Stored cross-site scripting in the WPVR WordPress plugin before 9.0.3 lets authenticated users with the Contributor role or higher plant script inside tour hotspot content, which then runs in the browser of anyone who later views the affected tour. The vulnerable code neither sanitises nor escapes that hotspot content on storage or on front-end output (CWE-79), so the payload persists in the tour and fires on view rather than at injection time. Exploitation requires a valid low-privilege account and use of the tour-hotspot feature, and impact is confined to the browsers of tour viewers rather than the WordPress server itself; a public PoC reference exists but is not verified as working exploit code, EPSS is low at 0.21% (10th percentile), and the item is not flagged for confirmed active exploitation (CISA KEV), consistent with a managed, this-month priority.
Stored cross-site scripting in the GeoDirectory WordPress plugin before 2.8.194 allows an authenticated user holding the Contributor role or higher to place a map shortcode whose style-related attributes are not sanitised or escaped before being written into a style attribute, so the injected script runs in the browser of any user who later views that content. Exploitation requires that the attacker can author content containing the map shortcode and that a victim - an administrator reviewing the post or a front-end visitor - subsequently loads it; sites that do not grant untrusted users Contributor access, or that do not use the map shortcode, are materially less exposed. A public proof-of-concept reference exists (WPScan advisory) but is not verified as working exploit code, EPSS is low at 0.21% (10th percentile), there is no CISA KEV listing, and the vendor has released a fix in 2.8.194.
Stored cross-site scripting in the Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 lets an account with a role as low as Contributor rewrite the plugin's tracking configuration, because one of its AJAX handlers performs no capability check and the nonce guarding it is readable by anyone who can reach the admin dashboard, so attacker-chosen JavaScript then executes in the browsers of all visitors, administrators included. The flaw is not anonymous: the attacker must already hold an authenticated WordPress account that can open wp-admin, and the injected payload only fires when a victim - an administrator or a site visitor - subsequently loads a page that renders the tampered tracking output. No KEV designation appears in the available intelligence, EPSS is 0.21% (10th percentile), a public PoC reference exists at WPScan but is not verified as working exploit code, and this is a moderate-priority issue rather than a top-tier emergency; version 2.2.3 is the first fixed release.
Unauthenticated visitors can self-assign an arbitrary membership level and set their own approved, confirmed and paid flags when registering through the front-end forms of the Front End Users WordPress plugin through 3.2.35, because the plugin does not restrict which account attributes a registrant may submit. Sites that rely on the plugin's membership-level or approval/payment gating for content restriction are the ones that lose protection; sites that do not use those gating features gain an attacker little. This is a genuine but moderate-priority issue rather than an urgent emergency: EPSS is only 0.20% (9th percentile), there is no CISA KEV entry, and the only available exploit reference is a public PoC reference that is not verified as working exploit code - so no confirmed active exploitation and no verified exploit at time of analysis.
Any authenticated user holding even a minimal role such as Subscriber on a WordPress site running the MAS Videos plugin through 1.3.4 can permanently delete arbitrary posts, pages, attachments and other users' content, because the plugin's front-end video and playlist deletion handlers perform no capability or ownership check and verify a nonce tied only to a static action rather than to the targeted object. The issue is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/C:N/I:H/A:N) under CWE-862 Missing Authorization, with the authentication prerequisite being the principal limiting factor - sites that permit open or self-service registration are materially more exposed than those that restrict account creation. Exploitation status: no public exploit identified at time of analysis beyond a public PoC reference that is not verified as working exploit code; there is no CISA KEV entry, EPSS is 0.18% (7th percentile), and the vuln.today decision label is this_month.
Authenticated path traversal in the GeoDirectory WordPress plugin before 2.8.194 allows any user holding a Subscriber-level account or higher to supply an image URL during front-end listing submission that the plugin then treats as a local filesystem path, reading files from outside the web root and deleting them from the server. The impact is constrained to filenames carrying an allowed media extension, but each successful hit both re-publishes the targeted file at a public URL and destroys the original as a side effect. Exploitation requires a low-privilege account (which open registration on many WordPress sites provides) and no victim interaction; EPSS is low at 0.20% (10th percentile), the issue is not in CISA KEV, and only a public PoC reference exists that is not verified as working exploit code.
Unauthenticated command injection in Travisun Opptrix 0.4.0 allows remote attackers to run arbitrary commands on the host by manipulating the /api/auth/setup endpoint of the project's Schedule API. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, E:P) and the independent assessment agree that no credentials or user interaction are needed, and the impact is scoped to the vulnerable component with low confidentiality, integrity and availability effect in the vendor score but high across all three in our assessment. A public PoC reference exists; it is not verified as working exploit code, and there is no confirmed active exploitation. Real-world priority remains low: the maintainer says the project was meant to run only on localhost, it is deprecated and completely taken offline, and only unsupported versions are affected, which is why this is tracked as a this_month item rather than an emergency.
Denial of service in Travisun Opptrix 0.4.0 is reachable through the /api/channels/webhook/ route, where the preParsing handler's use of Buffer.concat can be driven into improper resource handling (CWE-404). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the route is remotely reachable by unauthenticated attackers with no user interaction, but the assessed impact is deliberately narrow: low availability loss only, with no confidentiality or integrity consequence. A public PoC reference exists but is not verified as working exploit code, and realistic exposure is sharply limited because the maintainer has taken the project offline and deprecated it, states the flaw manifested primarily in local environments during early development, and says the main versions were intended to run exclusively on localhost.
Code injection in Travisun Opptrix 0.4.0 through the /api/system-update/import endpoint can lead to remote code execution by an unauthenticated network attacker when the HTTP API is reachable. The independent assessment rates confidentiality, integrity, and availability impact as high, but practical exposure is constrained because the deprecated project was intended to run only on localhost and remote exploitation requires an operator to expose the API on a routable interface. The supplied intelligence does not confirm CISA KEV active exploitation, and a public PoC reference exists but is not verified as working exploit code.
Authenticated users with only subscriber-level access can write arbitrary post metadata under attacker-chosen keys to any post, including content owned by higher-privileged users, in News Kit Addons For Elementor through version 1.4.7. The issue is a missing capability and ownership check (CWE-862) in an authenticated AJAX action, yielding integrity-only impact per our assessment. A public PoC reference exists but is not verified as working exploit code; EPSS is 0.18% and no CISA KEV confirmation is present.
Missing authorization in the Advanced Twenty Seventeen WordPress plugin through 1.3.1 lets any authenticated user, including a subscriber, create and activate the plugin's bundled child theme site-wide, and lets an attacker trigger the same theme switch via CSRF against any logged-in user up to an administrator. The flaw affects site integrity and availability only, with no confidentiality impact; no KEV entry is present in the supplied intelligence, a public PoC reference exists but is not verified as working exploit code, and EPSS is 0.13% (2nd percentile).
GeoDirectory WordPress plugin versions before 2.8.194 fail to enforce status, ownership and password checks in an unauthenticated AJAX listing-loading handler, allowing remote unauthenticated attackers to retrieve the content of draft, pending, private or password-protected listings by supplying their IDs. The flaw is confidentiality-only (C:L) and the practical impact depends on the site actually containing non-public listings with discoverable IDs. This is a genuine but moderate-priority information-disclosure issue, not a high-urgency emergency; no CISA KEV confirmation is present, EPSS is low at 0.20% (9th percentile), and a public PoC reference exists but is not verified as working exploit code.
Unauthenticated visitors to WordPress sites running GeoDirectory before 2.8.194 can retrieve the title, permalink and card fields of draft, pending, private and trashed listings through one of the plugin's single-item map-popup REST routes, which performs no status or ownership check on the supplied listing ID (CVSS 5.3, CWE-200). Exploitation is straightforward wherever that route is reachable and non-public listings exist, but disclosure is confined to those card-level fields rather than the full listing body or private owner data, and the attacker must know or guess a valid numeric listing ID. A vendor patch (2.8.194) is available, EPSS is 0.20% (9th percentile), there is no CISA KEV entry, and the referenced WPScan publication is a PoC reference that is not verified as working exploit code.
Authorization bypass in the GeoDirectory WordPress plugin before 2.8.194 lets any user holding Subscriber-level access or higher rewrite image metadata - title, caption, moderation status and the featured flag - on attachments belonging to other users' listings, and claim another user's image as their own featured image. Because the plugin never confirms that a referenced attachment belongs to the listing being saved, a low-privileged account is enough; on sites with open registration an attacker can self-provision that account. This is an integrity-only issue (no confidentiality or availability impact), EPSS is 0.18% (7th percentile) and ris
Missing authorization in News Kit Addons For Elementor before 1.4.9 lets authenticated subscriber-level users install and activate the plugin from the WordPress.org repository by calling an AJAX action that lacks a capability check. The issue is network-reachable and needs no administrator interaction, but its impact is limited to unauthorized plugin installation and activation-integrity only, with no confidentiality or availability effect-and it requires a valid low-privilege account, which is trivial on sites with open registration. A public PoC reference exists but is not verified as working exploit code; EPSS is 0.18% (7th percentile).
Missing authorization in Faveo Helpdesk's unauthenticated client controller (UnAuthController) allows remote attackers to change, close, open, or resolve support tickets by supplying a ticket id and status value, with no login and no victim interaction required (CVSS:3.1 AV:N/AC:L/PR:N/UI:N, integrity-only at VI:L). All releases up to and including 2.0.3 are affected, and exploitation yields unauthorized ticket-state manipulation rather than data theft or outage, since confidentiality and availability impacts are absent. No public exploit code and no CISA KEV entry were identified at time of analysis.
Weak password recovery in Faveo Helpdesk 2.0.3 allows remote, unauthenticated attackers to manipulate the forgot-password flow handled by ForgotPasswordController::sendResetLinkEmail and PasswordController::reset in app/Http/Controllers/Auth/ForgotPasswordController.php. The issue is CWE-640, and the assessed impact is limited to low confidentiality, integrity and availability effects with unchanged scope; the supplied vector also indicates low attack complexity and no privileges or user interaction. No public exploit has been identified at time of analysis, and the available decision signal places this at this_month priority rather than an emergency.
Stored cross-site scripting in the 'Notes' field of Checklists in Cervantes v1.3-beta lets an authenticated user with permission to write notes plant a payload that executes in another user's browser when that checklist is viewed. Because the victim is expected to hold higher privileges than the author, the injected script can act with elevated rights - the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N (6.8 base), reflecting a scope change and high confidentiality impact, and the tags attached to this record cite both XSS and RCE outcomes. Exploitation requires a multi-user deployment where low- and high-privilege users share checklists, plus victim interaction; no public exploit code was identified at time of analysis, and the vulnerability is not listed as actively exploited.
BigFix Platform installations that still ship a Mozilla CA certificate bundle (PEM) dated before 2026/10/20 continue to trust certificates whose private keys are known to be compromised, so an attacker holding an on-path position can impersonate the remote servers BigFix validates and tamper with the files the application downloads. Successful exploitation requires that stale bundle to be present, a privileged man-in-the-middle position, and a certificate chained to one of the compromised keys, which is why the assessed severity is moderate rather than urgent (CVSS 3.1 base 6.8, AV:N/AC:H/PR:N/UI:R). No public exploit code or PoC reference was identified at time of analysis, and the flaw does not affect installations already running the 2026/10/20 or later bundle shipped with BES Support v1520 and above.
Brainstorm Force SureDash through 1.12.2 does not enforce authorization for low-privileged users, allowing an authenticated WordPress account to read data intended for higher-privileged roles; the issue is scored CVSS 6.5 with confidentiality-only impact. The flaw is CWE-862 missing authorization, and no public exploit was identified at time of analysis. Sites that allow untrusted user registration have the larger exposure because a low-privileged account is the prerequisite.
Missing authorization in the Quadlayers WP Social Feed Gallery (insta-gallery) plugin for WordPress through version 5.0.13 allows unauthenticated remote attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) to reach functionality that should sit behind an access-control check, yielding low confidentiality and low integrity impact with no availability impact. The flaw is CWE-862 (Missing Authorization) and is rated 6.5, so it does not by itself provide full site takeover, code execution, or data destruction - a moderate-severity, likely-low-urgency issue rather than a top-tier emergency. No public exploit code or PoC reference was identified at time of analysis, there is no CISA KEV entry, and no vendor-released patch version is identified in the available data; the priority label assigned by vuln.today is 'this_month'.
Reflected cross-site scripting in the WordPress plugin Ad Inserter (versions through 2.8.18) lets a low-privilege actor craft a request or URL carrying a script payload and execute it in a victim's browser once that victim is persuaded to follow the link. Rated medium severity at CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), the flaw is non-persistent and requires victim interaction, so abuse depends on social engineering rather than a silent remote compromise. No confirmed active exploitation (not in CISA KEV) and no working exploit code is documented in the available sources; the report originates from Patchstack and is prioritized as a this-month item, with applicability limited to Ad Inserter up to and including 2.8.18.
Stored cross-site scripting in the All-in-One Video Gallery WordPress plugin through 4.9.7 allows an authenticated low-privileged user to persist script content that runs when another user views the affected page. The flaw is rated CVSS 6.5 (CWE-79) and requires user interaction for the stored payload to execute; no public exploit or CISA KEV entry is identified in the provided data, and vuln.today prioritizes it as a this_month item rather than an emergency.
Missing authorization in the WpEvently (mage-eventpress) WordPress plugin through 5.7.8 is a medium-severity (CVSS 6.5) flaw that lets unauthenticated remote attackers reach functionality lacking proper access control checks, with low confidentiality and integrity impact and no availability impact. The issue is CWE-862 and is tagged as an authentication bypass; no CISA KEV confirmation was supplied and no public exploit identified at time of analysis. The Patchstack advisory is the available reference, and the exact vulnerable endpoint or action is not named in the supplied sources.
Malformed DNS replies can crash the parser in lua-resty-dns before 0.24, causing resolver:query() to raise an uncaught Lua exception that aborts the request and breaks name resolution for that worker. The flaw sits in parse_section() and _decode_name(), which trust the resource-record lengths declared in the received message and previously truncated over-long TXT/SOA data instead of rejecting it; a short A RDATA, short AAAA RDATA, truncated record header, or excessive compression pointers is enough to trigger the failure. Exploitation requires the attacker to control the queried authoritative nameserver or to spoof its response (off-path spoofing also has to win the transaction-ID race), so no authentication or user interaction is needed but network position against the resolver's upstream is; impact is limited to availability (aborted lookups, failed resolution) with no code execution, data exposure, or integrity loss. No public exploit has been identified at time of analysis and the issue is not in CISA KEV; a vendor patch is available in v0.24.
Unitree Go2 firmware up to the 1.1.13, 1.1.14.1, and 1.1.15.1 releases contains a chat_go WebSocket client that does not validate TLS server certificates, allowing a man-in-the-middle to impersonate the WSS server and potentially read or alter traffic. Exploitation requires the attacker to first obtain a privileged network intercept position, which the assessment rates as high complexity and difficult; no authentication or user interaction is required once that position exists. The vendor has confirmed the issue, no public exploit code has been identified at time of analysis, and this is a moderate, not emergency, priority.
LiteSpeed Cache, the WordPress caching plugin maintained by Hai Zheng, inserts sensitive information into the data it sends back to clients, exposing content that should not be readable by outside parties in releases through 7.9. The CVSS 5.9 score pairs high confidentiality impact with high attack complexity, so while the flaw can be reached unauthenticated over the network with no user interaction, exploitation depends on a specific condition the public sources do not describe. No public exploit was identified at time of analysis, and the single Patchstack reference does not list a fixed version, so any site currently running LiteSpeed Cache 7.9 or earlier remains in scope.
Cross-project target tampering in Cervantes v1.3-beta lets anyone holding a valid account on a multi-project instance tamper with penetration-testing targets owned by other projects, including modifying or deleting them, which undermines the integrity of scopes, results and the security reports generated from them. The exposure is limited to integrity and availability of target records (CVSS 5.4, C:N/I:L/A:L), and exploitation presupposes a deployment that hosts more than one project, since a single-project instance exposes no foreign targets. No public exploit code has been identified at time of analysis, a vendor patch advisory is published, and this is a moderate-priority issue, not an emergency, so remediation fits a this-month cycle.
An insecure direct object reference in the manager-api of xiaozhi-esp32-server before 0.9.8 lets any authenticated account read other users' device address books by supplying a victim's device MAC to the /device/address-book/{macAddress} endpoint, disclosing contact MACs, aliases, call permissions and owning user IDs. The flaw requires only a normal or self-registered account plus knowledge of the target device MAC (CVSS v4.0 5.3, CVSS v3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), and impact is confined to confidentiality with no write or denial-of-service capability. It is not in CISA KEV and no working exploit code has been confirmed; a public technical writeup of the flaw exists, and the vendor has released a fix in v0.9.8.
Authenticated members of Yudao Cloud (yudao-cloud) through 2026.09 can read other members' after-sale operation logs through an insecure direct object reference in the mall trade module, exposing refund amounts, status transitions and timestamps. The endpoint GET /app-api/trade/after-sale-log/list accepts arbitrary, sequentially enumerable afterSaleId values without an ownership check, giving a read-only confidentiality impact rated CVSS 5.3 (PR:L). No CISA KEV entry or confirmed active exploitation is indicated; a public technical writeup reference exists but is not verified as working exploit code, and the vendor has published a fix commit.
Authenticated users of ONEARMY community-platform before 2.165.2 can mark other users' notifications as read by iterating sequential notification IDs against the POST /api/notifications/:id/read endpoint, which updated the notifications table by ID alone without verifying ownership. The effect is integrity-only and confined to users in the same tenant: victims silently lose unread indicators for replies, comments and new-content notices, and may miss activity they would otherwise respond to. The vendor has released 2.165.2 with the ownership check, and a public technical writeup of the IDOR exists; no public exploit code or active exploitation is confirmed (not in CISA KEV), and the vendor-assigned CVSS 4.0 score is 5.3 (assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), so priority is this-month rather than emergency.
DaybydayCRM through 2.2.1 lets any authenticated account - including a low-privileged employee - take over project assignment by sending a PATCH or POST request to /projects/updateassign/{external_id} with an arbitrary user_assigned_id, because ProjectsController::updateAssign() never enforces the can-assign-new-user-to-project permission. The impact is a limited-integrity authorization bypass: project ownership and the notifications that follow can be redirected to an attacker-chosen user, while no data is disclosed and availability is unaffected (CVSS 5.3, CWE-862). A valid session plus knowledge or enumeration of a target project's external_id is required, no public exploit code was identified at the time of analysis, and the issue is not listed in CISA KEV.
Incorrect authorization in BookStack's AttachmentController allows an authenticated user who holds attachment permissions to reach attachments belonging to other users' unpublished draft pages by enumerating sequential attachment IDs, then download, rename, relink or replace those files. Only BookStack deployments before 26.09.2 are affected, and the flaw is bounded to draft-page attachments rather than published content or the wider application, giving low confidentiality and integrity impact (CVSS 4.0 base 5.3; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) with no victim interaction required. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has shipped a fix in BookStack 26.09.2.
Missing authorization in RosarioSIS before 12.9.1 lets an authenticated teacher write referrals, eligibility codes, attendance entries and final grades for students outside their own course periods by submitting arbitrary student IDs to the save handlers MakeReferral.php, EnterEligibility.php, InputFinalGrades.php and TakeAttendance.php. The flaw requires valid teacher-level credentials (CVSS 4.0 base 5.3, PR:L) and is confined to record integrity within the same school - there is no confidentiality or availability impact and no anonymous attack path. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor has released fix version 12.9.1.
Cervantes (alpha 0.3 through v1.3-beta) contains an insecure direct object reference that lets any authenticated low-privileged user on a shared instance read sensitive project findings, proof-of-concept details, credentials, and client information, and change finding status or transfer findings into projects they own. The attack is network-reachable, needs no user interaction, and primarily compromises confidentiality with a lower integrity impact; availability is not affected. No public exploit identified at time of analysis, and the vendor references patch information in its Grayback advisories.