Monthly
Unauthenticated sensitive data exposure in WP Cafe Pro WordPress plugin versions prior to 3.0.15 allows any remote attacker without credentials to retrieve sensitive information directly from affected WordPress installations. Classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), the flaw is network-exploitable with no authentication or user interaction required, yielding a CVSS 3.1 score of 7.5 (High). No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available in version 3.0.15.
Secret exfiltration via URL parameter interpolation in SiYuan's http_request MCP tool affects all versions before v3.8.0. An MCP client with elevated access can embed secret placeholder references directly in the destination URL of an http_request tool call, causing SiYuan to resolve and transmit stored plaintext secrets to any attacker-controlled host without user confirmation. No public exploit has been identified at time of analysis, but the exploitation mechanism is straightforward for any party holding MCP client access.
Cross-host redirect cookie leakage in Hurl ≤ 8.0.1 exposes session credentials to attacker-controlled redirect destinations when scripts use the dedicated [Cookies] section. Hurl's HTTP client correctly strips raw Cookie headers and Authorization credentials on host changes, but the separate RequestSpec.cookies pathway - populated by the [Cookies] section of .hurl files - bypasses this stripping logic, forwarding scoped cookies to the redirected host. No public exploit code is identified and this vulnerability is not in CISA KEV; the CVSS 4.0 score of 6.9 reflects high confidentiality impact gated by the requirement that a user actively runs the affected script.
Open mail relay in the J-BusinessDirectory Joomla extension (versions 1.0.0-6.2.2) allows unauthenticated remote attackers to redirect business contact emails to arbitrary recipients by supplying an attacker-controlled email address in the contact_id_offer or contact_id_event request parameters. The extension incorrectly trusts client-supplied input for recipient resolution rather than performing a server-side lookup against the referenced offer or event record. No public exploit has been identified and EPSS is at the 5th percentile, but the zero-authentication requirement and trivial exploitation path make opportunistic abuse of the site's mail infrastructure realistic.
Sensitive data exposure in the Track Geolocation Of Users Using Contact Form 7 WordPress plugin (versions <= 3.0.2) permits remote unauthenticated attackers to retrieve geolocation records collected from Contact Form 7 form submissions with no credentials or user interaction required. The vulnerability is rooted in CWE-201 - sensitive information returned in responses to unauthorized parties - yielding high confidentiality impact consistent with the CVSS vector (C:H/I:N/A:N). No public exploit code has been confirmed and the CVE does not appear in CISA KEV at time of analysis, though the trivial attack prerequisites (AV:N/AC:L/PR:N/UI:N) mean that exploitation would be straightforward once the plugin's vulnerable endpoint is identified.
Unauthenticated sensitive data exposure in the CMSMinds Pay with Contact Form 7 WordPress plugin (versions through 1.0.4) allows remote, unauthenticated attackers to retrieve sensitive information - likely payment-related or personal contact data - without any credentials or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms a fully network-accessible attack path requiring zero privileges, yielding high confidentiality impact. No public exploit or CISA KEV listing has been identified at time of analysis.
Sensitive data exposure in the Shortcodes and Extra Features for Phlox Theme WordPress plugin (versions up to and including 2.17.22) allows unauthenticated remote attackers to retrieve sensitive information without credentials via network requests. The flaw is rooted in CWE-201, where the plugin inserts sensitive information into data sent to requestors without enforcing access controls, making it passively collectible by any actor who reaches the affected endpoint. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis, though the zero-barrier entry point (AV:N/AC:L/PR:N/UI:N) makes opportunistic scanning a realistic threat vector.
Unauthenticated sensitive data exposure in the iCARRY WordPress plugin (versions <= 2.9) allows any remote, unauthenticated attacker to retrieve sensitive information by interacting with the plugin's endpoints over a standard HTTP connection. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires no credentials, no user interaction, and no special preconditions, making every unpatched site trivially accessible. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity means discovery and abuse would be straightforward for any motivated attacker.
Unauthenticated sensitive data exposure in the REST API Log WordPress plugin (versions <= 1.7.1) allows any remote actor to query the plugin's log storage and retrieve recorded REST API request and response data without credentials. Reported by Patchstack and scored CVSS 7.5 (High) with AV:N/AC:L/PR:N/UI:N, the exposure is trivially reachable across the network with no authentication or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Sensitive customer data exposure in the WP Event Solution WordPress plugin (versions up to and including 4.1.18) allows authenticated low-privileged users to access confidential customer information over the network. The vulnerability, classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), results in high confidentiality impact with no integrity or availability loss. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility elevate realistic risk for sites collecting customer data via this plugin.
Unauthenticated sensitive data exposure in WP Cafe Pro WordPress plugin versions prior to 3.0.15 allows any remote attacker without credentials to retrieve sensitive information directly from affected WordPress installations. Classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), the flaw is network-exploitable with no authentication or user interaction required, yielding a CVSS 3.1 score of 7.5 (High). No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available in version 3.0.15.
Secret exfiltration via URL parameter interpolation in SiYuan's http_request MCP tool affects all versions before v3.8.0. An MCP client with elevated access can embed secret placeholder references directly in the destination URL of an http_request tool call, causing SiYuan to resolve and transmit stored plaintext secrets to any attacker-controlled host without user confirmation. No public exploit has been identified at time of analysis, but the exploitation mechanism is straightforward for any party holding MCP client access.
Cross-host redirect cookie leakage in Hurl ≤ 8.0.1 exposes session credentials to attacker-controlled redirect destinations when scripts use the dedicated [Cookies] section. Hurl's HTTP client correctly strips raw Cookie headers and Authorization credentials on host changes, but the separate RequestSpec.cookies pathway - populated by the [Cookies] section of .hurl files - bypasses this stripping logic, forwarding scoped cookies to the redirected host. No public exploit code is identified and this vulnerability is not in CISA KEV; the CVSS 4.0 score of 6.9 reflects high confidentiality impact gated by the requirement that a user actively runs the affected script.
Open mail relay in the J-BusinessDirectory Joomla extension (versions 1.0.0-6.2.2) allows unauthenticated remote attackers to redirect business contact emails to arbitrary recipients by supplying an attacker-controlled email address in the contact_id_offer or contact_id_event request parameters. The extension incorrectly trusts client-supplied input for recipient resolution rather than performing a server-side lookup against the referenced offer or event record. No public exploit has been identified and EPSS is at the 5th percentile, but the zero-authentication requirement and trivial exploitation path make opportunistic abuse of the site's mail infrastructure realistic.
Sensitive data exposure in the Track Geolocation Of Users Using Contact Form 7 WordPress plugin (versions <= 3.0.2) permits remote unauthenticated attackers to retrieve geolocation records collected from Contact Form 7 form submissions with no credentials or user interaction required. The vulnerability is rooted in CWE-201 - sensitive information returned in responses to unauthorized parties - yielding high confidentiality impact consistent with the CVSS vector (C:H/I:N/A:N). No public exploit code has been confirmed and the CVE does not appear in CISA KEV at time of analysis, though the trivial attack prerequisites (AV:N/AC:L/PR:N/UI:N) mean that exploitation would be straightforward once the plugin's vulnerable endpoint is identified.
Unauthenticated sensitive data exposure in the CMSMinds Pay with Contact Form 7 WordPress plugin (versions through 1.0.4) allows remote, unauthenticated attackers to retrieve sensitive information - likely payment-related or personal contact data - without any credentials or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms a fully network-accessible attack path requiring zero privileges, yielding high confidentiality impact. No public exploit or CISA KEV listing has been identified at time of analysis.
Sensitive data exposure in the Shortcodes and Extra Features for Phlox Theme WordPress plugin (versions up to and including 2.17.22) allows unauthenticated remote attackers to retrieve sensitive information without credentials via network requests. The flaw is rooted in CWE-201, where the plugin inserts sensitive information into data sent to requestors without enforcing access controls, making it passively collectible by any actor who reaches the affected endpoint. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis, though the zero-barrier entry point (AV:N/AC:L/PR:N/UI:N) makes opportunistic scanning a realistic threat vector.
Unauthenticated sensitive data exposure in the iCARRY WordPress plugin (versions <= 2.9) allows any remote, unauthenticated attacker to retrieve sensitive information by interacting with the plugin's endpoints over a standard HTTP connection. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires no credentials, no user interaction, and no special preconditions, making every unpatched site trivially accessible. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity means discovery and abuse would be straightforward for any motivated attacker.
Unauthenticated sensitive data exposure in the REST API Log WordPress plugin (versions <= 1.7.1) allows any remote actor to query the plugin's log storage and retrieve recorded REST API request and response data without credentials. Reported by Patchstack and scored CVSS 7.5 (High) with AV:N/AC:L/PR:N/UI:N, the exposure is trivially reachable across the network with no authentication or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Sensitive customer data exposure in the WP Event Solution WordPress plugin (versions up to and including 4.1.18) allows authenticated low-privileged users to access confidential customer information over the network. The vulnerability, classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), results in high confidentiality impact with no integrity or availability loss. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility elevate realistic risk for sites collecting customer data via this plugin.