GeoDirectory, a WordPress directory plugin, writes administrator-supplied text into a generated PHP file inside its own plugin folder without escaping it (CWE-94), so a high-privilege user who can save GeoDirectory settings can plant PHP code that any unauthenticated visitor then triggers by requesting the generated file. The prerequisite is a settings-capable account - on a multisite network that means a subsite administrator who is otherwise deliberately prevented from running code - so exploitability is concentrated in sandboxed multisite and managed-hosting deployments, where a full single-site administrator would already have code execution. Fixes are available in 2.8.194; EPSS is low at 0.29% (20th percentile), there is no CISA KEV entry, and the only public reference is a WPScan advisory that is not verified as working exploit code.
Download Monitor, a WordPress plugin, fails to verify that a clicked link actually belongs to the site before fetching it client-side and injecting part of the response back into the page, producing a cross-site scripting condition in every release before 5.3.4. The flaw is remotely reachable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C) but is gated by mandatory user interaction - an attacker must convince a victim to click a crafted link - and it crosses a trust boundary into the browser, so the injected script runs in the context of the affected WordPress site. A public PoC reference exists but is not verified as working exploit code, EPSS is only 0.24% (14th percentile), and there is no CISA KEV entry, so signals point to a moderate, interaction-gated risk rather than an emergency; the vendor fix is version 5.3.4.
Privilege escalation in the aBlocks WordPress plugin (Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder) through 2.17.0 lets an authenticated attacker with Contributor-level access or above raise their own WordPress role to Editor and receive a fully authenticated session at the elevated level. The flaw sits in the plugin's `/ablocks/v1/form-builder/registration` REST endpoint, which is registered with `permission_callback => __return_true` and whose `register()` handler reads `roleSlug` from attacker-controlled block attributes without confirming the block's `formType` is actually `registration`; the save-time sanitizer only enforces that constraint for registration blocks. Impact is bounded below administrator - `is_safe_registration_role()` rejects any role carrying `manage_options`, `edit_users`, `delete_users`, `create_users`, `promote_users`, or `edit_theme_options`, so Editor is the highest role practically reachable on a standard installation. No public exploit code or active exploitation is identified at time of analysis, and the CVSS vector (PR:L) confirms the attack requires authentication.
Unauthenticated remote attackers can terminate a Crow (CrowCpp) server process by sending an HTTP request body containing thousands of nested JSON objects to any route that passes the body to crow::json::load(). The recursive-descent parser in the Crow headers recursed without an effective depth guard, and a stack overflow is not catchable with try/catch, so the whole process dies and all open connections are dropped rather than a single request failing. The behavior is version-dependent on the deployment: the published PoC crashes a Windows build reliably with roughly 4000 nesting levels against a 1MB default stack, whereas Linux's ~8MB default stack resists the demonstrated depth, and a fronting reverse proxy that rejects oversized bodies prevents the attack. A public proof-of-concept (client and server source) accompanies the GitHub advisory; it is not independently verified as working exploit code, and there is no CISA KEV confirmation of active exploitation. Vendor-released patch: 1.3.4.
Camaleon CMS releases before 2.9.3 let an authenticated user who holds only the 'media' permission escape the site's temporary upload directory and write arbitrary files, which can be escalated to remote code execution. The concrete route is the crop_url media action: the attacker submits a base64 'data:' URI together with a name parameter containing ../ sequences, and the pre-2.9.3 upload sink stores the decoded payload at the traversed path - including an ERB template placed inside a theme's views directory, which executes when that view is rendered. The only gate is possession of the media permission, which confines the issue to users already granted upload rights rather than anonymous visitors; the vendor has shipped a fix in 2.9.3 and no public exploit has been identified at time of analysis, though the flaw warrants prompt remediation this week.
An allowlist bypass in Grav CMS 2.0.15 through 2.2.12 lets an authenticated account holding page-edit permission (api.pages.write, or admin.pages in the classic admin) invoke arbitrary public static PHP methods by smuggling a data-*@ directive past Grav's Class::method allowed-callable check inside a page-authored Flex form override; methods such as Folder::delete, Folder::move, Folder::copy or Utils::download can then delete directories, move or overwrite files, and read files outside the page tree. The crafted directive fires when the page's Flex form is built, for example when an administrator opens the page on the site, so the payload is planted by the lower-privileged editor and executed in an administrator's request. The vendor shipped a complete fix in 2.2.13; the earlier 2.2.2 patch (GHSA-9rq7-4cch-f22j) only closed the replace-name@ spelling and leaves installations exploitable, and no public exploit code was identified at time of analysis.
MongoDB Compass versions prior to 1.53.1 ship an Electron runtime whose bundled TLS root store still contains the compromised, recoverable eMudhra intermediate CA certificates, so a party holding a certificate chained to those intermediates can be treated as trusted by the application. Because the attacker must also occupy a man-in-the-middle position on the network path and induce a user to initiate a Compass connection through it, impact is confidential and integrity-related (VC:H/VI:H) rather than an unauthenticated remote take-over. The vendor resolves the issue in Compass 1.53.1, which bundles Electron 44.9.1; no public exploit code or active exploitation has been reported, and the issue is prioritised as this week rather than an emergency.
Unauthenticated remote attackers can read protected information from WordPress sites running the Knit Pay UPI QR Code Payment Gateway for WooCommerce through version 1.6.3 because a plugin endpoint lacks authorization checks (CWE-862). The flaw is rated CVSS 7.5 with confidentiality-only impact (C:H/I:N/A:N) and requires WooCommerce plus the named plugin to be installed and active. No CISA KEV entry or public exploit code is present in the supplied intelligence, and exposure is limited by the plugin's niche UPI payment deployment footprint.
PHP object injection in the Relevanssi WordPress plugin through 4.28.4 allows an authenticated attacker with high privileges - effectively administrator-level access in WordPress - to pass untrusted data into a deserialization path, with potential high impact to confidentiality, integrity, and availability. The specific vulnerable feature, endpoint, or parameter is not described in the available sources, and whether a usable POP gadget chain exists is not confirmed. No public exploit was identified at time of analysis.
Broken access control in Cervantes's JiraController allows any authenticated user to create, edit, or delete Jira tickets belonging to other projects, breaking project-level isolation in the tool's Jira integration. All releases from alpha 0.3 through v1.3-beta are affected (tracked by CPE cpe:2.3:a:cervantessec:cervantes), and successful abuse yields high integrity impact with limited confidentiality impact across the shared Jira workspace. Exploitation requires a valid low-privileged account (CVSS PR:L) and Jira integration must be in use; no public exploit code has been identified at time of analysis, and the issue is not in CISA KEV, though the vendor has published a fix and the aggregate decision label places remediation in the current week.
The WordPress plugin User Profile Builder (Beautiful User Registration Forms, User Profiles & User Role Editor) through version 4.0.3 lets an authenticated user with Author-level access or higher create brand-new WordPress accounts that carry the Editor role, because the Gutenberg 'Register' block forwards an attacker-supplied Assigned Role attribute straight into the [wppb-register] shortcode with no server-side authorization check. The built-in role guard only strips roles that hold the manage_options or remove_users capability, so Administrator is blocked but Editor and every other privileged non-Administrator role passes through untouched, giving a limited - not full-admin - privilege escalation with high integrity impact (CVSS 7.1, PR:L). No public exploit code or CISA KEV entry was identified at time of analysis, and the issue is rated a this-week, moderate-priority fix rather than an emergency.
Row-level data-scope enforcement in yudao-cloud through 2026.09 can be switched off by any authenticated tenant user who sends a 'data-permission-enable: false' header on requests to /admin-api (and /app-api), letting them read or modify records belonging to other departments and users inside the same tenant. The flaw is a trust-boundary error (CWE-807): DataPermissionRpcWebFilter honours that header on every request path instead of only on internal /rpc-api calls, so no special configuration, user interaction, or elevated role is needed beyond a valid account. Rated High at CVSS 4.0 7.1 (assessed 3.1: AV:N/AC:L/PR:L/UI:N/C:H/I:L/A:N); no public exploit code was identified at time of analysis, though a third-party technical writeup of the header bypass is referenced, and the vendor has published an upstream fix commit.
Stored cross-site scripting in the Infomaniak VOD WordPress plugin through version 1.5.14 allows an attacker who can store content that the plugin later renders to execute script in a victim's browser when the victim views the affected page. The independent assessment treats this as requiring a low-privilege authenticated user to plant the payload plus victim interaction (UI:R), with changed scope but low confidentiality, integrity, and no availability impact; the published vector lists PR:N, so the exact role required should be verified against the Patchstack advisory. No public exploit or CISA KEV entry is identified in the available data, and vuln.today assigns a 'this_week' priority.
Reflected cross-site scripting in the Pixelite Events Manager WordPress plugin through version 7.4.8 allows remote attackers to execute script in a victim's browser when the victim clicks a crafted link. The attacker needs no authentication (PR:N), but successful exploitation requires victim interaction (UI:R), limiting it to social-engineering-driven, one-victim-at-a-time attacks; the vuln.today priority label is 'this_week'. No public exploit identified at time of analysis, and no CISA KEV entry was provided.
Stored cross-site scripting in the QA Analytics WordPress plugin (qa-heatmap-analytics) affects every version through 5.3.0.1 and lets an attacker persist a script payload that executes in the browser of a user who later loads the page where it is rendered, with the scope change in the CVSS vector meaning the script can act beyond the vulnerable component's own origin context. Exploitation is not zero-click: a payload must first be stored and then a victim must be induced to view the affected page, and the available sources do not identify which input field or page is involved. No public exploit code has been identified at time of analysis; the issue was reported by Patchstack and is prioritized for remediation this week by vulnerability intelligence feeds.
Stored cross-site scripting in the Bold Grid WordPress plugin W3 Total Cache, affecting every version through 2.10.7, lets an attacker persist a script payload that then runs in the browser of a user who loads the affected page. The CVSS 3.1 score is 7.1 with scope change (S:C) and required user interaction (UI:R), so a victim - typically a privileged user viewing the rendered output - must load the tainted page before the payload fires. Exploitation status: no public exploit identified at time of analysis; the issue is not listed in CISA KEV and no EPSS value was supplied, and the priority label is 'this week' rather than emergency.
Reflected cross-site scripting in the WordPress plugin 'We're Open!' (opening-hours) through version 2.6 allows remote attackers to execute script in a victim's browser session when the victim opens a crafted URL, with no authentication required on the attacker's side (CVSS 3.1: 7.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The payload is not stored, so exploitation depends on luring a user who can reach the affected plugin pages - impact is greater if that user is an administrator. No public exploit code or CISA KEV entry was identified at the time of analysis, and the specific vulnerable parameter is not described in the available sources.
Stored cross-site scripting in the WP Event Solution WordPress plugin, affecting versions through 4.1.26, lets an actor who can store input that the plugin later renders execute script in the browser of a user who views the affected page. The CVSS vector requires victim interaction (UI:R) and indicates a scope change (S:C), and the supplied vector lists PR:N although the specific field and capability required are not described in the available sources; if authenticated submission is in fact required, exploitation is more limited. This is a moderate, not emergency, priority (vuln.today decision: this_week), and no public exploit was identified at time of analysis.
DOM-based cross-site scripting in the BuddyPress-dependent BP Better Messages WordPress plugin affects versions through 3.1.3 and lets an attacker deliver crafted content that executes in a victim's browser after the victim interacts with it. The reported severity is 7.1 (High), with the assessed vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, so no attacker authentication is required but victim interaction is mandatory and the payload runs client-side rather than on the server. The supplied intelligence does not confirm active exploitation (no CISA KEV flag) and no public exploit is identified at time of analysis; the exact plugin feature or parameter that sinks the input is not described.