Use-after-free in PHP's per-request global state handling lets unauthenticated remote attackers achieve arbitrary code execution against persistent workers that reuse memory across requests - PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27 and 8.5 before 8.5.12 are affected. Exploitation is high complexity (CVSS:4.0 9.2 with AC:H/AT:P): it needs a 'producer' operation that leaves request-owned state published after an interruption such as a fatal error, uncaught exception, timeout or OOM, followed by a later request to the same worker whose early operation consumes the stale pointer before normal initialization resets it. The vendor documents a confirmed mod_php RCE path (PHP 8.5 with fatal_error_backtraces enabled) and a confirmed session upload progress lifecycle; a public PoC reference exists but is not verified as working exploit code, CISA SSVC records exploitation as none, and the priority decision is act_now because affected PHP branches are patched and technical impact is total.
Unauthenticated remote code execution in PHP 8.2.x before 8.2.35, 8.3.x before 8.3.36, 8.4.x before 8.4.27, and 8.5.x before 8.5.12 arises when an attacker drives a worker into an out-of-memory condition while request memory is only partially initialized, leaving freed/reused structures that the request shutdown path then processes. Exploitation is confirmed practical against Apache mod_php with default input and memory limits in normal multi-worker prefork setups, and publicly available exploit code exists; the vendor and distros (Ubuntu USN-8948-1) have released fixed builds. With a 9.2 CVSS score, a public PoC, and an act_now priority decision, this warrants immediate patching, though reliability varies with build, extensions, frontend behavior and allocator layout, and no complete PHP-FPM exploit has been demonstrated.
Remote code execution is possible in Node.js releases that bundle a vulnerable Brotli decoder: a malformed brotli-compressed stream can trigger an out-of-bounds write when decompressed, corrupting memory in the process handling the data. Exposure is limited to deployments that actually pass attacker-controlled brotli data into the decoder - for example services honouring Content-Encoding: br on untrusted requests or responses, or applications calling zlib.brotliDecompress/BrotliDecompress on untrusted input - and no authentication or user interaction is required in that scenario. The flaw is rated High with a CVSS 4.0 score of 9.2 (assessed CVSS 3.1: AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H), no CISA KEV listing confirms active exploitation, and a public PoC reference exists but is not verified as working exploit code; the vendor fix is Node.js v26.12.1, released 2026-10-21.
Stack-based buffer overflow in the TOTOLINK EX200 Wi-Fi range extender (firmware 5.2.3c.7200) lets remote, unauthenticated attackers crash or potentially execute code on the device by sending a crafted HTTP request to the setStaticDhcpConfig function in /cgi-bin/cstecgi.cgi with an oversized Comment parameter. Publicly available exploit code exists (a GitHub proof-of-concept write-up is linked from the VulDB record), and the CVSS 4.0 base score of 9.3 reflects full confidentiality, integrity and availability impact with PR:N/UI:N/AC:L - no credentials or user interaction required. The practical constraint is reachability: the flaw is only exploitable if the extender's web management interface is exposed to the attacker, so the real-world risk is highest on devices whose administrative UI is reachable from the WAN or from an untrusted network segment rather than the typical isolated LAN-side deployment.
Stack-based buffer overflow in TOTOLINK EX200 firmware 5.2.3c.7200 allows remote attackers to overflow a stack buffer by sending an oversized macAddress argument to the setWiFiAclAddConfig function in /cgi-bin/cstecgi.cgi (wireless.so), with high confidentiality, integrity, and availability impact per the supplied CVSS vectors. Publicly available exploit code exists, and while the CVSS vector lists PR:N (unauthenticated), authentication requirements are not confirmed from the available data; practical exploitation is normally limited to attackers who can reach the device's LAN/Wi-Fi management interface unless that UI is deliberately WAN-exposed.
A stack-based buffer overflow in the formSetFirewallCfg handler of the Tenda AC19 router's httpd web management service lets a remote attacker crash or potentially execute code on the device by sending an overlong firewallEn parameter to /goform/SetFirewallCfg. The issue is confirmed against firmware 16.03.10.07 and carries a 9.3 CVSS v4 score with a PR:N vector, meaning no authentication is asserted as a prerequisite, although Tenda goform endpoints commonly enforce a session on default builds and the independent assessment flags this as unverified. Publicly available exploit code exists (a GitHub PoC repository is linked from the CVE record), which raises the likelihood of opportunistic attempts against any AC19 whose management interface is reachable.
Laravel TokenGuard authentication bypass is a genuine high-priority issue, not an inflated CVSS score: unauthenticated attackers can send a crafted non-string credential, such as an array-valued api_token, to routes protected by TokenGuard and, under affected MySQL or MariaDB configurations, be matched to an unintended existing user, enabling account takeover. The flaw affects Laravel Framework before 12.68.0 and 13.x before 13.29.0 and requires the vulnerable guard plus database type-coercion behavior; no public exploit was identified at time of analysis, and vendor-released fixes are available in 12.68.0 and 13.29.0.
An authenticated GitLab user can seize control of an existing LDAP-backed account on instances that have both OmniAuth SAML and LDAP auto-linking enabled, because the LDAP email lookup performed during OmniAuth identity linking does not properly sanitize input. GitLab CE/EE deployments from 10.1 up to (but excluding) 19.3.6, 19.4.3, and 19.5.1 are in scope; the attacker needs a valid account (PR:L) but no action from the victim (UI:N), and the compromise extends beyond the attacker's original security scope (S:C) with high confidentiality and integrity impact while availability is unaffected (CVSS 8.2). Publicly available exploit code exists and a HackerOne report documents the issue, though there is no CISA KEV confirmation of active exploitation; the dual-feature prerequisite (SAML plus LDAP auto-linking) sharply narrows the exposed population, so this is a high-priority fix for that specific configuration rather than a universal emergency.
Unauthenticated remote attackers can read and tamper with critical data handled by Oracle Java SE through its JSSE (Java Secure Socket Extension) component, rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:N). Affected builds are Java SE 8u511 and 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1, plus Oracle GraalVM for JDK 17.0.21 and 21.0.13 and GraalVM Enterprise Edition 21.3.20. Oracle's alert states the flaw is reachable via APIs of the affected component, such as a web service feeding untrusted data into JSSE, and adds a secondary sandbox-escape path for deployments running untrusted code in Java Web Start applications or applets; no public exploit code or active exploitation was identified at time of analysis, but the missing authentication prerequisite and network reachability make this a high-priority patch target rather than a paper finding.
D-Link DHP-W610AV firmware 1.02EUb03 leaves the administrative HNAP password empty in its default configuration, so remote attackers who can reach the management interface can log in without valid credentials and obtain full control of the device. The issue is unauthenticated and requires no user interaction (CVSS 8.9), and publicly available exploit code exists; active exploitation is not confirmed by CISA KEV.
Unauthenticated stored cross-site scripting in the Jane Menu WordPress plugin before 1.5.1 lets remote attackers bind any published page to an attacker-controlled remote document that the plugin fetches and renders without escaping, causing arbitrary JavaScript to execute for visitors, including administrators. Authentication is not required, but exploitation is not automatic: the payload fires only when a victim visits the tampered published page (UI:R). Publicly available exploit code exists; CISA KEV does not list this CVE, and the independent assessment rates this as a genuine high-priority issue rather than an inflated score.
Buffer overflow in the Tenda BE3L Pro router running firmware 16.03.60.62 lets an authenticated, low-privileged user of the web management interface corrupt memory and potentially achieve code execution or force a device crash by submitting a crafted security_5g value to /goform/WifiBasicSet. The bug is network-reachable with low attack complexity and no user interaction, and publicly available exploit code exists (no CISA KEV confirmation of active exploitation at time of analysis). Practical risk hinges on exposure: the management interface is normally confined to the LAN/Wi-Fi side, so exposure to untrusted networks materially raises the threat.
SQL injection in the Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 allows unauthenticated remote attackers to read arbitrary WordPress database contents by controlling a sort parameter that is placed directly into an SQL ORDER BY clause. The assessed vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, so the practical impact is high confidentiality loss with no integrity or availability effect, and no authentication or user interaction is needed. Publicly available exploit code exists; exposure is limited to sites running an affected plugin version with the chat-widget request handler reachable.
Unauthenticated SQL injection in Click n Chat (Chat Widget Integration) before 1.1.3 allows remote attackers to influence SQL query structure by supplying a parameter that the plugin uses as a column identifier without validation, giving high confidentiality impact through database data exposure with no integrity or availability impact assessed. Publicly available exploit code exists, and only WordPress sites with this specific plugin below version 1.1.3 are exposed, making the affected population narrow. The independent assessment rates the issue as network-reachable, low-complexity, and unauthenticated with scope unchanged, while the supplied base score is 8.6.
Missing authorization in Backup and Staging by WP Time Capsule before 1.22.28 allows an authenticated Subscriber on a WP Time Capsule staging site to invoke the staging-to-live deployment handler and overwrite the linked live site's database and configuration, potentially taking it offline. Exploitation is conditional on the plugin's staging-to-live workflow being configured with a separate live site, and publicly available exploit code exists. The vendor-released fixed version is 1.22.28.
Unauthenticated privilege escalation in the WP User Manager WordPress plugin (versions 2.9.21 through 2.9.25) allows an attacker to submit a live paid registration form and receive its configured administrator-equivalent role once the associated payment gateway has been disconnected - the payment gate is silently dropped instead of failing closed. The flaw is rated CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H, CWE-269), but practical exploitation requires the non-default combination of a published paid registration form that assigns a privileged role plus an inactive gateway, so sites that never offered paid registration, never mapped the form to a high-privilege role, or have unpublished the form are not exposed. Publicly available exploit code exists and the issue is fixed in 2.9.26; no KEV listing appears in the supplied intelligence.
Stored cross-site scripting in the Falang Multilanguage plugin for WordPress before 1.4.6 lets any authenticated user at Subscriber level or above plant script-bearing content that later renders in an administrator's browser session. The plugin's term-translation save handler performs no capability check and hands a valid nonce to any logged-in user, so a low-privilege account is enough to store the payload; execution still depends on a higher-privileged user opening the affected translation screen, which limits the real-world blast radius below the headline 8.0 score. Publicly available exploit code exists and the flaw is fixed in 1.4.6, but exploitation is only realistic on sites that allow self-registration or where the attacker already holds a low-tier account.
Authenticated SQL injection in the Modern Events Calendar Lite and Modern Event Calendar Pro WordPress plugins before version 7.37.0 allows any logged-in user with Subscriber-level access or higher to append additional SQL clauses to an existing query and read sensitive data from the site's database. Only confidentiality is affected - the vulnerable code path provides no route to modify or delete data, and no user interaction is needed (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N per independent assessment). Publicly available exploit code exists, and the practical blast radius is largest on event, membership and community sites that permit open or self-service registration, where an attacker can simply sign up for a low-privilege account.
Stored cross-site scripting in CF7 Redirection before 3.2.12 allows unauthenticated visitors to submit form data that is retained and later rendered without proper sanitization or escaping in the lead debug metabox. The payload executes only when a logged-in user, typically an administrator, opens the crafted entry's debug metabox while the plugin's non-default debug mode is enabled. Publicly available exploit code exists, but exploitation is constrained by that configuration dependency and the required privileged user interaction; no CISA KEV confirmation was provided.
Stored cross-site scripting in the Weglot WordPress plugin before 6.4.3 lets unauthenticated attackers plant a payload that executes in the browser of anyone who views an affected page in a translated language. The flaw appears when Weglot rewrites links for translated content: it re-inserts URLs without escaping and reverses earlier encoding. Exploitation requires the site to have link rewriting/translation rendering active with at least one additional language and a victim to load the translated view; publicly available exploit code exists, and the issue is moderate priority rather than a critical fire-drill.
Unauthenticated remote attackers can exhaust the daily rate-limit allowance for payment gateway verification in the Formidable Forms WordPress plugin on sites running versions 6.5 through 6.x with a payment gateway configured, causing legitimate verification attempts to be refused for up to 24 hours. The plugin records the rate-limit timestamp without verifying the caller's identity, so the issue is a bounded availability impact against the verification function rather than a full site outage or system compromise. Publicly available exploit code exists, a vendor patch is available in version 7.0, and the independently assessed impact is availability-only.
Privilege escalation in the Simple Banner WordPress plugin before 3.3.3 lets any role that an administrator has permitted to manage banners gain the full 'administrator' capability, allowing an authenticated low-privileged user to take complete control of the site. The flaw is only reachable when an admin has explicitly delegated banner management to a non-administrator role and the attacker holds an account in that role - a non-default configuration reflected in the AC:H/PR:L vector - so default installs and unauthenticated visitors are not exposed. Publicly available exploit code exists and the vendor has released version 3.3.3 as a fix; no CISA KEV listing is associated with this CVE at time of analysis.
miniOrange 2FA versions 6.2.9 to before 6.3.1 permit an attacker who already knows a victim's WordPress password to add an attacker-controlled passkey during a pending passkey login, bypassing the second factor on accounts that already have a passkey. The assessed vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N, so exploitation is authenticated (PR:L) and depends on a timing/state window (AC:H), with high confidentiality and integrity impact but no availability impact; publicly available exploit code exists, while no CISA KEV entry was supplied.
Account takeover is possible in Uncanny Toolkit for LearnDash (WordPress plugin) before 3.8.2: the plugin's password-reset handler accepts forged cross-site requests without validating their origin, so an unauthenticated attacker who induces a victim - one who is already partway through a reset - into loading a crafted page can set that account's password to an attacker-chosen value. Publicly available exploit code exists and the vendor shipped a fix in 3.8.2, though exploitation is gated by the timing of an in-progress reset plus victim interaction (CVSS 7.5, AC:H/UI:R).
Improper input validation in Node.js DNS resolution functions lets hostname or address strings containing null bytes reach dns.resolve/dns.lookup, which the 26.12.1 security release fixes by adding explicit null-byte validation of resolve inputs. Node.js 22.x through 22.23.3, 24.x through 24.22.0, and 26.x through 26.12.0 are affected, with the vendor patch shipped in Node.js 26.12.1. The assessed vector (AV:N/AC:H/PR:N/UI:N, C:H/I:H) means unauthenticated remote reach is possible but exploitation is conditional on the target application passing attacker-influenced strings into DNS resolution, and the exact trigger mechanism is not described in the available sources; a public PoC reference exists but is not verified as working exploit code, and there is no CISA KEV listing.
Node.js TLS certificate validation can accept a peer certificate that presents an IP address in a non-canonical representation instead of rejecting it, undermining identity checks for IP-addressed TLS peers; affected versions are 26.12.0, 24.22.0, and 22.23.3 and earlier on those branches. An attacker positioned to intercept the TLS path and able to supply a crafted certificate could exploit this to impersonate an IP-identified peer, with high confidentiality and integrity impact but no authentication or user interaction required. The vendor fixed the issue in the 2026-10-21 security release v26.12.1; a public PoC reference exists but is not verified as working exploit code, and no confirmed active exploitation is reported in the supplied intelligence.
Node.js TLS certificate validation in versions 26.12.0 and 24.22.0 can mishandle non-canonical IP address representations, potentially causing IP-based certificate identity checks to be evaluated incorrectly. A network-positioned attacker who can influence the certificate presented during TLS peer validation of an IP address may exploit this to affect confidentiality and integrity, though exploitation requires a man-in-the-middle or malicious-endpoint position and a suitably crafted certificate. No CISA KEV active-exploitation confirmation is provided, but a public PoC reference exists and is not verified as working exploit code.
Reflected cross-site scripting (CVSS 7.1) in WP Booking System before 2.1.0.3 allows unauthenticated remote attackers to inject script into an administrative page by luring a logged-in administrator to a crafted URL. The plugin reflects one of its parameters without validation or escaping, so the payload executes in the victim administrator's browser session and can perform actions with that user's privileges; exploitation requires user interaction (UI:R). Publicly available exploit code exists, and the vendor has released version 2.1.0.3 as a fix.
Stored cross-site scripting in the Advanced File Manager WordPress plugin (versions 5.4.13 through before 6.0.0) lets an attacker with file-manager access plant a file whose embedded script survives sanitisation, which then executes in the browser of any user who opens or previews it - typically an administrator. Exploitation requires a low-privileged account that an administrator has explicitly delegated file-manager access to (PR:L) plus a victim opening the crafted file (UI:R), which is why public exploit code exists but no active exploitation has been confirmed. Fixed in 6.0.0; the vendor advisory and WPScan entry document the detection flaw.
Reflected cross-site scripting in the User Profile Builder WordPress plugin before 4.0.1 allows an attacker to craft a URL that executes script in the browser of a logged-in high-privilege user, such as an administrator, when that user loads the vulnerable plugin admin page. The attacker needs no WordPress credentials (PR:N), but exploitation requires the victim to click the crafted link (UI:R) and succeeds only against users who can already access that admin page. Publicly available exploit code exists, and the vendor has released version 4.0.1 to address the flaw.
Hardcoded TURN relay credentials in the Girafit camera app (Android and iOS) version 1.9.1 and earlier expose a shared, static TURN username and session token that is identical across every installation and tied to no specific user or device. Unauthenticated remote attackers can recover this credential by decompiling the app binary or by capturing the cleartext STUN/TURN authentication exchange that occurs during live-view registration, and publicly available exploit code exists. On its own the leak supports tracking and fingerprinting of relay sessions; impersonation or deeper abuse is explicitly gated on also holding the separate TURN relay password, which this vulnerability does not disclose, keeping the assessed impact to confidentiality-only and low severity.
Insufficient GraphQL scope enforcement in GitLab CE/EE lets an authenticated user with a read_api-scoped token retrieve a project's incoming email address and create work items that the token should not permit. The flaw affects GitLab CE/EE versions from 18.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1; publicly available exploit code exists, and no confirmed active exploitation is indicated in the provided intelligence. The independent assessment rates this as a moderate-priority authorization issue because exploitation requires a valid read_api token and a conditional GraphQL path, with impact bounded to the disclosed email address and work-item creation rather than broad data access.
Stored cross-site scripting in Elementor Website Builder for WordPress before 4.3.5 lets an authenticated user with the Contributor role or higher upload an SVG whose text content carries a script payload that the plugin's sanitizer never inspects, since only SVG elements and attributes are validated. The payload fires when the SVG is rendered inline on a page and a victim views that page in a Chromium-based browser; Firefox users are unaffected, and exploitation requires the victim to actively load the poisoned page. Publicly available exploit code exists (published through WPScan) and the issue carries a vendor patch, but there is no CISA KEV listing and no evidence of active, widespread exploitation, making this a medium-severity (CVSS 6.8, CWE-79) stored XSS with meaningful but constrained prerequisites.
The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signed intermediate CA certificates protected by weak private keys, so a man-in-the-middle attacker who can intercept traffic and who can factor or guess those keys could mint certificates for arbitrary hostnames that TLS clients using the system trust store would accept (CVSS 6.8, CWE-295). Affected platforms span Red Hat Enterprise Linux 6 through 10 plus a long list of layered products such as OpenShift Container Platform 4, Satellite 6, Quay 3, Advanced Cluster Management, and the cert-manager and logging operators. Attackers need a privileged network position and a victim client that actually initiates a TLS connection validated against the system store, so this is a trust-anchoring and impersonation problem rather than a remotely reachable code-execution flaw; there is no availability impact and no public exploit code identified at time of analysis. Because individual intermediate certificates cannot be selectively distrusted across every consumer of the system store, Red Hat is removing the parent root CAs outright, which is the crux of the remediation.
Stored cross-site scripting in the HireZoot WordPress plugin before 4.1.1 allows any account holding the Author role to plant script payloads in plugin data that is later rendered unescaped in the admin dashboard, and the plugin actively reverses the HTML-entity encoding that would otherwise neutralise those payloads. The injected script executes in a logged-in administrator's session once that administrator views the affected dashboard page, giving a low-trust Author-level user a path to admin-context actions; publicly available exploit code exists and the vendor has released 4.1.1 as the fix. Because exploitation requires an existing Author account plus administrator interaction, this is a moderate-risk insider privilege-escalation issue rather than an anonymous remote compromise.
SQL injection in Swift Performance Lite before 2.3.7.4 allows authenticated users with author-level or higher privileges to execute arbitrary SQL queries, potentially exposing sensitive database contents. The flaw arises from missing sanitization and escaping of a value used in a SQL statement (CWE-89), and publicly available exploit code exists. Exploitation requires a valid author account on a site with the plugin active, which narrows the attack surface compared to unauthenticated flaws.
Node.js TLS identity checking accepts non-canonical textual representations of IP addresses, so a peer certificate carrying an IP subjectAltName in a non-canonical form can pass the check it should fail (CWE-295). The flaw is grouped with CVE-2026-106069 under the Node.js 26.12.1 security release ('tls: reject non-canonical IP addresses') and is rated High by the project; EUVD lists Node 24.22.0 (≤24.22.0), 26.12.0 (≤26.12.0) and 22.23.3 (≤22.23.3) as affected baselines, and it is fixed by upgrading to 26.12.1 or the corresponding patched 24.x and 22.x releases. Exploitation is not opportunistic: the attacker must be able to intercept or interpose on a TLS connection and present a certificate whose non-canonical IP form is accepted - an on-path/MITM position rather than a plain remote request - and the independent reassessment scores this AV:N/AC:H/PR:N/UI:N with high confidentiality and integrity impact. There is no CISA KEV entry and no confirmed active exploitation; a public PoC reference exists (a gist linked from exploit-tracking sources) but it is not verified as working exploit code, and the priority label is 'this_month' rather than act-now.
Memory-amplification denial of service in Pillow's BMP RLE decoder (BI_RLE4/BI_RLE8) allows unauthenticated remote attackers to exhaust memory by delivering a small crafted BMP to any image pipeline that processes untrusted files with Pillow before 13.0.0. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, so impact is limited to availability with no code execution or information disclosure; the Pillow project classifies this issue as Medium severity. No public exploit code was identified at time of analysis, and exploitation requires the application to actually route attacker-supplied BMP data into Pillow's decoder.
Information disclosure in GitLab CE/EE allows an attacker to retrieve sensitive internal server credentials when GitLab fails to filter internal response headers, leaking secrets that may be reusable against backend services. Affected are all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1, remediated in the 19.3.6, 19.4.3, and 19.5.1 patch releases. Publicly available exploit code exists (a HackerOne report is linked in the references), and a key prerequisite remains disputed: the published CVSS vector specifies PR:L (an authenticated low-privilege session) while the vendor description states an unauthenticated user could exploit the issue, so realistic exposure depends on resolving that question for the specific deployment.
Node.js releases at or below 22.23.3, 24.22.0 and 26.12.0 contain a flaw in the HTTP Agent's internal data guard, fixed in the v26.12.1 security release so that the guard functions even when no I/O is taking place. Exploitation is network reachable and needs no authentication or user interaction, but the assessed high attack complexity means an attacker must win a narrow timing window, and the resulting impact is bounded to low confidentiality and low integrity effects; the vendor classifies this item as 'Medium' within a release that otherwise bundles several High-severity fixes. A public PoC reference exists; it is not verified as working exploit code, no confirmed active exploitation has been reported, and the current priority places remediation in this month's cycle.
An authorization bypass in the GitLab CE/EE group milestones API lets any authenticated user read milestone metadata - titles, descriptions, and full project paths - from arbitrary private projects without holding membership in them. Affected releases span 15.10 through the fixed versions 19.3.6, 19.4.3, and 19.5.1, and exploitation only requires a valid account plus a crafted project filter parameter (CVSS 4.3, PR:L, confidentiality-only). Publicly available exploit code exists (HackerOne report 3792168), but the flaw is read-only metadata disclosure with no modification or code access, making it a low-to-moderate priority information-disclosure issue rather than a high-impact compromise.
Broken authorization on a plugin REST route lets unauthenticated attackers take over existing WooCommerce orders on stores running the Synchrony Financing WordPress plugin (affected range 1.0.5 up to, but not including, 1.1.2) - reassigning an order to an account they control, altering its contents, and reading the associated customer's personal data. Rated CVSS 6.5 (CWE-863) with a network-reachable, no-prerequisite attack path (AV:N/AC:L/PR:N/UI:N), the flaw is narrow in deployment scope but exposes customer PII wherever it is present, and publicly available exploit code exists. No confirmed active exploitation (CISA KEV) was observed at time of analysis, and a vendor-released patch (1.1.2) is available.
Unauthenticated attackers can activate pending WholesaleX accounts on WordPress sites running plugin versions before 3.0.9 by supplying a request that satisfies the plugin's confirmation-code comparison against an unset stored value, bypassing the administrator approval normally required before login. Publicly available exploit code exists, but the supplied SSVC assessment records exploitation as none and technical impact as partial; the issue is remotely reachable with no credentials or user interaction under the default approval configuration. The practical risk is moderate because a successful attack can activate an existing pending account and alter its login state, with low confidentiality and integrity impact and no availability impact.
Authenticated Subscriber-level users can abuse Moloni WordPress plugin versions before 5.0.14 to generate fiscal invoices for arbitrary orders, discard arbitrary orders, and create or modify products and stock because several AJAX actions lack capability and nonce checks. Exploitation requires the site to have an active stored connection to the external Moloni invoicing provider, and publicly available exploit code exists; the CVSS 3.1 score is 6.5 (Medium) with PR:L and integrity-only impact. Sites that allow open registration or host untrusted low-privilege accounts face the highest practical exposure.
Unauthenticated attackers can rewrite the merchant credential that a WordPress store's Wava Payment Plugin uses to create payments, silently flip the integration into a 'verified' state the site owner never completed, and strip the payment method from checkout entirely. The flaw affects versions 0.3.1 through 0.3.9 (fixed in 0.3.10) and is reachable in default configuration because the exposed public REST endpoint enforces no authorisation, nonce, or origin check. Ratings put it at CVSS 6.5 (AV:N/AC:L/PR:N/UI:N, integrity and availability only), and publicly available exploit code exists, so mass scanning against WordPress REST paths is plausible even though there is no confirmed active exploitation (no CISA KEV listing).
Stored cross-site scripting in the Elementor Website Builder WordPress plugin before 4.3.5 allows users holding the Author role or higher to upload SVG files whose embedded JavaScript executes in the browser of anyone who later opens or previews the file. The vendor's CVSS vector marks this authenticated (PR:L), and exploitation carries two hard preconditions: the plugin's non-default 'unfiltered file uploads' setting must be enabled, and the attacker must already possess an Author-or-above account, with the payload only firing when a second victim interacts with the uploaded SVG. Publicly available exploit code exists (WPScan reference) but there is no evidence of active exploitation, so the practical risk is moderate and configuration-dependent rather than urgent.
Unauthenticated remote attackers can take full administrative control of Apache Pulsar Manager 0.3.0 and later by creating an administrator account through an endpoint that remains reachable after initialization, and every account has effective full privileges. In all versions, the manager proxies requests to the Pulsar admin API without enforcing its own authentication and can attach its configured Pulsar credential to a requester-chosen destination, allowing unauthenticated users to perform permitted admin operations and steal the credential. No public exploit code was identified at time of analysis, but the product is retired, unsupported, and will not receive fixes, so exposure persists until deployments are removed.
Apache Traffic Server versions 8.0.1 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0 ship an experimental 'magick' plugin that, in its default unsigned configuration, passes client-controlled data into ImageMagick 'convert' arguments, letting remote attackers inject command-line options (CWE-88 argument injection) with no authentication or user interaction. Because the plugin is experimental and not enabled by default, only deployments that deliberately loaded it without enabling request signing are exposed; those that are exposed face a CVSS 3.1 score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) with scope change and full confidentiality, integrity, and availability impact, since injected arguments can drive ImageMagick into reading or writing arbitrary files or executing delegated commands. No public exploit code or CISA KEV entry is associated with this CVE at time of analysis, but the impact on a vulnerable, enabled instance is total, and upgrading to 9.2.16, 10.1.5, or 10.2.1 is recommended.
Arbitrary file upload in WP Mailster through 1.9.1.0 allows an attacker to place a dangerous executable file, such as a PHP web shell, into a web-accessible location and potentially gain remote code execution on the WordPress host. The provided CVSS vector rates the issue critical and asserts network exploitation with no privileges (PR:N), but the single Patchstack reference does not identify the upload endpoint or required WordPress capability, and the independent assessment notes that comparable plugin upload flaws often need at least a low-privileged account, so defenders should validate actual exposure. No public exploit code or CISA KEV entry was identified at time of analysis.
An authorization bypass in GitLab Enterprise Edition (versions 12.0 through 19.3.5, 19.4.0-19.4.2, and 19.5.0) lets an authenticated user grant or accept project and group membership outside identity provider control when the instance-wide SAML or LDAP membership lock is enabled. The flaw stems from incomplete enforcement of the membership lock against membership requests or invitations that were created before the lock was turned on, so it is state-dependent: it does not affect Community Edition or default installs, and it does not work against requests created after the lock is active. Publicly available exploit code and a HackerOne report exist, but there is no CISA KEV confirmation of active exploitation; it yields unauthorized project/group membership rather than administrative takeover.