Authentication bypass in the asVereinbase WordPress plugin before 1.1.8 allows unauthenticated remote attackers to log in as any user, including an administrator, because the plugin accepts an empty stored password or second-factor value as a match. Affected are WordPress sites running the plugin at versions below 1.1.8; the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact, and no special configuration or user interaction is required. A public PoC reference exists but is not verified as working exploit code, and the EPSS score is low at 0.19% (8th percentile) even though the vuln.today decision label is act_now, so the severity and priority signals are split and should be read together.
GeoDirectory, a WordPress directory plugin, writes administrator-supplied text into a generated PHP file inside its own plugin folder without escaping it (CWE-94), so a high-privilege user who can save GeoDirectory settings can plant PHP code that any unauthenticated visitor then triggers by requesting the generated file. The prerequisite is a settings-capable account - on a multisite network that means a subsite administrator who is otherwise deliberately prevented from running code - so exploitability is concentrated in sandboxed multisite and managed-hosting deployments, where a full single-site administrator would already have code execution. Fixes are available in 2.8.194; EPSS is low at 0.29% (20th percentile), there is no CISA KEV entry, and the only public reference is a WPScan advisory that is not verified as working exploit code.
Download Monitor, a WordPress plugin, fails to verify that a clicked link actually belongs to the site before fetching it client-side and injecting part of the response back into the page, producing a cross-site scripting condition in every release before 5.3.4. The flaw is remotely reachable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C) but is gated by mandatory user interaction - an attacker must convince a victim to click a crafted link - and it crosses a trust boundary into the browser, so the injected script runs in the context of the affected WordPress site. A public PoC reference exists but is not verified as working exploit code, EPSS is only 0.24% (14th percentile), and there is no CISA KEV entry, so signals point to a moderate, interaction-gated risk rather than an emergency; the vendor fix is version 5.3.4.
Stored cross-site scripting in the WPVR WordPress plugin before 9.0.3 lets authenticated users with the Contributor role or higher plant script inside tour hotspot content, which then runs in the browser of anyone who later views the affected tour. The vulnerable code neither sanitises nor escapes that hotspot content on storage or on front-end output (CWE-79), so the payload persists in the tour and fires on view rather than at injection time. Exploitation requires a valid low-privilege account and use of the tour-hotspot feature, and impact is confined to the browsers of tour viewers rather than the WordPress server itself; a public PoC reference exists but is not verified as working exploit code, EPSS is low at 0.21% (10th percentile), and the item is not flagged for confirmed active exploitation (CISA KEV), consistent with a managed, this-month priority.
Stored cross-site scripting in the GeoDirectory WordPress plugin before 2.8.194 allows an authenticated user holding the Contributor role or higher to place a map shortcode whose style-related attributes are not sanitised or escaped before being written into a style attribute, so the injected script runs in the browser of any user who later views that content. Exploitation requires that the attacker can author content containing the map shortcode and that a victim - an administrator reviewing the post or a front-end visitor - subsequently loads it; sites that do not grant untrusted users Contributor access, or that do not use the map shortcode, are materially less exposed. A public proof-of-concept reference exists (WPScan advisory) but is not verified as working exploit code, EPSS is low at 0.21% (10th percentile), there is no CISA KEV listing, and the vendor has released a fix in 2.8.194.
Stored cross-site scripting in the Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 lets an account with a role as low as Contributor rewrite the plugin's tracking configuration, because one of its AJAX handlers performs no capability check and the nonce guarding it is readable by anyone who can reach the admin dashboard, so attacker-chosen JavaScript then executes in the browsers of all visitors, administrators included. The flaw is not anonymous: the attacker must already hold an authenticated WordPress account that can open wp-admin, and the injected payload only fires when a victim - an administrator or a site visitor - subsequently loads a page that renders the tampered tracking output. No KEV designation appears in the available intelligence, EPSS is 0.21% (10th percentile), a public PoC reference exists at WPScan but is not verified as working exploit code, and this is a moderate-priority issue rather than a top-tier emergency; version 2.2.3 is the first fixed release.
Unauthenticated visitors can self-assign an arbitrary membership level and set their own approved, confirmed and paid flags when registering through the front-end forms of the Front End Users WordPress plugin through 3.2.35, because the plugin does not restrict which account attributes a registrant may submit. Sites that rely on the plugin's membership-level or approval/payment gating for content restriction are the ones that lose protection; sites that do not use those gating features gain an attacker little. This is a genuine but moderate-priority issue rather than an urgent emergency: EPSS is only 0.20% (9th percentile), there is no CISA KEV entry, and the only available exploit reference is a public PoC reference that is not verified as working exploit code - so no confirmed active exploitation and no verified exploit at time of analysis.
Any authenticated user holding even a minimal role such as Subscriber on a WordPress site running the MAS Videos plugin through 1.3.4 can permanently delete arbitrary posts, pages, attachments and other users' content, because the plugin's front-end video and playlist deletion handlers perform no capability or ownership check and verify a nonce tied only to a static action rather than to the targeted object. The issue is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/C:N/I:H/A:N) under CWE-862 Missing Authorization, with the authentication prerequisite being the principal limiting factor - sites that permit open or self-service registration are materially more exposed than those that restrict account creation. Exploitation status: no public exploit identified at time of analysis beyond a public PoC reference that is not verified as working exploit code; there is no CISA KEV entry, EPSS is 0.18% (7th percentile), and the vuln.today decision label is this_month.
Authenticated path traversal in the GeoDirectory WordPress plugin before 2.8.194 allows any user holding a Subscriber-level account or higher to supply an image URL during front-end listing submission that the plugin then treats as a local filesystem path, reading files from outside the web root and deleting them from the server. The impact is constrained to filenames carrying an allowed media extension, but each successful hit both re-publishes the targeted file at a public URL and destroys the original as a side effect. Exploitation requires a low-privilege account (which open registration on many WordPress sites provides) and no victim interaction; EPSS is low at 0.20% (10th percentile), the issue is not in CISA KEV, and only a public PoC reference exists that is not verified as working exploit code.
Unauthenticated PHP object injection in the Prime Mover - Backup and Migration plugin for WordPress (all versions up to and including 2.2.1) allows an attacker to plant a base64-encoded serialized object in wp_comments.comment_content through the stock wp-comments-post.php endpoint, with no authentication and no user interaction required. The payload is only deserialized when an administrator later runs a Prime Mover export or restore, at which point recursiveUnserializeReplace() passes the attacker-controlled value to unserialize() without an allowed_classes restriction; the plugin additionally ships its own gadget chain inside the bundled Freemius library (FS_Clone_Manager::__set → FS_Option_Manager::set_option → store() → update_option()), so no third-party plugin or theme is needed. The two-stage nature means the storage half is always reachable on a site with comments enabled while the trigger half depends on an administrator using the migration features; impact on successful trigger is full confidentiality, integrity and availability loss. Priority is act_now per the current decision signals; no public exploit code has been identified at time of analysis.
Improper token-purpose validation in Postiz (gitroomhq/postiz-app) through v2.25.2 allows any authenticated user holding a low-privileged account to obtain a validly signed token containing claims of their choosing, which the application then accepts interchangeably as a session, an organization invitation carrying a chosen role, a password reset, or an enterprise provisioning token. The primary path is the browser-extension channel credential-refresh route, which signs attacker-supplied data taken from the request itself with the shared token-signing secret and stores the signed result where the requesting user can read it back; a second, narrower team-invitation creation route signs extra request-body fields in the same way. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, but the vendor rates the issue critical (CVSS 9.9, scope changed) and the priority label is act_now, with upgrading to v2.25.3 stated as the only complete fix.
PHP object injection in the Paytium WordPress plugin (versions up to and including 5.0.5) allows remote, unauthenticated attackers to deserialize untrusted data per the supplied CVSS vector (AV:N/AC:L/PR:N/UI:N), which can lead to full loss of confidentiality, integrity and availability. The flaw is rated 9.8 and flagged act_now by vuln.today, but no CISA KEV entry, no confirmed public exploit code and no EPSS figure were provided. Real-world impact depends on whether an exploitable POP gadget chain exists in the running code and whether the vulnerable code path is reachable - object injection alone does not guarantee code execution.
PHP object injection in Tribulant Newsletters, the WordPress plugin newsletters-lite, through version 4.18.1 allows remote, unauthenticated attackers to reach an unserialize() call with crafted serialized data; the CVSS 3.1 vector rates confidentiality, integrity and availability impact as high. The practical outcome depends on a usable POP gadget chain in the plugin, WordPress core or another installed component, and the specific vulnerable endpoint, parameter and gadget chain are not described in the supplied intelligence, which rests on a single Patchstack report. No public exploit code is referenced in the available data, and active exploitation is not confirmed.
Unauthenticated command injection in Travisun Opptrix 0.4.0 allows remote attackers to run arbitrary commands on the host by manipulating the /api/auth/setup endpoint of the project's Schedule API. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, E:P) and the independent assessment agree that no credentials or user interaction are needed, and the impact is scoped to the vulnerable component with low confidentiality, integrity and availability effect in the vendor score but high across all three in our assessment. A public PoC reference exists; it is not verified as working exploit code, and there is no confirmed active exploitation. Real-world priority remains low: the maintainer says the project was meant to run only on localhost, it is deprecated and completely taken offline, and only unsupported versions are affected, which is why this is tracked as a this_month item rather than an emergency.
Postiz instances older than v2.25.3 that store media on local disk let a registered user have the publishing worker read an arbitrary file from the server and send it as an attachment to a Discord server the user controls; because self-registration is open by default, the attacker effectively needs no pre-existing account, only network reach to the instance. The flaw is an unconfined path traversal (CWE-22) in the media readers: a media value that is not an HTTP(S) address is treated as a file on the worker's disk and opened without confirming it lies inside UPLOAD_DIRECTORY, and two further routes reach the same reads, one acting as a file-existence oracle that can also exhaust backend memory. Confidentiality impact is high, integrity is not affected, availability impact is at most limited, the vendor fix is v2.25.3, the issue is prioritised act_now, and no public exploit code was identified at time of analysis.
OS command injection in Unitree Go2's chat_go voice-chat component (gpt_thread.py set_volume) through firmware 1.1.11.4 lets unauthenticated remote attackers execute shell commands by supplying a crafted Value argument, with a user-interaction precondition. The vendor has released firmware 1.1.11.5 to resolve the issue, and the supplied priority is act_now. No CISA KEV listing is included in the supplied data and no public exploit identified at time of analysis; exposure depends on whether chat_go is reachable from untrusted networks.
Denial of service in Travisun Opptrix 0.4.0 is reachable through the /api/channels/webhook/ route, where the preParsing handler's use of Buffer.concat can be driven into improper resource handling (CWE-404). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the route is remotely reachable by unauthenticated attackers with no user interaction, but the assessed impact is deliberately narrow: low availability loss only, with no confidentiality or integrity consequence. A public PoC reference exists but is not verified as working exploit code, and realistic exposure is sharply limited because the maintainer has taken the project offline and deprecated it, states the flaw manifested primarily in local environments during early development, and says the main versions were intended to run exclusively on localhost.
Code injection in Travisun Opptrix 0.4.0 through the /api/system-update/import endpoint can lead to remote code execution by an unauthenticated network attacker when the HTTP API is reachable. The independent assessment rates confidentiality, integrity, and availability impact as high, but practical exposure is constrained because the deprecated project was intended to run only on localhost and remote exploitation requires an operator to expose the API on a routable interface. The supplied intelligence does not confirm CISA KEV active exploitation, and a public PoC reference exists but is not verified as working exploit code.
CPython's ssl module validates TLS certificate chains that anchor to known-compromised eMudhra CA certificates, so anyone holding that CA's key material can impersonate arbitrary TLS servers to unpatched Python clients. Every Python application that relies on the default verification path (ssl.create_default_context() or an SSLContext without its own OCSP/CRL checking) is affected, which is CPython's default behaviour; the fix adds a hard-coded denylist of distrusted certificates enforced regardless of SSLContext policy. Exploitation is targeted rather than opportunistic, requiring the compromised CA key plus a man-in-the-middle or server-impersonation position against the victim's connection; no public exploit identified at time of analysis, and the vendor-tracked priority label is act_now.
Authenticated users with only subscriber-level access can write arbitrary post metadata under attacker-chosen keys to any post, including content owned by higher-privileged users, in News Kit Addons For Elementor through version 1.4.7. The issue is a missing capability and ownership check (CWE-862) in an authenticated AJAX action, yielding integrity-only impact per our assessment. A public PoC reference exists but is not verified as working exploit code; EPSS is 0.18% and no CISA KEV confirmation is present.
Missing authorization in the Advanced Twenty Seventeen WordPress plugin through 1.3.1 lets any authenticated user, including a subscriber, create and activate the plugin's bundled child theme site-wide, and lets an attacker trigger the same theme switch via CSRF against any logged-in user up to an administrator. The flaw affects site integrity and availability only, with no confidentiality impact; no KEV entry is present in the supplied intelligence, a public PoC reference exists but is not verified as working exploit code, and EPSS is 0.13% (2nd percentile).
Blind SQL injection in the WBW Product Filter WordPress plugin (woo-product-filter) through 3.4.6 lets remote attackers submit crafted requests that infer database contents through boolean or time-based responses. The supplied vector and independent assessment indicate network exploitation with no privileges or user interaction, while the independent assessment records high confidentiality impact, low integrity impact, and no availability impact; the exact injectable parameter or filter request is not described. The vuln.today priority label is act_now, and no public exploit was identified at time of analysis.
SQL injection in the Tribulant Newsletters WordPress plugin (newsletters-lite) through version 4.18.1 allows unauthenticated remote attackers to read data from the affected site's database, with the independent assessment scoring confidentiality impact high and integrity and availability impact none. The specific vulnerable parameter, endpoint, or feature is not described in the available sources, which consist of a single Patchstack advisory, and no public exploit has been identified at time of analysis. The act_now priority label reflects elevated concern, although the assessment notes the signals mostly align toward elevated priority but rest on a single source.
GeoDirectory WordPress plugin versions before 2.8.194 fail to enforce status, ownership and password checks in an unauthenticated AJAX listing-loading handler, allowing remote unauthenticated attackers to retrieve the content of draft, pending, private or password-protected listings by supplying their IDs. The flaw is confidentiality-only (C:L) and the practical impact depends on the site actually containing non-public listings with discoverable IDs. This is a genuine but moderate-priority information-disclosure issue, not a high-urgency emergency; no CISA KEV confirmation is present, EPSS is low at 0.20% (9th percentile), and a public PoC reference exists but is not verified as working exploit code.
Unauthenticated visitors to WordPress sites running GeoDirectory before 2.8.194 can retrieve the title, permalink and card fields of draft, pending, private and trashed listings through one of the plugin's single-item map-popup REST routes, which performs no status or ownership check on the supplied listing ID (CVSS 5.3, CWE-200). Exploitation is straightforward wherever that route is reachable and non-public listings exist, but disclosure is confined to those card-level fields rather than the full listing body or private owner data, and the attacker must know or guess a valid numeric listing ID. A vendor patch (2.8.194) is available, EPSS is 0.20% (9th percentile), there is no CISA KEV entry, and the referenced WPScan publication is a PoC reference that is not verified as working exploit code.
An integer overflow in open62541's UA_DataType_fromStructureDescription() allows a malicious or compromised OPC UA server to corrupt client heap memory when the client fetches custom DataType definitions, resulting in a crash or potential code execution. The flaw affects open62541 1.5.0 through 1.5.6: oversized structure definitions wrap the 16-bit memSize bitfield (and the 8-bit membersSize field), so the size computed during type construction no longer matches the true member layout used later by decodeBinaryStructure(). Exploitation is not passive - the client must connect to an untrusted server and actively invoke UA_Client_getRemoteDataTypes(), which is why CVSS 4.0 records AT:P and the assessed CVSS 3.1 vector uses AC:H despite unauthenticated remote reachability (PR:N); no public exploit was identified at time of analysis, but vuln.today assigns an act_now priority and the vendor has released 1.5.7.
Remote unauthenticated compromise of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition is possible through the JSSE component when attacker-influenced data reaches the affected APIs. The listed affected builds include Java SE 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, and 27.0.1.0.2, plus GraalVM for JDK 17.0.21.0.2/21.0.13.0.2 and GraalVM Enterprise Edition 21.3.20.0.2. Per the assessed CVSS vector AV:N/AC:L/PR:N/UI:N, exploitation is remote, unauthenticated, and requires no user interaction on the API path, with high confidentiality and integrity impact and no availability impact; no CISA KEV entry, public exploit code, or EPSS score was supplied, and the vuln.today decision label is act_now.
Privilege escalation in the aBlocks WordPress plugin (Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder) through 2.17.0 lets an authenticated attacker with Contributor-level access or above raise their own WordPress role to Editor and receive a fully authenticated session at the elevated level. The flaw sits in the plugin's `/ablocks/v1/form-builder/registration` REST endpoint, which is registered with `permission_callback => __return_true` and whose `register()` handler reads `roleSlug` from attacker-controlled block attributes without confirming the block's `formType` is actually `registration`; the save-time sanitizer only enforces that constraint for registration blocks. Impact is bounded below administrator - `is_safe_registration_role()` rejects any role carrying `manage_options`, `edit_users`, `delete_users`, `create_users`, `promote_users`, or `edit_theme_options`, so Editor is the highest role practically reachable on a standard installation. No public exploit code or active exploitation is identified at time of analysis, and the CVSS vector (PR:L) confirms the attack requires authentication.
Unauthenticated remote attackers can terminate a Crow (CrowCpp) server process by sending an HTTP request body containing thousands of nested JSON objects to any route that passes the body to crow::json::load(). The recursive-descent parser in the Crow headers recursed without an effective depth guard, and a stack overflow is not catchable with try/catch, so the whole process dies and all open connections are dropped rather than a single request failing. The behavior is version-dependent on the deployment: the published PoC crashes a Windows build reliably with roughly 4000 nesting levels against a 1MB default stack, whereas Linux's ~8MB default stack resists the demonstrated depth, and a fronting reverse proxy that rejects oversized bodies prevents the attack. A public proof-of-concept (client and server source) accompanies the GitHub advisory; it is not independently verified as working exploit code, and there is no CISA KEV confirmation of active exploitation. Vendor-released patch: 1.3.4.
Camaleon CMS releases before 2.9.3 let an authenticated user who holds only the 'media' permission escape the site's temporary upload directory and write arbitrary files, which can be escalated to remote code execution. The concrete route is the crop_url media action: the attacker submits a base64 'data:' URI together with a name parameter containing ../ sequences, and the pre-2.9.3 upload sink stores the decoded payload at the traversed path - including an ERB template placed inside a theme's views directory, which executes when that view is rendered. The only gate is possession of the media permission, which confines the issue to users already granted upload rights rather than anonymous visitors; the vendor has shipped a fix in 2.9.3 and no public exploit has been identified at time of analysis, though the flaw warrants prompt remediation this week.
An allowlist bypass in Grav CMS 2.0.15 through 2.2.12 lets an authenticated account holding page-edit permission (api.pages.write, or admin.pages in the classic admin) invoke arbitrary public static PHP methods by smuggling a data-*@ directive past Grav's Class::method allowed-callable check inside a page-authored Flex form override; methods such as Folder::delete, Folder::move, Folder::copy or Utils::download can then delete directories, move or overwrite files, and read files outside the page tree. The crafted directive fires when the page's Flex form is built, for example when an administrator opens the page on the site, so the payload is planted by the lower-privileged editor and executed in an administrator's request. The vendor shipped a complete fix in 2.2.13; the earlier 2.2.2 patch (GHSA-9rq7-4cch-f22j) only closed the replace-name@ spelling and leaves installations exploitable, and no public exploit code was identified at time of analysis.
Authorization bypass in the GeoDirectory WordPress plugin before 2.8.194 lets any user holding Subscriber-level access or higher rewrite image metadata - title, caption, moderation status and the featured flag - on attachments belonging to other users' listings, and claim another user's image as their own featured image. Because the plugin never confirms that a referenced attachment belongs to the listing being saved, a low-privileged account is enough; on sites with open registration an attacker can self-provision that account. This is an integrity-only issue (no confidentiality or availability impact), EPSS is 0.18% (7th percentile) and ris
Missing authorization in News Kit Addons For Elementor before 1.4.9 lets authenticated subscriber-level users install and activate the plugin from the WordPress.org repository by calling an AJAX action that lacks a capability check. The issue is network-reachable and needs no administrator interaction, but its impact is limited to unauthorized plugin installation and activation-integrity only, with no confidentiality or availability effect-and it requires a valid low-privilege account, which is trivial on sites with open registration. A public PoC reference exists but is not verified as working exploit code; EPSS is 0.18% (7th percentile).
GeoDirectory WordPress plugin before 2.8.194 fails to verify ownership of listings submitted by logged-out visitors, so unauthenticated attackers can edit, unpublish, attach images to, or reassign any guest-submitted listing. The flaw only matters when guest posting is enabled and guest listings already exist, and impact is limited to integrity changes on those listings - no data disclosure or availability loss - giving it a low vendor-aligned CVSS of 3.7 (AC:H, PR:N, UI:N). A public reference to the issue exists via WPScan but is not verified as working exploit code, EPSS is 0.19% (8th percentile), there is no KEV entry, and the tracking decision is monitor; a vendor patch is available.
MongoDB Compass versions prior to 1.53.1 ship an Electron runtime whose bundled TLS root store still contains the compromised, recoverable eMudhra intermediate CA certificates, so a party holding a certificate chained to those intermediates can be treated as trusted by the application. Because the attacker must also occupy a man-in-the-middle position on the network path and induce a user to initiate a Compass connection through it, impact is confidential and integrity-related (VC:H/VI:H) rather than an unauthenticated remote take-over. The vendor resolves the issue in Compass 1.53.1, which bundles Electron 44.9.1; no public exploit code or active exploitation has been reported, and the issue is prioritised as this week rather than an emergency.
Unauthenticated remote attackers can read protected information from WordPress sites running the Knit Pay UPI QR Code Payment Gateway for WooCommerce through version 1.6.3 because a plugin endpoint lacks authorization checks (CWE-862). The flaw is rated CVSS 7.5 with confidentiality-only impact (C:H/I:N/A:N) and requires WooCommerce plus the named plugin to be installed and active. No CISA KEV entry or public exploit code is present in the supplied intelligence, and exposure is limited by the plugin's niche UPI payment deployment footprint.
PHP object injection in the Relevanssi WordPress plugin through 4.28.4 allows an authenticated attacker with high privileges - effectively administrator-level access in WordPress - to pass untrusted data into a deserialization path, with potential high impact to confidentiality, integrity, and availability. The specific vulnerable feature, endpoint, or parameter is not described in the available sources, and whether a usable POP gadget chain exists is not confirmed. No public exploit was identified at time of analysis.
Broken access control in Cervantes's JiraController allows any authenticated user to create, edit, or delete Jira tickets belonging to other projects, breaking project-level isolation in the tool's Jira integration. All releases from alpha 0.3 through v1.3-beta are affected (tracked by CPE cpe:2.3:a:cervantessec:cervantes), and successful abuse yields high integrity impact with limited confidentiality impact across the shared Jira workspace. Exploitation requires a valid low-privileged account (CVSS PR:L) and Jira integration must be in use; no public exploit code has been identified at time of analysis, and the issue is not in CISA KEV, though the vendor has published a fix and the aggregate decision label places remediation in the current week.
The WordPress plugin User Profile Builder (Beautiful User Registration Forms, User Profiles & User Role Editor) through version 4.0.3 lets an authenticated user with Author-level access or higher create brand-new WordPress accounts that carry the Editor role, because the Gutenberg 'Register' block forwards an attacker-supplied Assigned Role attribute straight into the [wppb-register] shortcode with no server-side authorization check. The built-in role guard only strips roles that hold the manage_options or remove_users capability, so Administrator is blocked but Editor and every other privileged non-Administrator role passes through untouched, giving a limited - not full-admin - privilege escalation with high integrity impact (CVSS 7.1, PR:L). No public exploit code or CISA KEV entry was identified at time of analysis, and the issue is rated a this-week, moderate-priority fix rather than an emergency.
Row-level data-scope enforcement in yudao-cloud through 2026.09 can be switched off by any authenticated tenant user who sends a 'data-permission-enable: false' header on requests to /admin-api (and /app-api), letting them read or modify records belonging to other departments and users inside the same tenant. The flaw is a trust-boundary error (CWE-807): DataPermissionRpcWebFilter honours that header on every request path instead of only on internal /rpc-api calls, so no special configuration, user interaction, or elevated role is needed beyond a valid account. Rated High at CVSS 4.0 7.1 (assessed 3.1: AV:N/AC:L/PR:L/UI:N/C:H/I:L/A:N); no public exploit code was identified at time of analysis, though a third-party technical writeup of the header bypass is referenced, and the vendor has published an upstream fix commit.
Stored cross-site scripting in the Infomaniak VOD WordPress plugin through version 1.5.14 allows an attacker who can store content that the plugin later renders to execute script in a victim's browser when the victim views the affected page. The independent assessment treats this as requiring a low-privilege authenticated user to plant the payload plus victim interaction (UI:R), with changed scope but low confidentiality, integrity, and no availability impact; the published vector lists PR:N, so the exact role required should be verified against the Patchstack advisory. No public exploit or CISA KEV entry is identified in the available data, and vuln.today assigns a 'this_week' priority.
Reflected cross-site scripting in the Pixelite Events Manager WordPress plugin through version 7.4.8 allows remote attackers to execute script in a victim's browser when the victim clicks a crafted link. The attacker needs no authentication (PR:N), but successful exploitation requires victim interaction (UI:R), limiting it to social-engineering-driven, one-victim-at-a-time attacks; the vuln.today priority label is 'this_week'. No public exploit identified at time of analysis, and no CISA KEV entry was provided.
Stored cross-site scripting in the QA Analytics WordPress plugin (qa-heatmap-analytics) affects every version through 5.3.0.1 and lets an attacker persist a script payload that executes in the browser of a user who later loads the page where it is rendered, with the scope change in the CVSS vector meaning the script can act beyond the vulnerable component's own origin context. Exploitation is not zero-click: a payload must first be stored and then a victim must be induced to view the affected page, and the available sources do not identify which input field or page is involved. No public exploit code has been identified at time of analysis; the issue was reported by Patchstack and is prioritized for remediation this week by vulnerability intelligence feeds.
Stored cross-site scripting in the Bold Grid WordPress plugin W3 Total Cache, affecting every version through 2.10.7, lets an attacker persist a script payload that then runs in the browser of a user who loads the affected page. The CVSS 3.1 score is 7.1 with scope change (S:C) and required user interaction (UI:R), so a victim - typically a privileged user viewing the rendered output - must load the tainted page before the payload fires. Exploitation status: no public exploit identified at time of analysis; the issue is not listed in CISA KEV and no EPSS value was supplied, and the priority label is 'this week' rather than emergency.
Reflected cross-site scripting in the WordPress plugin 'We're Open!' (opening-hours) through version 2.6 allows remote attackers to execute script in a victim's browser session when the victim opens a crafted URL, with no authentication required on the attacker's side (CVSS 3.1: 7.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The payload is not stored, so exploitation depends on luring a user who can reach the affected plugin pages - impact is greater if that user is an administrator. No public exploit code or CISA KEV entry was identified at the time of analysis, and the specific vulnerable parameter is not described in the available sources.
Stored cross-site scripting in the WP Event Solution WordPress plugin, affecting versions through 4.1.26, lets an actor who can store input that the plugin later renders execute script in the browser of a user who views the affected page. The CVSS vector requires victim interaction (UI:R) and indicates a scope change (S:C), and the supplied vector lists PR:N although the specific field and capability required are not described in the available sources; if authenticated submission is in fact required, exploitation is more limited. This is a moderate, not emergency, priority (vuln.today decision: this_week), and no public exploit was identified at time of analysis.
DOM-based cross-site scripting in the BuddyPress-dependent BP Better Messages WordPress plugin affects versions through 3.1.3 and lets an attacker deliver crafted content that executes in a victim's browser after the victim interacts with it. The reported severity is 7.1 (High), with the assessed vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, so no attacker authentication is required but victim interaction is mandatory and the payload runs client-side rather than on the server. The supplied intelligence does not confirm active exploitation (no CISA KEV flag) and no public exploit is identified at time of analysis; the exact plugin feature or parameter that sinks the input is not described.
Missing authorization in Faveo Helpdesk's unauthenticated client controller (UnAuthController) allows remote attackers to change, close, open, or resolve support tickets by supplying a ticket id and status value, with no login and no victim interaction required (CVSS:3.1 AV:N/AC:L/PR:N/UI:N, integrity-only at VI:L). All releases up to and including 2.0.3 are affected, and exploitation yields unauthorized ticket-state manipulation rather than data theft or outage, since confidentiality and availability impacts are absent. No public exploit code and no CISA KEV entry were identified at time of analysis.
Weak password recovery in Faveo Helpdesk 2.0.3 allows remote, unauthenticated attackers to manipulate the forgot-password flow handled by ForgotPasswordController::sendResetLinkEmail and PasswordController::reset in app/Http/Controllers/Auth/ForgotPasswordController.php. The issue is CWE-640, and the assessed impact is limited to low confidentiality, integrity and availability effects with unchanged scope; the supplied vector also indicates low attack complexity and no privileges or user interaction. No public exploit has been identified at time of analysis, and the available decision signal places this at this_month priority rather than an emergency.
Stored cross-site scripting in the 'Notes' field of Checklists in Cervantes v1.3-beta lets an authenticated user with permission to write notes plant a payload that executes in another user's browser when that checklist is viewed. Because the victim is expected to hold higher privileges than the author, the injected script can act with elevated rights - the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N (6.8 base), reflecting a scope change and high confidentiality impact, and the tags attached to this record cite both XSS and RCE outcomes. Exploitation requires a multi-user deployment where low- and high-privilege users share checklists, plus victim interaction; no public exploit code was identified at time of analysis, and the vulnerability is not listed as actively exploited.