routine without validating or capping its size (CWE-400). Exposure is limited in scope but not in ease: only sites running the paid WooCommerce Bookings extension below 3.11.0 are affected (core WooCommerce is not), while the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, A:H, score 7.5) confirms that no credentials, user interaction, or non-default configuration are required. Publicly available exploit code exists, so any internet-facing site meeting the version condition should be treated as trivially reachable; the consequence is availability loss only, with no confidentiality or integrity impact.
Unauthenticated attackers can permanently delete arbitrary posts, pages, and media attachments on WordPress sites running WeddingCity Lite version 1.0.4 or earlier due to missing authorization checks in the plugin's deletion handler. The flaw, tracked as CWE-862, is remotely exploitable without authentication (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) and affects default installations with the plugin active. Publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been reported; the risk is high for affected sites due to the trivial attack requirements, but exposure is limited by the plugin's niche install base.
ImageMagick on Windows (versions through 7.1.2-33 and the legacy 6.x line through 6.9.13-58) can be induced to execute an attacker-supplied gswin64c.exe when it converts a PDF, PostScript, or EPS file while Ghostscript is left unregistered. The flaw is an uncontrolled search path (CWE-427) in NTGhostscriptEXE(): instead of resolving the Ghostscript binary through the registry, ImageMagick falls back to launching 'gswin64c.exe' by bare filename, so a malicious binary dropped in ImageMagick's current working directory is executed with ImageMagick's privileges. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV), and exploitation is conditional: it requires a Windows host with unregistered Ghostscript, attacker write access to the working directory, and a victim-triggered conversion - making this a genuine but situational, non-urgent issue rather than a mass-exploitation priority.
Privilege escalation in the Crowdfundly WordPress plugin (versions through 2.2.2) allows an attacker who already holds one of the plugin's own low-privileged roles to grant themselves the WordPress administrator role or arbitrary capabilities, resulting in full site takeover. The flaw sits in AJAX actions that lack capability checks, so it is reachable remotely with no victim interaction, but the attacker must first obtain a legitimate low-privilege Crowdfundly account - trivial on sites that permit open self-registration of backers/campaigners, and a hard blocker on sites that restrict account creation. Publicly available exploit code exists (per the WPScan entry), while there is no confirmed active exploitation (CISA KEV); the independent assessment rates this as an authenticated privilege-escalation issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rather than the higher-privilege PR:H rating shown in some feeds.