Illid
Monthly
A code injection vulnerability in ILLID Advanced Woo Labels WordPress plugin (versions up to 2.36) allows authenticated administrators to execute arbitrary code through improper input validation, potentially leading to full site compromise. The vulnerability requires high privileges to exploit (CVSS 7.2), has no known active exploitation in the wild (not in CISA KEV), and carries a very low EPSS score of 0.00043 (0.043%), indicating minimal real-world exploitation likelihood despite the high CVSS score.
Server-Side Request Forgery in the ILLID Share This Image WordPress plugin (all versions through 2.14) allows unauthenticated remote attackers to induce the WordPress server to issue arbitrary HTTP requests to internal or external destinations, potentially exposing internal network topology and services. The scope-changed CVSS vector (S:C) confirms that exploitation can extend impact beyond the vulnerable WordPress instance to backend systems reachable by the server. No public exploit code has been identified and SSVC assessment classifies exploitation as none at time of analysis, placing real-world urgency below the raw CVSS 5.4 score suggests.
Missing authorization in ILLID Share This Image WordPress plugin through version 2.12 allows unauthenticated remote attackers to access restricted functionality due to incorrectly configured access control, resulting in low-impact information disclosure. The vulnerability carries a moderate CVSS score of 5.3 but very low real-world exploitation probability (EPSS 0.02%, percentile 4%), suggesting this is a configuration or design flaw with limited practical impact rather than a critical security issue.
A code injection vulnerability in ILLID Advanced Woo Labels WordPress plugin (versions up to 2.36) allows authenticated administrators to execute arbitrary code through improper input validation, potentially leading to full site compromise. The vulnerability requires high privileges to exploit (CVSS 7.2), has no known active exploitation in the wild (not in CISA KEV), and carries a very low EPSS score of 0.00043 (0.043%), indicating minimal real-world exploitation likelihood despite the high CVSS score.
Server-Side Request Forgery in the ILLID Share This Image WordPress plugin (all versions through 2.14) allows unauthenticated remote attackers to induce the WordPress server to issue arbitrary HTTP requests to internal or external destinations, potentially exposing internal network topology and services. The scope-changed CVSS vector (S:C) confirms that exploitation can extend impact beyond the vulnerable WordPress instance to backend systems reachable by the server. No public exploit code has been identified and SSVC assessment classifies exploitation as none at time of analysis, placing real-world urgency below the raw CVSS 5.4 score suggests.
Missing authorization in ILLID Share This Image WordPress plugin through version 2.12 allows unauthenticated remote attackers to access restricted functionality due to incorrectly configured access control, resulting in low-impact information disclosure. The vulnerability carries a moderate CVSS score of 5.3 but very low real-world exploitation probability (EPSS 0.02%, percentile 4%), suggesting this is a configuration or design flaw with limited practical impact rather than a critical security issue.