Ezoic
Monthly
Unauthenticated broken authentication (CWE-288) in the Ezoic WordPress plugin versions 2.22.11 and earlier allows remote attackers to bypass authentication via an alternate path or channel, resulting in high confidentiality impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N) confirms network-based exploitation requiring no credentials, no user interaction, and low attack complexity, consistent with the 'Information Disclosure' tag applied by Patchstack. No public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated database export exposure in the Ezoic WordPress plugin (versions 2.6.35 through before 2.23.1) allows any remote attacker to trigger a full server-side export of the site's database, harvesting user password hashes and active password reset tokens - the latter enabling immediate account takeover without password cracking. The same missing authorization flaw (CWE-862) additionally permits unauthenticated persistent modification of plugin settings. A publicly available exploit exists per WPScan, and the CVSS vector confirms trivial remote exploitation with no authentication, interaction, or special conditions required.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability in Ezoic plugin <= 2.8.8 on WordPress. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauthenticated broken authentication (CWE-288) in the Ezoic WordPress plugin versions 2.22.11 and earlier allows remote attackers to bypass authentication via an alternate path or channel, resulting in high confidentiality impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N) confirms network-based exploitation requiring no credentials, no user interaction, and low attack complexity, consistent with the 'Information Disclosure' tag applied by Patchstack. No public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated database export exposure in the Ezoic WordPress plugin (versions 2.6.35 through before 2.23.1) allows any remote attacker to trigger a full server-side export of the site's database, harvesting user password hashes and active password reset tokens - the latter enabling immediate account takeover without password cracking. The same missing authorization flaw (CWE-862) additionally permits unauthenticated persistent modification of plugin settings. A publicly available exploit exists per WPScan, and the CVSS vector confirms trivial remote exploitation with no authentication, interaction, or special conditions required.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability in Ezoic plugin <= 2.8.8 on WordPress. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.