PHP
Monthly
Unauthenticated SQL injection in the eLoanApp Platform's AJAX user-verification endpoint allows remote attackers to inject boolean- and time-based payloads into the POST parameter 'logina', enabling database engine discovery and query delays. The affected product is RDL Technologies eLoanApp Platform as represented by CPE cpe:2.3:a:rdl_technologies:eloanapp_platform:*:*:*:*:*:*:*:*, and the independent assessment scores this as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, meaning network-reachable, unauthenticated exploitation with low confidentiality, integrity, and availability impact rather than full compromise. No public exploit identified at time of analysis, and the practical risk is moderate because blind extraction is slow and noisy, making large-scale data theft time-consuming and more detectable than error-based injection.
Authenticated code execution via media upload in Kunstmaan CMS (KunstmaanBundlesCMS) before 7.3.2: the MediaBundle checks the file-extension blacklist case-sensitively but lowercases the extension before writing the file, so a backend user with media-upload rights can submit a file named e.g. webshell.pHp, slip past the blacklist, and have it stored as webshell.php inside the web-accessible media directory. Impact escalates to full remote code execution, but only where the web server is configured to execute scripts in public/uploads/media/ - the vendor's hardening guidance (disable script execution for that path, send X-Content-Type-Options: nosniff) removes the execution impact. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the flaw is gated behind a valid media-role account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.2).
TLS certificate verification is silently disabled in the PHP library maclof/kubernetes-client versions 0.17.0 through 0.31.x whenever a loaded kubeconfig omits certificate-authority-data but points at an https:// API server; the library's parseKubeconfig() and parseKubeconfigFile() helpers then ignore the user's insecure-skip-tls-verify setting and turn verification off. This only matters to an attacker who already holds an on-path/man-in-the-middle position between the client and the Kubernetes API server, from which they can impersonate the API server, harvest Bearer tokens or Basic credentials, and tamper with REST or WebSocket traffic. Exploitation is conditional rather than opportunistic - there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV does not list it); unaffected deployments are those whose kubeconfig supplies certificate-authority-data. The 9.1 CVSS score reflects the high confidentiality and integrity impact, but real-world urgency is lower than that number suggests because of the attack-position requirement and the fix available in 0.32.0.
ApiAdmin 5.0 and earlier allow any logged-in administrator to achieve remote code execution by uploading a .php payload to POST /admin/Index/upload; the handler takes the client-supplied extension verbatim with no whitelist, blacklist, or content inspection, and move_uploaded_file() places the file into the web-served public/upload/Ymd/ directory, where it can be requested directly over HTTP. The attack path is gated by an authenticated admin session (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2), so practical exposure hinges on credential compromise, reuse, or insider access rather than an unauthenticated vector. EPSS is low at 0.35% (26th percentile) and the issue is not listed in CISA KEV; no public exploit code is identified at time of analysis, though a public proof-of-concept write-up is referenced (GitHub fangtang7/CVE) and the European vulnerability entry EUVD-2026-92468 tracks the same CVE.
Remote code execution in WookTeam 1.6.6 and earlier lets an attacker inject arbitrary PHP into an eval() call reached through the task export API at /api/project/task/export, granting full server-side code execution. The CVSS 3.1 vector rates the flaw 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), i.e. unauthenticated and network-reachable with total impact, although the assessor cautions that project/task export routes commonly sit behind a login session, so a valid authenticated session or an otherwise exposed/mis-protected route may be the real prerequisite and the PR:N rating should be verified against WookTeam's auth middleware. Publicly available exploit code exists and SSVC rates the attack automatable with total technical impact, while EPSS remains low at 0.15% (4th percentile) - signals conflict on urgency, and overall risk is bounded mainly by WookTeam's limited deployment footprint rather than by exploit difficulty.
Authenticated users holding editor privileges on wcms through 3.18.0 can turn the media upload API into a remote code execution primitive: the [*:path] parameter of POST /api/v0/media/upload/ is not validated, so an editor can write .php files into a web-served location (including outside the media directory via encoded ../ sequences) and have the web server execute them. The same unvalidated path on DELETE /api/v0/media/[*:path] additionally allows arbitrary file deletion, and the underlying flaw is an unrestricted upload of a dangerous file type (CWE-434) rated CVSS 4.0 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H). Exploitation is not anonymous - a valid editor account is mandatory (PR:L) and code execution further depends on the written PHP landing in a directory the web server executes; at time of analysis there is no CISA KEV entry and no public exploit identified at time of analysis.
Unauthenticated arbitrary file deletion in the VikAppointments Services Booking Calendar WordPress plugin (all versions up to and including 1.2.21) lets a remote attacker specify a server file path that the plugin will remove without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, 9.1), which can escalate to full site takeover when a critical file such as wp-config.php is deleted. Exploitation is conditional: the site must have published at least one File-type custom field on the confirmation-page shortcode, a configuration that is not created by default during plugin installation, so stock deployments are not directly reachable. No public exploit code was identified and the issue is not listed in CISA KEV at time of analysis, but the low complexity and unauthenticated reachability make prompt patching important on any site that uses custom File-type booking fields. Reported by Wordfence via the CVE program.
Local file inclusion in the WPCafe restaurant menu, online ordering and table booking plugin for WordPress affects all versions up to and including 3.0.18, allowing an authenticated user with contributor-level privileges or higher to manipulate the template-scope parameter that the plugin passes into a PHP include, causing arbitrary local files on the server to be read or, under the right conditions, executed. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.5) confirms the low-privileged authenticated prerequisite, while the high attack complexity reflects a second precondition: to reach code execution the attacker must also be able to place a .php file on the server for the vulnerable include to pull in, making full RCE conditional rather than guaranteed. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so real-world risk is tempered by the need for a valid contributor account plus a separate file-placement primitive.
Stored cross-site scripting (XSS) in the Magic Tooltips For Contact Form 7 plugin for WordPress (versions up to and including 1.0.34) allows unauthenticated attackers to inject arbitrary JavaScript that executes in an administrator's browser when they view the comment moderation screen at wp-admin/edit-comments.php. The flaw exists because the plugin's esc_html filter callback decodes HTML-entity-encoded payloads (e.g., '<tip>') back into live HTML, so an entity-encoded script submitted as a comment author name bypasses sanitize_text_field and is rendered as executable markup. Exploitation requires the site to have comment submission enabled (WordPress default) and a privileged administrator to open the moderation queue; no public exploit code or active exploitation is identified at time of analysis, though the CVSS score of 7.2 (High) reflects the unauthenticated, network-based attack vector and scope change.
Arbitrary file read and deletion in Formwork panel versions before 2.3.13 affect authenticated users who hold backup download or backup delete permissions. Exploitation requires a Linux deployment, where PHP basename() fails to treat backslashes as directory separators, allowing a base64-encoded backslash-separated traversal payload to escape the configured backup directory. No public exploit code or CISA KEV confirmation was identified at time of analysis, and the impact is confined to file read and deletion with no code execution.
Unauthenticated, network-reachable denial of service in Apache Thrift's PHP bindings before 0.25.0 lets attackers crash a Thrift service by sending crafted serialized messages that trigger a stack-based buffer overflow during protocol parsing. The vendor-supplied CVSS 4.0 score of 8.7 reflects high availability impact with no confidentiality or integrity impact (VC:N/VI:N/VA:H) and no privileges or user interaction required (PR:N/UI:N), and the assessed CVSS 3.1 vector agrees (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No public exploit code or active exploitation has been identified at time of analysis, and the vendor scope bounds the consequence to service crash/denial of service rather than data disclosure or code execution.
Stack exhaustion in Apache Thrift before 0.25.0 allows remote, unauthenticated attackers to crash processes that deserialize attacker-controlled Thrift messages, because the protocol skip routine in several language bindings fails to apply the binding's recursion limit when skipping unknown fields. The affected bindings are the Python C++ accelerator (the pure-Python protocols are not affected), the PHP library and its thrift_protocol extension, and the Perl, Lua, Smalltalk and OCaml libraries; the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the bug is reachable over the network with no privileges or user interaction, but the impact metrics (VC:N/VI:N/VA:H) restrict the consequence to availability loss. There is no code execution or data exposure, no public exploit code and no confirmed active exploitation at time of analysis, and Apache has released version 0.25.0 which restores the recursion limit.
Denial of service in the PHP bindings of Apache Thrift before 0.25.0 allows unauthenticated remote attackers to exhaust process stack space and crash the parsing worker by supplying deeply nested or self-referential serialized Thrift messages. The flaw is an uncontrolled recursion (CWE-674) in the deserialization path, rated 8.2 High under CVSS 4.0 (AV:N/AC:L/AT:P/PR:N/UI:N/VA:H, with no confidentiality or integrity impact) and 8.2-equivalent High under the assessed CVSS 3.1 vector (A:H only), confirming that impact is confined to availability. Exploitation is not unconditional: the CVSS 4.0 AT:P attack-requirement flag reflects that the target service must actually accept and deserialize attacker-controllable Thrift payloads through the PHP bindings, so internal services processing only trusted, bounded data are not realistically exposed. There is no public exploit code and no confirmed active exploitation at time of analysis, and a vendor-released fix is available in Apache Thrift 0.25.0.
Denial of service in the Apache Thrift PHP bindings before version 0.25.0 allows unauthenticated remote attackers to exhaust server resources by sending crafted Thrift protocol messages that trigger inefficient algorithmic complexity (CWE-407). The vulnerability affects only applications that use the PHP bindings to deserialize untrusted Thrift input; other language bindings are unaffected. No public exploit code has been identified at the time of analysis, and the CVSS 4.0 AT:P metric indicates a specific attack precondition must be met, so exploitation is not guaranteed against every deployment.
Unauthenticated remote attackers can crash applications that use the Apache Thrift PHP bindings prior to version 0.25.0 by supplying crafted Thrift protocol messages that trigger a NULL pointer dereference (CWE-476). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates the flaw is remotely reachable with low complexity and requires no authentication or user interaction, but the impact profile is availability-only (VC:N/VI:N/VA:H) - there is no confidentiality or integrity exposure, so the 8.7 score reflects a pure denial-of-service outcome rather than code execution. Exploitation is conditional on the target PHP service actually accepting and deserializing attacker-controlled Thrift input, and no public exploit code has been identified at time of analysis. A vendor patch is available in Apache Thrift 0.25.0, which per the advisory fixes the issue.
Unrestricted file upload in YesWiki before 4.6.7 lets a remote attacker who already holds an administrator account turn a crafted Bazar CSV import into server-side code execution: the import preview fetches a remote .php URL referenced in a file or image field and writes it into the web-accessible files/ directory with no extension or MIME validation, where PHP then executes it. The issue is a classic CWE-434 flaw rated CVSS 8.6 (CVSS:4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H), and because it requires a high-privilege account plus the Bazar component in use, it is best characterized as a privilege-escalation-to-RCE path rather than an unauthenticated remote compromise. No public exploit was identified at time of analysis, and there is no CISA KEV listing; vendor patching is available in YesWiki 4.6.7.
Session fixation in YesWiki before 4.6.7 allows an attacker who can set or learn a victim's pre-authentication YesWiki-* session cookie to reuse that same session after the victim logs in, gaining access to private content and performing actions with the victim's privileges. The root cause is CWE-384: the AuthController login logic authenticates the user without regenerating the PHP session ID, so the pre-login identifier stays valid after authentication. Exploitation is conditional rather than trivial - it requires the attacker to first control the cookie and the victim to subsequently complete a login (CVSS 4.0 7.6 with AC:H/AT:P; independently assessed as CVSS 3.1 AV:N/AC:H/PR:N/UI:R, C:H/I:H/A:N), and no public exploit code has been identified at time of analysis. The vendor has released 4.6.7, which regenerates the session ID on login and removes the condition.
Blind SQL injection in YesWiki before 4.6.7 allows unauthenticated remote attackers to read arbitrary database contents, including administrator password hashes from the yeswiki_users table, by planting a crafted option id in an anonymously editable Bazar list and then using {{newtextsearch}} requests as a boolean oracle. Successful exploitation depends on the deployment actually permitting anonymous editing of a Bazar list, and because the technique is blind, extraction is slow and noisy rather than a single-shot dump. Vendor severity is 8.7 (CVSS 4.0, AV:N/AC:L/PR:N/UI:N); our independent assessment, based on CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, confirms a high-confidentiality, no-integrity, no-availability impact with no authentication or user interaction required, and no public exploit code identified at time of analysis, with no evidence of confirmed active exploitation (CISA KEV).
Stored cross-site scripting in YesWiki before 4.6.7 lets unauthenticated attackers append raw HTML or JavaScript to any wiki page-including pages protected by write ACLs-by POSTing pagetag, title, and description fields to the {{pointimage}} action handler. Exploitation requires that the target instance have at least one page rendering {{pointimage}}, and the injected payload executes only when a victim, most damagingly an administrator, views the poisoned page. The vendor has released a patch in 4.6.7, and no public exploit code has been identified at time of analysis.
Unauthenticated user enumeration in YesWiki before 4.6.7 allows remote attackers to confirm registered email addresses by observing differing responses from the MotDePassePerdu lost-password recovery endpoint, which lacks rate limiting. This CWE-204 information disclosure does not expose credentials or account contents but enables targeted phishing and password-spraying campaigns. No public exploit code has been identified at time of analysis, and the vendor has released a patch in version 4.6.7.
An uncaught exception (CWE-248) in Apache Thrift's PHP language bindings before 0.25.0 allows unauthenticated remote attackers to terminate PHP processes that accept arbitrary Thrift protocol input, producing a denial of service with no confidentiality or integrity impact. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) means no privileges or user interaction are required against a default deployment that exposes a vulnerable PHP-based Thrift endpoint to untrusted network traffic; the practical prerequisite is that the target actually uses the PHP bindings rather than another language binding. No public exploit code and no confirmed active exploitation were identified at time of analysis, and exploitation potential is bounded to service availability - this is a genuine but limited availability risk rather than a data-breach emergency.
Denial of service in the Apache Thrift PHP bindings before 0.25.0 allows unauthenticated remote attackers who can reach a Thrift service built on those bindings to exhaust server resources via unbounded allocation. The flaw is CWE-770 (allocation of resources without limits or throttling), triggered when the PHP binding processes attacker-controllable message sizes or collections without a cap; impact is limited to availability (VA:H; VC:N/VI:N), meaning no data disclosure or code execution. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), so risk is highest for externally reachable Thrift endpoints that accept untrusted clients. Vendor-released patch: 0.25.0.
Denial of service in Apache Thrift before 0.25.0 allows unauthenticated remote attackers to crash or exhaust services running affected language bindings by sending malformed Thrift protocol data. The flaw combines improper length-parameter handling with excessive memory allocation, inefficient algorithmic complexity, uncaught exceptions, and insecure default initialization across the Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP, and D bindings. It is availability-only: no code execution, data disclosure, or data tampering is known from this issue. No public exploit code or confirmed active exploitation was identified at time of analysis; upgrading to 0.25.0 resolves it.
Denial of service in the Apache Thrift PHP bindings before version 0.25.0 lets remote, unauthenticated attackers exhaust CPU and memory on a Thrift-serving PHP application by sending a crafted Thrift message whose declared quantity is never validated. Per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, vendor CVSS 4.0 base 8.7), the weakness is availability-only: there is no code execution, data exposure, or integrity impact, and only deployments that use the PHP bindings to parse untrusted Thrift input over the network are exposed. No public exploit code or confirmed active exploitation (no CISA KEV listing) was identified at time of analysis, and no EPSS score was supplied; non-PHP Thrift bindings are out of scope for this issue.
Authentication bypass in the WordPress plugin JSON API Auth (all versions up to and including 3.1.2) lets unauthenticated remote attackers harvest a live Administrator logged_in cookie from a cached JSON response and use it to take over the site. The underlying defect sits in the required PI-Media/json-api parent plugin, whose controller-dispatch transient cache is keyed only by URI and query string with HTTP method and POST body ignored, so the authenticated /api/auth/generate_auth_cookie/ response - which embeds a wp_generate_auth_cookie() session cookie directly in its JSON body - is replayed to any subsequent unauthenticated GET, with the plugin's nominal HTTPS enforcement trivially defeated by passing insecure=cool. Our independent assessment keeps the full confidentiality and integrity impact of the vendor vector but treats the access complexity as High (base 8.1 rather than 9.8) because exploitation is opportunistic and conditional: both plugins must be installed and active with the Auth controller enabled, and a legitimate Administrator must have POSTed to the cookie-generation endpoint within the preceding 24-hour transient TTL; no public exploit identified at time of analysis.
Stored cross-site scripting in Smash Balloon's Social Post Feed / Custom Facebook Feed plugin for WordPress, in all versions up to and including 4.13.0, allows an unauthenticated attacker who merely holds a Facebook account to plant a malicious comment message on the connected Facebook Page, which the plugin ingests and later renders with the Vue v-html directive in the administrator-facing feed builder preview. Because the preview template uses v-show instead of v-if, the injected HTML - including onerror handlers - is evaluated in the DOM even when the comments area is not visually displayed, so the script executes as soon as an administrator opens the builder preview page; chained with the missing URL validation in the cff_install_addon AJAX handler, that script can coerce the admin session into installing a plugin from an attacker-controlled URL, potentially yielding server-side code execution. No public exploit code is identified at time of analysis, and real-world urgency is moderate because exploitation depends on a non-universal configuration (a connected public Facebook Page with comments ingested) and on an administrator actually loading the preview page.
Unauthenticated denial of service in the OMGF WordPress plugin before 6.3.11 allows remote attackers to invoke an action that issues a slow server-side loopback request, exhausting the site's PHP worker pool and potentially making the entire site unavailable. The affected action requires neither authentication nor a valid nonce, so no login or user interaction is needed on a default install. No public exploit identified at time of analysis, and a vendor patch (6.3.11) is available per the advisory.
Local file inclusion in the SiteOrigin Widgets Bundle WordPress plugin, in all versions up to and including 1.73.2, lets authenticated attackers with contributor-level access or higher (PR:L per the assessed vector) include and execute server-side .php files, bypassing access controls and exposing sensitive data; full attacker-controlled code execution is conditional on also having a way to place a .php file on the server that can then be included. The flaw is reached remotely by POSTing a crafted widgetData payload containing a legacy top-level 'theme' key together with a non-empty 'columns' array to the /wp-json/sowb/v1/widgets/previews REST endpoint, a structure that slips past validation because update_fields() only processes declared form fields. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the low privilege bar (any contributor account) and the fact that the vulnerable endpoint is REST-reachable without UI interaction make this a conditional priority rather than a drop-everything emergency.
Code injection in CTX Feed Pro (WooCommerce Product Feed Pro by Webappick) versions up to and including 7.6.12 allows an authenticated attacker with Administrator-level privileges to execute arbitrary PHP code on the server by supplying malicious input to the plugin's 'Feed Config' field, which is passed unsanitized to PHP's eval(). The vulnerability is not exploitable by anonymous or low-privileged users because it requires Administrator access, making the realistic threat model a stolen or malicious admin account or a multi-admin environment where a lower-trust admin should not have code-execution rights. No public exploit identified at time of analysis, and no confirmed active exploitation was reported.
SQL injection in ClipBucket v5 (all versions through 5.5.3-#197) allows an authenticated user who holds the ad_manager_access permission to inject arbitrary SQL through the delete parameter in admin_area/ads_manager.php, which is concatenated unsanitized into the AdsManager::DeleteAd DELETE statement against the ads_data table. A successful attacker can run time-based blind payloads to extract user credentials and email addresses, or directly modify and delete arbitrary records, giving high confidentiality and integrity impact on the application database. Publicly available exploit code exists (a published HackMD write-up), and while the flaw is remotely reachable it is gated behind a privileged admin-area role, so real-world exposure is limited to deployments that hand ad-manager rights to additional or semi-trusted users; no confirmed active exploitation (CISA KEV) has been reported, and an upstream fix is available as a pull request.
PictShare versions before 3.7.1 generate the per-file delete_code authorization token using PHP's non-cryptographic rand() PRNG, allowing an attacker who knows a hosted file's hash to predict or infer valid delete codes and delete other users' uploads without authorization. The vulnerability is remotely reachable and requires no authentication or user interaction (CVSS:4.0 AV:N/PR:N/UI:N), but exploitation is constrained by HIGH attack complexity (AC:H) because the attacker must reconstruct the PRNG state; the resulting impact is availability-only (VA:H) and grants no data disclosure. No public exploit code was identified at time of analysis and there is no CISA KEV listing; vendor-released patch: 3.7.1.
Stored cross-site scripting in GetSimple CMS CE 3.3.22 and earlier allows an authenticated attacker to inject persistent JavaScript that executes in an administrator's browser session when the affected admin page renders. The flaw resides in the 'Theme to Components' feature (admin/components.php), where a component title is HTML-entity-decoded and then printed inside a double-quoted HTML attribute without re-encoding, enabling attribute breakout. Publicly available exploit code exists (SSVC exploitation: poc), and no vendor-released patch was identified at time of analysis; the independent assessment rates the issue as requiring low privileges (PR:L) and user interaction (UI:R), with scope change and low confidentiality/integrity impact.
Stored local file inclusion in GetSimple CMS CE 3.3.22 and earlier lets any authenticated account holding page-editing rights save an arbitrary filesystem path into a page's template attribute, which the public front-end then passes unsanitized to PHP include() whenever that page is requested - including by anonymous visitors. The payoff is disclosure of any readable local file and, if the included target contains PHP (a log, an uploaded file, or attacker-planted content), code execution in the web server's context. Publicly available exploit code exists and no vendor-released patch was identified at time of analysis; the main limiting factor is that the attacker must first possess a legitimate page-editing account, which keeps this a real but conditional risk rather than an unauthenticated emergency.
Stored cross-site scripting in GetSimple CMS CE 3.3.22 and earlier lets an authenticated user with page-editing rights plant JavaScript in a page's Keywords, Description, Menu text or Content, which then executes in the browser of any administrator who later opens that page's backup in the admin control panel (admin/backup-edit.php). Exploitation requires two combined conditions - a valid page-editing account and an administrator voluntarily viewing the affected backup - so it is not attacker-triggered, and the impact is confined to the admin control-panel browser context; no public exploit code has been identified at time of analysis and no vendor patch is currently available. The supplied CVSS 4.0 score of 8.8 appears inflated and inconsistent with the described prerequisites (our assessment is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, roughly 5.4), and there is no evidence of active exploitation.
Remote code execution in GetSimple CMS CE prior to 1.5 allows an attacker to plant and execute PHP code as the web-server user by getting the UpdateCE.php handler to process a malicious ZIP archive. The handler extracts archive contents into the web-accessible root without validating file types or paths, so PHP webshells and ../ traversal writes are possible; publicly available exploit code exists, and SSVC rates it not automatable. Exploitation is high impact (CVSS 9.1) but constrained by the need to trigger the update through an administrator session or high existing privileges, so it is not mass-exploitable; version 1.5 contains the fix.
Administrator account takeover in GetSimple CMS CE 3.3.22 is achievable because the password reset endpoint is reachable without authentication and, on a reset request for an existing user, immediately writes a hash of a newly generated temporary password that was produced by PHP rand() seeded with microtime(). The time-bounded seed leaves a limited effective candidate space, and because the admin login endpoint enforces neither rate limiting nor account lockout (independent assessment: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), an unauthenticated remote attacker who knows or enumerates a valid username can generate candidate passwords and test them online until the correct one is found. Exploitation hinges on predicting or narrowing the PRNG value for the reset moment and sustaining enough login attempts, and it is self-defeating in stealth terms because submitting the reset silently overwrites the legitimate administrator's password; no public exploit code was identified at time of analysis and no vendor-released patch exists, though this is a genuine high-priority issue despite the absence of exploitation telemetry.
Authenticated path traversal in Vvveb CMS prior to version 1.0.8.6 allows an admin-panel user with backup access (default role site_admin or higher) to read and delete arbitrary files on the server, enabling database credential theft from config/db.php, disclosure of host files such as /etc/passwd, and site takeover by deleting the database configuration to force the installer back into setup mode. The vulnerability sits in the central path sanitizer used by the backup/file functionality and is reachable only with the high privilege level reflected in its CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H); no public exploit code has been identified at time of analysis. The vendor released a patch in 1.0.8.6 that adds recursive filtering to sanitizeFileName(), so unpatched instances below that version remain exposed.
Authenticated WordPress administrators using the Prime Mover migration plugin before version 2.2.1 can abuse a Zip Slip path traversal (CWE-22) to write attacker-controlled files to arbitrary filesystem locations outside the intended extraction directory, which may escalate to remote code execution when the written path is PHP-executable by the web server. The flaw is reached through the plugin's migration ZIP import workflow, where malicious ZIP entry names are processed by computeExtractionParameters() and resumableZipExtractor() in utilities/PrimeMoverSystemCheckUtilities.php. Exploitation requires a high-privileged admin account (CVSS PR:H, AV:N, UI:N) and crafted archive contents; no public exploit code was identified at time of analysis, and the vendor has released a patch. The risk is genuine but access-gated, since the admin prerequisite is the primary limiting factor and full RCE additionally depends on the hosting configuration.
PHP object injection in the Icegram WordPress plugin through version 3.1.31 allows an authenticated attacker holding only low-level (Contributor-equivalent) privileges to pass crafted serialized data into an unsafe PHP deserialization path, with the potential to trigger a gadget chain that yields high confidentiality, integrity, and availability impact. The flaw is network-reachable, low complexity, and requires no victim interaction (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), and because the vulnerable component is a widely deployable WordPress plugin, any site allowing self-service or delegated content roles expands its exposure surface. No public exploit code has been identified at time of analysis, and there is no CISA KEV listing for this CVE; exploitation depends on an attacker first obtaining a low-privileged account on the target site.
PHP object injection in the Hide Shipping Method For WooCommerce plugin (versions up to and including 1.5.4) allows an authenticated user with Editor-level or higher privileges to trigger deserialization of untrusted data on WordPress sites that also run WooCommerce, potentially leading to remote code execution, arbitrary file access, or data manipulation if a suitable gadget chain exists in the plugin, core, or other installed components. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, score 7.2) confirms the attack is network-reachable and requires no user interaction, but the high privilege prerequisite substantially limits exposure. No public exploit identified at time of analysis, no confirmed in-the-wild exploitation, and no fixed plugin version is listed in the available Patchstack advisory.
Authenticated, high-privilege users of Pandora FMS 777 and later can upload arbitrary .phar files through the console's File Manager module and have them executed as PHP on the server, because the module's extension blacklist does not block PHP archive files. Successful exploitation yields full loss of confidentiality, integrity and availability of the Pandora FMS application (CVSS 4.0 base 8.6, High; core vector AV:N/AC:L/AT:N/PR:H/UI:N with VC:H/VI:H/VA:H and no scope change, where the headline score is inflated by the vendor's AU/R/RE/U threat and environmental modifiers). Exploitation requires an authenticated console session with access to the File Manager (PR:H) and no user interaction; no public exploit code or confirmed active exploitation was identified at time of analysis, and the main exposure limiter is the privileged authentication prerequisite.
Arbitrary PHP code execution is achievable in Pandora FMS version 777 and later by chaining a CSRF-protection bypass with an unrestricted file upload in the Plugin File Manager, allowing an attacker to place and execute a malicious PHP payload on the server. Attackers do not need credentials of their own (CVSS PR:N), but exploitation is not a fire-and-forget network attack: it requires a specific attack condition to hold (AT:P) and a logged-in Pandora FMS administrator to interact with the forged request (UI:A), meaning the victim must be socially engineered into triggering it from an authenticated console session. Successful exploitation yields full confidentiality, integrity, and availability impact on the affected instance; no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated WordPress users with only Subscriber-level access can recursively delete arbitrary files and directories - up to and including the entire WordPress installation - on any site running the Super Forms - Drag & Drop Form Builder plugin version 6.3.316 or earlier. Because the super_save_form AJAX handler performs no capability check, a low-privileged attacker can first enable the file_upload_submission_delete setting for the form and then pass an unsanitized subdir value through super_submit_form into SUPER_Common::delete_dir(), with a trivially bypassed ABSPATH guard allowing deletion of wp-config.php and other critical files at the site root. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); however, the low privilege bar (sites with open registration are effectively exposed to anyone) and the destructive, site-wide impact make this a genuinely high-priority vulnerability rather than a CVSS-inflated paper risk.
MISP (Malware Information Sharing Platform) versions before v2.5.48 accept the same TOTP one-time code more than once, allowing a captured second-factor code to be replayed to open an additional authenticated session. The flaw is a CWE-294 capture-replay weakness: the login flow never recorded that a given TOTP time-step had already been consumed, so a code remained usable for its entire ~30-second validity window. Exploitation is conditional rather than drive-by - the targeted user must have TOTP enabled, the attacker must be able to observe or intercept the live code (network interception, shoulder surfing, or a compromised client) and in practice also hold the first-factor credentials, and the replay must land inside the same TOTP period; the vendor has released a fix in v2.5.48, and no public exploit code has been identified at time of analysis.
Second-factor authentication bypass in MISP versions before 2.5.48 lets an attacker who already holds a session past the password step and a copy of the HOTP paper-token list replay a previously consumed HOTP token, because the OTP check compared the submitted token against a counter cached in the user's session rather than the authoritative database counter; the stale cached value still matches the burned token, yielding a second successful login and rewinding the counter state. Exploitation is not anonymous: it requires an authenticated session (PR:L per the assessed vector, implying prior password compromise), HOTP paper-token 2FA explicitly enabled on the target account, and knowledge of at least one valid token value, per the assessed CVSS:3.1 vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N (vendor CVSS 4.0 score 7.6, High). No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in MISP 2.5.48 by commit f34aee2c7.
Stored cross-site scripting in the AI Engine - The Chatbot, AI Framework & MCP for WordPress plugin (versions up to and including 3.8.0) lets an unauthenticated attacker plant script payloads that execute in a WordPress site's admin dashboard. The attack chains a denylist bypass on the /mwai-ui/v1/chats/submit REST endpoint into the plugin's own PHP error-log parser, which returns the forged log line as recent PHP-error content that the Advisor task then feeds verbatim into the AI prompt (CWE-1427 indirect prompt injection); the unvalidated AI response is saved to the mwai_advisor_data option and rendered by the Advisor dashboard widget without escaping. Exploitation is conditional - the Advisor task, its error-log ingestion, and the non-streaming/non-admin catch branch must all be in play, and the payload only fires when an authenticated administrator opens the dashboard and the Advisor widget renders - which is why the independent assessment scores it UI:R despite the PR:N injection path; no public exploit code has been identified at time of analysis and there is no CISA KEV listing.
PHP object injection in the ThemeHigh 'Extra Product Options For WooCommerce | Custom Product Addons and Fields' plugin through version 3.3.8 allows an authenticated user holding the WooCommerce shop_manager role or higher to pass a crafted serialized payload into a deserialization sink, enabling arbitrary PHP object instantiation that can escalate to code execution or data tampering if a usable gadget chain exists in the surrounding WordPress/WooCommerce stack. The issue is rated CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting high impact but a high-privilege, backend-only prerequisite rather than unauthenticated exposure. There is no public exploit identified at time of analysis, and the plugin has not been confirmed as exploited in the wild; exploitation additionally requires WooCommerce to be installed and active and the plugin to remain at a vulnerable version.
PHP object injection in the Photo Gallery by 10Web WordPress plugin (versions up to and including 1.8.46) allows an authenticated user with Contributor-level privileges to pass crafted serialized data into a plugin code path that calls unserialize(), which under CVSS 3.1 scores 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Successful exploitation can corrupt or disclose data and, if a usable PHP gadget chain exists in the plugin, WordPress core, or another active plugin, can escalate to arbitrary code execution on the web server; no user interaction is required once the low-privileged account exists. At the time of analysis there is no CISA KEV listing and no public exploit code identified, and authentication as Contributor or higher is a firm prerequisite, so exposure is concentrated on sites that grant Contributor+ roles to untrusted users or leave open registration enabled.
PHP object injection in the WordPress plugin Nested Pages (wp-nested-pages, by Hook & Filter) in versions up to and including 3.3.2 lets an attacker who holds at least a Contributor-level account on the affected site submit crafted serialized data that is passed to PHP's unserialization logic, which can lead to arbitrary object instantiation and, where a usable POP gadget chain exists, to code execution, data theft, or full site compromise. The reported base score of 9.8 (AV:N/AC:L/PR:N/UI:N) is inconsistent with the vendor's own 'Contributor PHP Object Injection' designation; the authoritative assessment re-scores the issue as AV:N/AC:H/PR:L/UI:N, reflecting that a low-privileged authenticated WordPress account is a hard prerequisite and that RCE depends on gadget availability rather than being guaranteed. No public exploit code was identified at time of analysis and there is no CISA KEV listing, so this is not confirmed as actively exploited; exploitation is realistically limited to sites where open registration or loosely managed Contributor accounts give an outsider a foothold.
PHP object injection in the Schema & Structured Data for WP & AMP plugin (all versions up to and including 1.66) lets an authenticated attacker with a Contributor-level WordPress account feed crafted serialized input into a plugin deserialization path, and the vendor's CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High) rates that as low-complexity, network-reachable and capable of full confidentiality, integrity and availability impact once a usable POP gadget chain is available in the plugin, WordPress core or another installed component. Authentication is mandatory and there is no unauthenticated route, but no user interaction is required after the attacker holds a qualifying account; the practical exposure therefore depends on whether the site permits open registration or loosely manages Contributor roles. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so the primary risk is post-authentication privilege escalation rather than opportunistic mass exploitation.
PHP object injection in Page Builder by SiteOrigin (siteorigin-panels) version 2.36.0 and earlier allows an authenticated WordPress user holding high privileges - an Administrator or the Editor-level role implied by the advisory - to supply crafted, serialized content through the page-builder editor that the plugin then deserializes, yielding high confidentiality, integrity and availability impact (CVSS 3.1 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Because the flaw is a CWE-502 deserialization issue, weaponization into full remote code execution depends on a usable PHP POP gadget chain being present in the plugin, WordPress core, or another installed component, so the practical worst case is conditional rather than guaranteed. There is currently no evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but the high-privilege authentication prerequisite is the main barrier to mass abuse, not the technical difficulty - low-privilege or anonymous users cannot reach it.
Unauthenticated remote attackers who can reach a yii2-starter-kit deployment (through version 4.2.0) running with its default development configuration can read sensitive runtime data and write arbitrary PHP files. The dev profile sets the Yii debug and Gii modules' allowedIPs to ['*'] in common/config/web.php, so the debug endpoint leaks session cookies and executed database queries (C:H) while the Gii code generator can be abused to create attacker-controlled PHP in the application directory (I:H), a practical path to remote code execution. Exploitation requires the application to be network-exposed while still running the development/staging configuration; a properly hardened production deployment restricts allowedIPs (typically to localhost). No public exploit identified at time of analysis, and the issue is not in CISA KEV; EPSS data was not supplied.
Authenticated users holding the backend 'manager' role in yii2-starter-kit through 4.2.0 can upload PHP scripts through the backend file-storage upload action and then request them from the web-accessible storage directory, achieving remote code execution as the web server user. The defect is an unrestricted file upload (CWE-434) with a CVSS 4.0 base score of 8.7 (PR:L, fully consistent with the assessed CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): exploitation is gated on manager-level authentication, on the backend file-storage module being enabled and reachable, and on the storage directory being served without script-execution restrictions, which is the default starter-kit layout. No public exploit code identified at time of analysis, and the practical priority is tempered by the authentication prerequisite and the niche footprint of the product, though the impact is total for any live deployment that meets those preconditions.
Unauthenticated remote code execution in OrdaSoft Joomla CCK (all versions below 8.3.16) lets any remote attacker who can reach the component's frontend upload and execute arbitrary PHP, resulting in full compromise of the Joomla site - the CVSS 4.0 base score is 10.0 and the independent CVSS 3.1 assessment is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The upload endpoint site/uploader.php is reachable through the component's normal frontend routing via task=getContent with no authentication or ACL check anywhere in the dispatch chain, and the shipped source has its file-extension allow-list commented out, so an image/PHP polyglot carrying an attacker-chosen .php extension passes the magic-byte MIME check and is written to an executable path under the Joomla web root. Exploitation requires no privileges, no user interaction, and no non-default configuration - only that the extension be installed and its frontend be web-reachable; the supplied CVSS v4.0 vector carries E:A (Exploit Maturity: Attacked), although no CISA KEV entry was supplied in the available intelligence, so that metric is the sole exploitation signal available here.
Unauthenticated SQL injection in the JCTables extension for Joomla (joomcode.com) through version 1.21.1 lets any remote attacker read and write arbitrary database content, because the extension's front-end CRUD API controller performs neither a Joomla token check nor any authentication check on any task. Table names, column names and values are taken directly from request parameters and concatenated into SQL, so a default install with the extension's front-end endpoint reachable is exploitable by an unauthenticated attacker with no user interaction and no non-default configuration (CVSS 4.0 base 10.0; our independent assessment concurs this is a top-tier priority rather than a high-score/low-risk case). Exposure is limited to Joomla sites that actually have this specific third-party extension installed, and no confirmed public exploit code was identified in the available intelligence at time of analysis, although public research describing a read/write SQLi-to-RCE chain has been published.
Blind SQL injection in WPTasty Business Directory plugin versions through 6.4.27 allows an authenticated attacker with high privileges to infer database contents without direct query output, using boolean- or time-based inference. The CVSS vector indicates network exploitability, no user interaction, and high confidentiality impact, but the PR:H requirement means the attacker must already hold a privileged WordPress account, so this is a plausible but not urgent priority. No public exploit has been identified at time of analysis, and KEV status is not indicated.
Reflected cross-site scripting in the Ultimate Maps by Supsystic WordPress plugin (all versions through 1.5.5) lets remote, unauthenticated attackers execute arbitrary JavaScript in the browser of any user who is socially engineered into clicking an attacker-crafted link. The flaw is an output-encoding failure of class CWE-79 rated CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L); the attacker needs no credentials, but a victim with an active session on an affected site must be lured to the malicious page, and the resulting script runs in that site's origin. Impact is bounded to the browser context - script execution, possible session/token theft or content manipulation on the affected site - and does not by itself grant server-side code execution; there is no public exploit identified at time of analysis and no CISA KEV record for this CVE.
Unauthenticated cross-site scripting in the Easy Google Maps WordPress plugin (Supsystic, versions up to and including 1.14.6) allows remote attackers to inject and execute arbitrary script in a victim's browser session on any site where the plugin is installed and active. Exploitation requires the victim to interact - typically by clicking a crafted link or visiting an attacker-influenced page (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) - and the advisory does not disclose the specific vulnerable parameter or sink, which limits precise targeting but not the underlying flaw. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so this is a genuine but moderate-priority issue rather than an urgent one; impact escalates materially only when the interacting victim holds elevated privileges such as an administrator, where a single successful injection can lead to full site compromise.
Unauthenticated cross-site scripting in the WordPress plugin Ninja Forms (versions 3.15.3 and earlier) allows a remote attacker to have crafted script content rendered in a victim's browser session, with a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Exploitation requires the attacker to induce a victim - typically a logged-in administrator or a site visitor - to click a crafted link or load a malicious page, since the vector mandates user interaction (UI:R); no credentials are required (PR:N). Impact is confined to the victim's browser context (C:L/I:L/A:L) rather than server compromise, and no public exploit code or confirmed active exploitation was identified in the available data; the Patchstack report is the sole intelligence source provided, and the exact vulnerable parameter or endpoint is not specified, which limits precise targeting by defenders or attackers.
Reflected cross-site scripting in the If-So Dynamic Content Personalization plugin for WordPress (versions up to and including 1.10.1) lets unauthenticated remote attackers inject and execute arbitrary JavaScript in a victim's browser session. Exploitation is conditional on victim interaction - an administrator or site visitor must click a crafted link or load an attacker-influenced page - so there is no server-side compromise without that step; the assessed CVSS 3.1 score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). There is no CISA KEV listing and no public exploit identified at time of analysis, so this is a moderate-severity, broadly applicable WordPress plugin risk rather than a confirmed active campaign.
SQL injection in the WordPress plugin Media Library Assistant (version 3.41 and earlier) allows an authenticated Contributor-level account to inject arbitrary SQL into the plugin's media/attachment query handling, reading database content such as user password hashes, private or draft posts, and stored configuration secrets. The issue is remotely exploitable with low complexity and no user interaction, and the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) yields a base score of 8.5 (High), reflecting confidentiality-only impact plus a scope change that lets the injection reach tables outside the plugin itself. There is no public exploit identified at time of analysis and no CISA KEV entry, so the practical barrier to abuse is obtaining a Contributor account - realistic on sites with open registration, multi-author blogs, or guest-post/membership setups, but not on locked-down single-admin installs.
Reflected cross-site scripting in the WordPress plugin Quiz And Survey Master (slug quiz-master-next) through version 11.2.6 allows unauthenticated attackers to inject script that executes in a victim's browser after the victim clicks a crafted link or submits attacker-controlled input that the plugin then reflects. The issue is scored CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and independent assessment characterizes it as a genuine but moderate-priority web vulnerability: per the assessed vector, no authentication is required but successful exploitation depends on user interaction, and impact stays within the victim's browser/site security context rather than yielding direct server compromise. Risk is elevated when the lured victim is an authenticated administrator, because the injected script then runs with that user's privileges; no public exploit identified at time of analysis, and no KEV listing or product-specific EPSS estimate was supplied.
Authenticated SQL injection in the Event Tickets WordPress plugin through version 5.29.5 allows any account holding the Contributor role to inject arbitrary SQL through plugin-supplied input, giving read access to data well beyond what the plugin itself stores (CVSS 3.1: 8.5, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L). The practical barrier is the Contributor authentication requirement, which limits mass exploitation but is trivially satisfied on sites with open registration or large numbers of low-trust contributors; the Scope:Changed rating reflects that successful injection can expose the broader WordPress database, not just plugin tables. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has not published a fixed version in the available data, so this is a genuine mid-to-high priority issue rather than an emergency.
The miniOrange 'OAuth Single Sign On - SSO (OAuth Client)' WordPress plugin, versions 7.1.2 and earlier, can be tricked into accepting a spoofed identity during the OAuth/SSO login flow, letting a remote attacker bypass authentication and obtain a fully privileged WordPress session on any site that deploys the plugin's SSO login feature. The flaw is rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is remote and unauthenticated with no user interaction required, and successful abuse yields high confidentiality, integrity and availability impact across the site. At time of analysis there is no public exploit identified and the issue is not listed as confirmed actively exploited (CISA KEV); no EPSS score was supplied, but the critical severity and unauthenticated nature warrant urgent prioritisation for sites that have the plugin active and the SSO login endpoint reachable.
Unauthenticated cross-site scripting in Premmerce Permalink Manager for WooCommerce (versions 2.3.13 and earlier) allows remote attackers to inject script that executes in the context of a victim's browser when the crafted content is rendered. Because the CVSS vector carries PR:N with UI:R, no attacker credentials are required, but successful exploitation depends on a victim - typically a logged-in WordPress administrator - interacting with the attacker-influenced page, which is the primary limiting factor; the S:C scope-change flag means the injected script runs in a different security context (the admin session/browser) than the vulnerable plugin itself. No public exploit code or confirmed active exploitation was identified at time of analysis, and the site must be running WooCommerce with this specific plugin installed and active for exposure.
Unauthenticated cross-site scripting in the WPFunnels WordPress plugin at versions 3.13.1 and earlier allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser within the target site's origin once the victim loads or clicks a crafted link or request. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) confirms no authentication is required but that victim interaction is necessary, and the Changed scope means the injected script can affect resources beyond the vulnerable plugin while confidentiality, integrity, and availability impacts remain partial. No public exploit code and no active exploitation were identified at time of analysis, and the provided intelligence contains no CISA KEV listing and no EPSS score.
Reflected cross-site scripting in the Kreatura LayerSlider WordPress plugin (versions through 8.4.0) allows an unauthenticated remote attacker to inject script into a page response by luring a victim to a crafted URL that carries malicious input in a plugin request parameter; the payload is reflected back without proper output encoding. Because the CVSS vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, exploitation does not require authentication on the attacker's side but does require victim interaction (a click on the attacker-supplied link), and impact is confined to the victim's browser session within the target site's origin rather than the server. There is no public exploit identified at time of analysis and no CISA KEV listing, and the plugin is widely deployed across WordPress sites, so the practical risk lies in mass opportunistic scanning and targeted phishing rather than confirmed active exploitation.
Unauthenticated cross-site scripting in the WordPress Geo Mashup plugin affects all versions up to and including 1.13.21, allowing a remote attacker who can convince a logged-in or visiting user to follow a crafted link or submit crafted input to execute arbitrary script in that user's browser context. No authentication is required to reach the vulnerable code (CVSS vector PR:N), and the scope change (S:C) means injected script can act against the wider WordPress site rather than just the vulnerable plugin component, though exploitation is not autonomous because it depends on victim interaction (UI:R). No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the plugin's relatively niche deployment footprint plus the required social-engineering step are the main practical limiters on real-world risk.
Unauthenticated PHP object injection (CWE-502) in the WordPress plugin Booking Activities, affecting versions through 1.18.7.1, allows remote attackers to reach plugin endpoints and pass attacker-controlled data into PHP unserialize() with no authentication or user interaction required (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N). Potential impact includes code execution, file read/write, or denial of service, but real-world severity depends on the presence of a usable POP gadget chain in the plugin, WordPress core, or another loaded plugin/theme. No public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated path traversal in the WordPress Creator LMS plugin (WPFunnels) affects all versions up to and including 1.2.19 and allows a user holding only Contributor-level privileges to manipulate file paths and reach files outside the intended directory, primarily exposing sensitive data with limited integrity and availability effects. Exploitation requires a valid low-privilege account - self-registration must be enabled or an account otherwise obtained - and is rated high complexity (AC:H), meaning success depends on specific, not-guaranteed conditions; the issue is remote, needs no user interaction, and no public exploit has been identified at time of analysis. It is not confirmed actively exploited (no CISA KEV listing), and while the vendor-supplied CVSS of 7.5 and the scorer's high confidentiality/integrity/availability ratings read alarming, the practical risk is moderate because the attack is gated behind an authenticated Contributor role and elevated complexity.
Unauthenticated sensitive data exposure in the WordPress plugin BackupEase through version 2.2.2 lets any remote, network-reachable visitor retrieve information the plugin was never intended to expose, with confidentiality impact rated High and no integrity or availability effect (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N). Because the vector carries PR:N and UI:N, no account, credential, or victim interaction is required - the only prerequisite is that the plugin be installed at an affected version and its vulnerable endpoint reachable over HTTP(S). There is no public exploit identified at time of analysis, the issue is not confirmed actively exploited (no CISA KEV listing), and no EPSS score was provided in the available intelligence; Patchstack is credited as the reporting source.
Unauthenticated sensitive data exposure in the WordPress plugin StifLi Backup Tools affects all versions up to and including 2.2.7, allowing any remote attacker who can reach an affected site to retrieve information the plugin was never intended to expose without logging in first (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Impact is confidentiality-only - no data modification or denial of service - so the practical damage is the leak of backup-related information that could feed follow-on attacks such as credential theft or targeted exploitation. At the time of analysis there is no public exploit code identified and no confirmation of active exploitation (the CVE is not in CISA KEV), though the low attack complexity and zero authentication requirement make the flaw trivially reachable for anyone who knows or discovers the exposed endpoint; no EPSS score was supplied, and the risk is moderated mainly by the plugin's niche deployment footprint rather than by any technical barrier.
Unauthenticated cross-site scripting in the JetEngine WordPress plugin (versions 3.8.14.3 and earlier) allows a remote attacker to have attacker-controlled script execute in a victim's browser context once that victim loads an attacker-influenced page or crafted URL. Per the assessed vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, CVSS 7.1), no authentication is needed to deliver the payload, but exploitation requires victim interaction and the exact vulnerable feature or parameter is not disclosed in the advisory summary; impact scales with the privilege of the user who triggers it, making an administrator the highest-value target. Reported by Patchstack, this flaw has no public exploit code and no CISA KEV entry identified at time of analysis, and no EPSS signal was supplied.
Reflected cross-site scripting in the ThemeREX Addons WordPress plugin affects all versions below 2.45.0, allowing an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser within the affected site's origin. Exploitation requires user interaction (CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base score 7.1): the attacker must lure a victim to a crafted link or attacker-influenced page that triggers the injected payload, and success also depends on the site lacking a WAF or the patched plugin. There is no public exploit code identified at time of analysis and no confirmed active exploitation; impact is confined to the victim's browser session (low confidentiality, integrity and availability) rather than direct server compromise.
Unauthenticated access control failure in the WebToffee WordPress Backup & Migration plugin (slug wp-migration-duplicator) through version 1.6.0 allows remote attackers to read protected resources without credentials or user interaction; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (base 7.5) reflects a high confidentiality impact with no integrity or availability effect. Any WordPress site with this plugin installed and active at or below 1.6.0 is exposed, while sites that have upgraded past 1.6.0 or that do not run the plugin are unaffected. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Unauthenticated cross-site scripting (XSS) in the Ad Inserter WordPress plugin through version 2.8.18 allows remote attackers to execute arbitrary script in a victim's browser via a crafted request, provided the victim is tricked into clicking a link or visiting an attacker-influenced page (CVSS 3.1 base 7.1 High, AV:N/AC:L/PR:N/UI:R/S:C). The flaw is network-reachable and requires no authentication, but the UI:R dependency limits mass exploitation; no public exploit code or confirmed active exploitation was identified at time of analysis. The specific injectable parameter is not named in the available data and should be confirmed from the Patchstack advisory.
Unauthenticated cross-site scripting in the Happyforms WordPress plugin affects every release through version 1.26.15, allowing an attacker to inject script that executes in a victim's browser when they view attacker-influenced content. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (7.1, High) confirms no authentication is required (PR:N) and no non-default configuration beyond an active plugin, but exploitation depends on a victim loading the crafted content (UI:R), so the attacker cannot compromise a site autonomously and impact stays within the browser/session context rather than server-side code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis; the only scoring signal available is the Patchstack-assigned CVSS 3.1 score, and the specific vulnerable form field or parameter has not been published.
Cross-site request forgery in the WordPress plugin Blacklist Manager - WooCommerce Anti-Fraud, Blacklist & Checkout Verification (versions through 2.3.1) lets a remote, unauthenticated attacker forge state-changing requests that execute with the privileges of a logged-in victim who loads attacker-controlled content. Exploitation is not autonomous: it requires an authenticated user with a live session - typically an administrator or shop manager - on a site where WooCommerce and this plugin are both installed and active, and that user must be tricked into visiting a malicious page (CVSS UI:R, PR:N means the attacker needs no credentials of their own, not that the victim is anonymous). The published CVSS 3.1 base score of 8.8 (C:H/I:H/A:H) appears inflated for a CSRF issue; our independent assessment rates it AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L, reflecting high integrity impact but limited confidentiality and availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Remote code execution in the CartFlows WordPress plugin affects versions 3.2.0 and earlier, allowing an authenticated user with Contributor role or higher to execute arbitrary code on the hosting server. The flaw is a PHP include/require path-control weakness (CWE-98) with a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation requires a valid low-privileged account but no user interaction. No public exploit was identified at time of analysis, and the practical exposure depends on whether the site grants Contributor access to untrusted users.
Reflected cross-site scripting in the Parsi Date (wp-parsidate) WordPress plugin, affecting all versions up to and including 6.3, allows an unauthenticated remote attacker to inject script into a victim's browser by getting that user to load a crafted URL or request. Tracked as CVE-2026-96836 with a CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), the flaw carries low confidentiality, integrity and availability impacts because execution is limited to client-side script in the victim's session rather than server-side code execution, and exploitation requires victim user interaction (UI:R) since the target must click or load the malicious link. No public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (CISA KEV), though as a broadly deployed WordPress plugin it presents an attractive mass-scanning target for unauthenticated request campaigns.
PHP object injection in the Themefic Ultimate Addons for Contact Form 7 WordPress plugin (versions through 3.5.51) allows an authenticated user holding the Editor role to feed crafted serialized data into a plugin code path that calls PHP's unserialize, which can lead to code execution, file operations, or data tampering if a viable POP gadget chain exists in the plugin or elsewhere on the site. The issue is network-reachable and needs no user interaction, but exploitation is access-gated by the Editor-privilege prerequisite, and no public exploit code has been identified at time of analysis; EPSS data was not provided.
PHP object injection in the WordPress plugin Content Egg through version 6.3.1 allows an attacker who holds the Shop manager role to trigger unsafe deserialization of attacker-controlled data, potentially leading to full site compromise. The vulnerability is network-reachable with low attack complexity and requires no user interaction, but the PR:H rating in the CVSS vector means a valid authenticated account at the Shop manager privilege level is a prerequisite, and meaningful code-execution impact further depends on the presence of a usable PHP POP gadget chain in Content Egg or another loaded plugin or theme. No public exploit code has been identified at time of analysis, and there is no indication that the flaw is being actively exploited in the wild.
Authenticated Contributor-level users can exploit a PHP Object Injection vulnerability in Themify Builder versions up to and including 7.8.1. The flaw, caused by unsafe deserialization (CWE-502), allows an attacker with a Contributor account to inject a serialized PHP object, potentially leading to remote code execution or full site compromise if a usable PHP gadget chain exists in the WordPress installation. The vendor-assigned CVSS score is 8.8 (High), and no public exploit code has been identified at the time of analysis.
Unauthenticated reflected cross-site scripting in GiveWP 4.16.9 and earlier allows remote attackers to inject arbitrary script into a victim's browser through crafted input that the WordPress plugin fails to properly output-encode. Exploitation requires the victim to interact with the attacker-controlled request (UI:R), and the CVSS 3.1 score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), so the attacker needs no credentials but must lure a user, ideally a privileged GiveWP administrator. The provided intelligence contains no CISA KEV entry and no public exploit code; no public exploit identified at time of analysis.
SQL injection in the Category Discount WooCommerce WordPress plugin (slug woo-product-category-discount, CVE-2026-96828) affects all versions up to and including 5.18 and allows an authenticated WordPress Administrator to inject arbitrary SQL through the plugin's admin-side functionality, yielding high-impact confidentiality exposure (CVSS 7.6, C:H/I:N/A:L, S:C). The PR:H prerequisite is the dominant limiting factor: only the highest-privilege role can reach the vulnerable code, so this is realistically a post-account-compromise or insider-abuse vector rather than an opportunistic unauthenticated attack. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was supplied; Patchstack is credited with reporting the flaw.
SQL injection in the Melapress Admin Notices Manager WordPress plugin (versions up to and including 1.6.0) allows an authenticated WordPress Administrator to inject arbitrary SQL into a plugin-handled parameter, giving the attacker read access to data outside the plugin's own tables. The assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L scores 7.6, but the PR:H requirement means exploitation presupposes top-tier site access; the practical threat model is multi-admin sites, delegated or agency-managed installs, or an attacker who has already escalated a lower-privilege foothold to administrator. No public exploit code has been identified and the issue is not listed in CISA KEV; no EPSS score was supplied with the available intelligence, so no exploit-probability estimate is asserted here.
Remote unauthenticated attackers can delete arbitrary content, including customer reviews, on WordPress/WooCommerce sites that have the Customer Reviews for WooCommerce plugin installed and active at version 5.120.0 or earlier. The flaw is a missing authorization check (CWE-862) on a network-accessible endpoint, requiring no authentication or user interaction (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the risk is a genuine but bounded priority because impact is confined to availability/data loss rather than site compromise.
Unauthenticated SQL injection in the WordPress Books Gallery plugin (wp-books-gallery) 4.8.3 and earlier lets a remote attacker read arbitrary data from the site's WordPress database over plain HTTP, with no credentials and no user interaction required. Exposure is limited to sites that actually have this low-adoption plugin installed and activated, and no public exploit code was identified at time of analysis; there is no CISA KEV entry for this issue. Because the assessed impact is high confidentiality with only a low availability effect, the realistic worst case is full database disclosure - user password hashes, private content and configuration secrets - rather than code execution or data tampering.
Stored/reflected cross-site scripting in the Awesome Support WordPress plugin (versions 6.3.9 and earlier) allows a low-privileged subscriber-level account to inject script that executes in the browser of an administrator or support agent who views the crafted content, enabling session theft, credential harvesting, or privileged actions performed in the victim's authenticated context. Rated CVSS 3.1 7.1 (HIGH), the flaw requires victim user interaction (UI:R) and, per the vulnerability description, a subscriber account to plant the payload, meaning sites that do not permit public registration are substantially less exposed; exploitation is scope-changing (S:C) because the script runs in the victim's session rather than the plugin's own context. No public exploit identified at time of analysis; there is no CISA KEV listing and no exploit code was observed in the supplied intelligence. Note that the published CVSS vector claims PR:N while the description and our assessment indicate a subscriber (authenticated) injection path - authentication requirements are therefore not fully confirmed from available data.
Cross-site scripting in the oik plugin for WordPress (versions 4.15.4 and earlier) allows script injection that executes in a victim's browser session, with the Patchstack advisory scoping the issue to Subscriber-level users. The reported CVSS 3.1 vector scores 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), but the PR:N rating conflicts with the 'Subscriber' qualifier, which indicates a low-privilege authenticated account is the probable prerequisite, and exploitation additionally requires a victim to render the injected payload (UI:R). No public exploit code, no CISA KEV listing, and no confirmed patched release were identified at time of analysis, and the plugin's niche deployment combined with the authentication and interaction requirements keeps practical risk below what the raw 7.1 figure implies.
Unauthenticated SQL injection in the eLoanApp Platform's AJAX user-verification endpoint allows remote attackers to inject boolean- and time-based payloads into the POST parameter 'logina', enabling database engine discovery and query delays. The affected product is RDL Technologies eLoanApp Platform as represented by CPE cpe:2.3:a:rdl_technologies:eloanapp_platform:*:*:*:*:*:*:*:*, and the independent assessment scores this as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, meaning network-reachable, unauthenticated exploitation with low confidentiality, integrity, and availability impact rather than full compromise. No public exploit identified at time of analysis, and the practical risk is moderate because blind extraction is slow and noisy, making large-scale data theft time-consuming and more detectable than error-based injection.
Authenticated code execution via media upload in Kunstmaan CMS (KunstmaanBundlesCMS) before 7.3.2: the MediaBundle checks the file-extension blacklist case-sensitively but lowercases the extension before writing the file, so a backend user with media-upload rights can submit a file named e.g. webshell.pHp, slip past the blacklist, and have it stored as webshell.php inside the web-accessible media directory. Impact escalates to full remote code execution, but only where the web server is configured to execute scripts in public/uploads/media/ - the vendor's hardening guidance (disable script execution for that path, send X-Content-Type-Options: nosniff) removes the execution impact. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the flaw is gated behind a valid media-role account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.2).
TLS certificate verification is silently disabled in the PHP library maclof/kubernetes-client versions 0.17.0 through 0.31.x whenever a loaded kubeconfig omits certificate-authority-data but points at an https:// API server; the library's parseKubeconfig() and parseKubeconfigFile() helpers then ignore the user's insecure-skip-tls-verify setting and turn verification off. This only matters to an attacker who already holds an on-path/man-in-the-middle position between the client and the Kubernetes API server, from which they can impersonate the API server, harvest Bearer tokens or Basic credentials, and tamper with REST or WebSocket traffic. Exploitation is conditional rather than opportunistic - there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV does not list it); unaffected deployments are those whose kubeconfig supplies certificate-authority-data. The 9.1 CVSS score reflects the high confidentiality and integrity impact, but real-world urgency is lower than that number suggests because of the attack-position requirement and the fix available in 0.32.0.
ApiAdmin 5.0 and earlier allow any logged-in administrator to achieve remote code execution by uploading a .php payload to POST /admin/Index/upload; the handler takes the client-supplied extension verbatim with no whitelist, blacklist, or content inspection, and move_uploaded_file() places the file into the web-served public/upload/Ymd/ directory, where it can be requested directly over HTTP. The attack path is gated by an authenticated admin session (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2), so practical exposure hinges on credential compromise, reuse, or insider access rather than an unauthenticated vector. EPSS is low at 0.35% (26th percentile) and the issue is not listed in CISA KEV; no public exploit code is identified at time of analysis, though a public proof-of-concept write-up is referenced (GitHub fangtang7/CVE) and the European vulnerability entry EUVD-2026-92468 tracks the same CVE.
Remote code execution in WookTeam 1.6.6 and earlier lets an attacker inject arbitrary PHP into an eval() call reached through the task export API at /api/project/task/export, granting full server-side code execution. The CVSS 3.1 vector rates the flaw 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), i.e. unauthenticated and network-reachable with total impact, although the assessor cautions that project/task export routes commonly sit behind a login session, so a valid authenticated session or an otherwise exposed/mis-protected route may be the real prerequisite and the PR:N rating should be verified against WookTeam's auth middleware. Publicly available exploit code exists and SSVC rates the attack automatable with total technical impact, while EPSS remains low at 0.15% (4th percentile) - signals conflict on urgency, and overall risk is bounded mainly by WookTeam's limited deployment footprint rather than by exploit difficulty.
Authenticated users holding editor privileges on wcms through 3.18.0 can turn the media upload API into a remote code execution primitive: the [*:path] parameter of POST /api/v0/media/upload/ is not validated, so an editor can write .php files into a web-served location (including outside the media directory via encoded ../ sequences) and have the web server execute them. The same unvalidated path on DELETE /api/v0/media/[*:path] additionally allows arbitrary file deletion, and the underlying flaw is an unrestricted upload of a dangerous file type (CWE-434) rated CVSS 4.0 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H). Exploitation is not anonymous - a valid editor account is mandatory (PR:L) and code execution further depends on the written PHP landing in a directory the web server executes; at time of analysis there is no CISA KEV entry and no public exploit identified at time of analysis.
Unauthenticated arbitrary file deletion in the VikAppointments Services Booking Calendar WordPress plugin (all versions up to and including 1.2.21) lets a remote attacker specify a server file path that the plugin will remove without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, 9.1), which can escalate to full site takeover when a critical file such as wp-config.php is deleted. Exploitation is conditional: the site must have published at least one File-type custom field on the confirmation-page shortcode, a configuration that is not created by default during plugin installation, so stock deployments are not directly reachable. No public exploit code was identified and the issue is not listed in CISA KEV at time of analysis, but the low complexity and unauthenticated reachability make prompt patching important on any site that uses custom File-type booking fields. Reported by Wordfence via the CVE program.
Local file inclusion in the WPCafe restaurant menu, online ordering and table booking plugin for WordPress affects all versions up to and including 3.0.18, allowing an authenticated user with contributor-level privileges or higher to manipulate the template-scope parameter that the plugin passes into a PHP include, causing arbitrary local files on the server to be read or, under the right conditions, executed. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.5) confirms the low-privileged authenticated prerequisite, while the high attack complexity reflects a second precondition: to reach code execution the attacker must also be able to place a .php file on the server for the vulnerable include to pull in, making full RCE conditional rather than guaranteed. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so real-world risk is tempered by the need for a valid contributor account plus a separate file-placement primitive.
Stored cross-site scripting (XSS) in the Magic Tooltips For Contact Form 7 plugin for WordPress (versions up to and including 1.0.34) allows unauthenticated attackers to inject arbitrary JavaScript that executes in an administrator's browser when they view the comment moderation screen at wp-admin/edit-comments.php. The flaw exists because the plugin's esc_html filter callback decodes HTML-entity-encoded payloads (e.g., '<tip>') back into live HTML, so an entity-encoded script submitted as a comment author name bypasses sanitize_text_field and is rendered as executable markup. Exploitation requires the site to have comment submission enabled (WordPress default) and a privileged administrator to open the moderation queue; no public exploit code or active exploitation is identified at time of analysis, though the CVSS score of 7.2 (High) reflects the unauthenticated, network-based attack vector and scope change.
Arbitrary file read and deletion in Formwork panel versions before 2.3.13 affect authenticated users who hold backup download or backup delete permissions. Exploitation requires a Linux deployment, where PHP basename() fails to treat backslashes as directory separators, allowing a base64-encoded backslash-separated traversal payload to escape the configured backup directory. No public exploit code or CISA KEV confirmation was identified at time of analysis, and the impact is confined to file read and deletion with no code execution.
Unauthenticated, network-reachable denial of service in Apache Thrift's PHP bindings before 0.25.0 lets attackers crash a Thrift service by sending crafted serialized messages that trigger a stack-based buffer overflow during protocol parsing. The vendor-supplied CVSS 4.0 score of 8.7 reflects high availability impact with no confidentiality or integrity impact (VC:N/VI:N/VA:H) and no privileges or user interaction required (PR:N/UI:N), and the assessed CVSS 3.1 vector agrees (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No public exploit code or active exploitation has been identified at time of analysis, and the vendor scope bounds the consequence to service crash/denial of service rather than data disclosure or code execution.
Stack exhaustion in Apache Thrift before 0.25.0 allows remote, unauthenticated attackers to crash processes that deserialize attacker-controlled Thrift messages, because the protocol skip routine in several language bindings fails to apply the binding's recursion limit when skipping unknown fields. The affected bindings are the Python C++ accelerator (the pure-Python protocols are not affected), the PHP library and its thrift_protocol extension, and the Perl, Lua, Smalltalk and OCaml libraries; the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the bug is reachable over the network with no privileges or user interaction, but the impact metrics (VC:N/VI:N/VA:H) restrict the consequence to availability loss. There is no code execution or data exposure, no public exploit code and no confirmed active exploitation at time of analysis, and Apache has released version 0.25.0 which restores the recursion limit.
Denial of service in the PHP bindings of Apache Thrift before 0.25.0 allows unauthenticated remote attackers to exhaust process stack space and crash the parsing worker by supplying deeply nested or self-referential serialized Thrift messages. The flaw is an uncontrolled recursion (CWE-674) in the deserialization path, rated 8.2 High under CVSS 4.0 (AV:N/AC:L/AT:P/PR:N/UI:N/VA:H, with no confidentiality or integrity impact) and 8.2-equivalent High under the assessed CVSS 3.1 vector (A:H only), confirming that impact is confined to availability. Exploitation is not unconditional: the CVSS 4.0 AT:P attack-requirement flag reflects that the target service must actually accept and deserialize attacker-controllable Thrift payloads through the PHP bindings, so internal services processing only trusted, bounded data are not realistically exposed. There is no public exploit code and no confirmed active exploitation at time of analysis, and a vendor-released fix is available in Apache Thrift 0.25.0.
Denial of service in the Apache Thrift PHP bindings before version 0.25.0 allows unauthenticated remote attackers to exhaust server resources by sending crafted Thrift protocol messages that trigger inefficient algorithmic complexity (CWE-407). The vulnerability affects only applications that use the PHP bindings to deserialize untrusted Thrift input; other language bindings are unaffected. No public exploit code has been identified at the time of analysis, and the CVSS 4.0 AT:P metric indicates a specific attack precondition must be met, so exploitation is not guaranteed against every deployment.
Unauthenticated remote attackers can crash applications that use the Apache Thrift PHP bindings prior to version 0.25.0 by supplying crafted Thrift protocol messages that trigger a NULL pointer dereference (CWE-476). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates the flaw is remotely reachable with low complexity and requires no authentication or user interaction, but the impact profile is availability-only (VC:N/VI:N/VA:H) - there is no confidentiality or integrity exposure, so the 8.7 score reflects a pure denial-of-service outcome rather than code execution. Exploitation is conditional on the target PHP service actually accepting and deserializing attacker-controlled Thrift input, and no public exploit code has been identified at time of analysis. A vendor patch is available in Apache Thrift 0.25.0, which per the advisory fixes the issue.
Unrestricted file upload in YesWiki before 4.6.7 lets a remote attacker who already holds an administrator account turn a crafted Bazar CSV import into server-side code execution: the import preview fetches a remote .php URL referenced in a file or image field and writes it into the web-accessible files/ directory with no extension or MIME validation, where PHP then executes it. The issue is a classic CWE-434 flaw rated CVSS 8.6 (CVSS:4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H), and because it requires a high-privilege account plus the Bazar component in use, it is best characterized as a privilege-escalation-to-RCE path rather than an unauthenticated remote compromise. No public exploit was identified at time of analysis, and there is no CISA KEV listing; vendor patching is available in YesWiki 4.6.7.
Session fixation in YesWiki before 4.6.7 allows an attacker who can set or learn a victim's pre-authentication YesWiki-* session cookie to reuse that same session after the victim logs in, gaining access to private content and performing actions with the victim's privileges. The root cause is CWE-384: the AuthController login logic authenticates the user without regenerating the PHP session ID, so the pre-login identifier stays valid after authentication. Exploitation is conditional rather than trivial - it requires the attacker to first control the cookie and the victim to subsequently complete a login (CVSS 4.0 7.6 with AC:H/AT:P; independently assessed as CVSS 3.1 AV:N/AC:H/PR:N/UI:R, C:H/I:H/A:N), and no public exploit code has been identified at time of analysis. The vendor has released 4.6.7, which regenerates the session ID on login and removes the condition.
Blind SQL injection in YesWiki before 4.6.7 allows unauthenticated remote attackers to read arbitrary database contents, including administrator password hashes from the yeswiki_users table, by planting a crafted option id in an anonymously editable Bazar list and then using {{newtextsearch}} requests as a boolean oracle. Successful exploitation depends on the deployment actually permitting anonymous editing of a Bazar list, and because the technique is blind, extraction is slow and noisy rather than a single-shot dump. Vendor severity is 8.7 (CVSS 4.0, AV:N/AC:L/PR:N/UI:N); our independent assessment, based on CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, confirms a high-confidentiality, no-integrity, no-availability impact with no authentication or user interaction required, and no public exploit code identified at time of analysis, with no evidence of confirmed active exploitation (CISA KEV).
Stored cross-site scripting in YesWiki before 4.6.7 lets unauthenticated attackers append raw HTML or JavaScript to any wiki page-including pages protected by write ACLs-by POSTing pagetag, title, and description fields to the {{pointimage}} action handler. Exploitation requires that the target instance have at least one page rendering {{pointimage}}, and the injected payload executes only when a victim, most damagingly an administrator, views the poisoned page. The vendor has released a patch in 4.6.7, and no public exploit code has been identified at time of analysis.
Unauthenticated user enumeration in YesWiki before 4.6.7 allows remote attackers to confirm registered email addresses by observing differing responses from the MotDePassePerdu lost-password recovery endpoint, which lacks rate limiting. This CWE-204 information disclosure does not expose credentials or account contents but enables targeted phishing and password-spraying campaigns. No public exploit code has been identified at time of analysis, and the vendor has released a patch in version 4.6.7.
An uncaught exception (CWE-248) in Apache Thrift's PHP language bindings before 0.25.0 allows unauthenticated remote attackers to terminate PHP processes that accept arbitrary Thrift protocol input, producing a denial of service with no confidentiality or integrity impact. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) means no privileges or user interaction are required against a default deployment that exposes a vulnerable PHP-based Thrift endpoint to untrusted network traffic; the practical prerequisite is that the target actually uses the PHP bindings rather than another language binding. No public exploit code and no confirmed active exploitation were identified at time of analysis, and exploitation potential is bounded to service availability - this is a genuine but limited availability risk rather than a data-breach emergency.
Denial of service in the Apache Thrift PHP bindings before 0.25.0 allows unauthenticated remote attackers who can reach a Thrift service built on those bindings to exhaust server resources via unbounded allocation. The flaw is CWE-770 (allocation of resources without limits or throttling), triggered when the PHP binding processes attacker-controllable message sizes or collections without a cap; impact is limited to availability (VA:H; VC:N/VI:N), meaning no data disclosure or code execution. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), so risk is highest for externally reachable Thrift endpoints that accept untrusted clients. Vendor-released patch: 0.25.0.
Denial of service in Apache Thrift before 0.25.0 allows unauthenticated remote attackers to crash or exhaust services running affected language bindings by sending malformed Thrift protocol data. The flaw combines improper length-parameter handling with excessive memory allocation, inefficient algorithmic complexity, uncaught exceptions, and insecure default initialization across the Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP, and D bindings. It is availability-only: no code execution, data disclosure, or data tampering is known from this issue. No public exploit code or confirmed active exploitation was identified at time of analysis; upgrading to 0.25.0 resolves it.
Denial of service in the Apache Thrift PHP bindings before version 0.25.0 lets remote, unauthenticated attackers exhaust CPU and memory on a Thrift-serving PHP application by sending a crafted Thrift message whose declared quantity is never validated. Per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, vendor CVSS 4.0 base 8.7), the weakness is availability-only: there is no code execution, data exposure, or integrity impact, and only deployments that use the PHP bindings to parse untrusted Thrift input over the network are exposed. No public exploit code or confirmed active exploitation (no CISA KEV listing) was identified at time of analysis, and no EPSS score was supplied; non-PHP Thrift bindings are out of scope for this issue.
Authentication bypass in the WordPress plugin JSON API Auth (all versions up to and including 3.1.2) lets unauthenticated remote attackers harvest a live Administrator logged_in cookie from a cached JSON response and use it to take over the site. The underlying defect sits in the required PI-Media/json-api parent plugin, whose controller-dispatch transient cache is keyed only by URI and query string with HTTP method and POST body ignored, so the authenticated /api/auth/generate_auth_cookie/ response - which embeds a wp_generate_auth_cookie() session cookie directly in its JSON body - is replayed to any subsequent unauthenticated GET, with the plugin's nominal HTTPS enforcement trivially defeated by passing insecure=cool. Our independent assessment keeps the full confidentiality and integrity impact of the vendor vector but treats the access complexity as High (base 8.1 rather than 9.8) because exploitation is opportunistic and conditional: both plugins must be installed and active with the Auth controller enabled, and a legitimate Administrator must have POSTed to the cookie-generation endpoint within the preceding 24-hour transient TTL; no public exploit identified at time of analysis.
Stored cross-site scripting in Smash Balloon's Social Post Feed / Custom Facebook Feed plugin for WordPress, in all versions up to and including 4.13.0, allows an unauthenticated attacker who merely holds a Facebook account to plant a malicious comment message on the connected Facebook Page, which the plugin ingests and later renders with the Vue v-html directive in the administrator-facing feed builder preview. Because the preview template uses v-show instead of v-if, the injected HTML - including onerror handlers - is evaluated in the DOM even when the comments area is not visually displayed, so the script executes as soon as an administrator opens the builder preview page; chained with the missing URL validation in the cff_install_addon AJAX handler, that script can coerce the admin session into installing a plugin from an attacker-controlled URL, potentially yielding server-side code execution. No public exploit code is identified at time of analysis, and real-world urgency is moderate because exploitation depends on a non-universal configuration (a connected public Facebook Page with comments ingested) and on an administrator actually loading the preview page.
Unauthenticated denial of service in the OMGF WordPress plugin before 6.3.11 allows remote attackers to invoke an action that issues a slow server-side loopback request, exhausting the site's PHP worker pool and potentially making the entire site unavailable. The affected action requires neither authentication nor a valid nonce, so no login or user interaction is needed on a default install. No public exploit identified at time of analysis, and a vendor patch (6.3.11) is available per the advisory.
Local file inclusion in the SiteOrigin Widgets Bundle WordPress plugin, in all versions up to and including 1.73.2, lets authenticated attackers with contributor-level access or higher (PR:L per the assessed vector) include and execute server-side .php files, bypassing access controls and exposing sensitive data; full attacker-controlled code execution is conditional on also having a way to place a .php file on the server that can then be included. The flaw is reached remotely by POSTing a crafted widgetData payload containing a legacy top-level 'theme' key together with a non-empty 'columns' array to the /wp-json/sowb/v1/widgets/previews REST endpoint, a structure that slips past validation because update_fields() only processes declared form fields. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the low privilege bar (any contributor account) and the fact that the vulnerable endpoint is REST-reachable without UI interaction make this a conditional priority rather than a drop-everything emergency.
Code injection in CTX Feed Pro (WooCommerce Product Feed Pro by Webappick) versions up to and including 7.6.12 allows an authenticated attacker with Administrator-level privileges to execute arbitrary PHP code on the server by supplying malicious input to the plugin's 'Feed Config' field, which is passed unsanitized to PHP's eval(). The vulnerability is not exploitable by anonymous or low-privileged users because it requires Administrator access, making the realistic threat model a stolen or malicious admin account or a multi-admin environment where a lower-trust admin should not have code-execution rights. No public exploit identified at time of analysis, and no confirmed active exploitation was reported.
SQL injection in ClipBucket v5 (all versions through 5.5.3-#197) allows an authenticated user who holds the ad_manager_access permission to inject arbitrary SQL through the delete parameter in admin_area/ads_manager.php, which is concatenated unsanitized into the AdsManager::DeleteAd DELETE statement against the ads_data table. A successful attacker can run time-based blind payloads to extract user credentials and email addresses, or directly modify and delete arbitrary records, giving high confidentiality and integrity impact on the application database. Publicly available exploit code exists (a published HackMD write-up), and while the flaw is remotely reachable it is gated behind a privileged admin-area role, so real-world exposure is limited to deployments that hand ad-manager rights to additional or semi-trusted users; no confirmed active exploitation (CISA KEV) has been reported, and an upstream fix is available as a pull request.
PictShare versions before 3.7.1 generate the per-file delete_code authorization token using PHP's non-cryptographic rand() PRNG, allowing an attacker who knows a hosted file's hash to predict or infer valid delete codes and delete other users' uploads without authorization. The vulnerability is remotely reachable and requires no authentication or user interaction (CVSS:4.0 AV:N/PR:N/UI:N), but exploitation is constrained by HIGH attack complexity (AC:H) because the attacker must reconstruct the PRNG state; the resulting impact is availability-only (VA:H) and grants no data disclosure. No public exploit code was identified at time of analysis and there is no CISA KEV listing; vendor-released patch: 3.7.1.
Stored cross-site scripting in GetSimple CMS CE 3.3.22 and earlier allows an authenticated attacker to inject persistent JavaScript that executes in an administrator's browser session when the affected admin page renders. The flaw resides in the 'Theme to Components' feature (admin/components.php), where a component title is HTML-entity-decoded and then printed inside a double-quoted HTML attribute without re-encoding, enabling attribute breakout. Publicly available exploit code exists (SSVC exploitation: poc), and no vendor-released patch was identified at time of analysis; the independent assessment rates the issue as requiring low privileges (PR:L) and user interaction (UI:R), with scope change and low confidentiality/integrity impact.
Stored local file inclusion in GetSimple CMS CE 3.3.22 and earlier lets any authenticated account holding page-editing rights save an arbitrary filesystem path into a page's template attribute, which the public front-end then passes unsanitized to PHP include() whenever that page is requested - including by anonymous visitors. The payoff is disclosure of any readable local file and, if the included target contains PHP (a log, an uploaded file, or attacker-planted content), code execution in the web server's context. Publicly available exploit code exists and no vendor-released patch was identified at time of analysis; the main limiting factor is that the attacker must first possess a legitimate page-editing account, which keeps this a real but conditional risk rather than an unauthenticated emergency.
Stored cross-site scripting in GetSimple CMS CE 3.3.22 and earlier lets an authenticated user with page-editing rights plant JavaScript in a page's Keywords, Description, Menu text or Content, which then executes in the browser of any administrator who later opens that page's backup in the admin control panel (admin/backup-edit.php). Exploitation requires two combined conditions - a valid page-editing account and an administrator voluntarily viewing the affected backup - so it is not attacker-triggered, and the impact is confined to the admin control-panel browser context; no public exploit code has been identified at time of analysis and no vendor patch is currently available. The supplied CVSS 4.0 score of 8.8 appears inflated and inconsistent with the described prerequisites (our assessment is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, roughly 5.4), and there is no evidence of active exploitation.
Remote code execution in GetSimple CMS CE prior to 1.5 allows an attacker to plant and execute PHP code as the web-server user by getting the UpdateCE.php handler to process a malicious ZIP archive. The handler extracts archive contents into the web-accessible root without validating file types or paths, so PHP webshells and ../ traversal writes are possible; publicly available exploit code exists, and SSVC rates it not automatable. Exploitation is high impact (CVSS 9.1) but constrained by the need to trigger the update through an administrator session or high existing privileges, so it is not mass-exploitable; version 1.5 contains the fix.
Administrator account takeover in GetSimple CMS CE 3.3.22 is achievable because the password reset endpoint is reachable without authentication and, on a reset request for an existing user, immediately writes a hash of a newly generated temporary password that was produced by PHP rand() seeded with microtime(). The time-bounded seed leaves a limited effective candidate space, and because the admin login endpoint enforces neither rate limiting nor account lockout (independent assessment: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), an unauthenticated remote attacker who knows or enumerates a valid username can generate candidate passwords and test them online until the correct one is found. Exploitation hinges on predicting or narrowing the PRNG value for the reset moment and sustaining enough login attempts, and it is self-defeating in stealth terms because submitting the reset silently overwrites the legitimate administrator's password; no public exploit code was identified at time of analysis and no vendor-released patch exists, though this is a genuine high-priority issue despite the absence of exploitation telemetry.
Authenticated path traversal in Vvveb CMS prior to version 1.0.8.6 allows an admin-panel user with backup access (default role site_admin or higher) to read and delete arbitrary files on the server, enabling database credential theft from config/db.php, disclosure of host files such as /etc/passwd, and site takeover by deleting the database configuration to force the installer back into setup mode. The vulnerability sits in the central path sanitizer used by the backup/file functionality and is reachable only with the high privilege level reflected in its CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H); no public exploit code has been identified at time of analysis. The vendor released a patch in 1.0.8.6 that adds recursive filtering to sanitizeFileName(), so unpatched instances below that version remain exposed.
Authenticated WordPress administrators using the Prime Mover migration plugin before version 2.2.1 can abuse a Zip Slip path traversal (CWE-22) to write attacker-controlled files to arbitrary filesystem locations outside the intended extraction directory, which may escalate to remote code execution when the written path is PHP-executable by the web server. The flaw is reached through the plugin's migration ZIP import workflow, where malicious ZIP entry names are processed by computeExtractionParameters() and resumableZipExtractor() in utilities/PrimeMoverSystemCheckUtilities.php. Exploitation requires a high-privileged admin account (CVSS PR:H, AV:N, UI:N) and crafted archive contents; no public exploit code was identified at time of analysis, and the vendor has released a patch. The risk is genuine but access-gated, since the admin prerequisite is the primary limiting factor and full RCE additionally depends on the hosting configuration.
PHP object injection in the Icegram WordPress plugin through version 3.1.31 allows an authenticated attacker holding only low-level (Contributor-equivalent) privileges to pass crafted serialized data into an unsafe PHP deserialization path, with the potential to trigger a gadget chain that yields high confidentiality, integrity, and availability impact. The flaw is network-reachable, low complexity, and requires no victim interaction (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), and because the vulnerable component is a widely deployable WordPress plugin, any site allowing self-service or delegated content roles expands its exposure surface. No public exploit code has been identified at time of analysis, and there is no CISA KEV listing for this CVE; exploitation depends on an attacker first obtaining a low-privileged account on the target site.
PHP object injection in the Hide Shipping Method For WooCommerce plugin (versions up to and including 1.5.4) allows an authenticated user with Editor-level or higher privileges to trigger deserialization of untrusted data on WordPress sites that also run WooCommerce, potentially leading to remote code execution, arbitrary file access, or data manipulation if a suitable gadget chain exists in the plugin, core, or other installed components. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, score 7.2) confirms the attack is network-reachable and requires no user interaction, but the high privilege prerequisite substantially limits exposure. No public exploit identified at time of analysis, no confirmed in-the-wild exploitation, and no fixed plugin version is listed in the available Patchstack advisory.
Authenticated, high-privilege users of Pandora FMS 777 and later can upload arbitrary .phar files through the console's File Manager module and have them executed as PHP on the server, because the module's extension blacklist does not block PHP archive files. Successful exploitation yields full loss of confidentiality, integrity and availability of the Pandora FMS application (CVSS 4.0 base 8.6, High; core vector AV:N/AC:L/AT:N/PR:H/UI:N with VC:H/VI:H/VA:H and no scope change, where the headline score is inflated by the vendor's AU/R/RE/U threat and environmental modifiers). Exploitation requires an authenticated console session with access to the File Manager (PR:H) and no user interaction; no public exploit code or confirmed active exploitation was identified at time of analysis, and the main exposure limiter is the privileged authentication prerequisite.
Arbitrary PHP code execution is achievable in Pandora FMS version 777 and later by chaining a CSRF-protection bypass with an unrestricted file upload in the Plugin File Manager, allowing an attacker to place and execute a malicious PHP payload on the server. Attackers do not need credentials of their own (CVSS PR:N), but exploitation is not a fire-and-forget network attack: it requires a specific attack condition to hold (AT:P) and a logged-in Pandora FMS administrator to interact with the forged request (UI:A), meaning the victim must be socially engineered into triggering it from an authenticated console session. Successful exploitation yields full confidentiality, integrity, and availability impact on the affected instance; no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated WordPress users with only Subscriber-level access can recursively delete arbitrary files and directories - up to and including the entire WordPress installation - on any site running the Super Forms - Drag & Drop Form Builder plugin version 6.3.316 or earlier. Because the super_save_form AJAX handler performs no capability check, a low-privileged attacker can first enable the file_upload_submission_delete setting for the form and then pass an unsanitized subdir value through super_submit_form into SUPER_Common::delete_dir(), with a trivially bypassed ABSPATH guard allowing deletion of wp-config.php and other critical files at the site root. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); however, the low privilege bar (sites with open registration are effectively exposed to anyone) and the destructive, site-wide impact make this a genuinely high-priority vulnerability rather than a CVSS-inflated paper risk.
MISP (Malware Information Sharing Platform) versions before v2.5.48 accept the same TOTP one-time code more than once, allowing a captured second-factor code to be replayed to open an additional authenticated session. The flaw is a CWE-294 capture-replay weakness: the login flow never recorded that a given TOTP time-step had already been consumed, so a code remained usable for its entire ~30-second validity window. Exploitation is conditional rather than drive-by - the targeted user must have TOTP enabled, the attacker must be able to observe or intercept the live code (network interception, shoulder surfing, or a compromised client) and in practice also hold the first-factor credentials, and the replay must land inside the same TOTP period; the vendor has released a fix in v2.5.48, and no public exploit code has been identified at time of analysis.
Second-factor authentication bypass in MISP versions before 2.5.48 lets an attacker who already holds a session past the password step and a copy of the HOTP paper-token list replay a previously consumed HOTP token, because the OTP check compared the submitted token against a counter cached in the user's session rather than the authoritative database counter; the stale cached value still matches the burned token, yielding a second successful login and rewinding the counter state. Exploitation is not anonymous: it requires an authenticated session (PR:L per the assessed vector, implying prior password compromise), HOTP paper-token 2FA explicitly enabled on the target account, and knowledge of at least one valid token value, per the assessed CVSS:3.1 vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N (vendor CVSS 4.0 score 7.6, High). No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in MISP 2.5.48 by commit f34aee2c7.
Stored cross-site scripting in the AI Engine - The Chatbot, AI Framework & MCP for WordPress plugin (versions up to and including 3.8.0) lets an unauthenticated attacker plant script payloads that execute in a WordPress site's admin dashboard. The attack chains a denylist bypass on the /mwai-ui/v1/chats/submit REST endpoint into the plugin's own PHP error-log parser, which returns the forged log line as recent PHP-error content that the Advisor task then feeds verbatim into the AI prompt (CWE-1427 indirect prompt injection); the unvalidated AI response is saved to the mwai_advisor_data option and rendered by the Advisor dashboard widget without escaping. Exploitation is conditional - the Advisor task, its error-log ingestion, and the non-streaming/non-admin catch branch must all be in play, and the payload only fires when an authenticated administrator opens the dashboard and the Advisor widget renders - which is why the independent assessment scores it UI:R despite the PR:N injection path; no public exploit code has been identified at time of analysis and there is no CISA KEV listing.
PHP object injection in the ThemeHigh 'Extra Product Options For WooCommerce | Custom Product Addons and Fields' plugin through version 3.3.8 allows an authenticated user holding the WooCommerce shop_manager role or higher to pass a crafted serialized payload into a deserialization sink, enabling arbitrary PHP object instantiation that can escalate to code execution or data tampering if a usable gadget chain exists in the surrounding WordPress/WooCommerce stack. The issue is rated CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting high impact but a high-privilege, backend-only prerequisite rather than unauthenticated exposure. There is no public exploit identified at time of analysis, and the plugin has not been confirmed as exploited in the wild; exploitation additionally requires WooCommerce to be installed and active and the plugin to remain at a vulnerable version.
PHP object injection in the Photo Gallery by 10Web WordPress plugin (versions up to and including 1.8.46) allows an authenticated user with Contributor-level privileges to pass crafted serialized data into a plugin code path that calls unserialize(), which under CVSS 3.1 scores 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Successful exploitation can corrupt or disclose data and, if a usable PHP gadget chain exists in the plugin, WordPress core, or another active plugin, can escalate to arbitrary code execution on the web server; no user interaction is required once the low-privileged account exists. At the time of analysis there is no CISA KEV listing and no public exploit code identified, and authentication as Contributor or higher is a firm prerequisite, so exposure is concentrated on sites that grant Contributor+ roles to untrusted users or leave open registration enabled.
PHP object injection in the WordPress plugin Nested Pages (wp-nested-pages, by Hook & Filter) in versions up to and including 3.3.2 lets an attacker who holds at least a Contributor-level account on the affected site submit crafted serialized data that is passed to PHP's unserialization logic, which can lead to arbitrary object instantiation and, where a usable POP gadget chain exists, to code execution, data theft, or full site compromise. The reported base score of 9.8 (AV:N/AC:L/PR:N/UI:N) is inconsistent with the vendor's own 'Contributor PHP Object Injection' designation; the authoritative assessment re-scores the issue as AV:N/AC:H/PR:L/UI:N, reflecting that a low-privileged authenticated WordPress account is a hard prerequisite and that RCE depends on gadget availability rather than being guaranteed. No public exploit code was identified at time of analysis and there is no CISA KEV listing, so this is not confirmed as actively exploited; exploitation is realistically limited to sites where open registration or loosely managed Contributor accounts give an outsider a foothold.
PHP object injection in the Schema & Structured Data for WP & AMP plugin (all versions up to and including 1.66) lets an authenticated attacker with a Contributor-level WordPress account feed crafted serialized input into a plugin deserialization path, and the vendor's CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High) rates that as low-complexity, network-reachable and capable of full confidentiality, integrity and availability impact once a usable POP gadget chain is available in the plugin, WordPress core or another installed component. Authentication is mandatory and there is no unauthenticated route, but no user interaction is required after the attacker holds a qualifying account; the practical exposure therefore depends on whether the site permits open registration or loosely manages Contributor roles. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so the primary risk is post-authentication privilege escalation rather than opportunistic mass exploitation.
PHP object injection in Page Builder by SiteOrigin (siteorigin-panels) version 2.36.0 and earlier allows an authenticated WordPress user holding high privileges - an Administrator or the Editor-level role implied by the advisory - to supply crafted, serialized content through the page-builder editor that the plugin then deserializes, yielding high confidentiality, integrity and availability impact (CVSS 3.1 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Because the flaw is a CWE-502 deserialization issue, weaponization into full remote code execution depends on a usable PHP POP gadget chain being present in the plugin, WordPress core, or another installed component, so the practical worst case is conditional rather than guaranteed. There is currently no evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but the high-privilege authentication prerequisite is the main barrier to mass abuse, not the technical difficulty - low-privilege or anonymous users cannot reach it.
Unauthenticated remote attackers who can reach a yii2-starter-kit deployment (through version 4.2.0) running with its default development configuration can read sensitive runtime data and write arbitrary PHP files. The dev profile sets the Yii debug and Gii modules' allowedIPs to ['*'] in common/config/web.php, so the debug endpoint leaks session cookies and executed database queries (C:H) while the Gii code generator can be abused to create attacker-controlled PHP in the application directory (I:H), a practical path to remote code execution. Exploitation requires the application to be network-exposed while still running the development/staging configuration; a properly hardened production deployment restricts allowedIPs (typically to localhost). No public exploit identified at time of analysis, and the issue is not in CISA KEV; EPSS data was not supplied.
Authenticated users holding the backend 'manager' role in yii2-starter-kit through 4.2.0 can upload PHP scripts through the backend file-storage upload action and then request them from the web-accessible storage directory, achieving remote code execution as the web server user. The defect is an unrestricted file upload (CWE-434) with a CVSS 4.0 base score of 8.7 (PR:L, fully consistent with the assessed CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): exploitation is gated on manager-level authentication, on the backend file-storage module being enabled and reachable, and on the storage directory being served without script-execution restrictions, which is the default starter-kit layout. No public exploit code identified at time of analysis, and the practical priority is tempered by the authentication prerequisite and the niche footprint of the product, though the impact is total for any live deployment that meets those preconditions.
Unauthenticated remote code execution in OrdaSoft Joomla CCK (all versions below 8.3.16) lets any remote attacker who can reach the component's frontend upload and execute arbitrary PHP, resulting in full compromise of the Joomla site - the CVSS 4.0 base score is 10.0 and the independent CVSS 3.1 assessment is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The upload endpoint site/uploader.php is reachable through the component's normal frontend routing via task=getContent with no authentication or ACL check anywhere in the dispatch chain, and the shipped source has its file-extension allow-list commented out, so an image/PHP polyglot carrying an attacker-chosen .php extension passes the magic-byte MIME check and is written to an executable path under the Joomla web root. Exploitation requires no privileges, no user interaction, and no non-default configuration - only that the extension be installed and its frontend be web-reachable; the supplied CVSS v4.0 vector carries E:A (Exploit Maturity: Attacked), although no CISA KEV entry was supplied in the available intelligence, so that metric is the sole exploitation signal available here.
Unauthenticated SQL injection in the JCTables extension for Joomla (joomcode.com) through version 1.21.1 lets any remote attacker read and write arbitrary database content, because the extension's front-end CRUD API controller performs neither a Joomla token check nor any authentication check on any task. Table names, column names and values are taken directly from request parameters and concatenated into SQL, so a default install with the extension's front-end endpoint reachable is exploitable by an unauthenticated attacker with no user interaction and no non-default configuration (CVSS 4.0 base 10.0; our independent assessment concurs this is a top-tier priority rather than a high-score/low-risk case). Exposure is limited to Joomla sites that actually have this specific third-party extension installed, and no confirmed public exploit code was identified in the available intelligence at time of analysis, although public research describing a read/write SQLi-to-RCE chain has been published.
Blind SQL injection in WPTasty Business Directory plugin versions through 6.4.27 allows an authenticated attacker with high privileges to infer database contents without direct query output, using boolean- or time-based inference. The CVSS vector indicates network exploitability, no user interaction, and high confidentiality impact, but the PR:H requirement means the attacker must already hold a privileged WordPress account, so this is a plausible but not urgent priority. No public exploit has been identified at time of analysis, and KEV status is not indicated.
Reflected cross-site scripting in the Ultimate Maps by Supsystic WordPress plugin (all versions through 1.5.5) lets remote, unauthenticated attackers execute arbitrary JavaScript in the browser of any user who is socially engineered into clicking an attacker-crafted link. The flaw is an output-encoding failure of class CWE-79 rated CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L); the attacker needs no credentials, but a victim with an active session on an affected site must be lured to the malicious page, and the resulting script runs in that site's origin. Impact is bounded to the browser context - script execution, possible session/token theft or content manipulation on the affected site - and does not by itself grant server-side code execution; there is no public exploit identified at time of analysis and no CISA KEV record for this CVE.
Unauthenticated cross-site scripting in the Easy Google Maps WordPress plugin (Supsystic, versions up to and including 1.14.6) allows remote attackers to inject and execute arbitrary script in a victim's browser session on any site where the plugin is installed and active. Exploitation requires the victim to interact - typically by clicking a crafted link or visiting an attacker-influenced page (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) - and the advisory does not disclose the specific vulnerable parameter or sink, which limits precise targeting but not the underlying flaw. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so this is a genuine but moderate-priority issue rather than an urgent one; impact escalates materially only when the interacting victim holds elevated privileges such as an administrator, where a single successful injection can lead to full site compromise.
Unauthenticated cross-site scripting in the WordPress plugin Ninja Forms (versions 3.15.3 and earlier) allows a remote attacker to have crafted script content rendered in a victim's browser session, with a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Exploitation requires the attacker to induce a victim - typically a logged-in administrator or a site visitor - to click a crafted link or load a malicious page, since the vector mandates user interaction (UI:R); no credentials are required (PR:N). Impact is confined to the victim's browser context (C:L/I:L/A:L) rather than server compromise, and no public exploit code or confirmed active exploitation was identified in the available data; the Patchstack report is the sole intelligence source provided, and the exact vulnerable parameter or endpoint is not specified, which limits precise targeting by defenders or attackers.
Reflected cross-site scripting in the If-So Dynamic Content Personalization plugin for WordPress (versions up to and including 1.10.1) lets unauthenticated remote attackers inject and execute arbitrary JavaScript in a victim's browser session. Exploitation is conditional on victim interaction - an administrator or site visitor must click a crafted link or load an attacker-influenced page - so there is no server-side compromise without that step; the assessed CVSS 3.1 score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). There is no CISA KEV listing and no public exploit identified at time of analysis, so this is a moderate-severity, broadly applicable WordPress plugin risk rather than a confirmed active campaign.
SQL injection in the WordPress plugin Media Library Assistant (version 3.41 and earlier) allows an authenticated Contributor-level account to inject arbitrary SQL into the plugin's media/attachment query handling, reading database content such as user password hashes, private or draft posts, and stored configuration secrets. The issue is remotely exploitable with low complexity and no user interaction, and the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) yields a base score of 8.5 (High), reflecting confidentiality-only impact plus a scope change that lets the injection reach tables outside the plugin itself. There is no public exploit identified at time of analysis and no CISA KEV entry, so the practical barrier to abuse is obtaining a Contributor account - realistic on sites with open registration, multi-author blogs, or guest-post/membership setups, but not on locked-down single-admin installs.
Reflected cross-site scripting in the WordPress plugin Quiz And Survey Master (slug quiz-master-next) through version 11.2.6 allows unauthenticated attackers to inject script that executes in a victim's browser after the victim clicks a crafted link or submits attacker-controlled input that the plugin then reflects. The issue is scored CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and independent assessment characterizes it as a genuine but moderate-priority web vulnerability: per the assessed vector, no authentication is required but successful exploitation depends on user interaction, and impact stays within the victim's browser/site security context rather than yielding direct server compromise. Risk is elevated when the lured victim is an authenticated administrator, because the injected script then runs with that user's privileges; no public exploit identified at time of analysis, and no KEV listing or product-specific EPSS estimate was supplied.
Authenticated SQL injection in the Event Tickets WordPress plugin through version 5.29.5 allows any account holding the Contributor role to inject arbitrary SQL through plugin-supplied input, giving read access to data well beyond what the plugin itself stores (CVSS 3.1: 8.5, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L). The practical barrier is the Contributor authentication requirement, which limits mass exploitation but is trivially satisfied on sites with open registration or large numbers of low-trust contributors; the Scope:Changed rating reflects that successful injection can expose the broader WordPress database, not just plugin tables. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has not published a fixed version in the available data, so this is a genuine mid-to-high priority issue rather than an emergency.
The miniOrange 'OAuth Single Sign On - SSO (OAuth Client)' WordPress plugin, versions 7.1.2 and earlier, can be tricked into accepting a spoofed identity during the OAuth/SSO login flow, letting a remote attacker bypass authentication and obtain a fully privileged WordPress session on any site that deploys the plugin's SSO login feature. The flaw is rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is remote and unauthenticated with no user interaction required, and successful abuse yields high confidentiality, integrity and availability impact across the site. At time of analysis there is no public exploit identified and the issue is not listed as confirmed actively exploited (CISA KEV); no EPSS score was supplied, but the critical severity and unauthenticated nature warrant urgent prioritisation for sites that have the plugin active and the SSO login endpoint reachable.
Unauthenticated cross-site scripting in Premmerce Permalink Manager for WooCommerce (versions 2.3.13 and earlier) allows remote attackers to inject script that executes in the context of a victim's browser when the crafted content is rendered. Because the CVSS vector carries PR:N with UI:R, no attacker credentials are required, but successful exploitation depends on a victim - typically a logged-in WordPress administrator - interacting with the attacker-influenced page, which is the primary limiting factor; the S:C scope-change flag means the injected script runs in a different security context (the admin session/browser) than the vulnerable plugin itself. No public exploit code or confirmed active exploitation was identified at time of analysis, and the site must be running WooCommerce with this specific plugin installed and active for exposure.
Unauthenticated cross-site scripting in the WPFunnels WordPress plugin at versions 3.13.1 and earlier allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser within the target site's origin once the victim loads or clicks a crafted link or request. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) confirms no authentication is required but that victim interaction is necessary, and the Changed scope means the injected script can affect resources beyond the vulnerable plugin while confidentiality, integrity, and availability impacts remain partial. No public exploit code and no active exploitation were identified at time of analysis, and the provided intelligence contains no CISA KEV listing and no EPSS score.
Reflected cross-site scripting in the Kreatura LayerSlider WordPress plugin (versions through 8.4.0) allows an unauthenticated remote attacker to inject script into a page response by luring a victim to a crafted URL that carries malicious input in a plugin request parameter; the payload is reflected back without proper output encoding. Because the CVSS vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, exploitation does not require authentication on the attacker's side but does require victim interaction (a click on the attacker-supplied link), and impact is confined to the victim's browser session within the target site's origin rather than the server. There is no public exploit identified at time of analysis and no CISA KEV listing, and the plugin is widely deployed across WordPress sites, so the practical risk lies in mass opportunistic scanning and targeted phishing rather than confirmed active exploitation.
Unauthenticated cross-site scripting in the WordPress Geo Mashup plugin affects all versions up to and including 1.13.21, allowing a remote attacker who can convince a logged-in or visiting user to follow a crafted link or submit crafted input to execute arbitrary script in that user's browser context. No authentication is required to reach the vulnerable code (CVSS vector PR:N), and the scope change (S:C) means injected script can act against the wider WordPress site rather than just the vulnerable plugin component, though exploitation is not autonomous because it depends on victim interaction (UI:R). No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the plugin's relatively niche deployment footprint plus the required social-engineering step are the main practical limiters on real-world risk.
Unauthenticated PHP object injection (CWE-502) in the WordPress plugin Booking Activities, affecting versions through 1.18.7.1, allows remote attackers to reach plugin endpoints and pass attacker-controlled data into PHP unserialize() with no authentication or user interaction required (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N). Potential impact includes code execution, file read/write, or denial of service, but real-world severity depends on the presence of a usable POP gadget chain in the plugin, WordPress core, or another loaded plugin/theme. No public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated path traversal in the WordPress Creator LMS plugin (WPFunnels) affects all versions up to and including 1.2.19 and allows a user holding only Contributor-level privileges to manipulate file paths and reach files outside the intended directory, primarily exposing sensitive data with limited integrity and availability effects. Exploitation requires a valid low-privilege account - self-registration must be enabled or an account otherwise obtained - and is rated high complexity (AC:H), meaning success depends on specific, not-guaranteed conditions; the issue is remote, needs no user interaction, and no public exploit has been identified at time of analysis. It is not confirmed actively exploited (no CISA KEV listing), and while the vendor-supplied CVSS of 7.5 and the scorer's high confidentiality/integrity/availability ratings read alarming, the practical risk is moderate because the attack is gated behind an authenticated Contributor role and elevated complexity.
Unauthenticated sensitive data exposure in the WordPress plugin BackupEase through version 2.2.2 lets any remote, network-reachable visitor retrieve information the plugin was never intended to expose, with confidentiality impact rated High and no integrity or availability effect (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N). Because the vector carries PR:N and UI:N, no account, credential, or victim interaction is required - the only prerequisite is that the plugin be installed at an affected version and its vulnerable endpoint reachable over HTTP(S). There is no public exploit identified at time of analysis, the issue is not confirmed actively exploited (no CISA KEV listing), and no EPSS score was provided in the available intelligence; Patchstack is credited as the reporting source.
Unauthenticated sensitive data exposure in the WordPress plugin StifLi Backup Tools affects all versions up to and including 2.2.7, allowing any remote attacker who can reach an affected site to retrieve information the plugin was never intended to expose without logging in first (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Impact is confidentiality-only - no data modification or denial of service - so the practical damage is the leak of backup-related information that could feed follow-on attacks such as credential theft or targeted exploitation. At the time of analysis there is no public exploit code identified and no confirmation of active exploitation (the CVE is not in CISA KEV), though the low attack complexity and zero authentication requirement make the flaw trivially reachable for anyone who knows or discovers the exposed endpoint; no EPSS score was supplied, and the risk is moderated mainly by the plugin's niche deployment footprint rather than by any technical barrier.
Unauthenticated cross-site scripting in the JetEngine WordPress plugin (versions 3.8.14.3 and earlier) allows a remote attacker to have attacker-controlled script execute in a victim's browser context once that victim loads an attacker-influenced page or crafted URL. Per the assessed vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, CVSS 7.1), no authentication is needed to deliver the payload, but exploitation requires victim interaction and the exact vulnerable feature or parameter is not disclosed in the advisory summary; impact scales with the privilege of the user who triggers it, making an administrator the highest-value target. Reported by Patchstack, this flaw has no public exploit code and no CISA KEV entry identified at time of analysis, and no EPSS signal was supplied.
Reflected cross-site scripting in the ThemeREX Addons WordPress plugin affects all versions below 2.45.0, allowing an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser within the affected site's origin. Exploitation requires user interaction (CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base score 7.1): the attacker must lure a victim to a crafted link or attacker-influenced page that triggers the injected payload, and success also depends on the site lacking a WAF or the patched plugin. There is no public exploit code identified at time of analysis and no confirmed active exploitation; impact is confined to the victim's browser session (low confidentiality, integrity and availability) rather than direct server compromise.
Unauthenticated access control failure in the WebToffee WordPress Backup & Migration plugin (slug wp-migration-duplicator) through version 1.6.0 allows remote attackers to read protected resources without credentials or user interaction; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (base 7.5) reflects a high confidentiality impact with no integrity or availability effect. Any WordPress site with this plugin installed and active at or below 1.6.0 is exposed, while sites that have upgraded past 1.6.0 or that do not run the plugin are unaffected. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Unauthenticated cross-site scripting (XSS) in the Ad Inserter WordPress plugin through version 2.8.18 allows remote attackers to execute arbitrary script in a victim's browser via a crafted request, provided the victim is tricked into clicking a link or visiting an attacker-influenced page (CVSS 3.1 base 7.1 High, AV:N/AC:L/PR:N/UI:R/S:C). The flaw is network-reachable and requires no authentication, but the UI:R dependency limits mass exploitation; no public exploit code or confirmed active exploitation was identified at time of analysis. The specific injectable parameter is not named in the available data and should be confirmed from the Patchstack advisory.
Unauthenticated cross-site scripting in the Happyforms WordPress plugin affects every release through version 1.26.15, allowing an attacker to inject script that executes in a victim's browser when they view attacker-influenced content. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (7.1, High) confirms no authentication is required (PR:N) and no non-default configuration beyond an active plugin, but exploitation depends on a victim loading the crafted content (UI:R), so the attacker cannot compromise a site autonomously and impact stays within the browser/session context rather than server-side code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis; the only scoring signal available is the Patchstack-assigned CVSS 3.1 score, and the specific vulnerable form field or parameter has not been published.
Cross-site request forgery in the WordPress plugin Blacklist Manager - WooCommerce Anti-Fraud, Blacklist & Checkout Verification (versions through 2.3.1) lets a remote, unauthenticated attacker forge state-changing requests that execute with the privileges of a logged-in victim who loads attacker-controlled content. Exploitation is not autonomous: it requires an authenticated user with a live session - typically an administrator or shop manager - on a site where WooCommerce and this plugin are both installed and active, and that user must be tricked into visiting a malicious page (CVSS UI:R, PR:N means the attacker needs no credentials of their own, not that the victim is anonymous). The published CVSS 3.1 base score of 8.8 (C:H/I:H/A:H) appears inflated for a CSRF issue; our independent assessment rates it AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L, reflecting high integrity impact but limited confidentiality and availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Remote code execution in the CartFlows WordPress plugin affects versions 3.2.0 and earlier, allowing an authenticated user with Contributor role or higher to execute arbitrary code on the hosting server. The flaw is a PHP include/require path-control weakness (CWE-98) with a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation requires a valid low-privileged account but no user interaction. No public exploit was identified at time of analysis, and the practical exposure depends on whether the site grants Contributor access to untrusted users.
Reflected cross-site scripting in the Parsi Date (wp-parsidate) WordPress plugin, affecting all versions up to and including 6.3, allows an unauthenticated remote attacker to inject script into a victim's browser by getting that user to load a crafted URL or request. Tracked as CVE-2026-96836 with a CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), the flaw carries low confidentiality, integrity and availability impacts because execution is limited to client-side script in the victim's session rather than server-side code execution, and exploitation requires victim user interaction (UI:R) since the target must click or load the malicious link. No public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (CISA KEV), though as a broadly deployed WordPress plugin it presents an attractive mass-scanning target for unauthenticated request campaigns.
PHP object injection in the Themefic Ultimate Addons for Contact Form 7 WordPress plugin (versions through 3.5.51) allows an authenticated user holding the Editor role to feed crafted serialized data into a plugin code path that calls PHP's unserialize, which can lead to code execution, file operations, or data tampering if a viable POP gadget chain exists in the plugin or elsewhere on the site. The issue is network-reachable and needs no user interaction, but exploitation is access-gated by the Editor-privilege prerequisite, and no public exploit code has been identified at time of analysis; EPSS data was not provided.
PHP object injection in the WordPress plugin Content Egg through version 6.3.1 allows an attacker who holds the Shop manager role to trigger unsafe deserialization of attacker-controlled data, potentially leading to full site compromise. The vulnerability is network-reachable with low attack complexity and requires no user interaction, but the PR:H rating in the CVSS vector means a valid authenticated account at the Shop manager privilege level is a prerequisite, and meaningful code-execution impact further depends on the presence of a usable PHP POP gadget chain in Content Egg or another loaded plugin or theme. No public exploit code has been identified at time of analysis, and there is no indication that the flaw is being actively exploited in the wild.
Authenticated Contributor-level users can exploit a PHP Object Injection vulnerability in Themify Builder versions up to and including 7.8.1. The flaw, caused by unsafe deserialization (CWE-502), allows an attacker with a Contributor account to inject a serialized PHP object, potentially leading to remote code execution or full site compromise if a usable PHP gadget chain exists in the WordPress installation. The vendor-assigned CVSS score is 8.8 (High), and no public exploit code has been identified at the time of analysis.
Unauthenticated reflected cross-site scripting in GiveWP 4.16.9 and earlier allows remote attackers to inject arbitrary script into a victim's browser through crafted input that the WordPress plugin fails to properly output-encode. Exploitation requires the victim to interact with the attacker-controlled request (UI:R), and the CVSS 3.1 score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), so the attacker needs no credentials but must lure a user, ideally a privileged GiveWP administrator. The provided intelligence contains no CISA KEV entry and no public exploit code; no public exploit identified at time of analysis.
SQL injection in the Category Discount WooCommerce WordPress plugin (slug woo-product-category-discount, CVE-2026-96828) affects all versions up to and including 5.18 and allows an authenticated WordPress Administrator to inject arbitrary SQL through the plugin's admin-side functionality, yielding high-impact confidentiality exposure (CVSS 7.6, C:H/I:N/A:L, S:C). The PR:H prerequisite is the dominant limiting factor: only the highest-privilege role can reach the vulnerable code, so this is realistically a post-account-compromise or insider-abuse vector rather than an opportunistic unauthenticated attack. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was supplied; Patchstack is credited with reporting the flaw.
SQL injection in the Melapress Admin Notices Manager WordPress plugin (versions up to and including 1.6.0) allows an authenticated WordPress Administrator to inject arbitrary SQL into a plugin-handled parameter, giving the attacker read access to data outside the plugin's own tables. The assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L scores 7.6, but the PR:H requirement means exploitation presupposes top-tier site access; the practical threat model is multi-admin sites, delegated or agency-managed installs, or an attacker who has already escalated a lower-privilege foothold to administrator. No public exploit code has been identified and the issue is not listed in CISA KEV; no EPSS score was supplied with the available intelligence, so no exploit-probability estimate is asserted here.
Remote unauthenticated attackers can delete arbitrary content, including customer reviews, on WordPress/WooCommerce sites that have the Customer Reviews for WooCommerce plugin installed and active at version 5.120.0 or earlier. The flaw is a missing authorization check (CWE-862) on a network-accessible endpoint, requiring no authentication or user interaction (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the risk is a genuine but bounded priority because impact is confined to availability/data loss rather than site compromise.
Unauthenticated SQL injection in the WordPress Books Gallery plugin (wp-books-gallery) 4.8.3 and earlier lets a remote attacker read arbitrary data from the site's WordPress database over plain HTTP, with no credentials and no user interaction required. Exposure is limited to sites that actually have this low-adoption plugin installed and activated, and no public exploit code was identified at time of analysis; there is no CISA KEV entry for this issue. Because the assessed impact is high confidentiality with only a low availability effect, the realistic worst case is full database disclosure - user password hashes, private content and configuration secrets - rather than code execution or data tampering.
Stored/reflected cross-site scripting in the Awesome Support WordPress plugin (versions 6.3.9 and earlier) allows a low-privileged subscriber-level account to inject script that executes in the browser of an administrator or support agent who views the crafted content, enabling session theft, credential harvesting, or privileged actions performed in the victim's authenticated context. Rated CVSS 3.1 7.1 (HIGH), the flaw requires victim user interaction (UI:R) and, per the vulnerability description, a subscriber account to plant the payload, meaning sites that do not permit public registration are substantially less exposed; exploitation is scope-changing (S:C) because the script runs in the victim's session rather than the plugin's own context. No public exploit identified at time of analysis; there is no CISA KEV listing and no exploit code was observed in the supplied intelligence. Note that the published CVSS vector claims PR:N while the description and our assessment indicate a subscriber (authenticated) injection path - authentication requirements are therefore not fully confirmed from available data.
Cross-site scripting in the oik plugin for WordPress (versions 4.15.4 and earlier) allows script injection that executes in a victim's browser session, with the Patchstack advisory scoping the issue to Subscriber-level users. The reported CVSS 3.1 vector scores 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), but the PR:N rating conflicts with the 'Subscriber' qualifier, which indicates a low-privilege authenticated account is the probable prerequisite, and exploitation additionally requires a victim to render the injected payload (UI:R). No public exploit code, no CISA KEV listing, and no confirmed patched release were identified at time of analysis, and the plugin's niche deployment combined with the authentication and interaction requirements keeps practical risk below what the raw 7.1 figure implies.