GStreamer's AV1 LEB128 parser can overflow when it processes a crafted AV1 bitstream, causing applications that decode or preview the media to crash. An unauthenticated remote attacker can trigger the overflow by supplying malformed AV1 content, but a user or application must open or preview it, and impact is limited to denial of service on Red Hat Enterprise Linux 6, 7, 8, 9, and 10 deployments. No public exploit has been identified at time of analysis.
Any WordPress site running the Page and Post Restriction plugin through version 1.6.1 can be tricked into disclosing private and role-restricted content to an unauthenticated attacker who lures a logged-in user onto an attacker-controlled page. The plugin's `papr_restrict_page_post_rest_api()` handler re-establishes the visitor's identity from the `wordpress_logged_in` cookie on GET and HEAD REST requests without checking a REST nonce, silently undoing the nonce-based cookie rejection that WordPress core's `rest_cookie_check_errors()` performs; combined with WordPress's permissive REST CORS behaviour (echoed `Origin` plus `Access-Control-Allow-Credentials: true`), a credentialed cross-origin `fetch` returns the victim's private posts/pages, their `/wp-json/wp/v2/users/me` profile and comments they are allowed to see. Impact is confidentiality-only - no data can be modified - and exploitation requires the victim to be authenticated and to actually visit the malicious page (UI:R); there is no CISA KEV listing and no verified public exploit code at time of analysis, and the vuln.today priority is 'this_month' rather than emergency.
GStreamer's gst-plugins-base MicroDVD subtitle parser can crash the consuming media application when it processes a malformed .sub subtitle file, resulting in a NULL pointer dereference (CWE-476). Affected deployments include Red Hat Enterprise Linux 6, 7, 8, 9, and 10 packages, and the issue requires the victim to open or play media with the crafted subtitle, so exploitation depends on user interaction and is availability-only. No public exploit was identified at time of analysis; upstream fix references are available, but a released patched version is not independently confirmed from the supplied data.
Authenticated SQL injection in the JoomSport WordPress plugin (beardev), all versions up to and including 5.7.14, allows any user with a Contributor-level account to read sensitive data from the site database. The attacker authors a post containing the [jsMatchPlayerList] shortcode with a crafted 'pgroup' value and previews it - WordPress executes shortcodes during preview for the post's own author, which reaches the vulnerable query without any further victim interaction. Exploitation is gated on holding Contributor-or-higher privileges, no public exploit code was identified at time of analysis, and this is a moderate, authentication-gated risk rather than a drop-everything emergency, with a this_month remediation priority.
Authenticated cross-database data disclosure in the Arc SQL-native time-series database (versions before 26.06.2, including the partially patched 26.06.1) lets any valid API token - even one created with permissions: [] or scoped to a single database - read other tenants' Parquet telemetry data by naming DuckDB I/O table functions such as parquet_scan() in a POST /api/v1/query request. The sandbox introduced for CVE-2026-47735 allowlists the entire multi-tenant storage root, and Arc's RBAC layer never authorizes function calls, while the SQL denylist only matches the literal read_parquet( spelling, so the parquet_scan alias plus glob, parquet_metadata, parquet_schema, read_blob, read_csv_auto, read_json and read_text all slip through. A public PoC reference exists (poc/poc_sandbox_alias_bypass.py in the advisory); it is not verified as working exploit code, and no confirmed active exploitation (CISA KEV) is recorded for this CVE. Impact is confidentiality-only (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and is limited to RBAC-enabled multi-tenant deployments - single-database installations are not cross-tenant affected.
Cross-user disclosure of vehicle maintenance records affects LubeLogger through 1.6.7 in the authenticated PrintRecordStickers endpoint. A logged-in user who can view any one vehicle can pass that authorized vehicleId while supplying arbitrary integer recordIds and an ImportMode to retrieve other users' service, fuel, repair, and related records, including descriptions, costs, notes, mileage, and attachment metadata. The flaw is fixed in 1.6.8; a public PoC reference exists but it is not verified as working exploit code, and there is no CISA KEV confirmation of active exploitation.
Denial of service in GCC libstdc++ occurs when an affected application extracts data into a std::bitset from a wide-character (wchar_t) stream and the library's internal stack buffer is sized without accounting for character size and alignment, producing a stack-based buffer overflow. The vendor vector is network-reachable and unauthenticated (AV:N/PR:N/UI:N) but high complexity (AC:H), and the independent assessment limits impact to a crash (A:H, no confidentiality or integrity impact); real exposure requires an application that exposes this specific wide-character bitset extraction path to untrusted input, which is uncommon. No public exploit was identified at time of analysis and the CVE is not in CISA KEV.
Authenticated HotCRP users can unmask the authors of anonymous reviews and comments by probing the `cmt:USER` search term, which matches papers where a visible comment was written by USER without checking whether the commenter's identity is supposed to be disclosed. The flaw was introduced with the `cmt:` search term in v2.101 (2017) and affects installations through the 3.3 fix line; exploitation requires a logged-in account with search access plus a paper whose comment is visible while the commenter's identity is hidden - the classic anonymous or double-blind review configuration - and candidate usernames must be enumerated or guessed. Impact is confidentiality-only (reviewer anonymity), no public exploit code was identified at time of analysis, and the vendor's fix commit c4b008e756650db3063e8dd8300127936aae9ec1 adds an explicit comment-identity visibility check.
Cloud Foundry's Cloud Controller (CAPI) writes sensitive material into audit log records, so custom buildpack credentials, syslog drain URL credentials and service-binding parameters become readable by anyone with access to those audit events. Exploitation requires an authenticated principal (CVSS PR:L) who can read CAPI audit events and the occurrence of ordinary operations such as applying, creating or updating an app manifest, creating a user-provided service instance with a syslog drain URL, or binding a service. The exposure is passive - secrets are recorded whether or not an attacker does anything - so impact is bounded by how widely audit-event read access is granted in a given deployment; no public exploit code has been identified at time of analysis and the issue is a moderate-priority disclosure rather than an emergency.
Unauthenticated deletion of arbitrary non-PHP files inside wp-content/uploads/ affects every version of the Forminator Forms WordPress plugin up to and including 1.55.0.2. The plugin trusts upload field metadata supplied in POST requests for draft submissions, and when a later draft is linked to the poisoned one through the previous_draft_id parameter, that attacker-controlled metadata is used as the file path for a delete operation. No KEV entry, no EPSS signal and no public exploit code were identified at time of analysis; exploitation is limited to media and attachments rather than code execution, since PHP files and paths outside the uploads directory are out of scope, keeping this a moderate-priority issue slated for this-month handling rather than emergency response.
Heap-based memory corruption in GStreamer's gst-plugins-bad H.265 parser allows unauthenticated remote attackers to crash applications that decode attacker-supplied HEVC media, giving a denial-of-service impact only with no confidentiality or integrity effect. The victim must actively open or play the crafted bitstream (CVSS UI:R), and the flaw is limited to a fixed-size array overrun triggered when the parser mishandles Screen Content Coding palette predictor initializer values. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is rated moderate for routine patching rather than emergency response.
Unbounded DAG pinning in the Filecoin Pin pinning daemon through 1.1.0 lets a caller holding a valid access token - or any caller when the server runs with ALLOW_NO_AUTH=true - exhaust disk, network, CPU, memory and libp2p resources by submitting a CID that resolves to a very large DAG, degrading or crashing the process or host and leaving oversized partial CAR files that require manual recovery. The issue is availability-only (CVSS 6.5, C:N/I:N/A:H) and authentication is required per the vector (PR:L); the advisory ships a public PoC request referencing a caller-supplied origins peer, but it is a reference that is not verified as working exploit code, and the CVE is not in CISA KEV. Exploitation is conditional: each per-pin Helia node has no bootstrap or mDNS configuration so a bare CID may not be fetchable, the daemon binds to localhost by default and refuses to start without a token, so realistic exposure is limited to daemons reachable beyond localhost, shared tokens among untrusted users, or deliberately enabled no-auth mode.
Shopper versions prior to 2.10.1 expose administrator and staff profile records to low-privileged admin-panel users through an insecure direct object reference in the customer detail route `/cpanel/customers/{user}/show`. Any account holding `access_dashboard` and `read_customers` can substitute an arbitrary user ID and receive profile data for accounts that the separate team-management interface protects behind the stronger `view_users` permission; differing 200/403/404 responses also permit user-ID enumeration, and if the same role holds `delete_customers` the `anonymizeAction()` may operate on the unrestricted loaded user model. Exploitation requires a valid authenticated staff session (PR:L) and same-table staff/customer accounts, and the vendor advisory ships a step-by-step proof-of-concept reproduction; the trigger is an ordinary authenticated request with a modified URL path segment rather than any special product configuration.
Request smuggling in Undertow's ChunkReader lets a remote attacker bypass the chunk-size limit using a crafted 15-digit chunk length, overflow internal state flags, and force the server to end a request body early so the trailing bytes are reinterpreted as a second, smuggled request. Red Hat ships the affected Undertow code in JBoss Enterprise Application Platform 7 and 8, Fuse 7, Red Hat Single Sign-On 7, the Red Hat build of Apache Camel for Spring Boot 4, and Red Hat Enterprise Linux 8 and 9, scored CVSS 3.1 6.5 with low integrity and availability impact and no confidentiality impact. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV; real-world consequence is concentrated in deployments where Undertow shares connections with, or sits behind, a front-end proxy or load balancer whose parser disagrees on message boundaries, while standalone deployments without connection reuse are largely limited to premature termination of the attacker's own request.
Privilege escalation in Cloud Foundry's Cloud Controller API (CAPI) lets an account that holds only the SpaceSupporter role perform start-command and buildpack-action modifications that are supposed to require SpaceDeveloper privileges, and then abuse that capability to read the credentials of services bound to applications in the space. Deployments running the Cloud Foundry Controller (CAPI) and CF-Deployment are in scope per the published CPE data, and exploitation requires a valid account already granted SpaceSupporter on a space containing apps with bound services, plus an app staging or restart so the malicious start command or buildpack executes. No public exploit code has been identified at time of analysis and there is no KEV listing; the reported priority is remediation this month, and the separate assessment classifies this as a genuine but contained privilege-escalation issue rather than a top-tier emergency.
Missing authorization checks in the Drupal Commerce Core contrib module (2.x releases up to 2.41 and 3.0.0 through 3.3.13) allow forceful browsing, so a remote request can reach an endpoint or operation that the module should have gated behind an access check, yielding limited reads and modifications (CVSS 6.5, C:L/I:L, no availability impact). Drupal contributed-module installs are the exposure surface; sites on other CMS platforms or without Commerce enabled are unaffected. There is no KEV listing and no public exploit identified at time of analysis, and EPSS is low at 0.22% (13th percentile), so the consistent read is a real-but-not-urgent access-control defect; a vendor patch is available, which places this in normal monthly maintenance rather than emergency response.
Out-of-bounds memory corruption in Chrome's MediaStream component (versions prior to 156.0.8078.79) allows a remote attacker to read memory inside the renderer sandbox by convincing a victim to load a crafted HTML page. Per the CVSS vector the attack is network-reachable and needs no authentication (PR:N), but requires user interaction (UI:R) - the victim must open the malicious page - and the assessed impact is confidentiality-only (C:H, I:N, A:N), with no sandbox escape or code execution claimed. No public exploit or exploit code has been identified at time of analysis (SSVC exploitation: none; EPSS 0.18%, 7th percentile), and the vendor has released a fixed build, so this is a this-month, patch-on-normal-cadence item rather than an emergency.
NULL pointer dereference in the H.264 parser of gst-plugins-bad lets a crafted Multiview (MVC) H.264 file cause a parse failure whose cleanup path dereferences NULL, crashing the GStreamer-based application and causing a denial of service. The issue is medium severity (CVSS 5.5) with a local attack vector, no privileges required, and user interaction needed to get the crafted file ingested; affected deployments include gst-plugins-bad on Red Hat Enterprise Linux 6 through 10. No public exploit identified at time of analysis.
Skuul School Management System through version 2.6.5 lets any holder of a valid student account read other students' examination results and marks, because the ResultChecker::checkResult method accepts a client-supplied studentId without confirming that the requested record belongs to the caller. The flaw is CWE-639 (authorization bypass through a user-controlled key), reachable over the network by a low-privileged authenticated user with no victim interaction, and scored CVSS 6.5 with confidentiality-only impact. Exploitation is gated on legitimate student credentials; no public exploit code is confirmed at time of analysis, EPSS is 0.16% (5th percentile), and the issue is not in CISA KEV, making this a moderate data-exposure risk rather than an emergency.
Drupal's Entity Reference Manager contrib module (Merge entities submodule) versions 0.0.0 through 1.0.3 fail to enforce proper authorization on its merge-entity functionality, allowing forceful browsing to reach routes a user should not be permitted to access. Sites are affected only where this optional contrib module is installed and enabled; impact is limited to partial confidentiality and integrity with no availability effect, and the trigger conditions are not fully described in the available sources. No KEV listing or confirmed public exploit code exists, EPSS is low at 0.15% (5th percentile), and a vendor patch is available.
Incorrect authorization in the Drupal Actstream contributed module lets remote unauthenticated visitors reach protected activity-stream resources through forceful browsing, yielding limited reads and modifications of data they should not be able to touch (CVSS 6.5, C:L/I:L/A:N). Sites running Actstream in the affected ranges - 0.0.0 up to but not including 2.0.1, and 2.1.0 up to but not including 2.1.1 - are exposed only if this contributed module is installed and unpatched; Drupal core is not implicated. No public exploit code has been identified at the time of analysis, EPSS is 0.14% (4th percentile), and the issue is not in CISA KEV, so this is a moderate-severity, lower-priority item rather than an emergency.
Missing authorization in the Drupal Xray Audit contrib module allows unauthenticated remote visitors to reach protected routes directly, a forceful-browsing condition affecting the 1.x branch through 1.6.3, the 2.x branch through 2.0.4, and the 3.x branch through 3.1.1. Only Drupal sites that have installed and enabled this optional auditing module are exposed, so deployment scope is narrow; the advisory rates the issue CVSS 3.1 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), with limited confidentiality and integrity impact and no availability impact. No public exploit code has been identified at the time of analysis (EPSS 0.13%, 3rd percentile), CISA SSVC records exploitation as none, and a vendor patch is available, so this is prioritised for patching this month rather than as an emergency.
A NULL-pointer dereference in the picotls TLS 1.3 library crashes any process that uses picotls as its client-side TLS stack when a malicious or man-in-the-middle peer answers a handshake with a HelloRetryRequest followed by a spoofed Hello message. Only builds up to and including revision 44bc503 are affected; the flaw is fixed in commit a06ca41. Impact is availability-only (process termination, no code execution or data disclosure), and the client must be induced to connect to the hostile peer, which is why the assessed vector carries a user-interaction requirement. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Unauthenticated filesystem path injection in Immich's machine-learning service (vulnerable through 3.0.3, fixed in 3.3.0) lets any client that can reach port 3003 supply an arbitrary cache_dir through the /predict options object, turning model download into an arbitrary-directory write and, on a provoked model-load failure, into a recursive delete of an attacker-chosen path. The endpoint has no authentication on any route and the release docker-compose publishes 3003:3003, so the flaw is reachable pre-auth wherever the ML port is exposed; an attacker-shaped request that sets cache_dir to a mounted media or data volume can corrupt or destroy stored files, bounded by the ML process's filesystem permissions. The model-name allowlist prevents escalation to arbitrary-model deserialization or code execution despite the RCE/deserialization tags attached to this record; a validated proof-of-concept request is documented in the vendor advisory and was executed against the real shutil.rmtree code path, and no CISA KEV listing or confirmed in-the-wild exploitation is present in the available data. The CVE record carries CVSS 6.5 while the upstream advisory and our independent assessment score it 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), reflecting full pre-auth integrity and availability impact when the ML port is reachable.
Cross-site scripting in WP Customer Area through version 8.4.0 allows a Subscriber-level authenticated user to inject script that executes when another user views affected plugin content. The CVSS 3.1 score is 6.5 with PR:L and UI:R, so exploitation requires a valid low-privilege account and victim interaction; the exact vulnerable field is not disclosed in the available sources. No public exploit was identified at time of analysis, and the provided intelligence does not indicate confirmed active exploitation (CISA KEV).
Unauthenticated broken access control in the GiveWP WordPress donation plugin through version 4.19.0.1 lets remote attackers reach plugin operations that should require authorization, yielding limited confidentiality and integrity impact with no availability effect (CVSS 6.5). The assessed vector is AV:N/AC:L/PR:N/UI:N, so no credentials and no user interaction are needed, although the specific endpoint or parameter that lacks its capability check is not disclosed in the available sources. No CISA KEV entry and no public exploit code were identified at time of analysis, and the issue is scoped in the this_month (routine monthly patching) priority band rather than as an emergency.
Unauthenticated arbitrary content deletion in Masteriyo LMS 3.4.3 and earlier lets remote attackers remove content from WordPress sites without authentication or user interaction. The issue is a missing authorization check (CWE-862) in the LMS plugin, and the supplied sources do not identify the exact endpoint or feature that triggers deletion. It is a genuine but mid-tier priority for this-month remediation; no public exploit has been identified at time of analysis and no CISA KEV confirmation is present in the supplied data.
The HUSKY plugin (Products Filter Professional for WooCommerce, vendor realmag777) at version 1.4.6 and earlier exposes sensitive data to unauthenticated remote visitors: per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no credentials or user interaction are required to reach the exposure. The impact is rated moderate (CVSS 6.5) with limited confidentiality effect (C:L) and no availability impact, and the available sources do not specify which plugin feature, endpoint, or configuration actually triggers the disclosure or which data is revealed. Neither CISA KEV listing nor public exploit code is present in the supplied intelligence, and no EPSS score was provided, so this is tracked as a this-month remediation item rather than an emergency; exposure is limited to WordPress sites that have this specific plugin installed and active.
Stored/subscriber cross-site scripting in the MultiVendorX WordPress plugin affects sites running versions through 5.0.20 and lets an authenticated subscriber-level account place script content that executes when a victim views it, potentially in a higher-privileged browser context because the assessed vector includes a scope change. The issue is moderate severity (CVSS 6.5), reported by Patchstack, and requires user interaction for exploitation. No public exploit code or CISA KEV entry was identified in the available intelligence.
Missing authorization checks in the WordPress plugin Booking and Rental Manager (vendor magepeopleteam) through version 2.8.2 let an authenticated subscriber-level account reach functionality or data that should require higher privileges, resulting in disclosure of confidential information. The flaw is network-reachable with low attack complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5), and impact is limited to confidentiality - no integrity or availability effect is indicated. No public exploit code and no confirmed active exploitation were identified in the supplied data, and the priority label is this_month rather than act_now; the practical exposure hinges on whether the target site permits self-registration, since any visitor can then obtain the required subscriber account.
Cross-site scripting (CWE-79) in the WPEverest 'User Registration' plugin for WordPress, affecting versions up to and including 5.3.0, allows an attacker holding a subscriber-level account to inject script that executes in a victim's browser session, scoring CVSS 6.5. Exploitation is constrained: the attacker must be an authenticated subscriber (PR:L, which presupposes that user registration is enabled on the target site), a victim must view the injected content (UI:R), and the resulting impact lands in the victim's browser context rather than the server (S:C). No public exploit code has been identified at time of analysis, and the flaw is not in CISA KEV; the vuln.today decision label is 'this_month', indicating scheduled rather than emergency remediation.
Stored cross-site scripting (CWE-79) in the Ultimate Addons for Elementor - Lite plugin (slug header-footer-elementor) affects every release through 2.9.5. An authenticated WordPress user who holds enough privilege to save content into the affected plugin fields can persist a script payload that later executes in the browser of another user who loads the page or screen rendering it, giving a scope-changed (S:C) impact rated 6.5 under CVSS 3.1. The flaw requires an account (PR:L) and victim interaction (UI:R); it is not listed in CISA KEV and no public exploit was identified at time of analysis, so it should be handled as a routine, prioritized patch within the current monthly cycle rather than an emergency.
PHP local file inclusion in the Unlimited Elements For Elementor plugin (versions through 2.0.26) lets an authenticated low-privileged user on a WordPress site cause the plugin to include a filename they influence, disclosing the contents of local files. The CVSS vector (AV:N/AC:L/PR:L/UI:N, C:H/I:N/A:N) confirms the main barrier is that a valid low-privilege account is needed; there is no integrity or availability impact, only confidentiality loss. This is a moderate-priority issue rather than an emergency - no CISA KEV entry, no public exploit reference, and the trigger details (the specific endpoint or parameter that controls the include path) are not described in the available sources, with no vendor patch version yet identified in the provided data.
SQL injection in the Majestic Support help desk plugin for WordPress (all versions up to and including 1.2.2) lets any authenticated user at Subscriber level or above append additional SQL into existing help-desk queries and read sensitive data from the site database, with confidentiality fully impacted but no integrity or availability effect. The login requirement is a weak barrier: the 'saveusereraserequest' task is whitelisted for front-end customer use, the plugin auto-provisions a help-desk record for every WordPress account, and the only guard is a nonce the attacker legitimately retrieves from their own 'Add erase request' page, so any site with open registration is effectively exposed to any self-registered user. No public exploit code has been identified at time of analysis, the issue is rated moderate priority (CVSS 6.5, PR:L, UI:N) rather than an emergency, and the vendor has published a fixed release, 1.2.3.
Unauthenticated visitors to WordPress sites running Ad Inserter through version 2.8.19 can trigger execution of arbitrary registered shortcodes when an administrator has placed an ad block containing a dynamic tag such as {title}, {tag}, {category}, or {smart-tag} and enabled that block on search pages, because the plugin passes an unvalidated value into do_shortcode(). The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), limiting impact to low confidentiality and integrity with no availability effect, and no public exploit was identified at time of analysis; CISA SSVC records exploitation as none, with automatable exploitation and partial technical impact, and the vulnerability is rated for this-month remediation rather than emergency action.
Unauthenticated arbitrary shortcode execution affects the GeoDirectory - WP Business Directory Plugin and Classified Listings Directory for WordPress in all versions up to and including 2.8.198. A plugin action (per the references, an AJAX handler in class-geodir-ajax.php and the listings widget) passes an attacker-supplied value into do_shortcode() without proper validation, letting remote attackers with no privileges and no user interaction run any shortcode registered on the target site. The practical impact is bounded by which shortcodes the site has available; the available sources do not describe a shortcode path that yields full code execution, and no public exploit code or active exploitation is confirmed at time of analysis.
Authorization bypass in the Meow Gallery plugin for WordPress, in all versions up to and including 5.5.4, lets any authenticated user holding author-level access or higher enumerate and read metadata - post ID, title, date, author and status - for every private and draft post on the site, including unpublished content belonging to other users. The root cause is a missing capability check on the plugin's REST handlers and core class (CWE-862), reachable remotely with PR:L and no user interaction against default configurations. Wordfence rates the issue 6.5, while our assessment narrows the confidentiality impact to metadata disclosure rather than post body content; no public exploit code has been identified at time of analysis, and the vulnerability is not in CISA KEV.
Dimpact ZAC prior to 5.2.0 exposes decision, audit-history, BPMN process-diagram, and afzender mailbox metadata for zaken outside a user's authorized zaaktypes to any authenticated low-privileged municipal user who knows a valid zaak or besluit UUID. The flaw is a cross-zaaktype IDOR (CWE-285/CWE-639) caused by missing assertPolicy checks on by-id read endpoints while the platform filter only requires an application role on any zaaktype; the advisory includes a local proof-of-concept reproduction (a public PoC reference exists; it is not verified as working exploit code). No CISA KEV active-exploitation confirmation is available, the impact is read-only confidentiality, and upgrading to 5.2.0 remediates; overall priority is moderate.
Wekan deployments before 11.11 construct case-insensitive regular expressions from user-controlled search input without escaping metacharacters, so any logged-in user can submit a balanced catastrophic-backtracking pattern that makes MongoDB's PCRE2 engine spend roughly 400-700 ms of CPU per query; several concurrent requests hold mongod busy for seconds to minutes and degrade or deny service to everyone else on the instance. Availability is the only impacted property (CVSS 3.1 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) - authenticated low-privilege access is required, with the user-search publication needing only a DDP session while the searchUsers method also requires board membership or site-admin status, and exploitation is further conditional on an external MongoDB backend (FerretDB v1/RE2 deployments are not practically affected). A detailed proof-of-concept with measured timings and a reproduction script accompanies the upstream GitHub advisory; no CISA KEV listing or confirmed active exploitation is reported, and the upstream priority for this issue is 'this_month'.
Stored cross-site scripting in the bPlugins 'Media Player Addons for Elementor - Media Player widget for WP' WordPress plugin, affecting every version through 1.1.10, allows an authenticated user with low privileges to persist script payloads that execute in another user's browser session. Exploitation requires a valid WordPress account able to edit content that uses the Media Player widget (PR:L), and the payload only fires when a victim, typically a higher-privileged administrator or editor, renders the affected page (UI:R); the scope change reflects the payload running in the victim's security context. No CISA KEV entry or working exploit code is associated with this CVE in the available data, and the sole reference is the Patchstack vulnerability database entry; the trigger specifics are not described in the available sources.
Stored cross-site scripting in the WordPress plugin The Events Calendar (Liquid Web / StellarWP) allows an authenticated user with low-level privileges to persist a script payload that executes in the browser of any visitor who later loads the affected page. Every version up to and including 6.18.2 is in scope, and exploitation requires a second user to view the injected content, which is why the scored impact is limited to Low confidentiality, integrity and availability under a changed scope (CVSS 6.5). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the trigger field or plugin feature that fails to neutralize the input is not described in the available sources.
Stored cross-site scripting in The Events Calendar WordPress plugin (Liquid Web / StellarWP), affecting versions through 6.18.2, allows an authenticated low-privilege user to persist a script payload that executes in another user's browser when the affected page is rendered. The CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting that the attacker must hold a posting-capable account and must wait for a victim - typically a higher-privileged user such as an administrator - to view the injected content, with impact crossing into that victim's browser context. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the priority signal places this in managed, this-month remediation rather than emergency response.
Stored cross-site scripting in the Blocksy Companion WordPress plugin (versions through 2.1.60) allows an authenticated low-privilege user to persist script that runs when another user views the affected page. The CVSS 3.1 score is 6.5 with PR:L and UI:R, so the attacker needs a WordPress account able to store content and the victim must load it; no public exploit was identified at time of analysis.
Cross-site request forgery in Chamilo LMS 2.0.0 (CVSS 6.5) lets an attacker induce a logged-in administrator or DRH to create, modify, or delete skill records and profiles, or remove skill-gradebook associations. The affected actions in public/main/inc/ajax/skill.ajax.php perform database mutations without Security::check_token() validation, and the attacker needs no account of their own but must get a privileged victim with an active session to visit a malicious page. The vendor fixed the missing token checks in 2.0.1; no public exploit identified at time of analysis.
Prefix-matching defects in the Kroxylicious ACL authorizer can let an authenticated Kafka client read topics that configured ACL rules are intended to deny when overlapping prefix rules or mixed principal types are present. The issue affects Red Hat Streams for Apache Kafka 2 and 3 deployments that use the Kroxylicious ACL authorizer and carries a CVSS score of 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Exploitation requires valid Kafka client authentication plus an ACL configuration with overlapping or cross-type prefixes, so deployments without that layout are not exposed; no public exploit was identified at time of analysis.
Stored DOM-based cross-site scripting in the Cool FormKit Lite form builder for Elementor (WordPress plugin, slug extensions-for-elementor-form) through version 2.7.9 lets an authenticated attacker with contributor-level access or above plant arbitrary script in a page by setting the '_elementor_data.form_fields[].custom_id' value on an Elementor form widget. The payload fires client-side for any visitor - including anonymous ones - who later loads a page rendering that form, because the plugin's frontend script re-serializes the server-emitted escaped JSON into HTML and the custom_id escapes its attribute context. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; the contributor authentication barrier keeps it moderate-priority rather than emergency-tier.
Stored cross-site scripting in the Events Made Easy WordPress plugin through version 3.3.1 lets an authenticated user with contributor-level access or higher inject script through the map shortcode's width attribute, which is placed unescaped into an inline style attribute. The issue is rated CVSS 6.4 and no public exploit was identified at time of analysis. Affected sites are those running the plugin at versions up to and including 3.3.1 and allowing contributor-or-higher users to publish content containing the plugin's map shortcode.
Stored cross-site scripting in the GeoDirectory WordPress plugin through version 2.8.199 lets authenticated users with Subscriber-level access or above plant arbitrary HTML and script in a listing description (post_content), which executes in the browser of any visitor or administrator who later views that listing. The payload survives filtering because the plugin's geodir_kses_safe_embed_attributes() helper only strips data-embed-url, data-src and data-embed, while the bundled AyeCode UI library renders every [data-bs-toggle="popover-html"] element with { html: true, sanitize: false }. CVSS 3.1 scores this 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), an authenticated, low-complexity, scope-changing stored XSS that is reachable only where the site lets untrusted users register and submit listings; no public exploit was identified at time of analysis. Wordfence reported the issue and vuln.today assigns it this_month priority.
Stored cross-site scripting in the Themify Builder WordPress plugin affects all versions up to and including 7.8.4: authenticated users holding contributor-level access or higher can write arbitrary markup into the 'variations' repeater sub-fields (style, or the woff/woff2/ttf/svg/eot URL values) of a Custom Font (tb_cf) post, because Themify_Metabox::_save_meta() only applies wp_kses_data() when the field type is 'textbox' or 'textarea' and stores repeater values through update_post_meta() unfiltered. The injected content is later echoed without escaping by Themify_Custom_Fonts::render_columns() inside a <style> block on the Custom Fonts admin listing, so the script runs when a privileged user (typically an administrator) opens that page. The CVSS 3.1 score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), and no public exploit was identified at time of analysis; real-world priority is bounded by the mandatory contributor-level account, the need for the plugin to be active, and the requirement that a second, higher-privileged user visit the specific admin listing.
Stored cross-site scripting in the Redux Framework WordPress plugin, affecting all versions up to and including 4.5.15, lets a Subscriber-level account plant script payloads that execute in an administrator's browser when that admin opens the attacker's profile in wp-admin. Two defects combine: the multi_media field renderer prints stored values unescaped into an href attribute, a hidden input value and an HTML element, and Redux_Extension_Users::user_meta_save() evaluates a field's 'permissions' requirement against a request-body 'checkuser_id' rather than the current user, so a low-privileged user can write a field declared for 'manage_options'. Exploitation is conditional - the site must have a theme or plugin that registers a multi_media field through the Redux Users API - and no public exploit code has been identified at time of analysis; the vendor-released patch is version 4.5.16.