Unauthenticated PII disclosure in the Booking Package WordPress plugin through version 1.7.29 lets remote attackers retrieve the booking_package_booked_customers table, exposing customer names, email addresses, phone numbers, physical addresses, and cancellation tokens. The endpoint's only nominal protection is a nonce that the plugin emits in the public booking_package JavaScript object on any page rendering the [booking_package] shortcode or widget, so any visitor can harvest it and call the unauthorized retrieval path; no authentication, user interaction, or special configuration is required per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. No CISA KEV listing was provided, and no public exploit identified at time of analysis, and the assessed impact is confidentiality-only (I:N/A:N), making this an actionable priority for sites actively using the plugin but not a top-tier emergency.
Unauthenticated information disclosure in the FOG imaging/cloning suite (all versions prior to 1.5.10.1870) allows a remote requester to retrieve the configured default Active Directory domain-join password by dispatching the management adInfo() endpoint through node=ipxe, which was reachable without an authenticated session and returns the credential in the domainpass JSON field. Exploitation requires only network reachability to the FOG web interface plus the operator-side condition that a FOG_AD_DEFAULT_PASSWORD value has been configured for automatic AD domain joins; if no default AD password is set, the endpoint discloses nothing sensitive. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, though the disclosure of a reusable domain-join credential carries high confidentiality impact (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Malformed CCSDS telecommand frames cause assertion-driven denial of service in NASA's F´ (F Prime) flight-software framework prior to version 4.2.0 by aborting or resetting the flight-software process. In affected topologies, a frame that leaves a payload of six bytes or fewer after the TcDeframer strips its TC header and trailer reaches Svc::Ccsds::SpacePacketDeframer::dataIn_handler, which enforces the minimum packet-length condition with FW_ASSERT instead of rejecting and returning the buffer; the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) reflects high availability impact with no confidentiality or integrity loss and no authentication or user interaction required within the framework. No public exploit code or active exploitation has been identified at time of analysis, and the principal practical limitation is that the attacker must be able to inject frames onto the spacecraft telecommand uplink or command/data-link path, which is not generally internet-exposed; the issue is fixed in 4.2.0.
Discourse forums with the non-default 'secure uploads' feature enabled could keep serving media and attachments to anonymous visitors after the owning category was made read-restricted, because per-upload security metadata was never reconciled when a category's read_restricted flag flipped or when category permissions changed during a bulk import. Only uploads that were posted while the category was still public are exposed - including uploads attached to topics that were later deleted - and they remain reachable through their short upload URLs, which an attacker must know or enumerate; the vendor's reported CVSS 3.1 base of 7.5 reflects network, unauthenticated, no-interaction access, although our assessment raises complexity to High (AC:H) because both a specific non-default configuration and a triggering permission event are required. The issue is fixed in 2026.9.0, 2026.8.1, 2026.7.3 and 2026.1.9, and no public exploit was identified at time of analysis.
Unauthenticated information disclosure in the LatePoint appointment booking and scheduling plugin for WordPress (versions up to and including 5.7.3) lets any remote attacker read other customers' appointment records and pending cart contents by supplying sequential booking[id] and cart[id] values to the public steps__reload_booking_form_summary_panel and steps__start routes, which are reachable without login through wp_ajax_nopriv_latepoint_route_call. No ownership check is applied to those identifiers, so enumeration is trivial and requires no authentication, no user interaction and no special configuration beyond having the plugin active with live booking or cart data; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) confirms remote unauthenticated exploitation with confidentiality-only impact, and the readiness of sequential integer keys makes the practical barrier to exploitation very low. No public exploit code has been identified at time of analysis, the flaw is not listed in CISA KEV, and EPSS data was not available in the supplied intelligence; the assessment is that this is a genuine, easily reproducible read-only disclosure rather than an inflated high-severity score.
Malformed inter-processor hub traffic can abort or reset NASA's F´ (F Prime) flight-software process in versions prior to 4.2.0, because the Svc::GenericHub receive handler treats externally supplied deserialization results as invariants and aborts via FW_ASSERT when they fail. An unauthenticated remote peer on a hub link (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) can send a truncated buffer, a HubType value at or above HUB_TYPE_MAX, or a header-only command-dispatch payload to trigger the fault, producing availability-only impact. The vendor has released 4.2.0 with hardened bounds and type checks; no public exploit code has been identified at time of analysis, and the issue is confined to deployments that genuinely instantiate GenericHub and expose its link to untrusted or spoofable peers.
Unauthenticated time-based blind SQL injection in the Gmedia Photo Gallery plugin for WordPress, affecting all versions up to and including 1.25.1, lets any remote attacker append arbitrary SQL to the plugin's existing query through the 'gmedia__in' parameter and extract sensitive data from the site's database. The plugin's mobile-app endpoint dispatches the 'library' action without validating the Mobile App feature flag, a nonce, or any WordPress authentication, so no account or session of any kind is required, matching the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5). Impact is confidentiality-only and exploitation is blind and time-based, so extraction is slower and noisier than an error-based injection; no public exploit code and no confirmed active exploitation were identified at time of analysis.
User enumeration and credential-verification flaws in Omada Controller MSP mode allow an authenticated attacker to validate credentials for other accounts by manipulating the Identifier parameter, potentially leading to unauthorized access to MSP resources or account compromise. Exploitation requires the controller to be running in MSP mode, an existing authenticated session, and knowledge of the target account's Identifier; no public exploit code or active exploitation has been identified at time of analysis. The issue is rated moderate priority due to these prerequisites and the oracle-based nature of the leak, as the endpoint returns distinguishable responses for nonexistent users, invalid passwords, and successful authentication.
Blind SQL injection in the 10Web Form Maker WordPress plugin (all versions up to and including 1.15.48) lets unauthenticated remote attackers append additional SQL to queries built from the 'inputs' parameter, allowing them to extract sensitive information from the site's database. The plugin's nonce check offers no real protection because the required nonce is emitted into the HTML source of every public page that renders a form, so the only practical prerequisite is that a Form Maker form be reachable by an anonymous visitor - the normal way a contact-form plugin is deployed. CVSS is 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only), no public exploit code has been identified at time of analysis, and the issue should still be treated as high priority given how trivially the vulnerable handler can be reached.
Unauthenticated attackers can inject SQL into the JTL-Connector for WooCommerce WordPress plugin (all versions up to and including 2.4.3) through the 'product.push' identity-linking endpoint, allowing blind, time-based extraction of data from the site's WordPress database. The flaw requires no credentials, no user interaction and no non-default configuration - only that the plugin is installed and its connector endpoint is reachable, which is its normal operating mode for JTL ERP synchronisation - and it fires during identity linking before ProductController::push() runs, so downstream validation never gets a chance to reject the request. Impact is limited to data disclosure (CVSS 7.5, C:H/I:N/A:N) and exploitation is slower than direct extraction because it relies on time-based inference, but it is fully automatable; no public exploit code was identified at time of analysis and there is no CISA KEV telemetry for this CVE. Overall this is a credible, high-priority issue for the narrow population of sites actually running the JTL-WooCommerce bridge.
Unauthenticated remote attackers can render PgBouncer 1.20.0 through 1.26.0 unresponsive by sending a single crafted StartupMessage whose options parameter contains an empty parameter name (for example "-c="), which makes the server's ignore_startup_parameters lookup loop indefinitely during the pre-authentication startup phase. Because PgBouncer serves every client from a single process, the loop pins a CPU core and stalls all connection pools until an administrator manually restarts the daemon, so a lone packet from any TCP-reachable source can take down the entire pooler. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but the issue is network-reachable with low complexity, requires no credentials or user interaction, and carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflecting its availability-only impact.
Authentication bypass via capture-replay in Progress MOVEit Transfer's OIDC module allows a remote unauthenticated attacker (CVSS PR:N) to replay captured OpenID Connect authentication material and impersonate a legitimate user, but only when OIDC SSO is configured and a real user completes an authentication (UI:R, AC:H). Affected versions are MOVEit Transfer before 2025.1.6 and 2026.0.0 through 2026.0.3; instances using other authentication methods are not exposed to this specific flaw. No public exploit identified at time of analysis.
Unauthenticated SQL injection in Abandoned Cart Pro for WooCommerce (all versions up to and including 10.8.0) allows remote attackers to extract sensitive information from a WordPress site's database by forging the plugin's encrypted 'validate' parameter. The parameter is protected with AES-CTR, a malleable stream cipher, so an attacker who abandons a cart using an email address they control can harvest one legitimate token, recover the keystream, and re-encrypt arbitrary SQL; the HMAC integrity check introduced in 10.4.1 is enforced only when the wcap_nonce parameter is present, and omitting that parameter skips the check entirely. CVSS 3.1 scores this 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting unauthenticated, remote, confidentiality-only impact; no public exploit code and no confirmed active exploitation were identified at time of analysis, though the attack requires only a token-harvest and keystream-recovery step rather than a one-shot injection.
Denial of service in NASA's F´ (F Prime) framework prior to 4.2.0 allows remote attackers to abort or reset the flight software process by delivering a file-uplink packet whose file-packet type byte falls outside the valid Type enum, driving Fw::FilePacket deserialization into an unvalidated FW_ASSERT (CWE-617). The impact is availability-only, matching the assessed CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no confidentiality or integrity loss, and the practical limiting factor is reachability: the malicious packet must traverse the Svc::FileUplink file-packet path, which in spaceflight deployments is the ground-to-vehicle uplink. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has released a fix in F Prime 4.2.0.
Cookie header leakage in cpp-httplib before 0.51.0 causes session cookies to be forwarded to a different origin when the library's client follows a cross-origin 301, 302, 307, or 308 redirect. Remote attackers who control the redirect response - or who occupy a network man-in-the-middle position against a plaintext HTTP origin - can capture cookies intended for the original origin, with confidentiality-only impact rated CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Exploitation requires the consuming application to enable set_follow_location(true) and to supply cookies directly or via default_headers_, so unauthenticated remote attackers, not authenticated local users, drive the vector, and there is no public exploit identified at time of analysis.
Privilege escalation in the Membership & User Roles for WooCommerce (Automatic Role Changer) plugin through version 20260828 lets an authenticated subscriber-level user re-acquire a previously revoked Administrator role and take full administrative control of the WordPress site. The flaw is reachable when the plugin is configured in Replace Roles mode and the attacker's account previously legitimately held Administrator while the plugin was active, because that role stays cached in the dfxwcrc_foreign_roles user meta and is re-applied whenever a role-assignment event fires, such as completing a purchase for a role-mapped product. Wordfence reported the issue (CVSS 7.5, CWE-269) and no public exploit code was identified at the time of analysis; the stacked preconditions - former legitimate admin, stale cache, Replace Roles mode - materially limit real-world exploitation, and only former privileged users, not arbitrary subscribers, can abuse it.
Code injection in the VillaTheme 'Email Template Customizer for WooCommerce' WordPress plugin, affecting versions up to and including 1.3.4, lets an attacker influence the content/code generated by the plugin's email template handling, carrying a high confidentiality impact (C:H) with low integrity impact in our assessment. The supplied advisory vector claims unauthenticated, no-interaction exploitation (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5), but our independent assessment revises this to PR:L (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), meaning a privilege prerequisite cannot be ruled out and the unauthenticated claim is unverified. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied; exposure is limited to WordPress sites running WooCommerce with this specific plugin active.
Code injection in the VillaTheme Salevo WooCommerce plugin for WordPress (woo-boost-sales) affects all releases through 1.3.0 and lets a remote attacker reach a code-generation sink within the plugin, with the assessor's scoring indicating high impact to confidentiality, integrity and availability. The underlying vulnerability class is CWE-94 (Improper Control of Generation of Code), and the Patchstack advisory tags the issue as potential remote code execution; there is no confirmed actively exploited status (not in CISA KEV) and no public exploit code identified at time of analysis. Exploitation requires the plugin to be installed and active on a WooCommerce site, which meaningfully narrows the realistic attack surface; the exact vulnerable function, endpoint or parameter is not disclosed, and the published CVSS vector (PR:N) conflicts with the assessor's vector (PR:L), so the precise authentication precondition is not fully resolved from available data.
An integer overflow in list allocation inside the Nix expression evaluator - and in the Lix fork - can drive an out-of-bounds write when an attacker-supplied Nix expression is evaluated, allowing memory corruption in the evaluating process. Only Nix before 2.35.3 and Lix before 2.95.4 are affected, and the flaw is remotely reachable and requires no authentication or user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:L, base 7.5), though the high attack complexity means allocation sizes must be crafted precisely. Our assessment is consistent with a memory-corruption primitive rather than a trivial crash - high integrity impact, low availability impact, no confidentiality impact; no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV).
Improper access control in TP-Link Omada Controller's MSP and OpenAPI certificate/private-key management APIs allows an authenticated user to perform privileged certificate operations - uploading or deleting the controller's TLS certificate or private key - which can disrupt secure management access to the controller. The description states a low-privileged authenticated account is sufficient, although the supplied CVSS 4.0 vector (7.5) specifies PR:H; an independent assessment captures the lower-privilege reading as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, i.e. network-reachable, no user interaction, no confidentiality impact, and high integrity and availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis (no KEV listing and no EPSS score were provided), so exploitation requires a valid controller account plus network reachability to the affected MSP or OpenAPI endpoints.
Denial of service in the Linux kernel networking stack: a stale transport_header left behind after tunnel decapsulation makes qdisc_pkt_len_segs_init() compute a negative transport offset, which is cast to unsigned and turns into an out-of-bounds read of the skb, crashing the host (availability impact only, no code execution or data exposure). Reachability is narrow: the machine must decapsulate GSO-marked tunnel traffic and then forward the inner frame at layer 2 through a bridge or HSR rather than handing it to the local IP stack, and the flaw only exists in kernels carrying commit 7fb4c1967011. The assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, meaning unauthenticated remote traffic can trigger it but the confluence of preconditions makes exploitation complex; EPSS is 0.21% (10th percentile) and no public exploit identified at time of analysis.
Autodesk's ADP Desktop SDK transmits sensitive Autodesk service credentials and tokens over an unencrypted channel (CWE-319), allowing anyone able to observe that traffic to capture the secrets and use them for unauthorized access to Autodesk services. The published CVSS 3.1 vector (7.5) is AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H, which describes a constrained scenario - local positioning, high attack complexity, some existing privileges, and a legitimate user triggering the SDK operation - while our independent assessment (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) models an on-path observer on an adjacent network with confidentiality-only impact; either reading requires the attacker to already be positioned to observe the cleartext transmission. Exploitation is limited to loss of confidentiality of transmitted secrets, not code execution or integrity compromise, and there is no public exploit identified at time of analysis; a vendor patch is available per the Autodesk advisory.
Authenticated users on Discourse sites running the bundled Chat plugin can receive live and recent private-category channel messages they are not entitled to see, because the MessageBus publication audience for a read-restricted category channel is bounded by category visibility alone and never verifies Chat eligibility under the site's group restrictions (CWE-862 missing authorization). Only sites where chat is enabled, a chat channel is attached to a read-restricted category, and chat_allowed_groups are configured such that a user may view the category while being excluded from Chat are affected; exploitation requires a valid authenticated account with category-view access, which the assessed vector reflects (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Disclosure is confined to messages flowing through the MessageBus stream and its short backlog - the Chat API does not expose full channel history, and no message creation or modification is possible - making this a moderate confidentiality-only issue with no public exploit identified at time of analysis.
Remote, unauthenticated code execution is possible in the HPE NonStop SNMP Trap Multiplexer, which processes inbound SNMP trap messages on the HPE NonStop platform. An attacker who can reach the trap-receiving interface can deliver a crafted trap that overflows a stack buffer (CWE-121); our independent assessment rates the full impact as high for confidentiality, integrity and availability (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), whereas the vendor-published 7.5 vector reflects only an availability impact (C:N/I:N/A:H) - a conflict that must be reconciled with HPE before prioritization. Exploitation requires network reachability to the trap listener and no credentials, privileges, or user interaction (PR:N/UI:N); no public exploit code has been identified at time of analysis and the CVE is not in CISA KEV. Exposure is confined to the specialized population running HPE NonStop with this multiplexer deployed - typically banking, telecom and transaction-processing environments - which limits the scale but not the severity of a successful attack.
Missing authorization in the Crocoblock JetFormBuilder WordPress plugin through version 3.6.6 allows unauthenticated network attackers to reach an improperly access-controlled endpoint, with the assessed impact being availability-only (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Per the independent assessment, exploitation requires a site with an affected version where the specific vulnerable plugin action is reachable, and no public exploit was identified at time of analysis. Signals are mixed and point to a moderate, not top-tier, priority.
Customer account takeover in the Appointment Booking Plugin - LatePoint | Calendar & Scheduling for WordPress through 5.7.2 is possible on sites that enable the 'Use WordPress users as customers' option: an authenticated Subscriber-level attacker whose own user_login equals a victim customer's email address causes their WordPress user ID to be linked into that victim's LatePoint customer row, exposing the victim's bookings, services, agents and calendar data and overwriting the victim's email address the next time the victim logs in. Exploitation is tightly conditional - it requires the opt-in WordPress-user integration, a Subscriber account (commonly obtainable when open registration is enabled), and prior knowledge of the target's email address, so the attack is per-victim and targeted rather than mass-exploitable; no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was provided in the source data. The flaw has been assigned CVSS 7.4 with high confidentiality and integrity impact but no availability impact, and a fix appears to have shipped in the 5.7.3 release.
An authenticated administrator on Hitachi Vantara can retrieve password reset codes for arbitrary users through a privileged API, enabling takeover of other accounts on the application. This CWE-640 weakness is rated 7.4 High by CVSS 4.0 and requires high privileges (PR:H per the CVSS vector), so exploitation is confined to malicious insiders or attackers who already possess administrator access; device credentials and customer data remain inaccessible per the vendor. No public exploit identified at time of analysis.
Unauthenticated administrative account takeover in FileRise versions prior to 3.16.0: because the application treats an empty or missing users.txt as a fresh installation, a remote caller with no credentials can detect that first-run setup has silently reopened and create the next initial administrator account through the setup flow. The empty-user-store condition must first arise from storage loss, truncation, or another failure after setup previously completed (hence the AC:H rating), so reliably-stored, intact installations are not exposed; once that state exists, exploitation requires no authentication and no user interaction (PR:N/UI:N) and yields high confidentiality and integrity impact (CVSS 7.4). There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, though the flaw is trivially reproducible by anyone who notices the exposed setup page.
Privilege escalation in Google Cloud Application Integration (versions prior to 2026-08-27) allows an authenticated low-privilege user within a Google Cloud project to abuse AuthConfig validation and the integration execution runtime to impersonate a higher-privileged service account and gain that account's cloud permissions. The flaw is classified as Incorrect Authorization (CWE-863) with a CVSS v4.0 base score of 7.3; there is no public exploit identified at time of analysis and no CISA KEV listing. Google remediated the issue server-side on 27 August 2026, so current Google Cloud instances are no longer affected and no customer patching action is required.
Memory corruption in NASA's F´ (F Prime) FpySequencer component, affecting framework versions prior to 4.2.0, lets an authenticated high-privilege actor who can load and execute flight sequences bypass the sequencer's stack write bounds check via a U32 integer wraparound in a STORE directive, so memcpy writes outside the sequencer stack and can cause denial of service, memory corruption, and potentially code execution. It is rated CVSS 3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) because the malicious sequence must be supplied and run - typically requiring trusted commanding, uplink, or ground-system authority - making it an access-gated risk rather than an unauthenticated mass-exploitation threat. No public exploit has been identified at time of analysis, there is no CISA KEV entry, and the vendor released a fixed version (4.2.0).
Session hijacking in the VideoWhisper Broadcast Live Video WordPress plugin (up to version 7.3.2) is enabled by a session fixation flaw (CWE-384), allowing remote attackers to take over authenticated sessions, but only if a victim logs in while an attacker-controlled session ID is active (UI:R per independent assessment). No public exploit code exists and no active exploitation is confirmed (not in CISA KEV). The published CVSS 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) overstates the required user interaction and availability impact; the assessed vector is AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N.
Markdown Preview Enhanced, the VS Code Markdown preview extension, fails to validate webview-to-extension-host messages prior to version 0.8.30: the handler in src/preview-provider.ts accepts any attacker-supplied _crossnote.{command} plus arbitrary args and forwards it to vscode.commands.executeCommand with no allowlist or type checking. JavaScript already running inside the preview webview - obtainable via the separately tracked .crossnote/head.html script-injection flaw (GHSA-mcwg-4j78-qwv3) - can therefore invoke privileged extension commands such as updateMarkdown, chromeExport, pandocExport, and runCodeChunk with attacker-selected arguments, enabling file writes, code-chunk execution, export-tool execution, and arbitrary URL opening within the victim's workspace context. Exploitation is conditional rather than standalone: it requires a pre-existing webview JavaScript execution primitive and a victim who opens and previews attacker-controlled repository content, and no public exploit code has been identified at time of analysis; both the bridge-abuse bug and its most practical trigger are resolved in 0.8.30.
Insecure storage of sensitive information in Progress MOVEit Transfer allows an authenticated low-privilege local user to recover confidential material - most plausibly stored credentials, keys, or configuration secrets - from the MOVEit Transfer host, as reflected by the assessed CVSS 3.1 vector AV:L/AC:L/PR:L/UI:R/C:H, which requires local presence, a valid account, and user interaction. Affected builds are MOVEit Transfer before 2025.1.6 and 2026.0.0 through 2026.0.3, with remediation in 2025.1.6 and 2026.0.4 per the Progress September 2026 security bulletin. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); note that the authoritative independent assessment rates the impact as confidentiality-only (C:H/I:N/A:N), not the integrity and availability impact implied by the 7.3 base score in the raw feed.
PHP Object Injection in the Post Export Import with Media WordPress plugin (versions ≤1.17.1) allows authenticated administrators to inject arbitrary PHP objects via deserialization of untrusted input, but the flaw has no impact unless a separate plugin or theme provides a usable POP gadget chain. If such a chain exists, the attacker could delete files, retrieve sensitive data, or execute code. No public exploit code has been identified, and the issue is considered conditional and lower-priority despite the 7.2 CVSS score.
Authenticated attackers with high privileges on SonicWall Network Security Manager (NSM) on-prem can execute arbitrary OS commands via an OS command injection flaw (CWE-78), achieving remote code execution. The vulnerability affects NSM on-prem versions 4.3.1 and earlier, requires a privileged session (PR:H), and is assessed with high attack complexity (AC:H) due to unenumerated specific conditions. No public exploit code or active exploitation has been identified (CISA KEV status: none; SSVC exploitation: none), and the EPSS score is 0.54% (44th percentile), indicating a moderate-priority risk rather than an urgent emergency.
Missing authorization in the VideoWhisper Paid Videochat Turnkey Site (ppv-live-webcams) WordPress plugin, in all versions through 7.5.12, lets unauthenticated remote attackers invoke plugin functionality that should be gated behind an access-control check, rated CVSS 3.1 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). The accessible functionality yields only low confidentiality, integrity and availability impact rather than full site compromise, and real-world exposure is bounded by the narrow install base of this specialized pay-per-view videochat plugin. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Stored cross-site scripting (XSS) in the Verified Reviews (Avis Vérifiés) WordPress plugin up to version 2.4.6 allows unauthenticated attackers to inject arbitrary web scripts via the 'moderation' parameter, which execute when a user views an affected page. The plugin's ntav_check_data() function uses loose '!=' comparisons, enabling signature verification bypass by sending a JSON body with boolean true for idWebsite and sign. No public exploit identified at time of analysis; CVSS 3.1 score is 7.2 (HIGH).
Stored cross-site scripting in the Cryptocurrency Donation Box plugin for WordPress (all versions up to and including 2.2.13) allows unauthenticated attackers to persist arbitrary JavaScript via the data_object parameter of the cdbbc_payment_verify AJAX action, which executes whenever a user opens an injected page. The plugin registers that AJAX action under wp_ajax_nopriv_ and its only gate is a nonce that is publicly exposed to anonymous visitors inside the wallets_data JavaScript object emitted by the [crypto-donation-box] shortcode, so exploitation needs no credentials (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C, score 7.2) and no non-default configuration - any site publishing the shortcode is exposed. Impact is gated on the second-order step: the injected script fires when a logged-in user, typically an administrator, views the plugin's donation list table in wp-admin. No public exploit code or confirmed active exploitation is identified at time of analysis, and the practical exposure is limited to sites running this niche plugin.
Stored cross-site scripting in the WordPress plugin Smart Forms - When You Need More Than Just a Contact Form (all versions up to and including 2.6.104) lets unauthenticated attackers inject arbitrary JavaScript through the 'formString' parameter, which is persisted and later executed in the browser of any user, typically an administrator, who views the affected page or the form-entries listing. The nonce and authentication check on the rednao_smart_forms_save_form_values AJAX handler is enforced only when the non-default smart_forms_block_anonymous_submissions option is enabled, so default installations accept and store malicious payloads from anyone with network access. No public exploit code has been identified at time of analysis, but the unauthenticated access path, low attack complexity, and scope-changing admin-context execution make this an elevated-priority issue for affected sites; impact still depends on a privileged user subsequently rendering the stored payload.
Cross-company record deletion in InvoiceShelf 2.3.3 and earlier allows an authenticated user with membership in any one company to destroy data belonging to other tenants on the same instance. The bulk-delete validators (DeleteCustomersRequest, DeleteEstimatesRequest, DeleteExpensesRequest, DeleteInvoiceRequest, DeleteItemsRequest, DeletePaymentsRequest and DeleteUserRequest) verify that submitted identifiers exist but do not consistently bind them to the caller's company_id, so an attacker who supplies a foreign numeric ID can delete customers, estimates, expenses, invoices, items, payments or user accounts outside their own tenant. Exploitation requires a valid account (PR:L) and a multi-tenant deployment; single-company self-hosted installs have no cross-tenant data to target. No public exploit code or active exploitation was identified at time of analysis, and the vendor released a fix in 2.4.0.
Stored cross-site scripting in the Mang Board WordPress plugin affects every version up to and including 2.4.3, allowing unauthenticated remote attackers to inject arbitrary web scripts through the 'user_name' parameter that execute in the browser of any visitor who later loads a page rendering the stored value. The payload slips past the plugin's mbw_htmlspecialchars2() save-time sanitizer because it relies only on unquoted HTML attribute syntax built from spaces, alphanumerics, and characters such as =, parentheses, and dots, none of which that routine escapes. Impact is confined to client-side script execution in the context of the vulnerable site (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2), and no public exploit identified at time of analysis.
Path-restriction bypass in BusyBox httpd's reverse proxy feature allows unauthenticated remote attackers to reach backend paths outside the configured forwarding prefix. When URL-prefix proxying is configured, only the first request on a TCP connection has its path rewritten; a pipelined second request is relayed verbatim, defeating the intended prefix restriction and exposing arbitrary backend routes. Affects BusyBox httpd deployments, including Red Hat Hardened Images, that enable the non-default reverse proxy directive; no public exploit identified at time of analysis. CVSS 3.1 base score 7.2 (High) reflects network reachability, low complexity, no privileges or user interaction, and changed scope impacting the proxied backend.
Stored cross-site scripting in the 'Record of Consent Extension for Complianz' WordPress plugin (all versions up to and including 2.5) lets unauthenticated attackers persist arbitrary JavaScript into stored consent records via the 'uid' parameter, which then executes in the browser of any user - including an administrator reviewing the consent records admin tab - who later loads the tainted page. The write path is anonymously reachable because the enforcing nonce is emitted through wp_localize_script on wp_enqueue_scripts, making it readable by any frontend visitor, and no capability or role check gates the write path. It carries a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N); no public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting in the NewStatPress WordPress plugin (versions up to and including 1.4.5) lets unauthenticated attackers plant script payloads through the visitor-supplied query string that the plugin automatically logs into its statistics table. The payload is rendered unescaped inside a single-quoted href attribute in the 'Last referrers' meta box on the plugin's Overview admin page, so it executes only when a high-privileged user - typically an administrator - opens that page and hovers the injected link. No public exploit code was identified at time of analysis and there is no CISA KEV listing, so this is assessed as a moderate-priority issue given the mandatory admin interaction and the reliance on an administrator eventually reviewing referrer statistics.
Stored cross-site scripting in the NewStatPress WordPress plugin (all versions through 1.4.5) allows unauthenticated attackers to plant arbitrary JavaScript that later executes in the browsers of visitors viewing a page that renders the plugin's 'Top Pages' output. The injected payload arrives through the QUERY_STRING/REQUEST_URI value of a crafted request, which the plugin records and later reflects without sanitization or output escaping. Exploitation is gated rather than trivial: an administrator must have published the [NewStatPress type="Top Pages"] shortcode on a publicly viewable page, and the attacker's crafted URL must accumulate enough hits to enter the plugin's top-N ranking before anything is displayed - a condition reflected in the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N), which lowers complexity confidence from the reported 7.2 HIGH to account for those prerequisites. No public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting in the FV Flowplayer Video Player WordPress plugin (all versions up to and including 7.5.54.7212) allows unauthenticated attackers to inject arbitrary JavaScript through the 'synopsis' shortcode attribute, which then executes in the browser of any visitor who opens the affected page. The plugin fails to sanitize the attribute on input and fails to escape it on output; the injection only reaches a vulnerable code path when the plugin's 'Parse Vimeo and YouTube links' (parse_comments) option is enabled and a shortcode uses liststyle="season". Because of that dual, non-default configuration prerequisite, an independent re-assessment rates the attack complexity as High (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) rather than the vendor-facing AC:L, though the unauthenticated, no-user-interaction injection vector is unchanged. No public exploit code and no CISA KEV entry were identified at time of analysis.
Stored cross-site scripting in the WordPress plugin Contact Form DB for Enfold (all versions up to and including 2.0.2) lets unauthenticated attackers inject arbitrary JavaScript through public-facing Enfold contact form submissions, which is then rendered unescaped when an administrator opens the plugin's form-entries page at admin/ecf_index.php. The CVSS 3.1 base score is 7.2 (High), driven by AV:N/AC:L/PR:N/UI:N with a scope change and Low confidentiality and integrity impact; the practical prerequisite is that a logged-in privileged user must subsequently view the stored submissions, so exploitation is stored rather than immediate. No public exploit code was identified at time of analysis, and there is no indication of confirmed active exploitation (CISA KEV).
Stored cross-site scripting in the Document Gallery plugin for WordPress (all versions up to and including 5.1.1) allows unauthenticated remote attackers to inject arbitrary JavaScript into the plugin's thumber webhook action request body, which is later rendered unsanitized in the plugin's administrative logging view and executes in the browser of any user who opens the affected page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) makes this look like a high-priority unauthenticated XSS, but exploitation has a real prerequisite: logging must be enabled in the plugin's Advanced settings, which is only the default when WP_DEBUG is true, so an administrator on a normal production site must have manually turned logging on - default installations are not affected. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor-released patch version is confirmed in the available data.
Stored cross-site scripting in the AnyComment WordPress plugin (all versions up to and including 0.3.6) allows unauthenticated attackers to submit a crafted 'email' value to the public /wp-json/anycomment/v1/subscribe REST endpoint, which is then stored and later rendered unescaped into an HTML table cell on the AnyComment Subscriptions admin screen. The payload fires only when an administrator subsequently opens AnyComment → Subscriptions, so the affected audience is limited to authenticated dashboard users rather than the public comment stream; scoped impact per the assessed vector is limited confidentiality and integrity (C:L/I:L) with a scope change (S:C). No public exploit code was identified at time of analysis, and exploitation requires the specific precondition that the stored subscription's user_ID does not resolve to an existing WP_User, which is the code path that bypasses escaping.
An authorization bypass in n8n versions before 1.123.83 allows an authenticated user with editor (write) access to a shared workflow to execute restricted credentials that belong to another user, by embedding those credentials inside nested or tool inline sub-workflow definitions. When the workflow runs, the sub-workflows execute using the credential owner's secret values rather than being rejected against the attacker's own credential scope. This is a conditional privilege/authorization issue rather than a drive-by remote threat: it requires a multi-user instance with shared workflows and scoped credential sharing, an editor-level account, and the presence of at least one restricted credential owned by someone else - single-user instances and deployments without shared workflows are not affected. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation; the issue is reported as an Authentication Bypass and is fixed in n8n 1.123.83.