Monthly
FluentCart, the WPManageNinja e-commerce plugin for WordPress, embeds sensitive information inside data it sends to clients in versions through 1.7.1, letting remote attackers pull that embedded data without authenticating. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) shows the exposure is network-reachable, low-complexity and requires no credentials or user interaction, but yields only confidentiality impact - no integrity or availability effect. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; exposure is limited to WordPress sites running this specific plugin at 1.7.1 or earlier.
Crafted input sent over the network to a reachable DeepSeek V4 instance or API can cause the service to return sensitive information to the requester, with the assessed vector requiring no authentication, no privileges, and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - confidentiality-only impact). Publicly available exploit code exists: the CVE record links a public GitHub gist alongside the vendor homepage, and CISA's SSVC assessment marks the issue automatable with total technical impact, although the record's 9.1 score implies an integrity impact our own assessment does not confirm. Defenders cannot yet scope exposure precisely because no affected build, version, or deployment mode is published, so the practical risk is highest for any DeepSeek V4 endpoint or API that is reachable from untrusted networks.
Unauthenticated sensitive data exposure in the Contact Form 7 - Dynamic Text Extension WordPress plugin (versions up to and including 5.0.7) lets any remote visitor cause the plugin's dynamic-text rendering to return information that was not meant to be disclosed, with high confidentiality impact and no integrity or availability effect (assessed CVSS 3.1 base 7.5). The assessed vector AV:N/AC:L/PR:N/UI:N means no authentication, user interaction, or special configuration is required beyond having the vulnerable plugin installed, active, and reachable on an internet-facing site. Risk is bounded by plugin presence and by whatever sensitive values a site's dynamic-text fields actually render; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated sensitive data exposure in the Web Plura Backup & Restore Manager plugin for WordPress (versions 0.2.25 and earlier) allows remote attackers to read potentially sensitive backup-related information from affected sites. Exploitation requires only that the plugin is installed and active, per the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirming remote, low-complexity, unauthenticated access with no user interaction; impact is limited to confidentiality (C:H/I:N/A:N). No public exploit identified at time of analysis, and the affected install base is limited to sites running this specific low-footprint plugin.
Unauthenticated information disclosure in the AKINSOFT WOLVOX Control Panel (versions 26.02.25 up to but not including 26.02.26) lets a remote attacker reach the panel over the network and pull sensitive data from system resources into responses sent back to the client. Because the assessed attack vector is AV:N/AC:L/PR:N/UI:N, no credentials or user interaction are needed against an internet- or network-reachable instance, and successful exploitation yields high confidentiality impact (C:H), exposing host/system-level information to an unauthorized party. Note that the supplied base vector (9.8) also asserts high integrity and availability impact, whereas the independent assessment scopes the issue to confidentiality only (I:N/A:N); either way the practical effect is data exposure rather than code execution or service disruption. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released a fix.
API key disclosure in Payload CMS lets an authenticated user with ordinary read access to other users' authentication documents retrieve those users' active API keys and then act with the victim accounts' full permissions until the keys are rotated or disabled. Affected deployments are the npm `payload` package from 3.0.0 before 3.90.0 and canary releases from 4.0.0-canary.0 before 4.0.0-canary.34, but only where an authentication collection has `useAPIKey` enabled and users can read authentication documents they do not own - configurations restricted to self-read, or with `useAPIKey` disabled, are not exploitable. The CVSS 4.0 score is 7.7 (AV:N/AC:L/AT:P/PR:L) and our independent review assesses it as a credible upper-medium priority issue for environments that actually use the feature rather than an internet-wide emergency; no CISA KEV entry or public exploit code was identified at time of analysis.
Unauthenticated sensitive data exposure in the WordPress plugin SiteVault - Backup, Restore, Migration & Cloning (by royal_plugins) at version 1.5.17 and earlier lets remote attackers retrieve sensitive information from affected sites without authentication, user interaction, or special configuration, as reflected by the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (base 7.5 HIGH). Only sites with the plugin installed and active at or below 1.5.17 are exposed; the impact is high confidentiality loss with no integrity or availability effect, consistent with the CWE-201 sensitive-data-exposure classification reported by Patchstack. No public exploit code has been identified at time of analysis, no CISA KEV listing applies, and no EPSS score was supplied, so the practical risk is driven mainly by the plugin's install base and the ease of unauthenticated, low-complexity remote exploitation.
Unauthenticated sensitive data exposure in the Groundhogg WordPress plugin versions 4.8.3 and earlier allows remote attackers to retrieve confidential information from affected sites. Tracked as CVE-2026-104385 with a CVSS score of 7.5, the flaw requires no authentication or user interaction and can be exploited over the network with low complexity. No public exploit identified at time of analysis, but the high confidentiality impact (CWE-201) makes prompt remediation critical.
Unauthenticated sensitive data exposure in the Snapshotify - All-in-One Backup & Restore & Migrate WordPress plugin (versions 1.3.2 and earlier) allows remote attackers to retrieve information the plugin transmits without adequate protection, yielding a high confidentiality impact with no integrity or availability impact. The flaw is remotely reachable, requires no authentication and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5), and is rooted in CWE-201, the insertion of sensitive information into sent data. Exposure is limited to WordPress sites that have this specific backup/restore/migrate plugin installed and active; no public exploit identified at time of analysis, and no EPSS, KEV or proof-of-concept data was provided with the source material.
Unauthenticated information disclosure in the Norvis Backup WordPress plugin (versions up to and including 1.1.0) allows any remote attacker to retrieve sensitive site data without credentials, user interaction, or special configuration, as reflected by the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N with high confidentiality impact (base 7.5 HIGH) and no integrity or availability impact. The flaw is a CWE-201 sensitive-information-in-sent-data issue in a low-prevalence backup plugin, so exposure is limited to sites actually running this plugin at a vulnerable version. There is no public exploit identified at time of analysis, and no vendor-released patch version was confirmed in the available data; the sole source is the Patchstack advisory.
FluentCart, the WPManageNinja e-commerce plugin for WordPress, embeds sensitive information inside data it sends to clients in versions through 1.7.1, letting remote attackers pull that embedded data without authenticating. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) shows the exposure is network-reachable, low-complexity and requires no credentials or user interaction, but yields only confidentiality impact - no integrity or availability effect. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; exposure is limited to WordPress sites running this specific plugin at 1.7.1 or earlier.
Crafted input sent over the network to a reachable DeepSeek V4 instance or API can cause the service to return sensitive information to the requester, with the assessed vector requiring no authentication, no privileges, and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - confidentiality-only impact). Publicly available exploit code exists: the CVE record links a public GitHub gist alongside the vendor homepage, and CISA's SSVC assessment marks the issue automatable with total technical impact, although the record's 9.1 score implies an integrity impact our own assessment does not confirm. Defenders cannot yet scope exposure precisely because no affected build, version, or deployment mode is published, so the practical risk is highest for any DeepSeek V4 endpoint or API that is reachable from untrusted networks.
Unauthenticated sensitive data exposure in the Contact Form 7 - Dynamic Text Extension WordPress plugin (versions up to and including 5.0.7) lets any remote visitor cause the plugin's dynamic-text rendering to return information that was not meant to be disclosed, with high confidentiality impact and no integrity or availability effect (assessed CVSS 3.1 base 7.5). The assessed vector AV:N/AC:L/PR:N/UI:N means no authentication, user interaction, or special configuration is required beyond having the vulnerable plugin installed, active, and reachable on an internet-facing site. Risk is bounded by plugin presence and by whatever sensitive values a site's dynamic-text fields actually render; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated sensitive data exposure in the Web Plura Backup & Restore Manager plugin for WordPress (versions 0.2.25 and earlier) allows remote attackers to read potentially sensitive backup-related information from affected sites. Exploitation requires only that the plugin is installed and active, per the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirming remote, low-complexity, unauthenticated access with no user interaction; impact is limited to confidentiality (C:H/I:N/A:N). No public exploit identified at time of analysis, and the affected install base is limited to sites running this specific low-footprint plugin.
Unauthenticated information disclosure in the AKINSOFT WOLVOX Control Panel (versions 26.02.25 up to but not including 26.02.26) lets a remote attacker reach the panel over the network and pull sensitive data from system resources into responses sent back to the client. Because the assessed attack vector is AV:N/AC:L/PR:N/UI:N, no credentials or user interaction are needed against an internet- or network-reachable instance, and successful exploitation yields high confidentiality impact (C:H), exposing host/system-level information to an unauthorized party. Note that the supplied base vector (9.8) also asserts high integrity and availability impact, whereas the independent assessment scopes the issue to confidentiality only (I:N/A:N); either way the practical effect is data exposure rather than code execution or service disruption. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released a fix.
API key disclosure in Payload CMS lets an authenticated user with ordinary read access to other users' authentication documents retrieve those users' active API keys and then act with the victim accounts' full permissions until the keys are rotated or disabled. Affected deployments are the npm `payload` package from 3.0.0 before 3.90.0 and canary releases from 4.0.0-canary.0 before 4.0.0-canary.34, but only where an authentication collection has `useAPIKey` enabled and users can read authentication documents they do not own - configurations restricted to self-read, or with `useAPIKey` disabled, are not exploitable. The CVSS 4.0 score is 7.7 (AV:N/AC:L/AT:P/PR:L) and our independent review assesses it as a credible upper-medium priority issue for environments that actually use the feature rather than an internet-wide emergency; no CISA KEV entry or public exploit code was identified at time of analysis.
Unauthenticated sensitive data exposure in the WordPress plugin SiteVault - Backup, Restore, Migration & Cloning (by royal_plugins) at version 1.5.17 and earlier lets remote attackers retrieve sensitive information from affected sites without authentication, user interaction, or special configuration, as reflected by the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (base 7.5 HIGH). Only sites with the plugin installed and active at or below 1.5.17 are exposed; the impact is high confidentiality loss with no integrity or availability effect, consistent with the CWE-201 sensitive-data-exposure classification reported by Patchstack. No public exploit code has been identified at time of analysis, no CISA KEV listing applies, and no EPSS score was supplied, so the practical risk is driven mainly by the plugin's install base and the ease of unauthenticated, low-complexity remote exploitation.
Unauthenticated sensitive data exposure in the Groundhogg WordPress plugin versions 4.8.3 and earlier allows remote attackers to retrieve confidential information from affected sites. Tracked as CVE-2026-104385 with a CVSS score of 7.5, the flaw requires no authentication or user interaction and can be exploited over the network with low complexity. No public exploit identified at time of analysis, but the high confidentiality impact (CWE-201) makes prompt remediation critical.
Unauthenticated sensitive data exposure in the Snapshotify - All-in-One Backup & Restore & Migrate WordPress plugin (versions 1.3.2 and earlier) allows remote attackers to retrieve information the plugin transmits without adequate protection, yielding a high confidentiality impact with no integrity or availability impact. The flaw is remotely reachable, requires no authentication and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5), and is rooted in CWE-201, the insertion of sensitive information into sent data. Exposure is limited to WordPress sites that have this specific backup/restore/migrate plugin installed and active; no public exploit identified at time of analysis, and no EPSS, KEV or proof-of-concept data was provided with the source material.
Unauthenticated information disclosure in the Norvis Backup WordPress plugin (versions up to and including 1.1.0) allows any remote attacker to retrieve sensitive site data without credentials, user interaction, or special configuration, as reflected by the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N with high confidentiality impact (base 7.5 HIGH) and no integrity or availability impact. The flaw is a CWE-201 sensitive-information-in-sent-data issue in a low-prevalence backup plugin, so exposure is limited to sites actually running this plugin at a vulnerable version. There is no public exploit identified at time of analysis, and no vendor-released patch version was confirmed in the available data; the sole source is the Patchstack advisory.