Aman
Monthly
Blind SQL injection in the WordPress plugin FunnelKit Automations (wp-marketing-automations) through version 3.8.5.2 lets remote attackers pass crafted SQL through a plugin input and infer database contents, exposing WordPress user credentials, session tokens and stored marketing/automation data. The vulnerability carries a 9.3 vendor-side CVSS score, while the independent assessment scores it as scope-unchanged with high confidentiality impact only (no integrity or availability effect); because the sources do not name the vulnerable parameter, AJAX action or REST route, the unauthenticated (PR:N) rating cannot be confirmed from the description, and WordPress plugin SQLi flaws are frequently limited to low-privilege authenticated roles - verifying that prerequisite is the decisive exposure question. No public exploit code has been identified at time of analysis, but the issue is flagged act_now priority and a public PoC reference may appear quickly given the plugin's wide install base.
Cross-site request forgery in the FunnelKit Automations WordPress plugin (wp-marketing-automations) affects every release through 3.8.5.2 and lets an attacker induce a logged-in privileged user - typically an administrator or plugin operator - to submit state-changing requests against the site without their intent. The issue carries CVSS 3.1 score 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) because successful forgery can compromise confidentiality and integrity, but it cannot succeed without that victim interaction on an active, authenticated session. Reported by Patchstack and assigned a vuln.today priority of 'this_week'; no public exploit code and no confirmed active exploitation (CISA KEV) are indicated in the available data.
Unauthenticated cross-site scripting in the CF7 Views - Complete Entry Management for Contact Form 7 WordPress plugin through version 3.2.6 allows an attacker to have injected script execute in a victim's browser session when the victim follows a crafted link or loads attacker-influenced content. Exploitation requires no credentials (PR:N) but is gated by mandatory user interaction (UI:R), and impact is bounded by the victim's privileges on the affected WordPress origin, so maximum damage requires socially engineering a logged-in administrator. Patchstack reports the issue at CVSS 7.1; no public exploit code and no confirmed active exploitation (CISA KEV) are identified in the available data, and no EPSS value was supplied.
DOM-based cross-site scripting in the WordPress plugin CF7 Views - Complete Entry Management for Contact Form 7 (by Aman) affects all versions from an unspecified start through 3.2.2, letting a remote attacker who lures a user into interacting with a crafted link or page execute arbitrary JavaScript in that user's browser session. The flaw carries a CVSS 3.1 base score of 7.1 with a scope change (S:C), reflecting that script executes outside the vulnerable component's security context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue was disclosed via Patchstack.
Broken authentication in the FunnelKit Automations WordPress plugin (versions <= 3.7.3) allows authenticated low-privilege users (subscribers) to bypass intended authentication controls, leading to integrity tampering and availability impact on the WordPress site. The flaw is reported by Patchstack and tracked as EUVD-2026-36929, with no public exploit identified at time of analysis and no CISA KEV listing. Given subscriber-level registration is open on many WordPress sites, the practical attack surface is broader than the CVSS 7.1 score alone suggests.
Blind SQL injection in Views for WPForms WordPress plugin (versions ≤3.4.6) allows authenticated low-privilege attackers with network access to extract sensitive database contents. The vulnerability enables cross-scope compromise with high confidentiality impact and limited availability disruption. Patchstack reported this SQLi flaw; no public exploit identified at time of analysis. EPSS data not available, suggesting lower immediate exploitation probability, though the low attack complexity (AC:L) makes exploitation straightforward once authenticated access is obtained.
Blind SQL injection in Ninja Forms Views plugin (versions ≤3.3.2) allows authenticated attackers with low-level privileges to extract sensitive database information via specially crafted queries. The vulnerability carries an 8.5 CVSS score with scope change, enabling attackers to access data beyond the plugin's normal authorization boundaries. Reported by Patchstack with detailed vendor advisory available, though no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Stored cross-site scripting (XSS) in the CF7 Views - Complete Entry Management for Contact Form 7 plugin (versions <= 3.2.5) enables an authenticated Contributor-level user to inject malicious scripts that execute in the browser of a higher-privileged victim who views the crafted entry or view. The CVSS v3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting the need for authentication and user interaction, and the potential for limited confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at the time of analysis.
The mintToken function of a smart contract implementation for aman, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Blind SQL injection in the WordPress plugin FunnelKit Automations (wp-marketing-automations) through version 3.8.5.2 lets remote attackers pass crafted SQL through a plugin input and infer database contents, exposing WordPress user credentials, session tokens and stored marketing/automation data. The vulnerability carries a 9.3 vendor-side CVSS score, while the independent assessment scores it as scope-unchanged with high confidentiality impact only (no integrity or availability effect); because the sources do not name the vulnerable parameter, AJAX action or REST route, the unauthenticated (PR:N) rating cannot be confirmed from the description, and WordPress plugin SQLi flaws are frequently limited to low-privilege authenticated roles - verifying that prerequisite is the decisive exposure question. No public exploit code has been identified at time of analysis, but the issue is flagged act_now priority and a public PoC reference may appear quickly given the plugin's wide install base.
Cross-site request forgery in the FunnelKit Automations WordPress plugin (wp-marketing-automations) affects every release through 3.8.5.2 and lets an attacker induce a logged-in privileged user - typically an administrator or plugin operator - to submit state-changing requests against the site without their intent. The issue carries CVSS 3.1 score 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) because successful forgery can compromise confidentiality and integrity, but it cannot succeed without that victim interaction on an active, authenticated session. Reported by Patchstack and assigned a vuln.today priority of 'this_week'; no public exploit code and no confirmed active exploitation (CISA KEV) are indicated in the available data.
Unauthenticated cross-site scripting in the CF7 Views - Complete Entry Management for Contact Form 7 WordPress plugin through version 3.2.6 allows an attacker to have injected script execute in a victim's browser session when the victim follows a crafted link or loads attacker-influenced content. Exploitation requires no credentials (PR:N) but is gated by mandatory user interaction (UI:R), and impact is bounded by the victim's privileges on the affected WordPress origin, so maximum damage requires socially engineering a logged-in administrator. Patchstack reports the issue at CVSS 7.1; no public exploit code and no confirmed active exploitation (CISA KEV) are identified in the available data, and no EPSS value was supplied.
DOM-based cross-site scripting in the WordPress plugin CF7 Views - Complete Entry Management for Contact Form 7 (by Aman) affects all versions from an unspecified start through 3.2.2, letting a remote attacker who lures a user into interacting with a crafted link or page execute arbitrary JavaScript in that user's browser session. The flaw carries a CVSS 3.1 base score of 7.1 with a scope change (S:C), reflecting that script executes outside the vulnerable component's security context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue was disclosed via Patchstack.
Broken authentication in the FunnelKit Automations WordPress plugin (versions <= 3.7.3) allows authenticated low-privilege users (subscribers) to bypass intended authentication controls, leading to integrity tampering and availability impact on the WordPress site. The flaw is reported by Patchstack and tracked as EUVD-2026-36929, with no public exploit identified at time of analysis and no CISA KEV listing. Given subscriber-level registration is open on many WordPress sites, the practical attack surface is broader than the CVSS 7.1 score alone suggests.
Blind SQL injection in Views for WPForms WordPress plugin (versions ≤3.4.6) allows authenticated low-privilege attackers with network access to extract sensitive database contents. The vulnerability enables cross-scope compromise with high confidentiality impact and limited availability disruption. Patchstack reported this SQLi flaw; no public exploit identified at time of analysis. EPSS data not available, suggesting lower immediate exploitation probability, though the low attack complexity (AC:L) makes exploitation straightforward once authenticated access is obtained.
Blind SQL injection in Ninja Forms Views plugin (versions ≤3.3.2) allows authenticated attackers with low-level privileges to extract sensitive database information via specially crafted queries. The vulnerability carries an 8.5 CVSS score with scope change, enabling attackers to access data beyond the plugin's normal authorization boundaries. Reported by Patchstack with detailed vendor advisory available, though no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Stored cross-site scripting (XSS) in the CF7 Views - Complete Entry Management for Contact Form 7 plugin (versions <= 3.2.5) enables an authenticated Contributor-level user to inject malicious scripts that execute in the browser of a higher-privileged victim who views the crafted entry or view. The CVSS v3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting the need for authentication and user interaction, and the potential for limited confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at the time of analysis.
The mintToken function of a smart contract implementation for aman, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.