Unauthenticated arbitrary file upload in the SimpleForm WordPress plugin through 3.10.2 lets remote attackers write files that may be executable by the web server, with remote code execution possible where the upload directory permits script execution. The handle_upload function derives the file extension before sanitization and lacks a server-side file-key allowlist, so a trailing-dot filename bypasses extension and MIME checks; the only gate is a nonce exposed in every public form's data-nonce attribute. No public exploit is identified in the provided data, but the vendor-reported severity is critical (CVSS 9.8) and the priority label is act_now.
Unauthenticated remote code execution in the weDevs Project Manager plugin for WordPress through version 4.1.1 lets remote attackers invoke arbitrary PHP functions by supplying a crafted 'id' parameter to the plugin's REST route. WordPress core runs the route's validate_callback before its permission_callback, so the plugin's Project_Manage_Capability authorization gate is bypassed; the validator concatenates the 'id' value into a pipe-delimited rule string, splits it, and calls each token as a dynamic PHP function without an allowlist. CVSS 3.1 scores 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the supplied decision label is act_now, and no public exploit identified at time of analysis in the provided intelligence.
Unauthenticated remote code execution is possible in Apache MINA 3.0.0 through 3.0.0-M2 when an application places the 3.0 codec module's JavaNativeMessageDecoder in a filter chain facing an untrusted peer: the decoder deserializes frame bytes with ObjectInputStream.readObject() and applies no class filter, so crafted input can drive a gadget chain already present on the application's classpath. Deployments that do not wire this decoder are unaffected, and the recommended 2.2.X branch does not contain the class. The 3.0 branch is inactive and explicitly unsupported, the vendor does not plan to release a fix, and no public exploit has been identified at time of analysis.
Unauthenticated PHP object injection in the PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin (all versions up to and including 7.1.1) lets remote attackers place an anonymous WooCommerce Store API checkout whose customer_note is carried verbatim into the generated invoice HTML and ultimately into unserialize() inside the bundled mPDF library, opening the path to server-side code execution. The described trigger works on a default install only when an offline gateway such as Direct Bank Transfer (BACS) or cheque is enabled, because the resulting 'on-hold' order status is what fires the invoice-generation hook; whether object injection escalates to full code execution depends on an exploitable PHP POP gadget chain being loadable in the target environment. No public exploit code was identified at time of analysis, but the vendor has shipped version 7.2.0 and the priority decision is act_now given the remote, unauthenticated, low-complexity profile reflected in the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N).
Authentication bypass in Uncanny LearnDash Toolkit 3.8.2 and earlier lets a network attacker who already knows a target account's credentials log in even when that account is pending approval, unverified, or administrator-suspended. The plugin's account gate checks the raw `email` value with `get_user_by()`, while the later `wp_signon()` call runs WordPress core's `sanitize_user()`, so appended junk causes the gate to be skipped while the real account still authenticates; the required nonce is freely obtainable from the unauthenticated `ult-refresh-nonce` endpoint. Risk signals are mixed: the supplied vector is 9.8 with PR:N and the decision label is act_now, but exploitation still requires valid credentials for an account in a gated state; no public exploit identified at time of analysis.
Unauthenticated super-administrator access in Jpom 2.10.0 through 2.11.12 is possible through query-condition injection in the JPOM-USER-TOKEN header, where a value such as 'is not null' is treated by Hutool's Condition parser as an operator and bypasses LoginInterceptor authentication. The resulting super-administrator role can then use Jpom's script features to execute commands. The issue is rated act_now with CVSS 9.3; no CISA KEV entry or confirmed public exploit code is provided in the supplied data, and the trigger is remote and unauthenticated against default configurations.
Unauthenticated remote code execution affects AJ-Report through version 1.7.1 because Share-Tokens are signed with a hard-coded JWT secret that is identical across installations. An attacker can forge a token offline, set reportCode to 'dataSet', and reach the testTransform endpoint, which passes supplied script content to GroovyClassLoader. The issue is rated act_now by vuln.today and carries a CVSS 4.0 score of 9.3; no KEV designation or confirmed public exploit code is present in the supplied data, and no public exploit was identified at time of analysis.
Unauthenticated arbitrary file deletion in the Acadlix LMS - AI Quiz Maker, Online Exam & Course plugin for WordPress (all versions up to and including 1.1.9) allows remote attackers to remove any file the web server can write or unlink, rated CVSS 9.1. The plugin registers a frontend REST route, post_delete_assessment_file_by_id, whose permission callback only validates a generic wp_rest nonce that the plugin itself publishes inside the public acadlixOptions JavaScript object on every frontend page, so an attacker can harvest the nonce from any public page and then submit a traversal path - the nominal subscriber-level requirement is effectively void, matching the PR:N vector. Deleting a sensitive file such as wp-config.php can take the site down or force a reinstall flow that frequently ends in remote code execution; no public exploit identified at time of analysis, but the priority label is act_now given the trivial prerequisites and destructive impact. No CISA KEV entry is associated with this CVE.
Unauthenticated attackers can trash every published popup on WordPress sites running the Popup Builder plugin through version 4.4.5 by sending a single GET request with the sg_popup_preview_id parameter. The plugin fails to verify authorization for the trash action (CWE-862), and a second flaw in SGPopup::find() causes the request to match all published popups so the deletion runs against each of them, affecting integrity and availability of popup content with no confidentiality impact. CVSS 3.1 is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H); no public exploit identified at time of analysis, and the vuln.today decision label is act_now.
Authenticated Subscriber-level users on WordPress sites running WP Booking System - Booking Calendar through 2.1.0.5 can delete calendar notes belonging to any calendar, because the wpbs_action_ajax_calendar_remove_note() AJAX handler performs no capability check before removing a note. The vendor-reported score is 9.1 and vuln.today assigns an act_now decision label, while our assessment scores the issue CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N: the discrepancy turns on authentication (the advisory vector uses PR:N, but an account is required per the description) and on whether note deletion constitutes an availability impact. No public exploit identified at time of analysis; exposure is concentrated on sites that permit open Subscriber-level registration, and the effect is confined to integrity loss of calendar notes with no confidentiality exposure or code execution.
Remote code execution in the NextGEN Gallery WordPress plugin affects all versions through 4.4.1, where an authenticated attacker who owns at least one gallery can chain mass assignment of meta_data keys, missing realpath containment in render_image path construction, and a bypassable public image-delivery signature check to execute code on the server. The requirement is easier to retain than it appears: a Subscriber who was ever granted the 'NextGEN Manage gallery' capability keeps gallery-author access after revocation because _can_manage_gallery() falls back to stored ownership. No public exploit was identified at time of analysis; the CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Information disclosure in Konflux CI allows an authenticated user with permission to trigger automated workflow runs to inject filter commands via crafted issue titles, causing repository queries to surface API credentials, deployment keys, and internal notes in workflow logs. The weakness is code injection (CWE-94) in a workflow script that interpolates user-supplied titles into data queries without sanitization; it is not anonymously exploitable, and no public exploit code or CISA KEV entry is identified at time of analysis. This is a credible, prioritizable issue but not an emergency.
Privilege escalation in the User Frontend WordPress plugin through 4.3.13 allows any authenticated Subscriber-level user to plant a functional [wpuf-registration role="editor"] shortcode in a published post by hiding it behind a C0 control byte that the plugin's blocklist misses but WordPress storage processing strips. Once the form is rendered, an unauthenticated visitor or the attacker can submit it to create an Editor account, and with the default autologin_after_registration setting enabled the new Editor is logged in immediately. The issue is scored CVSS 8.8, is prioritized for remediation this week, is not listed in CISA KEV, and no public exploit was identified at time of analysis.
Unauthenticated attackers can escalate to administrator account takeover on WordPress sites running Rox Appointment Booking 1.3.1 and earlier, because the plugin's public booking REST route mass-assigns the raw request body into a customer record whose fillable fields include the internal wp_user_id column. An attacker can seed a poisoned customer row carrying an arbitrary administrator user ID (user ID 1 is a reliable guess) plus an email address they control, but the takeover only completes when an administrator later opens that record and clicks Update Customer, at which point the stored wp_user_id and attacker-supplied email are handed to wp_update_user() and the administrator's email is overwritten, enabling a standard WordPress password reset. The attack is network-reachable and needs no credentials, though the mandatory administrator interaction and the user-ID guess bound real-world exploitation; there is no CISA KEV listing, no confirmed public exploit code, and the fix is the vendor's 1.3.2 release.
ShowDoc releases from 2.8.14 up to (but not including) 3.9.6 let an authenticated user turn the Mock feature into a shell-command execution primitive: a crafted mockjs template stored through MockController::add is later evaluated by mockjs's eval()-based placeholder handler when MockController::infoByKey renders it, and because the mock service in the official Docker image ran as root, the commands execute with root privileges. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (vendor score 8.7 under CVSS 4.0), so the barrier is credentials with Mock-feature permission rather than network position - publicly registerable or multi-tenant instances carry the most exposure. A public PoC reference (a Gist linked from the CVE record) exists but is not verified as working exploit code, no CISA KEV listing or confirmed in-the-wild exploitation is reported, and the vendor has shipped a fix in ShowDoc 3.9.6 (Docker image 3.4.3) that adds a template whitelist and runs the mock service as a de-privileged 'mockmock' user; the vuln.today priority is this_week.
Unauthenticated file disclosure in the Drupal 7 File Force Download module (versions 7.1.0 through 7.1.2) allows a remote visitor to append download=1 to a file URL and retrieve files stored in the temporary:// scheme or in a stream wrapper supplied by another module without the access checks that should apply. Files in the public:// and private:// schemes are explicitly not affected, and the supplied data contains no indication of active exploitation; no public exploit identified at time of analysis.
Konflux CI automation scripts persist GitHub access tokens in plaintext on the CI runner and do not reliably remove them after a job finishes, so anyone able to read the runner filesystem - a co-located or follow-on job on a shared runner, or an attacker holding shell access to the host - can recover the credential and use it against the connected GitHub repositories to alter source code or release artifacts. The flaw is rated high severity (CVSS 8.6, CWE-312 cleartext storage of sensitive information) and is handled as this_week priority in current prioritisation signals; no public exploit code has been identified at time of analysis, and the risk is bounded because the token is only reachable from the local runner environment rather than over the network.
Authenticated contributors who hold write access to a Konflux-CI-managed repository can execute arbitrary shell commands inside the CI/CD workflow by injecting payloads into environment export scripts, whose unvalidated output is subsequently evaluated dynamically by manifest synchronization scripts. Successful exploitation gives the attacker control of pipeline execution and exposes authentication tokens, deployment credentials, and onward access to production systems, with a scope change beyond the pipeline component itself. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; the CVSS vector requires a privileged, authenticated actor (PR:H) plus a pipeline-triggering interaction (UI:R), so real-world exposure tracks how many semi-trusted principals can push to Konflux-managed repositories.
Heap-based buffer overflow in Opengear console server firmware 4.8.0 through 5.5.2 (IM72XX, CM71XX and ACM70XX appliances) lets an unauthenticated remote attacker crash the index.cgi process by sending a multipart/form-data POST request whose Content-Disposition name field is overlong. The CVSS 4.0 score of 8.4 reflects a network-reachable, no-authentication, no-interaction attack path, but it is tempered by AC:H and AT:P - a specific attack condition outside the attacker's direct control and high complexity - so a crash is readily achievable while anything beyond denial of service is constrained. The confirmed impact described by the vendor is the index.cgi crash; the vendor advisory reference is titled as buffer overflow to RCE, so remote code execution is vendor-claimed rather than independently demonstrated. No public exploit code or PoC is confirmed in the supplied intelligence, and the issue is not reported as actively exploited (CISA KEV); the vuln.today decision label is 'this_week', so firmware 5.5.3 should be scheduled promptly for internet-facing appliances.
Stack-exhaustion denial of service affects the Java bindings of Apache Thrift (org.apache.thrift:libthrift) before 0.24.0, where TProtocolUtil.skip() descends into nested container types without a default recursion depth limit. Unauthenticated remote attackers (PR:N in both the supplied CVSS 4.0 vector and the independently assessed CVSS 3.1 vector) who can get a Java Thrift service to deserialize crafted input - with unknown or unexpected fields that trigger the default skip path - can drive uncontrolled recursion until the stack is exhausted, producing a StackOverflowError; impact is confined to availability (VA:H) with no confidentiality or integrity effect. No public exploit code or PoC was identified in the supplied intelligence at time of analysis, and the vendor's only complete fix is upgrading to 0.24.0.
Remote code execution in WordPress Core 4.7 through 7.1.3 is possible only while a full-package core upgrade is running, when predictable, web-accessible staging paths allow an unauthenticated attacker to race the upgrader and execute code on the server. The flaw is a time-of-check/time-of-use condition (CWE-367) and is rated high complexity because the attacker must act within the transient upgrade window; outside an active upgrade the condition is not present. WordPress 7.1.4 contains the fix, and no public exploit was identified at time of analysis.
Authentication bypass in Wp Social Login and Register Social Counter 3.2.2 and earlier allows an unauthenticated remote attacker to obtain a fully authenticated WordPress session as an existing user, including an administrator, when the site has the bundled Facebook or Twitter social-login provider configured and active. The plugin's social-login REST callback trusts the OAuth provider's email string and calls wp_set_auth_cookie() without a password check, while the intended email-verification guard is ineffective for the bundled Hybridauth Facebook and Twitter adapters. No public exploit is identified at time of analysis, and the provided intelligence does not confirm active exploitation, but the assessed prerequisites and high impact make this a this-week priority.
Privilege escalation in konflux-ci allows an adjacent-network attacker with low-privilege authenticated access to capture a cluster-scoped impersonation token from the UI proxy when the environment lacks a default service certificate authority, yielding full administrative control of the cluster. The proxy disables TLS certificate verification for internal backend connections under that condition and attaches the token to those requests. Exploitation requires on-path network adjacency and the missing-service-CA deployment state; no public exploit was identified at time of analysis and active exploitation is not confirmed.
A heap-based buffer overflow in libheif's built-in ISO/IEC 23001-17 uncompressed-image ('unci') decoder lets a crafted HEIF file drive repeated out-of-bounds heap writes when the mixed-interleave YCbCr path is fed paired chroma components with unequal bit depths. Affected are libheif versions from 1.18.0 through 1.23.2 built with WITH_UNCOMPRESSED_CODEC=ON; decoding the file requires a victim or an image-processing pipeline to open the attacker-supplied image (unauthenticated per the CVSS vectors, but user interaction is required). The out-of-bounds write and crash are reliable, whereas code execution is deployment-specific - the advisory demonstrates file read and PHP code execution only against one exact WordPress/Imagick/libheif/glibc profile and explicitly does not claim universal RCE, and a public reproducer artifact (a crashing HEIF file) accompanies the advisory, though it is not verified as working code-execution exploit code. The vendor has released 1.23.3 with the fix.
Unauthenticated SQL injection in the WP Directory Kit plugin for WordPress, affecting all versions up to and including 1.6.0, allows a remote attacker to append arbitrary SQL to existing queries through the 'idfield' parameter and read sensitive records from the site's database. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with confidentiality-only impact (C:H/I:N/A:N), so a successful attack extracts data rather than altering it or causing a denial of service. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; the current priority is 'this_week' rather than emergency-level.
Infinite loop in json-glib's JSONPath slice evaluator lets an attacker hang any application that passes untrusted JSONPath strings to json_path_query(). A slice expression containing a negative step drives the evaluator into a non-terminating loop, spinning CPU and stalling the calling thread, so impact is limited to availability (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) with no disclosure or modification. The prerequisite is narrow but real: the embedding application must evaluate attacker-controlled JSONPath; code that only runs developer-authored queries is not exposed. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but the underlying flaw is trivially reachable by a single crafted query string and has been triaged for remediation this week.
SoftIron HyperCloud Orchestrator versions 1.0 through 2.6.17 allow an authenticated user with management-plane access to inject shell content through virtual machine template fields such as the VM DESCRIPTION, resulting in arbitrary operating system command execution on hypervisor hosts as the privileged orchestration user during deploy, migrate, or network setup operations. Exploitation is access-gated: it requires valid credentials, adjacent-network access to the management plane, and a qualifying VM lifecycle operation, and merely owning a virtual machine is not sufficient. No public exploit was identified at time of analysis, and the vendor-released fix is version 2.6.18.
Time-based blind SQL injection in FunnelKit Automations 3.8.5.2 and earlier allows unauthenticated attackers to append extra SQL to the plugin's existing queries and extract sensitive data from the WordPress database. Any store visitor who can obtain a publicly available WooCommerce cart nonce can submit a crafted bwfan_cart_id during a guest Store API checkout, but the payload is persisted rather than executed immediately and only fires when a scheduled Action Scheduler job reloads the stored meta on an order status transition out of pending, failed, or cancelled, making extraction blind and slow. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor scores it 7.5, while our assessment raises attack complexity to AC:H to reflect the deferred, second-order trigger and timing-based inference.
Privilege escalation to administrator in the WordPress plugin WP Mail Catcher (Mail Logging & Catcher) affects all versions up to and including 2.2.0: an authenticated subscriber-level user can read stored email logs through the 'message' parameter and recover a valid administrator password-reset key, then complete the reset flow and take over the site. The attack only works when an administrator has changed the plugin's default_view_role option to a capability held by low-privileged users, such as 'read', and when an administrator reset email is already present in the logs; the default manage_options value blocks it. No public exploit has been identified at time of analysis and there is no CISA KEV entry; CVSS 7.5 reflects high confidentiality, integrity and availability impact, with high attack complexity coming from the non-default configuration and logged-reset-email preconditions.
The Security Optimizer WordPress plugin (formerly SG Security) before 1.6.9 fails to cap how many two-factor authentication codes can be submitted against a single pending login, so an attacker who already holds a user's valid WordPress password can brute force the second factor and complete account takeover. Affected sites are those running any version below 1.6.9 with 2FA enabled through this plugin; accounts without plugin-managed 2FA are not exposed by this flaw. The issue carries a published CVSS of 7.5 (assessed AV:N/AC:H/PR:N/UI:N, with NVD scoring PR:L) and a low EPSS of 0.18% (8th percentile); there is no CISA KEV entry and no confirmed public exploit code, and the vendor has released a fix.
Unauthenticated remote attackers can overwrite the titles of arbitrary posts, create arbitrary published posts, and rewrite the stored settings of the Mapster WP Maps WordPress plugin at versions below 2.0.6, because one of its REST API routes that writes post data performs no authorization check. Any site with the plugin active and reachable over HTTP is exposed, with the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, integrity-only) confirming no authentication, interaction or special configuration is needed. Impact is confined to integrity of content and plugin configuration, with no direct confidentiality or availability effect; there is no confirmed active exploitation (CISA KEV not listed, SSVC exploitation: none), no public exploit identified at time of analysis, and EPSS is low at 0.15 percent (4th percentile), though the flaw is automatable and is prioritized for patching this week. A vendor fix is available in 2.0.6.
Stored cross-site scripting in Thelia before 3.1.0 lets anyone who self-registers a front-office customer account plant script in the customer name, which then executes in an administrator's browser on the back-office coupon screen when a 'For one or more customers' condition references that customer. Injection is effectively unauthenticated (CVSS PR:N) since registration validates firstname/lastname with NotBlank only, but execution is gated: an administrator must both attach that condition to a coupon and then load the coupon edit page or GET /admin/coupon/draw/conditionsSummaries/{couponId} (the AT:P and UI:A gates). From the admin origin the payload steals the in-page CSRF token and creates a new administrator account that resolves to super-admin; the vendor advisory publishes a staged proof-of-concept walkthrough, though it is not independently verified as working exploit code, and no active exploitation is confirmed (CISA KEV not listed). The vendor CVSS 4.0 score is 7.4 High, while our assessment lands on CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N, prioritised as this_week.
Spoofing in Microsoft Visual Studio stems from improper certificate validation and can let an unauthenticated remote attacker impersonate a remote endpoint, with high confidentiality and integrity impact and no availability impact per the CVSS vector. The issue affects Visual Studio 2017 version 15.9, 2019 version 16.11, 2022 version 17.14, and 2026 version 18.11; exploitation is high-complexity and realistically requires an intercepting position on the network path. No public exploit was identified at time of analysis, and the available vendor update is the indicated remediation.
Stored cross-site scripting in the Ninja Forms WordPress plugin (Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder) through version 3.15.5 allows an unauthenticated attacker to plant arbitrary script in the site's stored form data via the 'formData.extra' parameter, which is insufficiently sanitized on input and insufficiently escaped on output. Because the nf_ajax_submit endpoint hands a valid nonce to any requester on failure, the nonce check is effectively neutralized and the payload can be delivered in a single unauthenticated request; the script then executes when a victim - typically an administrator reviewing submissions or calculations - loads the page that renders the stored value. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (7.2), reflecting session-scoped confidentiality and integrity impact within the victim's browser; no public exploit code or CISA KEV entry was identified at time of analysis, and the vulnerability is tagged as a this_week priority rather than an emergency.
Stored cross-site scripting in the WordPress plugin Debug Log Manager (all versions through 2.5.2) lets unauthenticated remote attackers inject script through the 'message' and 'pageUrl' fields, which executes when a user views the injected log page. Exploitation is conditional: the site must have debug logging enabled with JS error logging active, and the attacker must use the publicly broadcast dlmVars.jsErrorLogging nonce to pass the unauthenticated endpoint's nonce check. This is a genuine but conditional this_week priority rather than a drop-everything emergency; no public exploit identified at time of analysis and active exploitation is not confirmed by the supplied data.
Stored cross-site scripting in the PPWP - Password Protect Pages WordPress plugin (all versions up to and including 1.9.26) lets unauthenticated attackers plant arbitrary web scripts that run when a victim views an injected page. The injection rides through a bare, tagless shortcode string submitted as a WordPress comment, which is later rendered inside the restricted-content form's desc_below_form attribute, with placeholder acting as a marker-smuggling helper; WordPress's comment_content filter leaves tagless shortcode text untouched and the site's comment_whitelist setting auto-approves follow-up comments from a previously approved name and email. Rated CVSS 7.2 with PR:N and S:C, it is prioritized this_week; no confirmed active exploitation (not in CISA KEV) and no public exploit code was identified at time of analysis.
Stored cross-site scripting in the Meow Lightbox WordPress plugin, affecting all versions up to and including 5.6.4, lets an unauthenticated attacker save a crafted payload that executes JavaScript in the browser of any user who later views the injected page. Exploitation is heavily gated: the administrator must have enabled Output Buffering, selected the HtmlDomParser engine and enabled Aggressive Resolve, and the site must additionally expose a stored-HTML submission surface (the description cites anonymous bbPress replies) whose kses allow-list still preserves img attributes. Where those conditions are met a single unauthenticated submission is sufficient; no public exploit code and no CISA KEV entry were identified at time of analysis, and the issue is fixed in version 5.6.5.
Stored cross-site scripting in the W3 Total Cache WordPress plugin, affecting all versions up to and including 2.10.7, allows an attacker who already holds a previously approved commenter identity to plant script that is later served from cache to other visitors. Exploitation is tightly gated rather than a default-configuration scenario: the site must have had a W3 Total Cache Pro license with REST caching enabled, that license must have since lapsed, and Disk Enhanced page caching must still be configured so an unlicensed REST cache mode persists and responses get stored and served as static HTML. There is no CISA KEV entry and no public exploit identified at time of analysis; the assessed vector (AC:H/PR:L) is materially narrower than the published 7.2 CVSS score, which places this in the this-week queue rather than an emergency for most deployments.
Stored cross-site scripting in the SureCart ecommerce plugin for WordPress, affecting all versions up to and including 4.9.4, lets unauthenticated visitors submit comment content that is stored without sufficient sanitization and rendered without adequate escaping, so attacker-supplied script runs in the browser of anyone who later views an affected page. The Wordfence-reported issue is scored 7.2 with a scope change (script executes in the victim's context), but our assessment raises attack complexity to High because the payload only executes if the comment is auto-approved or approved by a moderator and a victim then visits a page that loads SureCart's web-component bundle, such as a page containing a Buy Button block. No public exploit code and no CISA KEV entry are associated with this CVE at time of analysis, and the vendor priority is this_week.
Stored cross-site scripting in the WPO365 | Microsoft 365 Graph Mailer WordPress plugin, affecting all versions up to and including 6.2, lets unauthenticated attackers plant arbitrary script in a mail subject that is stored and later rendered back to a viewer. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2) reflects unauthenticated network reach with a scope change and limited confidentiality and integrity impact. Exploitation is conditional: the Graph Mailer must be enabled while OAuth authorization has not been completed - the default state right after activation - and the site must expose a mail-sending feature that forwards a submitter-controlled subject, such as a public Contact Form 7 form; the injected script only runs when a user, likely an administrator reviewing the mail log or the affected page, actually opens it. No confirmed public exploit code and no CISA KEV listing were identified at time of analysis; the vuln.today decision label is this_week, so this is a moderate-but-real priority rather than an emergency.
Stored cross-site scripting in the WooCommerce PDF Invoices & Packing Slips plugin (versions up to and including 5.16.4) allows an unauthenticated attacker to plant entity-encoded script payloads through the public checkout's billing first name, last name, company and customer note fields, which then execute in a shop staff or administrator's browser when that privileged user opens the generated invoice, packing slip or order document - so the assessed vector requires user interaction (UI:R) despite the input CVSS listing UI:N. The flaw is an incomplete fix for CVE-2026-92244: the wp_kses() allow-list added in 5.16.2 rejects payloads containing literal angle brackets, but entity-encoded payloads such as <img onerror=…> pass through unmodified and are rematerialized when decoded downstream. No public exploit code is confirmed at time of analysis; the vendor fix appears as changeset 3756047 on the plugin trunk, and the vendor advisory is linked from the Wordfence threat-intel record.
Stored cross-site scripting in the Relevanssi - A Better Search WordPress plugin, affecting every version up to and including 4.28.5, lets unauthenticated attackers submit a comment whose body is later rendered with Relevanssi's highlight markup and without adequate sanitization or escaping. Execution is tightly gated: the site must have both comment indexing and comment highlighting enabled, and the injected script only fires when a victim follows a crafted search-result permalink containing the highlight query parameter to a singular page - a user-interaction step reflected in the assessed vector (UI:R), which is why our assessment scores it slightly differently from the vendor's 7.2 (UI:N). No public exploit code has been identified at time of analysis, no KEV listing applies, and the issue is prioritised 'this_week' rather than as an emergency; version 4.28.6 resolves it by removing comment-text highlighting altogether.
Stored cross-site scripting in the FeedWordPress WordPress plugin, affecting all versions up to and including 2026.0517, allows an attacker who controls or can poison an RSS/Atom feed that a site already syndicates to plant script-bearing markup that is persisted into imported posts and executes when a user views them. No site authentication is required (CVSS PR:N), and the score carries a scope change (S:C) because the injected script runs in the context of the victim WordPress site rather than the external feed. The practical prerequisite is a pre-existing subscription to an attacker-influenced feed, so exposure is limited to sites syndicating untrusted sources; no public exploit has been identified at time of analysis, and priority is rated this_week rather than emergency.
Stored cross-site scripting in the Shield Security WordPress plugin (wp-simple-firewall) affects every version up to and including 22.3.2 and lets unauthenticated remote attackers inject arbitrary HTML/JavaScript into the plugin's traffic log through the logged REQUEST_URI value. The plugin records that value without adequate sanitization and later renders it into the hidden 'path' column of the Traffic table via DataTables innerHTML, so the payload is parsed into live DOM nodes and executes when an administrator opens the Traffic log viewer. Successful abuse is bounded by two conditions: the plugin's traffic/activity logging must be enabled so REQUEST_URI is captured and persisted, and an admin must subsequently view the traffic table; the issue was only partially addressed in 18.5.8, where esc_html() was applied to the visible 'page' column but not to 'path'. Exploitation status: no public exploit identified at time of analysis, and the vendor changeset identifies 22.3.4 as the fixed release.
Stored cross-site scripting in the Shipping Zones by Drawing for WooCommerce plugin (versions up to and including 3.3.0) allows unauthenticated attackers to plant script-bearing markup into a WooCommerce order by submitting a crafted 'szbd-picked' parameter during ordinary guest checkout. The injected JSON is persisted verbatim in order meta and later rendered inside the Google Maps link on the administrator's order-detail screen without escaping, so script executes in an administrator's browser when that specific order is opened - and, for the described onmouseover vector, when the admin hovers the link. No public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); the vendor has released 3.3.1 to address it.
Stored cross-site scripting in the VikRentCar Car Rental Management System plugin for WordPress (all versions up to and including 1.4.10) allows unauthenticated attackers to submit a crafted 'optionals' value that is neither sanitized on input nor escaped on output, so the injected script is persisted and runs in the browser of any user who later loads the affected page. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N for a score of 7.2, reflecting a scope change into the victim's browser session and low confidentiality and integrity impact, with maximum consequences when the viewer is a logged-in administrator. No CISA KEV listing and no confirmed public exploit code are present in the available intelligence; vuln.today triage places this in the 'this_week' remediation queue, and upgrading to 1.4.11 removes the flaw.
Stored cross-site scripting in the Welcart e-Commerce WordPress plugin through version 2.12.5 lets an unauthenticated visitor plant script in an order record by forging the ROBOT PAYMENT browser-return request with an arbitrary 'gid' value, which is written into order metadata without adequate sanitization or escaping. The injected script then executes in a WordPress administrator's browser when that order is opened in the admin panel, within that privileged session (changed scope, S:C). Affected sites are those running Welcart 2.12.5 or earlier with the ROBOT PAYMENT integration in use; the trigger therefore depends on a privileged victim opening the poisoned order, and no public exploit code was identified at time of analysis.
Stored cross-site scripting in the VikRentCar Car Rental Management System WordPress plugin (all versions up to and including 1.4.9) lets remote attackers inject arbitrary script through the 'poplink' parameter, which is then rendered on public booking-confirmation and car-details pages. The assessed CVSS vector is AV:N/AC:L/PR:N/UI:N/S:C with low confidentiality and integrity impact, and the only access control in the path is a vikwp_nonce token that the plugin itself prints to unauthenticated visitors on the public booking-confirmation page, so no account is required. Execution still depends on a victim later loading an injected page; no public exploit code or CISA KEV entry was identified at time of analysis, and the vulnerability is prioritised as 'this_week'.
Stored DOM-based cross-site scripting in the WordPress plugin 'User Submitted Posts - Enable Users to Submit Posts from the Front End' (all versions up to and including 20260916) allows unauthenticated attackers to inject arbitrary web scripts via the 'user-submitted-content' parameter of the plugin's public front-end submission form, with the payload executing when a visitor or reviewing administrator later loads the affected page. The practical risk is governed by moderation mode: on a default installation the submission is held as Pending and an administrator must approve it before the payload is reachable, whereas enabling the non-default 'publish immediately' option removes that approval step and makes the stored payload live with no moderator interaction. No public exploit code or active exploitation is identified in the available data, and the impact is bounded to in-browser script execution in the context of the viewing user rather than server compromise; the this_week priority label reflects a real but conditional exposure rather than an emergency.
Stored cross-site scripting in the ThirstyAffiliates WordPress plugin through version 3.12.1 lets remote attackers inject arbitrary script through the 'comment' parameter, which is then rendered to other visitors. Exploitation is constrained: the site must run a block theme (e.g. Twenty Twenty-Five) so the Comment Content block pushes comment HTML through render_block and triggers the plugin's transformer, and the attacker must first have one comment approved before later crafted comments auto-approve and render publicly. Wordfence's vector is AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (7.2), with scope change reflecting execution in other users' browser context; a public advisory and source references are available, but no confirmed working exploit code, KEV listing or EPSS signal was provided, and no public exploit was identified at time of analysis.