Heap out-of-bounds read in Sofia-SIP through 1.13.18 allows unauthenticated remote attackers to crash SIP processes by sending INVITE requests with a multipart Content-Type whose MIME boundary exceeds the body length, causing memcmp to read past a heap buffer. Publicly available exploit code exists, and the vulnerability is remotely triggerable without authentication or user interaction, affecting network-reachable SIP endpoints such as FreeSWITCH servers. The primary impact is denial of service (availability), with no confidentiality or integrity impact.
Unauthenticated path traversal in Janus WebRTC Server through 1.4.3 allows attackers to write files outside the configured recordings path via the Record&Play plugin's record request filename when the plugin is loaded and its signaling API is reachable. Exploitation is limited: the attacker can only create or truncate files ending in -audio.mjr, -video.mjr, or -data.mjr where the Janus process has write permissions, yielding low integrity impact (CVSS 6.9). Publicly available exploit code exists, but no confirmed active exploitation (CISA KEV) has been reported.
Server-side request forgery in Portkey AI Gateway 1.14.0 through 1.15.2 lets unauthenticated remote attackers make the gateway issue requests to loopback and Docker host services and return the responses to the caller. The flaw exists because the isValidCustomHost check trusts localhost-style hostnames whenever the TRUSTED_CUSTOM_HOSTS environment variable is unset, which is the default configuration; an attacker only needs to send a /v1 request carrying a crafted x-portkey-custom-host header (for example via the ollama provider). Publicly available exploit code exists for this issue and it is not listed in CISA KEV, so exploitation activity is not confirmed; the assessed impact is limited to confidentiality and integrity of services reachable from the gateway host, with no availability or code-execution impact.
Heap out-of-bounds read and write in MuJS 1.3.6 through 1.3.8 allows attackers to corrupt process memory by supplying JavaScript that inflates a simple/dense array's length property and then invokes Array.prototype.sort, driving the internal Ap_sort_cmp and Ap_sort_swap helpers to index slots past the allocated heap buffer; the practical result is memory corruption and a process crash (CVSS 4.0 base 6.9, AV:L/AC:L/PR:N/UI:P with high availability and low integrity impact). Publicly available exploit code exists, including a published proof-of-concept write-up demonstrating the array-length trigger, but the issue is not confirmed as actively exploited (no CISA KEV listing) and exploitation requires a target application embedding MuJS to execute attacker-controlled script that a victim loads or opens. Deployments that only ever run trusted, first-party JavaScript are not exposed, and MuJS 1.3.9 and later contain the fix; this is a genuine but moderate-priority memory-corruption flaw rather than an emergency.
Memory corruption in libzvbi through 0.2.45 can occur when a victim application decodes an attacker-supplied Teletext stream containing X/28/3 DRCS packets with unvalidated pixel-mode values, driving an out-of-bounds write in convert_drcs. Exploitation requires local decoding of the malicious stream and passive user interaction (opening or processing the stream/capture), and publicly available exploit code exists; there is no confirmed active exploitation. The out-of-bounds write (CWE-787) crashes the application and may corrupt memory, making this a moderate-severity, low-urgency issue rather than a top priority.
Stored cross-site scripting in the WordPress plugin Image Photo Gallery Final Tiles Grid (all versions before 3.6.16) lets an authenticated user with contributor-level access or higher inject JavaScript via unescaped gallery lightbox configuration values, which is then printed into an inline script on every page that embeds the affected gallery. The payload is stored and inert until a victim - most critically an administrator - loads such a page, so successful abuse requires victim user interaction and yields code execution in that victim's browser, enabling session/token theft or privileged actions performed as the victim. Publicly available exploit code exists (per WPScan's disclosure), though the EPSS score is low at roughly 0.20 percent (9th percentile) and there is no confirmed active exploitation; risk is moderate and gated on sites granting contributor+ accounts to untrusted users.
Stored cross-site scripting in the Gutenverse Form WordPress plugin before 3.0.11 lets authenticated users with Contributor-level access or higher plant malicious SVG icon markup in a form block, which the plugin decodes and inserts into the page without sanitization so the script executes in the browser session of any user who views or previews the form - typically an administrator reviewing a pending post. Exploitation is conditional: it requires the vulnerable plugin with an SVG-icon form block, an attacker-controlled Contributor account (open self-registration or an otherwise obtained account), and a higher-privileged victim who renders the form, so publicly available exploit code exists but the payload stays inert until a privileged session triggers it. The vendor patch is available in 3.0.11, EPSS is very low at 0.19% (8th percentile), and there is no indication of confirmed active exploitation (no CISA KEV listing), making this a moderate, real-but-conditional risk rather than an urgent emergency.
Stored cross-site scripting in the Donation Thermometer WordPress plugin affects versions 2.2.9 up to but not including 2.3.0, allowing an authenticated user with the Contributor role or higher to inject arbitrary event handlers via an unescaped colour value passed through a shortcode attribute, which then executes in the browser of any higher-privileged user who views or previews the affected page. Publicly available exploit code exists for this flaw per the WPScan advisory, though there is no indication of confirmed active exploitation (not listed in CISA KEV); EPSS is low at roughly 0.18% (8th percentile), reflecting the authenticated and user-interaction prerequisites. Realistic exposure is limited to sites that permit untrusted users to register as Contributors or otherwise accept contributor-authored content, since anonymous visitors cannot trigger the injection.
Stored cross-site scripting in the Pricing Table WordPress plugin (versions 1.0.7 through before 2.1.5) lets an authenticated user with contributor-level access or higher save a link value using a script-bearing scheme such as javascript: inside one of the plugin's blocks; that value is rendered without scheme validation and executes in the browser of another, typically higher-privileged user who views and interacts with the affected pricing table content. Vendor-released patch: 2.1.5, and publicly available exploit code exists, though CISA's SSVC assessment records no active exploitation, the issue is not KEV-listed, and EPSS is low at 0.18% (8th percentile). Practical exposure is limited because the attacker needs a pre-provisioned low-trust account and a second user must interact with the poisoned block, which places this in the moderate tier despite its base score.
Stored cross-site scripting (XSS) in the WordPress plugin PublishPress Future before 4.10.6 allows an authenticated attacker with Contributor or higher privileges to inject JavaScript that executes when a higher-privileged user views the affected content. Publicly available exploit code exists, but no KEV entry is provided, so active exploitation is not confirmed; EPSS is low at 0.18% (8th percentile), and the independent assessment treats this as a moderate-priority issue limited to multi-author sites with untrusted contributors. The required victim interaction and need for a pre-existing low-trust account are the main limiting factors.
Stored cross-site scripting in the Image Photo Gallery Final Tiles Grid WordPress plugin (all versions before 3.6.15) allows an authenticated user with contributor-level access or above to persist JavaScript inside gallery configuration values, which the plugin echoes unsanitized into an inline script on every page that embeds the gallery. Any visitor who loads such a page - including an administrator - will execute the injected script in the context of the site, per the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV; SSVC exploitation: none) and EPSS is low at 0.18% (8th percentile), so this is a moderate-priority issue whose real-world risk depends on whether the site grants posting privileges to untrusted users and whether an administrator can be lured onto a gallery page.
An out-of-bounds heap read in unshield through 1.6.2 lets a crafted InstallShield cabinet file with an out-of-range file_table_offset or an abnormally large file count crash the unshield command-line tool or any application linking libunshield. Exploitation is local and requires the victim or an automated pipeline to actively open the malicious .cab file (CVSS 4.0 base 6.8; assessed 3.1 as AV:L/AC:L/PR:N/UI:R with availability-only impact). Publicly available exploit code exists, but the realistic outcome is denial of service - no code execution or data disclosure has been demonstrated - and there is no evidence of confirmed active exploitation (CISA KEV).
A NULL pointer dereference in ELFIO through 3.12 allows a crafted ELF object file to crash any application that parses it, yielding availability-only denial of service without memory corruption, code execution, or data exposure. The defect lives in relocation_section_accessor::get_entry(), which trusts the sh_link index of a SHT_REL or SHT_RELA section; when that index dangles, find_hash_section() returns null and the subsequent dereference aborts the process. Publicly available exploit code exists, and although the CVSS 4.0 vector is PR:N (no privileges required) it is AV:L with UI:P, so the practical scenario is local tooling or an ingestion pipeline that opens attacker-supplied binaries rather than a remotely reachable service; there is no evidence of confirmed active exploitation in the wild.
Unauthenticated attackers can mark arbitrary WooCommerce orders as paid without any payment being made by abusing the hosted-payment return handler in the Trust Payments Gateway for WooCommerce plugin at versions before 3.1.0. Because that callback is not checked for authenticity, not bound to a specific order, and not validated against the amount paid, a single forged request to the public return endpoint is enough to flip an order to paid, and the same path can expose order and customer details. Publicly available exploit code exists (WPScan), but EPSS is low at 0.17% (5th percentile) and CISA's SSVC assessment records no exploitation, so this is a genuine but moderate-priority integrity and data-exposure issue rather than a mass-exploitation event.
Unauthenticated attackers can interfere with SSL certificate provisioning in the WP Encryption WordPress plugin versions before 7.8.8.2 by hitting a handler that performs neither a capability check nor a nonce check. A single request lets an attacker overwrite the site's certificate private key and replace the pending Let's Encrypt order and challenge material; repeated requests keep regenerating that material so the administrator can never complete issuance, resulting in a persistent denial of the certificate-provisioning workflow. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, score 6.5) confirms remote, unauthenticated exploitation with low integrity and availability impact and no confidentiality loss; publicly available exploit code exists according to WPScan, but there is no evidence of active exploitation and EPSS is low at 0.12% (2nd percentile). Exposure is limited to internet-reachable sites running the vulnerable plugin while an administrator is attempting Let's Encrypt issuance through it.
Unauthenticated remote attackers can forge payment gateway return requests in the Visma Pay for WooCommerce WordPress plugin before 1.2.2, marking arbitrary WooCommerce orders as paid and disclosing the customer name, email address, and postal address associated with any order. The flaw is exploitable when the store has not entered a merchant secret, because the plugin validates return requests against that empty secret; fully configured stores with a non-empty secret are not described as exploitable in the same way. Publicly available exploit code exists, and the issue is rated CVSS 6.5 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.
Authenticated users holding only subscriber-level accounts can modify, corrupt, or delete media-library attachments owned by other users-including administrators-through the Classified Listing WordPress plugin before 6.1.1. The defect is a missing-authorization flaw (CWE-862) triggered specifically when a gallery request references an unattached media item, which the plugin fails to check for ownership or edit capability. Publicly available exploit code exists and the plugin is a confirmed target for the WPScan research team, but there is no KEV listing or independent evidence of active exploitation, and EPSS is a low 0.17% (6th percentile); impact is confined to integrity and partial availability with no confidentiality loss (C:N).
HTML injection in Responsive Blocks WordPress plugin before 2.3.0 allows unauthenticated remote attackers to place arbitrary HTML, including phishing links, into notification emails sent to the site owner when a crafted value is submitted through the plugin's Form block. The issue is moderate, not critical: the independently assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, so there is no server-side code execution, confidentiality loss, or availability impact, and the injected content only matters if the recipient opens the email and interacts with the attacker-supplied HTML. Publicly available exploit code exists, but there is no evidence of confirmed active exploitation (CISA KEV) from the provided data.
Unauthenticated attackers can mark arbitrary WooCommerce orders as paid on stores running the Asaas Gateway for WooCommerce plugin before 2.7.8, because the plugin's payment webhook accepts an empty access token under its default configuration and never confirms that the notified payment actually belongs to the order it updates (CWE-287 improper authentication). Exploitation needs only the vulnerable plugin installed, active, and network-reachable in its default state, and publicly available exploit code exists; CISA's SSVC decision data records no observed exploitation and EPSS is low at 0.22% (12th percentile). The impact is confined to integrity of order payment status - no data disclosure or availability loss - but stores that auto-fulfill or auto-provision on a 'paid' status can suffer fraudulent fulfillment and revenue loss.
Unauthenticated information disclosure in the GamiPress WordPress plugin (affected versions 7.9.5 up to but not including 8.0.6) lets remote attackers retrieve private activity-log entries belonging to any user on the site without logging in, as no authentication, user interaction, or non-default configuration is required. The issue is an incomplete fix of CVE-2026-13450, meaning the earlier attempt to lock down these log entries left a bypass that still permits access to another user's private activity data. Publicly available exploit code exists and the flaw is fully automatable, though CISA's SSVC assessment records no observed exploitation; EPSS is low at roughly 0.19% (8th percentile), and the impact is confined to read-only leakage of activity-log content, so sensitivity depends on how the site uses GamiPress tracking.
Unauthenticated information disclosure in the AWP Classifieds WordPress plugin before version 4.4.9 lets remote attackers read the private contact email address stored on any listing by submitting a request to the ad submission page that references a payment transaction. The plugin omits the ownership/authorisation check on that code path, so no account, login, or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, score 5.3); the only exposure is the listing's private contact email, not credentials, content modification, or site control. Publicly available exploit code exists and WPScan published a proof-of-concept write-up, but there is no KEV entry and EPSS is low at 0.19% (8th percentile), so this is a genuine low-to-moderate priority issue affecting only sites running this optional plugin with listings that store private contact emails.
Unauthorized export of complete database table contents in the WP Data Access WordPress plugin before 5.5.84 lets unauthenticated remote attackers retrieve every row and column of any table the site publishes publicly, including data hidden from the on-page view, by reusing a token the plugin itself prints into those public pages. The flaw carries a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (5.3), so impact is confined to confidentiality with no modification or denial of service. Publicly available exploit code exists, but there is no confirmed active exploitation and EPSS is low at 0.18% (7th percentile); a vendor-released patch in version 5.5.84 is available.
Unauthenticated information disclosure in CodeAtoZ B2B Suite for WooCommerce before 1.6.1 allows remote attackers to retrieve other guests' submitted quotes, including buyer names, email addresses, and requested line items, by supplying an enumerable identifier. No authentication or user interaction is required, and publicly available exploit code exists, though the EPSS score is only 0.18% (7th percentile). This is a moderate-severity issue (CVSS 5.3) with impact limited to confidentiality of quote data, and no active exploitation has been confirmed (not in CISA KEV).
Unauthenticated configuration tampering in the LTL Freight Quotes WordPress plugin before 4.2.19 allows remote attackers to modify some of the plugin's stored settings by calling a REST route that performs no authorization check or input validation before writing to the database (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Only WordPress sites running this specific plugin below version 4.2.19 are exposed, and the assessed impact is integrity-only - settings can be altered, but the flaw does not permit data disclosure or site takeover. Publicly available exploit code exists and has been documented by WPScan, though there is no confirmed active exploitation (CISA KEV does not list this CVE) and EPSS is very low at 0.17% (6th percentile).
Unauthenticated remote attackers can delete or overwrite stored abandoned-cart records in the WordPress plugin Cart Abandonment Recovery for WooCommerce (all versions before 2.1.4) by supplying a customer's email address, which the plugin uses as the record key without verifying that the requester owns that address (CWE-639, CVSS 5.3). Exploitation requires only a known or guessable email per target record, so the attacker cannot mass-wipe blindly without an email list, and the impact is confined to abandoned-cart data - no passwords, orders, or payment details are exposed given C:N/I:L and SSVC technical impact of partial. No confirmed active exploitation has been reported (not in CISA KEV), but publicly available exploit code exists per WPScan and EPSS is 0.17% (5th percentile), indicating a genuine yet low real-world risk that is fully resolved by upgrading to 2.1.4.
Unauthenticated attackers can mark WooCommerce orders as paid without any payment taking place on sites running the Paymentfor Gateway for WooCommerce plugin before 1.0.6, because the plugin never verifies that an inbound payment notification actually came from the payment provider. Exploitation is simple for anyone who can reach the gateway's notification (callback/IPN) endpoint and reference an existing order - publicly available exploit code exists, and no credentials or user interaction are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) - but the risk is real yet bounded, since only stores that installed and enabled this specific gateway are affected. EPSS is low at 0.17% (5th percentile), there is no CISA KEV listing, and a vendor fix is available in version 1.0.6.
Unauthenticated attackers can mark arbitrary pending orders as paid in the Sifalo Pay WordPress plugin before version 2.5.3 by reusing a single valid payment transaction identifier harvested from a legitimate purchase of their own, because the plugin does not bind that identifier to the order being confirmed and does not check that the requester owns the order. The result is a moderate-severity integrity flaw (CVSS 5.3, CWE-639, PR:N/UI:N, no confidentiality or availability impact); publicly available exploit code exists, but there is no confirmed active exploitation, EPSS is low at 0.17 percent (5th percentile), and CISA SSVC records exploitation as none while noting the issue is automatable. Reaching the flaw still requires a site running a vulnerable plugin version with pending orders in its flow plus at least one real transaction the attacker can complete to obtain a usable identifier.
Unauthenticated attackers can write arbitrary payment session metadata onto any order and force any awaiting-payment order into a failed state in Sifalo Pay WordPress plugin versions before 2.5.3, because the payment-return handler does not verify order ownership or authorization. Publicly available exploit code exists, though EPSS is 0.17% (5th percentile) and no active exploitation is confirmed. The independent assessment rates this as a genuine but limited-impact medium issue: no code execution, no confidentiality loss, and only low integrity and availability impact.
Price manipulation in the SellKit WordPress plugin before 2.8.0 lets unauthenticated remote attackers place checkout orders at a self-chosen price for any purchasable product, because the plugin trusts a client-supplied price during server-side total recalculation. Publicly available exploit code exists, and EPSS is 0.17% (5th percentile); the vendor has released a patch. The flaw is a business-logic missing-authorization issue (CWE-862) with CVSS 5.3, and impact is limited to integrity-attackers can underpay but cannot read data or disrupt availability.
Robokassa Payment Gateway for WooCommerce versions before 1.9.0 accepts incoming payment-notification requests without verifying their authenticity, allowing unauthenticated remote attackers to force any WooCommerce order into a failed state. Because order identifiers are sequential and enumerable, an attacker can walk through the shop's entire order queue one request at a time, removing every order from fulfilment. Publicly available exploit code exists and a vendor patch is available in 1.9.0; EPSS is low (0.17%, 5th percentile) and there is no KEV listing indicating confirmed active exploitation, so this is best treated as a moderate-priority business-logic integrity issue rather than a top-tier emergency.
Unauthenticated visitors to any WordPress site running the 'Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant' plugin below version 5.3.2 can invoke an AJAX action that re-registers the store with the plugin's feed service and overwrites the stored shop secret, because that action performs neither a nonce nor a capability check (CVSS 3.1 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). The impact is integrity-only and confined to the plugin's feed registration state - there is no code execution, data disclosure, or site takeover path - and publicly available exploit code exists per the WPScan advisory. Real-world urgency is low: EPSS is 0.17% (5th percentile) and the CISA SSVC assessment records exploitation as 'none', with only the plugin version being a precondition.
Unauthenticated remote requests targeting the EmbedPress WordPress plugin (all versions before 4.6.8) can force the site to make server-side, credential-bearing calls to a third-party API and then write attacker-controlled cache entries into the site database. Because the vulnerable handler performs no capability or nonce check, any anonymous visitor can trigger it repeatedly, consuming the site owner's metered third-party API quota and inserting unbounded rows into the WordPress database when the plugin is installed, active, and configured with API credentials. Publicly available exploit code exists for this issue, so weaponization is trivial, though the EPSS score is low (0.17%, ~5th percentile), SSVC records no observed exploitation, and there is no confidentiality exposure or remote code execution - impact is limited to integrity/integrity-adjacent resource abuse.
Unauthenticated attackers can modify data in the WP Data Access WordPress plugin before version 5.5.77 by abusing one of the plugin's REST endpoints that verifies only read permission before carrying out a write. Exploitation is conditional on configuration: an administrator must have exposed a WP Data Access 'application' for anonymous (public) read access, and on such sites the administrator's explicit disabling of update actions offers no protection because the broken authorization check bypasses that control. Publicly available exploit code exists, but EPSS is low at 0.17% (5th percentile) and CISA's SSVC assessment rates exploitation as 'none'; impact is limited to integrity (CVSS 5.3, C:N/I:L/A:N) with no confidentiality or availability effect, and no authentication or user interaction is required against the vulnerable endpoint (PR:N/UI:N per the CVSS vector).
Unauthenticated attackers can forge Mobile Money payment confirmations against WordPress sites running the CamPay Shortcode Payment Gateway plugin before 1.7, marking fraudulent orders as paid, deleting genuine payment records, and writing plugin meta onto arbitrary posts. The root cause is a missing-authorization failure (CWE-862): the plugin's confirmation handling derives the payment outcome directly from client-supplied parameters rather than verifying authenticity with CamPay, so no login, user interaction, or non-default configuration is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). Publicly available exploit code exists per WPScan, but observed exploitation is not recorded (EPSS 0.17%, 5th percentile; CISA SSVC exploitation: none), and the vendor has released a fix in version 1.7.
Unauthenticated remote attackers can delete the stored SEO analysis data held by the Rank Math SEO WordPress plugin in any version before 1.0.280, because the routine that wipes that data enforces neither a capability check nor a nonce. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:N/I:L/A:N, 5.3) reflects an unauthenticated, network-reachable integrity-only impact: confidentiality and availability are untouched, so the realistic damage ceiling is loss of the plugin's cached SEO analysis results rather than site compromise or downtime. Publicly available exploit code exists and the vendor has shipped a fix, but CISA's SSVC evaluation rates exploitation as "none" and EPSS is only 0.17% (5th percentile), so this is a low-to-moderate priority issue and not confirmed actively exploited (no CISA KEV listing).
NEX-Forms WordPress plugin versions 9.2.1 up to (but not including) 9.3.1 fail to perform any authorization, ownership, or request-validation check before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign, or append to any previously submitted entry by simply referencing its sequential identifier. Exploitation requires no authentication (PR:N) and no user interaction (UI:N); publicly available exploit code exists, though CISA SSVC records no observed exploitation and EPSS is low at 0.16% (5th percentile), so this is a genuine but moderate-priority issue. Impact is confined to stored form-submission data - integrity and availability are rated Low, with no confidentiality loss and no compromise of the underlying WordPress host.
Comment injection in Sunshine Photo Cart before 3.7.4 lets unauthenticated remote attackers submit comments to restricted galleries without satisfying the gallery access restriction, spoofing author name and email; the same restriction is enforced when comments are displayed. Publicly available exploit code exists, but EPSS remains low at 0.13% (2nd percentile), and the issue is integrity-only, allowing attacker-chosen comment content and metadata to be stored in password-protected, email-gated, private, account-only, or expired galleries. No CISA KEV active exploitation is indicated, and the flaw is a genuine but modest-severity integrity issue rather than a critical priority.
Stored HTML and link injection in the LTL Freight Quotes WordPress plugin before version 4.2.19 allows unauthenticated remote attackers to submit unsanitized values that are persisted and later rendered to storefront visitors. The plugin performs neither an authorization check nor input sanitization before storing these request values, so exploitation requires no authentication, no user interaction, and no special configuration on a default installation. Impact is limited to injected markup and links - the assessed vector (C:N/I:L/A:N) confirms no script execution, data confidentiality loss, or availability impact - and a publicly available exploit exists, though the EPSS score of 0.13% (2nd percentile) signals low real-world urgency, consistent with CISA's SSVC rating of no observed exploitation.
Payment verification bypass in the Tickera WordPress plugin before 3.6.0.4 allows unauthenticated remote attackers to forge payment notifications and mark arbitrary orders as paid without actually paying. The vulnerability stems from insufficient integrity checking of incoming payment callbacks and a signature that does not cover the order ID or amount, enabling tampering. Publicly available exploit code exists, but no confirmed active exploitation (CISA KEV) has been reported. The independent assessment rates the integrity impact as High.
Payment bypass in WPForms Lite (versions before 2.0.2.2) allows unauthenticated visitors to submit forms that are configured to use the plugin's PayPal Commerce gateway without ever completing payment, because the plugin does not perform a server-side check that PayPal recorded a completed order before accepting the submission. The form confirmation is still delivered and notification emails are still sent even though no order exists at the payment provider and no payment is recorded, making this a business-logic integrity flaw (CVSS 5.3, I:L; no confidentiality or availability impact) rather than a system-compromise bug. Exploitation is limited to sites that have enabled the PayPal Commerce gateway on a form - forms using other gateways or no payment at all are out of scope - and while publicly available exploit code exists, there is no indication of confirmed active exploitation (not in CISA KEV).
Unauthenticated visitors can suppress all auto-inserted snippets for their own requests on WordPress sites running the WPCode plugin before 2.4.0, because the plugin enters its snippet "safe mode" without correctly verifying that the incoming request is genuinely for the login screen. The effect is confined to the attacker's own requests - snippets still execute for every other visitor and no site-wide change occurs - so per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) the result is a low-severity bypass of snippet-enforced behavior (headers, redirects, content/access controls) rather than an outage or global configuration change. Publicly available exploit code exists (WPScan advisory), and there is no CISA KEV confirmation of active exploitation, so real-world priority is modest despite WPCode's wide deployment.
Authenticated users holding the WordPress Contributor role or higher can delete arbitrary post meta on any post - including content owned by administrators and other higher-privileged users - on sites running the YITH WooCommerce Popup plugin before version 1.60.0, because the plugin fails to verify the requester's capability before performing the deletion. The impact is integrity-only (no confidentiality or availability loss, no code execution), and while publicly available exploit code exists, EPSS is low at 0.16% and there is no CISA KEV confirmation of active exploitation. The vendor has released a fixed version (1.60.0).
Path traversal in the Khronos NNEF Python tooling allows a local, unauthenticated attacker to create or overwrite .dat weight files outside the intended model directory when a victim converts, saves, or generates weights from a crafted graph.nnef. The flaw affects nnef through 1.0.10 and nnef-tools through 1.0.11 and is triggered by '../' sequences or absolute paths embedded in variable labels, an operation the tool performs as part of its normal workflow. Impact is limited to low-severity file integrity loss within paths writable by the user running the tool, and exploitation requires the victim to open an attacker-supplied model; publicly available exploit code exists, but there is no evidence of confirmed active exploitation (the issue is not in CISA KEV).
Parsing a crafted ADF node header in CGNS through 4.5.2 triggers a stack out-of-bounds read that can crash downstream tools such as cgnslist, giving an attacker a local denial-of-service against the parsing application. The flaw lives in ADFI_read_node_header (src/adf/ADF_internals.c), where an end tag that is not NUL-terminated causes ADFI_stridx_c to scan past the disk_node_data buffer. Publicly available exploit code exists (a HackMD proof-of-concept write-up referenced in the CVE record), but there is no confirmed active exploitation per CISA KEV, and there is no remote or network-triggered path: the victim must locally open an attacker-supplied .cgns or .adf file, and the worst outcome is a process crash with no code execution, data disclosure, or integrity loss.
Stack out-of-bounds read in vgmstream through r2117's G.722.1/Siren14 decoder can be triggered when a victim opens or lets a vgmstream-based application process a crafted .s14 or .sss file, causing an application crash. The issue is local-vector with passive user interaction and is availability-only, consistent with an assessed CVSS 3.1 score of 4.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L). Publicly available exploit code exists, but no CISA KEV confirmation is provided.
Arbitrary activity-log disclosure in the GamiPress WordPress plugin before 8.0.6 lets any authenticated user - including a lowest-privilege Subscriber - read other users' points balances and earned achievements, plus the usernames of administrators who manually awarded or revoked points, by invoking one authenticated AJAX action that performs neither a capability check nor an ownership verification. The issue is remotely reachable with only low privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3, CWE-639) and is read-only, with no integrity or availability impact. Publicly available exploit code exists, but there is no evidence of active exploitation and EPSS is low (0.17%, 6th percentile), so it ranks as a low-to-moderate priority for sites with open user registration.
Information disclosure in the Tainacan WordPress plugin before 1.4.0 lets any authenticated subscriber-level user read the email addresses of the repository's staff by calling reports REST endpoints that lack a management-capability check; the CVSS vector (PR:L) confirms authentication is required, so the attacker needs an existing or self-registered low-privileged WordPress account. Publicly available exploit code exists (referenced from the WPScan advisory), but there is no confirmed active exploitation and EPSS is only 0.17% (6th percentile), placing this at low practical risk. Impact is limited to confidentiality (C:L, CVSS 4.3) and serves reconnaissance or phishing preparation rather than direct system compromise.
Subscriber-level (or higher) users on WordPress sites running rtMedia for WordPress, BuddyPress and bbPress before 4.7.14 can assign uploaded media to an album they do not own or have write permission for, placing content into another user's private album and having it attributed to that victim. The plugin fails to validate album ownership on the upload path (CWE-639, an IDOR/authorization bypass through a user-controlled key), so the only prerequisite is an authenticated account plus the ability to supply a target album identifier - described in the independent assessment as exploitable by an authenticated attacker with PR:L, remote (AV:N), with impact limited to integrity (I:L) and no confidentiality or availability effect, giving an assessed CVSS of 4.3. Publicly available exploit code exists per the WPScan reference tagged as 'exploit', but there is no KEV listing and CISA's SSVC rates exploitation as none and automatable as no, while EPSS is only 0.16% (5th percentile) - consistent with low real-world urgency rather than a top-priority patch item.
Local privilege escalation in Metalama allows an unprivileged user on a shared Linux or macOS host to plant a malicious .NET assembly in the world-writable system temp directory that will later be loaded and executed by a higher-privileged victim's build process. Metalama cached and extracted compile-time assemblies, auxiliary tools, and embedded helper assemblies under Path.GetTempPath() (/tmp) and trusted existing artifacts solely on a sentinel '.completed' marker file rather than any integrity check, so an attacker can pre-create the deterministic directory layout and rely on the marker to skip regeneration. Exploitation requires a pre-existing local account on the same shared machine or CI/build agent and a victim build initiated afterward; Windows default configurations are not affected because per-user temp ACLs prevent cross-user planting. No public exploit code has been identified at time of analysis and there is no KEV listing, but EPSS-style urgency is moderate given the low attack complexity and the availability of a vendor fix in 2026.1.19 (and 2025.1.18 on the older branch).
Contributor-level WordPress users can abuse the FV Flowplayer Video Player plugin's server-side URL fetch routine to probe internal network resources, because the plugin fails to properly validate a user-supplied URL and its existing host-based restriction does not cover every case. Only sites running versions 7.5.44.7212 through 7.5.55.7212 that grant untrusted users Contributor access or above are realistically exposed, and the payoff is a semi-blind oracle: the attacker learns whether an internal host or service responds and its HTTP status code, but never sees the response body, making this a reconnaissance primitive rather than a data-theft vector. Exploitation is authenticated and requires the plugin's URL-based media fetch feature, EPSS is a negligible 0.16 percent (5th percentile), SSVC records no observed exploitation and no automatable path, and while publicly available exploit code exists there is no evidence of active exploitation in the wild; the vendor has shipped a patch in 7.5.55.7212, and this remains a genuinely low-priority issue.