Stored cross-site scripting in the Firelight Lightbox WordPress plugin before 2.3.24 lets users with contributor-level access or higher store arbitrary script payloads in image attribute values, which the plugin fails to escape before the browser processes them. The injected script executes when a different user - typically an editor or administrator - views or previews the affected content, so exploitation requires an authenticated contributor account plus victim interaction. No public exploit has been identified at time of analysis, EPSS is low at 0.16% (6th percentile), and CISA SSVC records no known exploitation and no automatable path; this is a moderate, authenticated issue suited to a normal patch cycle rather than emergency action.
Unauthenticated arbitrary shortcode execution in the WordPress plugin Ninja Forms (Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder) affects all versions up to and including 3.15.5. A form-processing action - associated in the cited source with the SuccessMessage action and the AJAX submission controller - passes an insufficiently validated value into do_shortcode(), allowing a remote attacker with no privileges to have arbitrary registered shortcodes rendered and executed. Impact is bounded because severity depends on which shortcodes the target site exposes (CVSS caps confidentiality and integrity at Low and availability at None); no public exploit has been identified at time of analysis, and the vendor has released 3.15.6 as the fixed version.
Epiphany (GNOME Web) 45.0 through 51.x writes a stored PERMIT for both the webcam and microphone permission of a site origin whenever a user answers an unrelated Clipboard or Website Data Access prompt, so the site can call getUserMedia afterwards without a dedicated camera/microphone dialog and capture audio and video. The root cause is a malformed else-if in set_permission() of src/ephy-window.c whose condition is a non-zero enum constant, making the branch unconditional for the two permission types that the permissions manager does not persist. Exploitation is conditional: the victim must visit the attacker's page and click Allow on a clipboard or third-party storage prompt (CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, 6.5, CWE-863), and no public exploit code or CISA KEV entry was identified at time of analysis.
Unauthenticated attackers can delete theme files from WordPress sites running the Spectra Gutenberg Blocks (Ultimate Addons for Gutenberg) plugin in any version up to and including 2.20.4, because the plugin's '__construct' routine in its FSE fonts compatibility class does not adequately validate file paths before a deletion operation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:N/I:L/A:L, score 6.5) confirms the endpoint is reachable remotely with no credentials and no user interaction, but impact is deliberately limited: the flaw is described as 'limited file deletion' confined to theme files, so it does not enable arbitrary file deletion, code execution or data disclosure - damage is site breakage or defacement. No CISA KEV listing and no confirmed public exploit code were supplied at time of analysis, and the Wordfence-sourced decision label places this at 'this_month' rather than an emergency: a genuine but mid-tier priority.
Time-based blind SQL injection in the Web 2.0 Directory plugin for WordPress (all versions up to and including 2.10.12) lets an attacker inject SLEEP-style conditional payloads through the 'w2dc_level_filter' parameter of the directory-listing filter and infer database contents from response timing. Because the parameter is interpolated into the query in integer context without surrounding quotes, WordPress's built-in addslashes/magic_quotes escaping does not neutralise the payload. The primary open question is privilege: the reporter describes the flaw as reachable by unauthenticated attackers, while the supplied CVSS vector encodes PR:L and our assessment records PR:N, so authentication requirements are not definitively resolved from the available data; extraction is also slow and detectable because it relies on blind timing inference. No public exploit code has been identified at time of analysis, and the issue is prioritised as this_month rather than as an emergency.
Time-based blind SQL injection in the WP2LEADS plugin for WordPress (all versions up to and including 3.5.6) lets an authenticated user holding Subscriber-level access or higher inject arbitrary SQL through the 'order' parameter and extract sensitive data from the site database. Exploitation requires a valid low-privileged account, so it is realistically reachable on sites that allow user self-registration or where an attacker already holds credentials; the blind, time-based extraction method makes data theft slow and produces measurable server-side delays. There is no CISA KEV listing and no public exploit identified at time of analysis, and the source data carries a 'this_month' priority label rather than an emergency rating.
Redux Framework through 4.5.15 leaks its complete stored options payload - plaintext password field values, API keys, license keys and SMTP credentials - to any subscriber-level user who simply loads wp-admin/profile.php and reads the inline redux_<opt_name> JavaScript block in the page source, because the Users extension localizes the full option set without verifying the user's panel capability (CWE-862). The Users extension is loaded automatically for every Redux instance registered by any installed theme or plugin, so every site running an affected copy is exposed whether or not the developer deliberately configured that extension. Exploitation requires an authenticated account at subscriber level or above and is therefore most damaging on sites that allow open self-registration and that store real secrets in Redux options; no public exploit identified at time of analysis, and the vendor fixed the issue in 4.5.16.
Unauthenticated attackers can recover the shared password protecting UsersWP's 25 built-in dummy user accounts - in all plugin versions up to and including 1.2.78 - from a single HTTP request, then authenticate as accounts such as antawn, chynna or kiki through wp-login.php. The value is derived as the first 15 characters of a SHA-256 hash of AUTH_KEY concatenated with site_url(), while the full 25-character hash of that same input is rendered into the hidden uwp_register_hash field on every registration form, reachable via the public /register/ page and the wp_ajax_nopriv_uwp_ajax_register_form AJAX handler even when user registration is switched off. Impact is conditional rather than universal: an administrator must previously have created the dummy users from the plugin's Tools page, and meaningful privilege escalation only occurs where one of those accounts was given an elevated role; no public exploit code has been identified at time of analysis.
Stored cross-site scripting in the FlexStock - Product Stock Sync with Google Sheets for WooCommerce plugin affects every version through 3.17.2, letting a logged-in Subscriber-level user write arbitrary script into the products[].post_content field that later executes in the browser of anyone viewing the injected page. The low barrier is structural rather than a misconfiguration: the plugin's admin_enqueue_scripts callback prints the REST bearer token into the Dashboard page source via wp_localize_script() with no capability check, and the REST endpoint's permission_callback validates only that token instead of calling current_user_can(), so any Subscriber can reach the write path without plugin-specific setup. Wordfence reported it as a medium-severity issue (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N); no public exploit code and no confirmed active exploitation were identified at time of analysis, and priority is set to this month.
Stored cross-site scripting in the GeoDirectory WordPress plugin (WP Business Directory and Classified Listings) affects every version up to and including 2.8.197 and lets an authenticated attacker holding only subscriber-level access plant arbitrary script in a listing through the 'post_images' parameter. The payload is saved server-side and later executes in the browser of an Administrator or Editor who opens that pending listing in the wp-admin edit screen, so the attacker escalates from a low-privilege account toward privileged sessions rather than attacking ordinary site visitors; exploitation depends on that editorial review step occurring. No public exploit code or active exploitation has been identified at time of analysis, and the vendor's trunk changeset indicates an upstream fix is in progress.
Stored cross-site scripting in the BuddyBoss Platform WordPress plugin (all versions through 3.6.0) lets a Subscriber-level account persist arbitrary script in a social group's name, which then executes in the browser of any user viewing that group page. Exploitation depends on the plugin's 'Enable social group creation by all members' setting - enabled by default, letting low-privilege users create groups - and is not possible where group creation has been restricted to administrators. A public advisory and release notes for version 3.7.0 are available; no KEV listing or confirmed exploit code is in the supplied data, and the assessed impact is moderate (CVSS 6.4, scope-changed, low confidentiality and integrity impact).
Stored cross-site scripting in the SEOPress WordPress plugin (all versions up to and including 10.3) lets any authenticated Subscriber-level user plant script in a page by setting their profile display_name to a value combining the literal %%archive_title%% token with HTML event-handler attributes. Because WordPress stores display names without HTML filtering and SEOPress substitutes the dynamic-variable token after output escaping has already been applied, the escaping is defeated and the injected markup executes in the browser of any user who views the affected page - including higher-privileged users, which is why the vector carries S:C. With a CVSS of 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) and a this_month priority rating, this is a moderate-severity issue that is practically reachable on sites with open self-registration enabled; no public exploit code or CISA KEV entry was identified at time of analysis. Exploitation requires both Subscriber-level authentication and a site configuration that actually renders %%archive_title%% on a page where the attacker's display name is surfaced.
Stored cross-site scripting in the Smart Post Gutenberg blocks plugin for WordPress affects every version through 4.0.9: an authenticated user holding only subscriber-level access can persist arbitrary script through the author 'display_name' field, which the plugin writes into its Author Filter dropdown and its client-side filter script without adequate sanitization or output escaping. The payload only fires under a narrow configuration - a page that pairs an Author Filter block with a grid or live-filter block - and only once a visitor clicks the attacker's author entry in that dropdown, which is why the assessed vector is AC:H/UI:R rather than a straight remote trigger. Impact is bounded to partial confidentiality and integrity within a changed scope (CVSS 6.4, CWE-79); there is no CISA KEV entry and no public exploit identified at time of analysis, and vuln.today slots remediation into the current-month queue rather than an emergency response.
Stored cross-site scripting in the WP Job Portal plugin for WordPress (all versions up to and including 2.7.0) lets authenticated users with Subscriber-level access inject arbitrary web scripts through the 'degreetitle' parameter, which are persisted and later executed in the browser of any user who views the affected page. Because the plugin's self-registration flow lets any visitor create a Subscriber-backed Employer account, sites with open registration are effectively exposed to unauthenticated outsiders, although execution still requires a second user - often an administrator - to access the injected page, and sites that disable self-registration limit exploitation to holders of an existing account. Rated CVSS 6.4 and prioritized by vuln.today as 'this_month' rather than urgent, the flaw is fixed by updating to version 2.7.1; no public exploit identified at time of analysis.
Stored cross-site scripting in the PublishPress Authors WordPress plugin (Co-Authors, Multiple Authors and Guest Authors in an Author Box) affects all versions up to and including 4.17.0, where the author 'name' field, which maps to the WordPress display_name, is insufficiently sanitized on input and escaped on output. An attacker holding an authenticated account at subscriber level or above can persist arbitrary script into an author box that executes for anyone viewing an injected page; the CVSS 3.1 vector scores 6.4 with scope change (S:C) because the payload runs in the context of the viewing user rather than the injecting one. Exploitation is gated by a non-default prerequisite: the attacker's account must already have a mapped author term, which only exists if an administrator assigned them as a co-author or enabled automatic author-term creation for their role, so a stock install with self-registered subscribers is not exploitable. No public exploit code or active exploitation is identified at time of analysis, and the plugin's 4.18.0 tag contains the revised Author_Editor.php referenced as the fix.
Stored cross-site scripting in the Discussion Board - WordPress Forum plugin (versions up to and including 2.6.0) lets any authenticated user with subscriber-level access or higher place a script payload in the WordPress profile Website (user_url) field. The plugin's ctdb_filter_comment_author_name() callback, hooked to get_comment_author_link, interpolates that raw URL into a single-quoted href attribute without esc_url() or esc_attr(), so the payload executes in the browser of anyone who opens a forum topic containing the attacker's reply. CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N); no public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
DeepInfer through 0.1.0 ships a profiling HTTP server whose unauthenticated /profile endpoint accepts an attacker-supplied output_dir and writes Chrome trace files to that location, letting remote attackers create directories anywhere the process can reach. Because pre-patch builds bound the server to 0.0.0.0, accepted GET requests, and merged URL query parameters into the request body, a cross-site request from an operator's browser (an <img> or auto-submitting <form>) is enough to trigger collection and force writes; the resulting error messages also act as a filesystem-existence oracle. Impact is bounded to directory creation, disk or inode exhaustion through trace output, and low-confidentiality path disclosure - no code execution is involved, exploitation requires the profiler HTTP server to be running and reachable, and no public exploit code was identified at time of analysis, with no CISA KEV listing.
Reflected DOM-based cross-site scripting in the Ninja Forms WordPress plugin, affecting all versions up to and including 3.15.5, allows unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser when the crafted link is clicked (CVSS 6.1; CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Exploitation is conditional: the target page must render a Ninja Forms form that uses the {field:*} merge-tag placeholder, and the attacker must supply a matching 'querystring:<key>'/'field:<key>' URL parameter so the server fully resolves the placeholder, after which the client-side else-branch abandons the server-sanitized value and reconstructs the field content from the raw query string. There is no server-side-only, no-interaction path - the required victim interaction keeps realistic risk targeted rather than widespread, and no public exploit was identified at time of analysis.
Stored cross-site scripting in the Webmention plugin for WordPress (versions up to and including 5.10.1) lets an unauthenticated attacker place script inside the og:title meta tag of a source URL and submit it as a webmention, which is then persisted verbatim into the target post's comment content. Execution is gated on an administrator approving the resulting pending comment, after which the script runs for any user who views the injected page; no public exploit code was identified at time of analysis, and the vendor has released 5.10.2 as the fix.
Reflected cross-site scripting in the Product Filter for WooCommerce by WBW WordPress plugin affects every release up to and including 3.4.6, and notably still affects sites that applied the incomplete 3.4.3 patch. The 'wpf_fid' value taken from the JSON-decoded filterSettings payload reaches the plugin's filter response path without absint() sanitization - only the separate getVar() read path was hardened - so an unauthenticated attacker who convinces a victim to click a crafted link can execute arbitrary script in that victim's browser session on the targeted site. Exploitation is per-victim and requires user interaction (UI:R), there is no persistent payload, and no public exploit code or active exploitation has been identified at time of analysis (priority label: this_month, CVSS 6.1).
Reflected cross-site scripting in ThemeHigh's WooCommerce Extra Product Options Pro plugin, affecting all versions up to and including 3.3.2, lets unauthenticated attackers inject arbitrary browser-side script through the '<fieldname>_start' and '<fieldname>_end' parameters of a Date & Time Range Picker extra field. The root cause is missing input sanitization combined with missing output escaping when those parameter values are reflected back into a WooCommerce product page. The attack is only reachable on product pages where a Date & Time Range Picker field has actually been configured, and the field name needed to build the payload is already visible in the page source, so discovery requires no prior knowledge; a victim must still be convinced to click a crafted link before the script runs in their session. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Reflected cross-site scripting in the WP User Frontend WordPress plugin (weDevs) affects all versions up to and including 4.3.13, allowing an unauthenticated attacker to inject arbitrary script through the 'field_attr[required]' parameter handled by the wpuf_get_child_cat AJAX action. The nonce check that would normally block such requests provides no protection here because the wpuf_nonce value is localized to every anonymous visitor of any page that renders a WPUF shortcode, so an attacker can harvest it freely. Rated CVSS 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), the flaw requires a victim to be tricked into clicking a crafted link, which bounds impact to that victim's browser session; no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
Unauthenticated data exposure in the WP Data Access WordPress plugin (all versions up to and including 5.5.88) lets a remote attacker pull every row and column of the database table behind any anonymously published app by manipulating the 'rel_tab' parameter, potentially dumping WordPress user password hashes, email addresses and password-reset keys from wp_users. The exposure is conditional: an administrator must have published at least one app whose REST API authorization is set to 'anonymous', the normal setting for publicly embedded apps, so sites with no anonymous app have no reachable endpoint to abuse. Impact is confidentiality-only (no write or availability effect); no public exploit has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation, while the vendor fix ships in version 5.5.89.
Cross-site request forgery in Thelia's back office lets a crafted link or hostile page make a logged-in administrator delete, hide or reorder catalogue and configuration objects without any error or audit entry. All Thelia releases before 3.2.0 are affected: the single per-session CSRF token is rendered into URL query strings (so it leaks through access logs, browser history, HTTP Referer headers or any XSS on the admin domain), and the setToggleVisibilityAction and updatePositionAction routes inherited from AbstractCrudController performed state changes without any token check, making toggles and reordering exploitable as pure CSRF with no token theft at all. The attacker needs no privileges (CVSS PR:N) but exploitation requires a currently authenticated back-office administrator to actively click the link, since anonymous requests are redirected to /admin/login; a public proof-of-concept reference exists in the vendor advisory, it is not verified as working exploit code, and there is no indication of active exploitation at time of analysis.
Arbitrary file overwrite in GNOME Epiphany 47.0 and later allows an attacker-crafted WebExtension package to truncate and replace an existing user-writable file with attacker-controlled content and permission bits. The installer in src/webextension/ephy-web-extension-manager.c used libarchive with archive_read_support_format_all(), so a TAR archive renamed to *.xpi was accepted instead of only genuine ZIP files; a hard-link entry inside that TAR, combined with archive_write_disk options including ARCHIVE_EXTRACT_PERM, redirects the write onto an attacker-chosen existing file. The victim must deliberately install or open the malicious .xpi (UI:R, local delivery), severity is assessed at CVSS 5.5 with integrity-only impact, and no public exploit was identified at time of analysis; an upstream fix restricting the installer to ZIP format only has been merged but a tagged patched release is not confirmed in the available data.
Arbitrary shortcode execution in the WordPress plugin Ninja Forms (Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder) affects every version up to and including 3.15.5: any authenticated user with Subscriber-level access can place a shortcode string in their profile display name and have it executed by do_shortcode() wherever the {wp:user_display_name} merge tag is rendered. Exploitation is not possible on a default install - an administrator must first have set a Ninja Forms field's Default Value to that merge tag and placed the form on a publicly accessible page, and the resulting impact is bounded by whichever shortcodes are registered on the target site. No public exploit has been identified at time of analysis and the issue is not in CISA KEV; the assigned priority is this_month, reflecting a moderate-severity, low-urgency configuration-dependent flaw rather than an emergency.
Stored DOM-based cross-site scripting in the NextGEN Gallery WordPress plugin (all versions up to and including 4.5.4) lets an unauthenticated attacker place script payloads through the 'comment' parameter that later execute in the browser of any visitor viewing the affected gallery page. Two concrete preconditions gate every attack: the site must have the Shutter or Shutter Reloaded lightbox selected as active (sites using another lightbox are not exposed), and the injected comment must pass WordPress's standard moderation workflow and be approved before it is rendered. Rated CVSS 5.4 with High attack complexity for exactly those reasons; there is no KEV listing and no public exploit identified at time of analysis, and an upstream fix is present in the plugin's trunk changeset 3773860, though a tagged patched release is not independently confirmed in the supplied data.
Unauthenticated attackers can permanently delete arbitrary WordPress Media Library attachments - including the files on disk - on any site running VillaTheme's Revopic / Photo Reviews for WooCommerce plugin through version 1.2.31. The plugin accepts attacker-chosen attachment IDs through the wcpr_image_upload_id POST parameter and stores them in review comment meta; the only validation confirms the ID is an attachment post type, never that the submitter owns or uploaded it, and the required wcpr_image_upload nonce is a shared public value printed on every product page. Deletion is deferred rather than immediate: it fires through the delete_comment hook when a moderator removes the planted review or when WordPress core's wp_scheduled_delete cron purges the trashed comment after EMPTY_TRASH_DAYS, and exploitation additionally requires enumerable target attachment IDs; no public exploit code or confirmed active exploitation was identified at time of analysis, and the assigned priority is this_month.
Stored cross-site scripting in the Content Pilot - Autoblogging & Affiliate Marketing Suite plugin for WordPress (through 2.2.4) lets an unauthenticated remote party inject scripts into posts generated from a configured RSS campaign, provided the administrator has pointed that campaign at a feed whose article content the attacker can influence and the campaign author holds unfiltered_html (Administrator by default). The malicious value is taken from a remote article's meta description and persisted as post_content without wp_kses_post filtering, then executes when a user views the generated post. No public exploit was identified at time of analysis; the prerequisite of an admin-configured, attacker-influenceable RSS campaign is why the assessed vector carries AC:H despite PR:N, making this a conditional, moderate-severity issue.
Stored cross-site scripting in the WordPress plugin W3 Total Cache (all versions up to and including 2.10.7) lets unauthenticated attackers inject arbitrary web scripts through the 'comment' parameter, which then execute when a user loads the injected page. The flaw is not unconditional: HTML Minify must be enabled, the default 'mfunc' entry must remain in the ignored-comment stems list, and the attacker must predict the md5(time()) placeholder namespace by reading the server clock from the HTTP Date response header within the applicable time window, which is why the assessed vector carries AC:H. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has published an upstream fix commit plus a changeset for the affected IgnoredCommentPreserver code; this is a genuine but conditional, moderate-severity issue rather than a top-tier emergency.
Unauthenticated attackers can read complete WordPress user records - including plaintext user_login and user_email, the hashed user_pass, and user_activation_key - from predictable gzip-serialized object-cache files written by the Seraphinite Accelerator plugin in all versions up to and including 2.29.24. The flaw is in WP_Object_Cache::_getFilePath, which maps user cache entries to directly fetchable files under wp-content/cache/seraphinite-accelerator/oc/g/users/g/<USER_ID>.dat.gz. Exploitation is gated on two conditions: the plugin's Object Cache feature must be enabled, and the attacker must first cause the target user's record to be cached (the advisory names an unauthenticated REST API request as the trigger) before retrieving the resulting file; no public exploit code or CISA KEV entry was identified at time of analysis. Because the disclosure is scoped to one user record per request and the leaked password material is hashed rather than plaintext, the practical severity rests on credential-harvesting and account-enumeration value rather than direct authentication bypass.
Unauthenticated account takeover of any Welcart shop member is possible on WordPress sites running the Welcart e-Commerce plugin up to and including 2.12.5. The enrollment/member handler trusts the attacker-supplied 'member[ID]' key without validating ownership, so a remote attacker who submits a victim's numeric member ID together with a new email address and password overwrites those credentials and can then log in as that member. The only gate is a wp_verify_nonce() check against a nonce printed on the auto-published New Enrollment Form, which every unauthenticated visitor can read, so default installations with no existing account are exploitable; no public exploit code has been identified at time of analysis, and the vendor-reported CVSS of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) is materially lower than our assessment of 9.8 (C:H/I:H/A:H) given the full account-takeover outcome.
Unauthenticated sensitive information exposure in the All in One SEO WordPress plugin through version 5.0.3 lets remote attackers pass a crafted 's' (search) parameter and have arbitrary non-public post meta values emitted verbatim into the page's HTML title element and the JSON-LD SearchResultsPage schema. Because the CVSS vector is PR:N/UI:N, no account or user interaction is needed, but the practical impact is confidentiality-only (C:L) and depends entirely on whether the targeted site actually stores secrets such as API keys or internal notes in custom fields the plugin renders. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; the vendor-side code changes referenced in the advisory point to an upstream fix in the plugin's trunk.
Path traversal in FFmpeg 5.0 through 9.0.2's IMF demuxer allows an unauthenticated remote attacker to make the demuxer open files outside an IMF package by embedding '..' or absolute paths in ASSETMAP Path elements, enabling local file existence and size probing plus server-side requests. The attacker must supply a crafted IMF package that the target opens or demuxes (UI:P), so exposure is highest in automated media-ingestion and transcoding services that process untrusted packages. This is a medium-severity information-disclosure/SSRF issue; no public exploit identified at time of analysis.
Sensitive information exposure in WP Overnight's PDF Invoices & Packing Slips for WooCommerce (all versions through 5.16.5) can deliver another customer's complete invoice PDF - billing identity, shipping address, private order notes, line items, prices, order dates, order ID and invoice number - as an attachment on an order-confirmation email the attacker receives. Exploitation is gated by two preconditions: the store must have enabled the plugin's non-default yearly invoice-number reset, and the attacker's own guest-checkout order must fire a 'processing' email within a 60-second window of a victim order carrying the same reset invoice number. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the raw CVSS of 5.3 overstates practical risk, since the assessed vector is AC:H with confidentiality impact limited to a single colliding document, and reliable large-scale exploitation is impractical given the timing race and configuration dependency.
Unauthenticated information disclosure in the Amelia booking plugin for WordPress (all versions through 2.4.12) lets remote attackers harvest staff personally identifiable information - full name, email address, phone number, gender and timezone - along with administrator-authored internal notes for every published event, by supplying a crafted 'page' parameter that causes the raw providers array to be serialized into the JSON response. With a CVSS score of 5.3 (AV:N/AC:L/PR:N/UI:N, confidentiality-only at C:L), the issue is a genuine but moderate-priority data leakage exposure rather than an emergency, and the available intelligence indicates no public exploit code and no confirmed active exploitation at time of analysis.
Time-based blind SQL injection in the Newsletters (newsletters-lite) plugin for WordPress through version 4.18.1 allows an attacker holding a subscriber-level subscriberauth cookie to append extra SQL into existing queries and extract sensitive data from the WordPress database. The vendor rates this 5.3 with high attack complexity and confidentiality-only impact, but the practical barrier is lower than that suggests: anyone can obtain the required nonce and cookie by subscribing through the public newsletter form and opening the emailed management link, because the ownership check validates only the subscriber_id field and never confirms that the injected 'id' parameter belongs to that subscriber. No CISA KEV entry and no public exploit code were identified at time of analysis, and the vulnerability is prioritised for this month's patch cycle rather than emergency response.
WBW Product Filter for WooCommerce through version 3.4.6 lets unauthenticated remote attackers enumerate draft, future and pending WooCommerce products, including their counts and rendered listing markup, and force unbounded product queries through the plugin's frontend AJAX action. The handler lacks capability and nonce checks and merges attacker-supplied query arguments into WP_Query, overriding the plugin's safe defaults. No public exploit was identified at time of analysis, the issue is not in CISA KEV, and no EPSS score was provided; CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), reflecting read-only confidentiality impact.
Nexterm through 1.2.2-BETA fails to verify session ownership on its session lifecycle routes, letting any authenticated user hibernate, resume, or terminate another user's live SSH, RDP, VNC, or SFTP session if they know or obtain the target session ID. This is an authorization/IDOR flaw (CWE-639) rated moderate severity: it requires a valid low-privilege account plus a target session identifier, and the outcome is limited to disruption of in-progress sessions with no read access to the victim's data. No public exploit code has been confirmed at time of analysis, and the vendor has addressed the issue in a patched release that enforces ownership validation.
Unauthenticated information disclosure in the WordPress plugin Quick Event Manager affects versions 8.4.6 through 9.18, where a calendar export endpoint returns details of requested posts without verifying their status or type, exposing the content of draft and private posts. Exploitation needs only a site running an affected version with the calendar export reachable, which is default behavior; no authentication or user interaction is required. No public exploit has been identified at time of analysis and EPSS is low at 0.16% (5th percentile), with CISA SSVC recording no exploitation activity, so practical risk depends on whether a target holds sensitive unpublished event content.
Unauthenticated visitors to any WordPress site running All-in-One Video Gallery before 5.0.0 can read the title and source URL(s) of videos that were never meant to be public - private, draft, pending, scheduled and trashed items - simply by requesting the plugin's player page with a chosen video ID. The plugin omits the publication-status check before rendering, and since IDs are sequential the set of hidden videos is practically enumerable; no account and no user interaction are needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3). Impact is confined to metadata disclosure - no integrity or availability effect and no exposure of credentials or full private content - and the vendor has released a fix in 5.0.0; there is no CISA KEV listing and no public exploit identified at time of analysis, while EPSS is low at 0.16% (5th percentile) and SSVC records no observed exploitation.
The Payable Payment Gateway for WooCommerce plugin before version 1.3.1 accepts incoming payment notifications without verifying their authenticity, then uses them to set a WooCommerce order to paid or failed. Because the callback endpoint is publicly reachable and the CVSS vector is PR:N/UI:N, remote attackers need no credentials or user interaction - only a valid order reference, which is guessable because WooCommerce order IDs are sequential - to flip the payment status of any order regardless of the payment method originally used. Impact is limited to order-state integrity (no data disclosure, no availability loss), EPSS is low at 0.15% (4th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis; the vendor has released a fix in 1.3.1.
Unauthenticated price tampering in the Premium Packages WordPress plugin before 7.2.2 lets visitors overwrite the stored price of cart items and place orders for any product at an arbitrary total, enabling fraudulent order values. The flaw is CWE-862 missing authorization, remotely reachable without credentials or user interaction (CVSS 3.1: 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), with impact confined to order and pricing integrity. No active exploitation or public exploit is identified at time of analysis; EPSS is 0.14% (4th percentile) and the priority label is this_month.
Missing authorization in the LearnHouse assignment API before version 1.1.1 lets an authenticated student read other students' assignment submissions, grades and instructor feedback by supplying a foreign user_id to the grade and submission read endpoints (CWE-639, IDOR-style user-controlled key). The exposure is confidentiality-only - no write, integrity or availability impact - and the caller must already hold a valid account that can reach the affected course, so this is not an anonymous remote compromise. No public exploit code and no confirmed active exploitation are identified in the available data, and the moderate 5.3 severity places it in a this_month remediation queue rather than an emergency patch cycle.
Improper privilege management in the YznCMS Auth Group Handler (app/admin/controller/auth/Group.php) allows a user who already holds a high-privilege backend session to manipulate group handling so that privileges are granted or changed beyond the intended authorization model, affecting confidentiality, integrity and availability at a low level (CVSS 4.0 base 5.1, assessed CVSS 3.1 5.1). All versions up to and including 2.2.0 are affected, and exploitation requires an existing authenticated administrator-level session on the YznCMS admin panel (PR:H), so anonymous or low-privileged users cannot reach the flaw; no public exploit has been identified at time of analysis. Upgrading to version 2.2.1, which contains the fix, resolves the issue.
The Payment Forms for Paystack WordPress plugin before 4.0.6 exposes its stored plugin configuration to users who should not see it, so any authenticated account holding the Contributor role or higher can read the live and test Paystack secret keys, which grant full access to the site owner's payment account. The flaw is a confidentiality-only information disclosure: no data modification, no denial of service, and no victim interaction is required beyond the attacker already having a low-privileged account on the site and the plugin being configured with Paystack credentials. Exploitation signals are currently weak - there is no CISA KEV listing and no public exploit identified at time of analysis, and EPSS is low at roughly 0.15% (4th percentile), so this is a moderate-priority disclosure rather than an emergency, with the real-world risk concentrated on multi-author sites or sites with open registration where Contributor accounts are easy to obtain.
An authorization workflow gap in the Germanized for WooCommerce plugin for WordPress, versions up to and including 4.1.4, lets an authenticated attacker with Subscriber-level access change their account email to a victim's billing email and then redeem their original, unrotated activation token, causing a pre-existing guest order to be linked to the attacker's account and exposing the buyer's billing name, street address, phone number and purchased items on the attacker's My Account page. Exploitation is conditional: the site must run double opt-in with 'Disable login for unactivated customers' explicitly set to No (non-default), public customer registration must be enabled, the token must be redeemed within its one-day expiry window, and a guest order must already exist whose billing email matches the victim address used. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the stacked configuration and timing prerequisites substantially limit real-world exploitability despite the network attack vector and low attack complexity.
An authorization bypass in the Hustle WordPress plugin (all versions up to and including 7.8.14.3) lets an authenticated user who holds the plugin-granted hustle_create capability - but not hustle_edit_integrations - overwrite the site's active email service provider credentials (AWeber, Constant Contact, Infusionsoft, ConvertKit or HubSpot API keys) with attacker-controlled values, redirecting every subsequent Hustle form lead submission to the attacker's ESP tenant. For HubSpot the same requests can also irreversibly delete the operator's OAuth token, OAuth referer and OAuth current-page option rows, breaking the integration until it is re-authorized. Exploitation is constrained: the attacker must already hold a delegated Hustle capability and must first load a Hustle module wizard page to capture a valid hustle_provider_action nonce, and the site must have an ESP integration configured for the impact to matter; no public exploit code or active exploitation has been identified at time of analysis, and the reported CVSS 4.3 and this_month priority reflect a genuine but bounded risk rather than an emergency.
Missing capability checks in the Perfect Images WordPress plugin (wp-retina-2x) through version 7.2.0 allow any authenticated user holding Author-level access to replace media files that do not belong to them via the /wp-json/wp-retina-2x/v1/replace REST route. Exploitation requires a valid account at Author level or above on a site where the plugin is installed and active; no user interaction and no non-default configuration are needed. Impact is confined to integrity (CVSS 3.1 score 4.3, C:N/I:L/A:N), with no confidentiality or availability effect described in the available sources; no public exploit has been identified at time of analysis, and no CISA KEV entry was supplied.
Authenticated users holding Author-level access or above can raise the role of accounts created through Essential Addons for Elementor's registration form, including accounts registered by unauthenticated visitors via the public form, to a higher role such as Editor. The flaw affects versions 6.6.0 through 6.8.7 and is an incomplete fix of CVE-2026-5193; version 6.8.8 corrects it. No public exploit has been identified at time of analysis, EPSS is 0.18% (7th percentile), and CISA SSVC records no known exploitation, no automatable exploitation, and partial technical impact.