Databasement instances before 1.8.2 allow an authenticated user to achieve remote code execution by injecting path-redirecting client options (such as mariadb-dump --result-file, -r, --tab, pg_dump --file, mongodump --out, or redis-cli --rdb/--eval) into the arguments passed to the backup dump binary. Shell quoting prevents classic OS command injection, but argument injection alone is sufficient: by directing the dump output to a web-served, PHP-executing path such as /app/public/index.php, the attacker writes code that the web server later executes. Authentication is required (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), publicly available exploit code exists, and success depends on the chosen output path being both web-accessible and interpretable as code; no evidence of confirmed active exploitation was provided.
OS command injection in the open-source OpenSpug Spug operations platform (affected versions through 3.4.0 and 4.0.1) allows an authenticated, low-privileged remote user to execute arbitrary operating-system commands on the host by sending crafted input to the /exec/transfer endpoint of the File Transfer component. Exploitation is low-complexity and requires no user interaction, but it does require a valid session against the Spug web interface (CVSS PR:L), so exposure is limited to attackers who already hold a low-privileged account rather than anonymous internet users. Publicly available exploit code exists (published rating E:P) and there is no CISA KEV entry indicating confirmed active exploitation, while the vendor was contacted and did not respond, leaving no vendor-released patch identified at time of analysis.
Unauthenticated attackers can plant persistent JavaScript that executes in the browser of every visitor to a WordPress site running the Adwised Web Push Notification plugin through version 2.5.7, because several state-changing plugin operations lack authorization checks and the plugin's secret-comparison routine can be defeated on installations where a secret key was never configured. Publicly available exploit code exists (WPScan published a proof-of-concept write-up), though there is no KEV confirmation of active exploitation. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) shows a network-reachable, unauthenticated attack that requires a victim visitor to load an affected page, so real-world impact is bounded by the unconfigured-secret precondition, and hardened installs that have set a secret are not affected.
Stored cross-site scripting in the WordPress plugin Web Vitals Tracking (versions through 5.4.2) allows unauthenticated visitors to inject arbitrary script content by submitting unvalidated, unescaped performance measurements that the plugin persists and later renders inside a script context on an administrative reporting page. The attack is remote and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R), but the payload only executes when a logged-in administrator loads the affected admin page, so exploitation depends on administrator activity rather than firing automatically; publicly available exploit code exists and the issue is tracked by WPScan as well as EUVD-2026-96769. Our independent assessment rates the impact more conservatively than the vendor/NVD score (scope-changed XSS with low confidentiality and integrity impact and no availability impact), so this should be treated as a credible, medium-to-high priority issue rather than a top-tier emergency.
Unauthenticated stored cross-site scripting in the HootBoard WordPress plugin (all versions through 3.1.4) lets any remote attacker inject arbitrary JavaScript through the plugin's REST endpoints, which lack authorization checks and store values without escaping before rendering them on a public page. The injected script executes in the browser of any visitor to that page - most dangerously a logged-in administrator, which is the path to full site compromise - but it requires the victim to view the poisoned page, so the impact is client-side and conditional rather than direct server takeover. Publicly available exploit code exists (the WPScan disclosure entry doubles as an exploit reference) and no vendor patch has been confirmed; our independent vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) rates this below the 8.8 vendor score, reflecting the interaction requirement and the typically low-severity confidentiality/integrity effect on the victim's browser session alone. No EPSS or CISA KEV data is present in the feed, so this should be treated as an actionable priority rather than a confirmed active exploitation event.
Stored cross-site scripting in the WordPress plugin KeyWord Collector through version 1.4 allows an unauthenticated remote attacker to POST arbitrary values directly to the plugin's settings-save routine, which enforces neither a capability/authorization check nor a nonce (CSRF) check, and the stored values are then rendered without output escaping. The injected JavaScript executes when a logged-in administrator later opens the plugin settings page, or when any site visitor loads a front-end page that displays the plugin's output; publicly available exploit code exists for this issue. Our independent assessment scores the flaw 6.1 under CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, which is more conservative than the 8.8 figure circulated elsewhere: exploitation is unauthenticated and requires no non-default configuration, but it is constrained by user interaction (UI:R) and the demonstrated consequence is script execution in a victim's browser session rather than direct server-side compromise.
WordPress sites running the Topcontent plugin through version 1.2.1 are exposed to stored cross-site scripting when the plugin's API key has never been configured, because an unauthenticated request handler lacks authorization and stores submitted content as posts without HTML sanitization. Publicly available exploit code exists, and a victim must load the malicious post for the injected JavaScript to execute. The issue is rated 8.8 by the input CVSS but the independent assessment assigns a more limited impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting that exploitation requires an unconfigured API key and user interaction; it is not confirmed as actively exploited in CISA KEV.
Stored cross-site scripting in the BuddyPress Instant Chat WordPress plugin (versions through 1.6) lets remote, unauthenticated users inject persistent JavaScript into a chat conversation they do not belong to, because the plugin neither verifies that the message sender is a participant in the target conversation nor escapes message content when rendering it. The injected script stays dormant until a legitimate member - potentially an administrator or other privileged user - loads and views that conversation, which is why exploitation requires user interaction rather than being fully automatic. WPScan has published a proof-of-concept advisory, so publicly available exploit code exists, and although the vendor/NVD score is 8.8, the realistic impact is more contained: script execution within a member's authenticated WordPress session in the context of the affected site, with no direct server-side compromise shown.
The Disable Users WordPress plugin (versions through 1.0.5) fails to apply its account-disabling control consistently across all authentication paths, so an attacker who holds the credentials of an account an administrator has disabled can still log in and operate with that account's original privileges. Exploitation requires pre-existing valid credentials for a previously disabled account (CVSS PR:L, base score 8.8), and the regained access is bounded by the role that account held - but where the disabled user was an administrator, the result is full site compromise (C:H/I:H/A:H). Publicly available exploit code exists per the WPScan disclosure; there is no indication of confirmed active exploitation (no CISA KEV entry in the provided data).
Unauthenticated file-upload handling in the Piotnet Forms WordPress plugin through 1.0.30 lets an attacker store a browser-renderable file (HTML, SVG or similar) inside the site's own origin, so that opening the file executes arbitrary JavaScript - a stored XSS condition. The storage step requires no account and no special configuration, only a publicly reachable form that exposes an upload field; execution is not self-triggering and depends on a victim, typically an administrator reviewing a submission or any user following the file's direct URL, opening the payload (UI:R), with the highest impact when that opener holds an authenticated admin session in the same origin. Publicly available exploit code exists per the WPScan disclosure, and while the vendor-classified score is 8.8, our independent assessment scores the realistic vector lower (S:C, C:L/I:L) because the write and the execution are separated by user interaction and the observable impact depends on who opens the file.
Stored cross-site scripting in the click5 CRM add-on for Contact Form 7 (all versions up to and including 1.0.4) lets unauthenticated attackers submit crafted content through the plugin's submission endpoint, which is stored and later rendered into an administrative page without sanitisation or escaping, so the injected script executes in the browser of a high-privilege user such as an administrator. Publicly available exploit code exists, and the add-on must be installed and active for exposure, but the attack is not autonomous: it succeeds only when a logged-in privileged user subsequently opens the poisoned admin screen. No confirmed active exploitation (CISA KEV) has been reported, and an independent reassessment rates the realistic severity considerably lower than the headline CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), with the required admin interaction as the primary limiting factor.
Stored cross-site scripting in the click5 CRM add-on to Gravity Forms (all versions through 1.0.3) lets an unauthenticated attacker plant script into CRM content submitted through the plugin's public, unauthenticated content-submission endpoint; the input is neither sanitised on entry nor escaped on output, so the payload executes when a high-privilege user - typically an administrator - later opens the admin page that renders the stored CRM data. Publicly available exploit code exists (WPScan published a proof-of-concept reference), but there is no CISA KEV entry or other confirmation of active exploitation. Although the bundled score of 8.8 implies severe impact, our independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, because exploitation is conditional: the plugin must be installed with its submission endpoint reachable, and an administrator must subsequently review the poisoned entry before the script fires.
Stored cross-site scripting (XSS) in the click5 CRM add-on to the WordPress plugin WPForms through version 1.0.3 lets an unauthenticated attacker plant a persistent script payload through the add-on's public submission endpoint; the payload is later rendered without sanitisation or escaping on an administrative page, so it executes in the browser session of a high-privilege user such as an administrator who views that page - a UI:R condition that gates actual code execution. Publicly available exploit code exists (WPScan published the vulnerability entry), but there is no confirmed active exploitation (no CISA KEV listing) and no EPSS figure was supplied; the risk is further bounded by the add-on's niche deployment and by the fact that the script runs in an admin browser rather than on the server. Our independent assessment rates this lower than the input's 8.8 (High), using a scope-changed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), which keeps the exploit prerequisites - installed and active add-on, unauthenticated submission, and administrator interaction - central to any real-world prioritisation.
Stored cross-site scripting in the click5 CRM add-on for Ninja Forms (all versions through 1.0.1) allows an unauthenticated attacker to submit crafted content through the add-on's public form endpoint and have it persisted without sanitisation, so the payload executes in the browser of any high-privilege user - typically an administrator - who later opens the admin page that renders those submissions. Exploitation requires no credentials to plant the payload (CVSS vector PR:N), but it does require user interaction (UI:R), meaning an administrator must actually view the poisoned submission for the script to fire; publicly available exploit code exists and the bug was reported by WPScan, though there is no confirmed active exploitation (CISA KEV) at time of analysis. Scored 8.8 under the NVD/A:H/C:H/I:H vector, but our independent assessment rebases it to CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (scope change, limited confidentiality and integrity, no availability impact), making this a moderate rather than top-tier priority that is bounded by whether admins routinely review unfiltered submission data.
Privilege escalation in the Mobile Builder WordPress plugin (versions through 1.4.2) allows any authenticated low-privilege user - including a self-registered customer account - to grant themselves the administrator role by writing unrestricted user meta keys through one of the plugin's REST routes. The flaw requires only a valid low-privilege account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) and no administrator interaction, and publicly available exploit code exists according to WPScan. Sites with open user self-registration enabled are the easiest to attack, but any existing low-privilege user can still exploit the vulnerable route; CISA's SSVC rates technical impact as total while noting no observed exploitation and no known automatable exploitation at this time.
Stored cross-site scripting in the Prenotazioni WordPress plugin (all versions up to and including 1.7.5) lets an unauthenticated attacker write arbitrary JavaScript into plugin settings that are saved without any capability or CSRF check and then rendered without output escaping. The payload persists in the site database and executes in the browser of any administrator opening the affected settings screen or any visitor viewing the affected front-end rendering, so impact is scoped to the privileges of the victim's own session rather than to the server itself. A public proof-of-concept/write-up is available (WPScan), while SSVC records exploitation status as 'none' and non-automatable; no EPSS score was supplied. Note the discrepancy between the researcher-assigned 8.8 (S:U/C:H/I:H/A:H) and our independent assessment (S:C/C:L/I:L/A:N), which treats confidentiality and integrity impact as limited because execution requires a page view (UI:R) and only affects the victim's browser session.
Stored cross-site scripting in the SmugMug Embed WordPress plugin through 3.13 allows unauthenticated remote users to store arbitrary gallery data via an AJAX action that lacks authorization and CSRF checks, with the payload executing when a logged-in administrator views the plugin's settings screen. Publicly available exploit code exists, but the independent assessment keeps impact limited: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, requiring administrator interaction and yielding low confidentiality and integrity impact. There is no CISA KEV confirmation in the provided data, so this should be treated as exploitable via public PoC rather than confirmed actively exploited.
Missing authorization in Wukong HRM (all versions through commit 186115e) lets any authenticated employee, including the lowest-privileged role, read company-wide payslips, salary records, bank card details and personal data, edit bank cards, and delete employees, departments and contracts. The defect is structural: the HR administrator role is unconditionally assigned to every caller and data-scope checks return the entire employee set instead of the caller's permitted scope, so both horizontal and vertical privilege boundaries collapse for any valid session. Publicly available exploit code exists - two PoC scripts targeting salary archive history and payroll card/Social Security data - so anyone with valid low-privilege employee credentials and network reach to the HRM web application can exploit this reliably; no KEV listing or confirmed active exploitation is present in the available data.
Unauthenticated SQL injection in the ASPL Product Quotation WordPress plugin through version 1.1.0 allows remote attackers to read arbitrary data from the site's database without credentials or user interaction. Publicly available exploit code exists (reported via the WPScan vulnerability entry), but the flaw is not flagged as confirmed actively exploited (CISA KEV). Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 8.6), impact is confidentiality-only - injected queries can disclose data but do not modify it or affect site availability.
Unauthenticated SQL injection in the Tcard WP WordPress plugin (all versions through 1.8.0) allows remote attackers to inject arbitrary SQL through one of the plugin's AJAX actions, exposing data from the underlying WordPress database. Exploitation requires no authentication, no user interaction, and no non-default configuration - only that the plugin be installed and active - and publicly available exploit code exists, though there is no confirmed actively exploited (CISA KEV) signal. The assessed impact is read-oriented (high confidentiality, no integrity or availability impact), so the practical risk is sensitive-data disclosure rather than site takeover, with real-world exposure bounded by how widely this low-footprint plugin is deployed.
Unauthenticated SQL injection in the Mobile builder WordPress plugin (all versions through 1.4.2) lets any remote attacker inject arbitrary SQL into the site's backend database and read data the application can access. The assessed vector (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms no authentication, no user interaction and no special configuration are required, with the sole precondition being that this non-default plugin is installed and active, and impact is confined to confidentiality. Publicly available exploit code exists (published via the WPScan vulnerability entry), and while this is not confirmed actively exploited (CISA KEV), the unauthenticated reachability and low skill barrier make it a genuine priority for any site running the plugin.
Unauthenticated SQL injection in the WordPress plugin Post Voting System 1.0 and earlier allows remote attackers to inject arbitrary SQL through a request parameter that is passed into a database query without sanitization or escaping, exposing the contents of the site's WordPress database. Every installation with the plugin active is potentially reachable, because exploitation requires no authentication, no user interaction, and no non-default configuration - publicly available exploit code exists, and WPScan has published the vulnerability, so mass scanning is plausible. The practical risk is bounded by deployment: the plugin is niche, and the impact is confined to confidentiality (database read), since the assessed vector is S:U with C:H and no integrity or availability effect; no fixed version is confirmed at the time of analysis, so removal or virtual patching is the current mitigation.
Unauthenticated SQL injection in the WP Verify API WordPress plugin through version 1.0.0 lets remote attackers supply malicious input to a parameter used directly in a SQL query, allowing extraction of database contents. Publicly available exploit code exists, while no EPSS score or CISA KEV entry was provided; the input CVSS is 8.6 (network, low complexity, no privileges or user interaction), and the independent assessment keeps scope unchanged and rates confidentiality impact high with no integrity or availability impact. The practical prerequisite is that a target WordPress site has this specific plugin installed and the vulnerable endpoint reachable.
Unauthenticated SQL injection in the Loja Automática WordPress plugin (versions through 1.0.0) allows remote attackers to read data from a site's backend database by supplying crafted input to a parameter that is not sanitized or escaped before being placed in a SQL query, resulting in a high confidentiality impact per the assessed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 8.6 as published). No authentication, privileges, or user interaction are required, and publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been reported; realistic exposure is limited almost entirely by how rarely this obscure plugin is installed and active. WPScan reported the issue, which is tracked as EUVD-2026-96788.
Unauthenticated SQL injection in the Datalist it WordPress plugin through version 0.0.3 allows anonymous attackers to execute arbitrary database queries and read sensitive data from the underlying WordPress database. Publicly available exploit code exists, and the provided CVSS score is high, though the independent assessment scopes confirmed impact to unauthorized database reads under unchanged scope; real-world exposure is likely limited by the plugin's apparent small install base and requires only that the plugin be active and reachable on a WordPress site.
Unauthenticated SQL injection in the WpCues Basic Quiz WordPress plugin through version 1.6.5 allows remote attackers to read arbitrary data from the site's database. Publicly available exploit code exists, but no confirmed active exploitation (CISA KEV) is reported. The independent assessment rates confidentiality impact as High with no integrity or availability impact and scope unchanged, so the practical risk is data disclosure for sites running the vulnerable plugin.
Unauthenticated SQL injection in the Llavero.io WordPress plugin (versions through 0.1.4) allows remote attackers to inject arbitrary SQL through an unsanitized parameter and read data from the site's WordPress database. Exploitation requires no authentication and no user interaction (CVSS PR:N/UI:N), and publicly available exploit code exists via the WPScan disclosure, though CISA KEV does not list this as confirmed actively exploited. Based on the independent assessment, impact is confined to confidentiality (read-only data disclosure, C:H/I:N/A:N), and the practical exposure is limited by the plugin's niche, early-version footprint.
Unauthenticated SQL injection in the Site Setup Wizard WordPress plugin through 1.5.8 allows any remote attacker who can reach a site running the plugin to inject arbitrary SQL through an improperly sanitised parameter and read data from the site's database, including potentially password hashes, user records and stored configuration secrets. Exploitation requires no authentication, no user interaction and no special configuration - only that the plugin be installed and active at version 1.5.8 or earlier - and publicly available exploit code exists. The flaw is read-only in effect (Confidentiality High, Integrity None, Availability None per our assessed vector), so it does not by itself permit data modification or full site takeover, and there is no indication of confirmed active exploitation (CISA KEV).
Unauthenticated SQL injection in the Social Web Suite WordPress plugin through 4.1.12 lets remote attackers read arbitrary data from the site's database, because the plugin accepts requests supposedly authorized by its shared secret before ever requiring that secret to be configured, and then passes an unsanitized parameter directly into an SQL statement. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that no authentication, privileges, or user interaction are needed: any internet-facing WordPress installation running a vulnerable version in the unconfigured state is directly exploitable. Publicly available exploit code exists, and while the primary limiting factor is the deployment footprint of this specific plugin (and the unset-secret prerequisite), the high confidentiality impact makes this a credible, actionable priority rather than a theoretical high-CVSS issue.
Unauthenticated SQL injection in the WP-Partner WordPress plugin (all versions through 1.2.1) allows remote attackers to append arbitrary SQL to an existing query and exfiltrate data from the underlying WordPress database, including user credentials, hashes, and other sensitive site content. The flaw carries a CVSS v3.1 base score of 8.6 (the independent assessment re-scores it as AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, i.e. high confidentiality impact with no direct integrity or availability effect), requires no authentication or user interaction, and publicly available exploit code exists - though there is no confirmation of active exploitation (no CISA KEV listing). Risk is concentrated on sites that actually run this specific, low-footprint plugin; any such site exposing the vulnerable endpoint over HTTP(S) is directly exploitable with default configuration.
Unauthenticated SQL injection in the Recordbrowser WordPress plugin (all versions through 1.1.7) allows remote attackers to append arbitrary SQL to plugin-issued database queries and read sensitive data from the underlying WordPress database. The vulnerable endpoint requires no authentication, no privileges and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), so any reachable site with the plugin installed and active is exposed; publicly available exploit code exists, and the flaw is not currently listed in CISA KEV, so confirmed active exploitation has not been established. The practical risk is limited mainly by deployment footprint - the plugin must be present and its vulnerable parameter reachable - but for sites that do run it, this is a genuine priority.
Unauthenticated attackers can reset, overwrite, or replace the post password of every published post on any WordPress site running the WP Posts Password Batch Manager plugin through version 1.1, because the plugin's bulk post-password handler is registered on an always-loaded admin handler and performs neither a capability check nor a nonce check. Successful exploitation with a single crafted request gives the attacker either disclosure of all password-protected post content (by clearing or resetting known/blank passwords) or a denial-of-service/lockout condition by setting every published post behind an attacker-chosen password, matching the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L (high integrity impact, low confidentiality and availability impact). Publicly available exploit code exists (the WPScan entry is tagged as an exploit reference), and no CISA KEV entry is associated with this CVE, so this is not confirmed as actively exploited; the practical risk is concentrated in the narrow set of sites that actually have this low-prevalence plugin installed and active, with published, password-protected content.
Stored cross-site scripting in the Adwised Web Push Notification WordPress plugin through version 2.5.7 allows any authenticated user - including a low-privileged subscriber - to overwrite the plugin's site-wide configuration and plant JavaScript that executes for every visitor of every front-end page, administrators included. The plugin performs no capability or nonce check on the configuration-update action and prints the stored settings unescaped inside an inline script block, so exploitation is trivial on any site with open user registration. Publicly available exploit code exists (WPScan reference), no CISA KEV listing has been recorded, and successful abuse yields session theft, administrator account takeover, and persistent compromise of the front end; no vendor-released patch was identified at time of analysis.
Memory exhaustion denial of service in WooCommerce Bookings (versions before 3.11.0) allows unauthenticated remote attackers to take a WordPress site offline with a single crafted request, because one of the plugin's unauthenticated AJAX actions feeds a user-supplied value directly into a memory allocation routine without validating or capping its size (CWE-400). Exposure is limited in scope but not in ease: only sites running the paid WooCommerce Bookings extension below 3.11.0 are affected (core WooCommerce is not), while the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, A:H, score 7.5) confirms that no credentials, user interaction, or non-default configuration are required. Publicly available exploit code exists, so any internet-facing site meeting the version condition should be treated as trivially reachable; the consequence is availability loss only, with no confidentiality or integrity impact.
Unauthenticated attackers can permanently delete arbitrary posts, pages, and media attachments on WordPress sites running WeddingCity Lite version 1.0.4 or earlier due to missing authorization checks in the plugin's deletion handler. The flaw, tracked as CWE-862, is remotely exploitable without authentication (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) and affects default installations with the plugin active. Publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been reported; the risk is high for affected sites due to the trivial attack requirements, but exposure is limited by the plugin's niche install base.
ImageMagick on Windows (versions through 7.1.2-33 and the legacy 6.x line through 6.9.13-58) can be induced to execute an attacker-supplied gswin64c.exe when it converts a PDF, PostScript, or EPS file while Ghostscript is left unregistered. The flaw is an uncontrolled search path (CWE-427) in NTGhostscriptEXE(): instead of resolving the Ghostscript binary through the registry, ImageMagick falls back to launching 'gswin64c.exe' by bare filename, so a malicious binary dropped in ImageMagick's current working directory is executed with ImageMagick's privileges. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV), and exploitation is conditional: it requires a Windows host with unregistered Ghostscript, attacker write access to the working directory, and a victim-triggered conversion - making this a genuine but situational, non-urgent issue rather than a mass-exploitation priority.
Privilege escalation in the Crowdfundly WordPress plugin (versions through 2.2.2) allows an attacker who already holds one of the plugin's own low-privileged roles to grant themselves the WordPress administrator role or arbitrary capabilities, resulting in full site takeover. The flaw sits in AJAX actions that lack capability checks, so it is reachable remotely with no victim interaction, but the attacker must first obtain a legitimate low-privilege Crowdfundly account - trivial on sites that permit open self-registration of backers/campaigners, and a hard blocker on sites that restrict account creation. Publicly available exploit code exists (per the WPScan entry), while there is no confirmed active exploitation (CISA KEV); the independent assessment rates this as an authenticated privilege-escalation issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rather than the higher-privilege PR:H rating shown in some feeds.
Envira Gallery WordPress plugin versions before 1.16.2 fail to verify the capability WordPress reserves for plugin installation when handling the setup-wizard plugin-installation request, letting an authenticated Multisite subsite Administrator install any WordPress.org-published plugin into the network-shared plugins directory - an action Multisite reserves for the network Super Admin. The issue is gated: it only crosses a privilege boundary on WordPress Multisite networks and requires the attacker to already hold subsite-Administrator credentials (CVSS 3.1 AV:N/AC:L/PR:H/UI:N, assessed with S:C/C:H/I:H/A:H, scored 7.2), and it is not exploitable on standard single-site WordPress where Administrators legitimately install plugins. Publicly available exploit code exists (WPScan-published), and the vendor has released a fixed version 1.16.2.
Missing authorization in 1Panel-dev CordysCRM before 1.9.2 lets any authenticated low-privileged user read organization invoicing entities by sending POST /field/source/business-title, an endpoint that performs no permission check and therefore ignores the CONTRACT_BUSINESS_TITLE_READ privilege. Successful exploitation exposes tax identification numbers, bank account numbers, opening banks, registration addresses, and phone numbers of customer organizations, giving an attacker a ready-made dataset for invoice fraud, business email compromise, and social engineering. Publicly available exploit code exists (a Python PoC published on GitHub), and the issue is confirmed fixed in 1.9.2; per the CVSS:4.0 vector (PR:L, no UI, network-reachable), the practical barrier is simply holding valid low-privilege credentials, so an insider or a compromised standard account is enough to pull the data.
Missing authorization in 1Panel-dev CordysCRM 1.9.0 up to (but not including) 1.9.2 lets an authenticated user who has been explicitly denied module permission page through organization-wide CRM records - leads, contacts, quotations, contracts, payment plans, payment records, orders and invoices - that belong to other users. The flaw lies in eight ModuleFieldController /field/source data-source endpoints that omit the data-permission scope check, so a low-privilege account (CVSS PR:L, unauthenticated attackers cannot exploit it directly) can enumerate and read data it should never see; impact is confidentiality-only with no integrity or availability effect. Publicly available exploit code exists (a proof-of-concept script targeting the field/source endpoint family), and the vendor has released a fix in 1.9.2 via commit a31fa16f, which injects a dataPermission.invisible guard into the affected MyBatis mappers and the controller.
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party integration settings - client id, client secret, agent id and corp id - through the unprotected editThirdAppConfig handler, redirecting directory synchronisation and messaging to attacker-controlled applications or breaking the integrations outright. The defect is a missing authorization check (CWE-862) in ThirdAppController.java with an assessed integrity impact (CVSS 3.1 base 7.1, PR:L, I:H), and publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) is reported. Real-world impact is context-dependent: instances with no configured third-party IM/directory integration expose little to steal or disrupt through this endpoint.
Reflected cross-site scripting in the Subscribe to Comments WordPress plugin (all versions before 2.3.3) allows remote attackers to inject script through a crafted URL whose parameter is reflected unvalidated into a link target, executing in the browser of anyone who clicks it, including logged-in administrators. Per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) the attacker needs no authentication (PR:N), but exploitation is gated by mandatory user interaction (UI:R) and is confined to a single victim's browser session per click - it is reflected, not stored, and does not compromise the server. Publicly available exploit code exists, the vendor has released a patched version (2.3.3), and the issue is not listed in CISA KEV, so confirmed active exploitation is not established; risk is moderate and user-interaction-gated rather than an emergency.
Unauthenticated remote attackers can bypass authentication in AmoyLab Unla through 0.10.0 by exploiting an OAuth2 authorization server that never authenticates a resource owner, allowing them to register a client, request an authorization code, and exchange it for a valid access token. This grants access to OAuth2-protected MCP prefixes, proxied upstream APIs, and injected credentials, with high confidentiality impact and low integrity impact. No public exploit identified at time of analysis, and no vendor-released patch is available; the vulnerability is remotely exploitable without authentication or user interaction, making it a high-priority issue for exposed instances.
Unauthenticated appointment takeover in Easy!Appointments 1.6.0 and earlier allows any remote attacker to rewrite, rebind, reschedule, or cancel arbitrary existing bookings by calling the public Booking::register() endpoint with a sequential appointment id and a self-asserted manage_mode flag while omitting the appointment management hash. Successful abuse also yields the victim's management hash, its update endpoint is reachable at PR:N/UI:N, and the flaw carries an assessed impact of high integrity loss, making it a genuine priority rather than a high-CVSS paper tiger; no public exploit identified at time of analysis, although a public technical write-up of the flaw exists, and no EPSS score was supplied in the available data.
Unbounded request-body buffering in mark3labs mcp-go through 1.2.1 lets remote unauthenticated attackers exhaust server memory and OOM-kill the process by sending arbitrarily large or many concurrent POST requests to the StreamableHTTPServer HTTP transport. Because the handler calls io.ReadAll on the raw request body before any size validation occurs, a single oversized request or a modest burst of parallel requests can drive allocation without limit; no credentials or user interaction are required (CVSS:4.0 PR:N/UI:N, availability-only impact rated 8.7). There is no confirmed in-the-wild exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but the low complexity and network reachability make this a credible, moderately-high-priority availability risk for any deployment exposing the StreamableHTTP endpoint directly to untrusted networks.
Unauthenticated information disclosure in Katanemo Plano through 0.4.37 allows any network attacker who can reach TCP port 9901 to read plaintext LLM provider API keys by issuing a single GET request to the Envoy admin interface's /config_dump endpoint. The Envoy admin listener is bound to all host interfaces (0.0.0.0) in the shipped config/envoy.template.yaml, so stock deployments are exposed by default; the only real barriers are network reachability to port 9901 and the presence of at least one configured provider key, and the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, C:H) reflects a low-effort, high-reward credential theft with no authentication or user interaction required. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, although the flaw has been publicly documented by VulnCheck.
Memory exhaustion in the Model Context Protocol (MCP) Kotlin SDK through version 0.15.0 allows unauthenticated remote clients to drive a server into denial of service by sending WebSocket frames whose headers declare payloads approaching 2 GiB, forcing the server to attempt huge heap allocations before any frame body is received. The flaw lives in the SDK's Application.mcpWebSocket extension, which installs Ktor WebSockets without a maxFrameSize limit, and because that unprotected configuration is the installed default, no special toggle or misconfiguration is required. Impact is availability-only (no confidentiality or integrity loss), the practical limiting factor is network reachability to an exposed WebSocket endpoint running an affected version, and no public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated information disclosure in OpenAgents Workspace (through launcher-v1.0.17) enables remote attackers to list all workspaces and retrieve sensitive data-including the unmasked browserfabric_api_key, workspace IDs, slugs, creator emails, and member lists-via a single GET /v1/workspaces request. The endpoint lacks authentication (CWE-306), so exploitation requires only network reachability to the backend API. No public exploit code or CISA KEV listing is reported; however, the exposure of API credentials creates a high confidentiality risk, consistent with the CVSS 4.0 base score of 8.7 and independent assessment.
pH7Builder (pH7 Social Dating CMS) versions before 18.6.0 leak sensitive member records - email addresses, IP addresses, phone numbers, and bank account fields - to unauthenticated remote attackers who bypass the API's access checks. The bypass works because Tool.class.php ships a hard-coded API key (private_api_key=dev772277) and the authorization logic trusts the client-supplied Host header, so an attacker sending 'Host: localhost' along with that static key and the shipped default allowed URL is treated as authorized. No public exploit code has been identified at time of analysis and there is no KEV entry, but the independent assessment scores the issue CVSS v3.1 7.5 (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N), a high-priority confidentiality-only exposure, with the vendor shipping 18.6.0 as the fix.
Incorrect authorization in Vearch 3.5.2 through 3.5.9 lets any authenticated non-root user who holds a role with ReadOnly or None resource privileges perform write operations that role should forbid. Because Role.HasPermissionForResources ignores the stored privilege level, such a user can upsert and delete documents and can call PUT /roles to grant their own role WriteRead privileges, escalating toward cluster-administrator access. Exploitation requires valid low-privilege credentials (PR:L) and is limited to the 3.5.2-3.5.9 range, so exposure is greatest in multi-tenant or shared deployments where untrusted users hold accounts; no public exploit code or confirmed active exploitation was identified at time of analysis.