Smub
Monthly
PHP object injection in Duplicator and Duplicator Pro allows unauthenticated attackers to plant a serialized object in public site content that is later deserialized when an administrator builds a package and then runs a migration or import with database search-and-replace. In Duplicator through 1.5.17 the bundled Requests 1.7 POP chain can escalate this to operating-system command execution; in Duplicator Pro through 4.6.10 the IndexList destructor gadget is limited to deleting an attacker-selected file when the containing directory is writable by the installer PHP process, with site takeover possible only through the additional wp-config.php deletion, race, and attacker-controlled database steps. This is a high-priority but heavily gated issue, and no public exploit identified at time of analysis.
Stored cross-site scripting in WPConsent (Cookie Banner & Cookie Consent for Privacy Compliance) through 1.1.9 allows unauthenticated attackers to inject arbitrary web scripts into comment content that execute when a user views an injected page. Exploitation is constrained: it requires the optional Script Blocking feature to be enabled, the ability to submit comments that are rendered, and two coordinated comments that place event-handler syntax in an allowed code element and the deterministic ___noise___ restoration key in an allowed abbr title attribute, with the key offset confirmable via an unauthenticated wpconsent_debug=1 request. No public exploit identified at time of analysis, and the assessed vector is AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N, so the non-default configuration and precise coordination limit realistic exploitation below the raw 7.2 score.
Stored cross-site scripting in the Easy Digital Downloads WordPress plugin (all versions up to and including 3.6.9) allows unauthenticated attackers to inject arbitrary scripts through PayPal IPN parameters, which are stored without sanitization and later rendered unescaped in the wp-admin 'Gateway Error Logs' reporting table. Although the injection is remote and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, with scope change because the script executes in the privileged wp-admin origin), the payload only runs when a logged-in user - in practice a store administrator - opens the gateway error logs page, and only stores with the PayPal gateway enabled are exposed. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); this is a moderate-priority issue driven mainly by the admin-view precondition.
Stored cross-site scripting in Smash Balloon's Social Post Feed / Custom Facebook Feed plugin for WordPress, in all versions up to and including 4.13.0, allows an unauthenticated attacker who merely holds a Facebook account to plant a malicious comment message on the connected Facebook Page, which the plugin ingests and later renders with the Vue v-html directive in the administrator-facing feed builder preview. Because the preview template uses v-show instead of v-if, the injected HTML - including onerror handlers - is evaluated in the DOM even when the comments area is not visually displayed, so the script executes as soon as an administrator opens the builder preview page; chained with the missing URL validation in the cff_install_addon AJAX handler, that script can coerce the admin session into installing a plugin from an attacker-controlled URL, potentially yielding server-side code execution. No public exploit code is identified at time of analysis, and real-world urgency is moderate because exploitation depends on a non-universal configuration (a connected public Facebook Page with comments ingested) and on an administrator actually loading the preview page.
Arbitrary file upload vulnerability in the Easy Digital Downloads WordPress plugin (≤3.6.9) allows authenticated attackers with Shop Manager-level access to upload malicious files via insufficient validation in the import file upload function, potentially achieving remote code execution. No public exploit or active exploitation reported at time of analysis. The fix was applied in the plugin trunk.
Stored cross-site scripting in Custom Twitter Feeds plugin for WordPress versions ≤2.5.4 allows unauthenticated remote attackers to execute arbitrary JavaScript when malicious content enters cached tweet data. The vulnerability stems from the ctf_get_more_posts AJAX endpoint outputting cached tweet text through nl2br() without HTML escaping, accessible without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). Attack requires either posting malicious tweets that the target site caches via its feed configuration, or leveraging other vulnerabilities to poison the tweet cache. No active exploitation confirmed at time of analysis. Wordfence identified the flaw with patch available in changeset 3519584.
Authenticated Editor-level attackers can achieve Remote Code Execution in ExactMetrics WordPress plugin (all versions ≤9.1.2) by chaining exposed onboarding credentials to install and activate arbitrary plugin ZIP files from attacker-controlled URLs. The attack exploits a missing authorization check in the 'exactmetrics_connect_process' AJAX endpoint that accepts the one-time hash token obtained via the exposed 'onboarding_key' transient-effectively bypassing plugin installation controls. EPSS and KEV status unknown; CVSS 7.2 reflects high-privilege requirement (PR:H) but direct path to RCE makes this a critical risk for multi-author WordPress sites where Editors have dashboard viewing permissions. Wordfence advisory and source code references confirm the vulnerability chain across three distinct code locations in versions through 9.1.1.
The NextGEN Gallery plugin for WordPress contains a Local File Inclusion vulnerability in the 'template' parameter of gallery shortcodes, affecting all versions up to and including 4.0.3. Authenticated attackers with Author-level privileges or higher can include and execute arbitrary PHP files on the server, potentially leading to remote code execution, data theft, or complete site compromise. This is a confirmed vulnerability reported by Wordfence with a high CVSS score of 8.8, though no active exploitation (KEV) status has been reported at this time.
Administrator-level users of the WP Mail Logging WordPress plugin, in all versions up to and including 1.17.0, can read complete mail-log rows belonging to other users - including recipient addresses, message subjects, full message bodies, and URLs contained in them. The flaw is that the 'email_address' parameter is passed unescaped into a SQL LIKE query during the WordPress personal-data export workflow, so an attacker with administrator privileges can retrieve additional records only when their own address contains a LIKE wildcard character (for example an underscore) that coincides with another address stored in the log. Exploitation is gated by several concrete preconditions - high privileges (CVSS PR:H), a wildcard-bearing attacker address, a matching entry in the mail log, and an administrator-triggered privacy export - and no public exploit identified at time of analysis; the assigned score is 2.7, reflecting a genuinely low-priority information-disclosure issue.
Reflected cross-site scripting in WPForms Lite through 2.0.2.1 allows an unauthenticated attacker to execute arbitrary script in a victim's browser if the site administrator previously saved a form whose description embeds a {query_var} Smart Tag inside an iframe srcdoc attribute and enabled Show Description on a public-facing page. The attacker must trick a victim into clicking a crafted link containing a malicious value for the referenced query parameter, and the flaw is rated CVSS 4.7 with high attack complexity and required user interaction. No public exploit code was identified at time of analysis and CISA KEV does not list this CVE.
Unauthenticated attackers can inject and execute arbitrary WordPress shortcodes through the All in One SEO (AIOSEO) plugin in versions up to and including 5.0.2, because an attacker-controllable value is passed to do_shortcode without adequate validation when the plugin renders its breadcrumb trail on the site's search results page. The flaw is only reachable when the AIOSEO breadcrumb is actively displayed on search results via the breadcrumb block, widget, shortcode, or template tag, and the practical impact is bounded by which shortcodes are registered on the target site. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; the issue is rated CVSS 6.5 (Medium), with the independent assessment treating attack complexity as higher than the vendor's vector because of the rendering precondition.
DOM-based cross-site scripting (XSS) in the All in One SEO WordPress plugin, versions up to and including 5.0.1.1, allows unauthenticated attackers to inject arbitrary web scripts via a crafted URL pathname, but successful exploitation requires a victim who holds the aioseo_manage_seo capability to open the SEO Preview panel in the WordPress admin toolbar while visiting the malicious URL. No public exploit code or active exploitation in the wild has been identified at time of analysis, and the substantial victim interaction and privilege requirements make this a moderate-risk, defense-in-depth issue rather than an urgent threat.
Reflected cross-site scripting in the WPForms - AI Form Builder for WordPress plugin (versions up to and including 2.0.2) allows unauthenticated remote attackers to inject arbitrary JavaScript into a victim's browser by submitting a crafted 'page_title' POST value, which is then rendered unescaped through the {page_title} Smart Tag. Exploitation is conditional: it only works on forms where an administrator has deliberately placed the {page_title} Smart Tag inside an HTML attribute context within the form's confirmation message, so many default WPForms deployments are not exploitable. The attack requires user interaction (UI:R) - the victim must be tricked into clicking a crafted link or otherwise submitting the malicious POST value - and there is no public exploit identified at time of analysis and no CISA KEV confirmation of active exploitation; impact is limited to script execution in the victim's browser session (scope change), not server compromise.
Authenticated stored cross-site scripting in the Custom Twitter Feeds (A Tweets Widget or X Feed Widget) WordPress plugin affects all versions up to and including 2.8.0, allowing an attacker holding a contributor-level account or higher to embed arbitrary script in the 'buttoncolor' attribute of the plugin's legacy shortcode. The injected markup is stored and executes in the browser of any user - including an administrator - who later views the affected page, with the cross-boundary scope (S:C) reflecting that the payload runs in the context of the hosting site rather than the plugin itself. Exploitation is conditional: the legacy code path must actually be active, and per the vendor analysis this occurs by default on common installs where the admin configured access tokens together with zero or multiple legacy feeds, which sets the ctf_statuses 'support_legacy_shortcode' option to boolean true. At time of analysis there was no public exploit identified and the issue is not recorded as confirmed actively exploited (CISA KEV), so the practical risk is a post-authentication content-injection scenario rather than an unauthenticated remote compromise.
SQL Injection in the Charitable donation plugin for WordPress (versions through 1.8.12.1) allows authenticated attackers with contributor-level access to extract sensitive data from the WordPress database. The vulnerability resides in the `order` shortcode attribute of the `[charitable_donors]` shortcode, which is reachable by contributors via draft or pending post previews - a low-friction entry point requiring no special site permissions beyond the contributor role. No public exploit code or active KEV-listed exploitation has been identified at time of analysis, but the confidentiality impact is high given that WordPress databases routinely contain PII, donor payment metadata, and user credentials.
Stored Cross-Site Scripting in the Envira Gallery WordPress plugin (versions ≤1.12.4) permits authenticated attackers holding Author-level privileges or higher to inject persistent JavaScript payloads through the gallery description configuration field. The injected script executes in the browsers of any site visitor who loads a page rendering an affected gallery with its description enabled, enabling session hijacking, credential theft, or admin account takeover. No public exploit code or CISA KEV listing has been identified at time of analysis; a fix has been committed to the WordPress plugin repository trunk per changeset 3514026.
Stored Cross-Site Scripting in the Smash Balloon Social Post Feed WordPress plugin (all versions through 4.9.0) allows authenticated attackers holding at minimum a Contributor role to inject arbitrary JavaScript via the 'id' shortcode attribute, which then executes in the browser of any user who visits the compromised page. The CVSS Scope:Changed designation reflects that injected scripts escape the plugin's trust boundary and execute within victims' browser sessions, enabling session hijack or privilege escalation against higher-privileged users such as administrators. No public exploit code or CISA KEV listing has been identified at time of analysis, though a fix commit (changeset 3640517) has been applied to the plugin's trunk branch per WordPress plugin Trac.
Stored Cross-Site Scripting in WPForms (AI Form Builder for WordPress) through version 2.0.0.1 allows contributor-level authenticated attackers to inject persistent malicious scripts into WordPress pages via an unsanitized data-sitekey attribute in the OptinMonster integration handler. Exploitation is constrained by a high-complexity attack condition: the target site must have OptinMonster installed, configured with an active inline campaign emitting matching #om-{id} markup, since WPForms only processes the vulnerable attribute when OptinMonster fires its 'om.Campaign.load' event. No public exploit code or CISA KEV listing has been identified at time of analysis. The CVSS-assigned scope change (S:C) reflects that injected scripts execute in victims' browser sessions, crossing the security boundary from the server-side WordPress context.
Cross-Site Request Forgery in Smash Balloon Social Photo Feed - Easy Social Feeds Plugin for WordPress (all versions through 6.11.1) enables unauthenticated remote attackers to overwrite the site's Instagram and Facebook oEmbed access tokens by forging a request that a logged-in administrator unwittingly executes. The root cause is missing or incorrect nonce validation on the `maybe_connection_data` function, WordPress's primary CSRF defense mechanism. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, a patch changeset is confirmed in the WordPress plugin repository.
CRLF injection in WPForms plugin for WordPress (all versions up to and including 1.10.2) enables unauthenticated attackers to silently blind-copy all site notification emails to an attacker-controlled address. The flaw originates from `get_reply_to_address()` applying the wrong smart-tag expansion context, allowing CR/LF characters preserved by `wpforms_sanitize_textarea_field()` to pass unstripped into raw mail header concatenation. Exploitation requires a specific non-default site configuration but demands no authentication or elevated interaction beyond a standard form submission; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated webhook forgery in WPForms (wpforms-lite ≤1.10.0.1) enables payment fraud by allowing any remote attacker who knows a valid PayPal subscription_id to manipulate subscription payment records - including forcing a cancelled or suspended subscription back to active status - without any credentials or user interaction. The PayPal Commerce webhook endpoint accepts and acts on arbitrary JSON POST payloads, performing no HMAC-SHA256 origin verification, and trusts attacker-supplied resource data once the event_type field passes a whitelist check. No public exploit has been identified and this vulnerability is not listed in CISA KEV at time of analysis, but the zero-complexity attack path makes independent exploitation straightforward for anyone possessing a valid subscription_id.
Sensitive information exposure in the PDF Embedder WordPress plugin (all versions through 4.9.3) allows authenticated attackers with contributor-level access or higher to extract configuration data via the enqueue_block_assets hook. The severity of impact is installation-dependent: on sites running the premium add-on with a saved license key, attackers can exfiltrate that license key; on Lite-only installations, exposed data is limited to non-sensitive viewer settings such as dimensions, toolbar preferences, and usage tracking. No public exploit identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Sensitive information exposure in the Slider by Soliloquy WordPress plugin (versions ≤ 2.8.1) allows authenticated attackers with subscriber-level access to read draft slider content that should be restricted to administrators and editors. The flaw exists in the plugin's map_meta_cap implementation within posttype.php, where capability checks are insufficiently enforced, permitting low-privileged users to retrieve draft slider metadata including unpublished media URLs, captions, and full slider configuration details. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Insecure Direct Object Reference in NextGEN Gallery WordPress plugin through version 4.2.0 allows authenticated attackers with Subscriber-level privileges and the 'NextGEN Manage gallery' capability to delete gallery images belonging to other users, including their physical files from disk. The DELETE /imagely/v1/images/{id} REST endpoint validates only the 'NextGEN Manage gallery' capability, entirely omitting gallery ownership checks and the 'NextGEN Manage others gallery' permission - making cross-user image destruction possible at low privilege. No public exploit code identified at time of analysis and no CISA KEV listing; however, when deleteImg is enabled (default), exploitation results in irreversible file-level data loss beyond what the CVSS 4.3 integrity score alone conveys.
Sensitive credential exposure in the All in One SEO WordPress plugin (versions up to and including 4.9.7) allows authenticated contributors to harvest API tokens, OAuth credentials, and license keys directly from rendered page source. The plugin passes unmasked internal configuration data to the browser via WordPress's wp_localize_script() mechanism in post editor contexts, making sensitive values accessible to any user with contributor-level access or above. No public exploit code or active exploitation has been identified at time of analysis, but exposed credentials carry secondary risk - compromised API/OAuth tokens could enable account takeover or abuse of connected third-party services.
Stored Cross-Site Scripting in Envira Gallery Lite (WordPress plugin, versions ≤ 1.12.4) enables authenticated attackers with Author-level access to inject persistent arbitrary JavaScript into gallery pages via the REST API. The attack exploits a context mismatch: the `arrows` gallery parameter is omitted from `sanitize_config_values()` sanitization, and `gallery_init()` escapes it with `esc_attr()` — a function designed for HTML attribute contexts, not inline JavaScript — allowing JavaScript expression injection that executes in any visitor's browser. No public exploit or active exploitation has been identified; EPSS is 0.01% and CISA KEV status is absent, placing this firmly in the low-immediate-risk tier despite its persistent, cross-user impact.
SQL injection in Charitable - Donation Plugin for WordPress versions up to 1.8.10.4 allows authenticated users with donation management admin privileges to inject malicious SQL via the 's' search parameter, enabling extraction of sensitive database information. The vulnerability stems from insufficient escaping and lack of prepared statement usage in the donation search functionality. Attack requires administrator-level access to the donation management area (edit_others_donations capability), limiting scope to internal threats but carrying high confidentiality impact.
ExactMetrics Google Analytics Dashboard for WordPress versions up to 9.1.2 allow authenticated subscribers to retrieve Google Ads access tokens and reset Google Ads integration settings through missing authorization checks in AJAX handlers. Although a nonce is verified, two AJAX endpoints (get_ads_access_token and reset_experience) lack the capability checks present in similar endpoints, enabling attackers with subscriber-level access to perform administrative actions. The CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects network-accessible unauthenticated exploitation, but the description indicates authenticated subscriber access is required, creating a discrepancy between reported CVSS and actual attack prerequisites.
Unauthenticated attackers can forge Stripe webhook events in the Charitable donation plugin for WordPress up to version 1.8.9.7, allowing them to mark pending donations as completed without processing actual payments. The plugin fails to cryptographically verify incoming webhook payloads, enabling attackers to manipulate donation records and bypass payment validation. This impacts all WordPress sites using affected versions and could result in financial loss for fundraising organizations.
PHP object injection in Duplicator and Duplicator Pro allows unauthenticated attackers to plant a serialized object in public site content that is later deserialized when an administrator builds a package and then runs a migration or import with database search-and-replace. In Duplicator through 1.5.17 the bundled Requests 1.7 POP chain can escalate this to operating-system command execution; in Duplicator Pro through 4.6.10 the IndexList destructor gadget is limited to deleting an attacker-selected file when the containing directory is writable by the installer PHP process, with site takeover possible only through the additional wp-config.php deletion, race, and attacker-controlled database steps. This is a high-priority but heavily gated issue, and no public exploit identified at time of analysis.
Stored cross-site scripting in WPConsent (Cookie Banner & Cookie Consent for Privacy Compliance) through 1.1.9 allows unauthenticated attackers to inject arbitrary web scripts into comment content that execute when a user views an injected page. Exploitation is constrained: it requires the optional Script Blocking feature to be enabled, the ability to submit comments that are rendered, and two coordinated comments that place event-handler syntax in an allowed code element and the deterministic ___noise___ restoration key in an allowed abbr title attribute, with the key offset confirmable via an unauthenticated wpconsent_debug=1 request. No public exploit identified at time of analysis, and the assessed vector is AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N, so the non-default configuration and precise coordination limit realistic exploitation below the raw 7.2 score.
Stored cross-site scripting in the Easy Digital Downloads WordPress plugin (all versions up to and including 3.6.9) allows unauthenticated attackers to inject arbitrary scripts through PayPal IPN parameters, which are stored without sanitization and later rendered unescaped in the wp-admin 'Gateway Error Logs' reporting table. Although the injection is remote and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, with scope change because the script executes in the privileged wp-admin origin), the payload only runs when a logged-in user - in practice a store administrator - opens the gateway error logs page, and only stores with the PayPal gateway enabled are exposed. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); this is a moderate-priority issue driven mainly by the admin-view precondition.
Stored cross-site scripting in Smash Balloon's Social Post Feed / Custom Facebook Feed plugin for WordPress, in all versions up to and including 4.13.0, allows an unauthenticated attacker who merely holds a Facebook account to plant a malicious comment message on the connected Facebook Page, which the plugin ingests and later renders with the Vue v-html directive in the administrator-facing feed builder preview. Because the preview template uses v-show instead of v-if, the injected HTML - including onerror handlers - is evaluated in the DOM even when the comments area is not visually displayed, so the script executes as soon as an administrator opens the builder preview page; chained with the missing URL validation in the cff_install_addon AJAX handler, that script can coerce the admin session into installing a plugin from an attacker-controlled URL, potentially yielding server-side code execution. No public exploit code is identified at time of analysis, and real-world urgency is moderate because exploitation depends on a non-universal configuration (a connected public Facebook Page with comments ingested) and on an administrator actually loading the preview page.
Arbitrary file upload vulnerability in the Easy Digital Downloads WordPress plugin (≤3.6.9) allows authenticated attackers with Shop Manager-level access to upload malicious files via insufficient validation in the import file upload function, potentially achieving remote code execution. No public exploit or active exploitation reported at time of analysis. The fix was applied in the plugin trunk.
Stored cross-site scripting in Custom Twitter Feeds plugin for WordPress versions ≤2.5.4 allows unauthenticated remote attackers to execute arbitrary JavaScript when malicious content enters cached tweet data. The vulnerability stems from the ctf_get_more_posts AJAX endpoint outputting cached tweet text through nl2br() without HTML escaping, accessible without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). Attack requires either posting malicious tweets that the target site caches via its feed configuration, or leveraging other vulnerabilities to poison the tweet cache. No active exploitation confirmed at time of analysis. Wordfence identified the flaw with patch available in changeset 3519584.
Authenticated Editor-level attackers can achieve Remote Code Execution in ExactMetrics WordPress plugin (all versions ≤9.1.2) by chaining exposed onboarding credentials to install and activate arbitrary plugin ZIP files from attacker-controlled URLs. The attack exploits a missing authorization check in the 'exactmetrics_connect_process' AJAX endpoint that accepts the one-time hash token obtained via the exposed 'onboarding_key' transient-effectively bypassing plugin installation controls. EPSS and KEV status unknown; CVSS 7.2 reflects high-privilege requirement (PR:H) but direct path to RCE makes this a critical risk for multi-author WordPress sites where Editors have dashboard viewing permissions. Wordfence advisory and source code references confirm the vulnerability chain across three distinct code locations in versions through 9.1.1.
The NextGEN Gallery plugin for WordPress contains a Local File Inclusion vulnerability in the 'template' parameter of gallery shortcodes, affecting all versions up to and including 4.0.3. Authenticated attackers with Author-level privileges or higher can include and execute arbitrary PHP files on the server, potentially leading to remote code execution, data theft, or complete site compromise. This is a confirmed vulnerability reported by Wordfence with a high CVSS score of 8.8, though no active exploitation (KEV) status has been reported at this time.
Administrator-level users of the WP Mail Logging WordPress plugin, in all versions up to and including 1.17.0, can read complete mail-log rows belonging to other users - including recipient addresses, message subjects, full message bodies, and URLs contained in them. The flaw is that the 'email_address' parameter is passed unescaped into a SQL LIKE query during the WordPress personal-data export workflow, so an attacker with administrator privileges can retrieve additional records only when their own address contains a LIKE wildcard character (for example an underscore) that coincides with another address stored in the log. Exploitation is gated by several concrete preconditions - high privileges (CVSS PR:H), a wildcard-bearing attacker address, a matching entry in the mail log, and an administrator-triggered privacy export - and no public exploit identified at time of analysis; the assigned score is 2.7, reflecting a genuinely low-priority information-disclosure issue.
Reflected cross-site scripting in WPForms Lite through 2.0.2.1 allows an unauthenticated attacker to execute arbitrary script in a victim's browser if the site administrator previously saved a form whose description embeds a {query_var} Smart Tag inside an iframe srcdoc attribute and enabled Show Description on a public-facing page. The attacker must trick a victim into clicking a crafted link containing a malicious value for the referenced query parameter, and the flaw is rated CVSS 4.7 with high attack complexity and required user interaction. No public exploit code was identified at time of analysis and CISA KEV does not list this CVE.
Unauthenticated attackers can inject and execute arbitrary WordPress shortcodes through the All in One SEO (AIOSEO) plugin in versions up to and including 5.0.2, because an attacker-controllable value is passed to do_shortcode without adequate validation when the plugin renders its breadcrumb trail on the site's search results page. The flaw is only reachable when the AIOSEO breadcrumb is actively displayed on search results via the breadcrumb block, widget, shortcode, or template tag, and the practical impact is bounded by which shortcodes are registered on the target site. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; the issue is rated CVSS 6.5 (Medium), with the independent assessment treating attack complexity as higher than the vendor's vector because of the rendering precondition.
DOM-based cross-site scripting (XSS) in the All in One SEO WordPress plugin, versions up to and including 5.0.1.1, allows unauthenticated attackers to inject arbitrary web scripts via a crafted URL pathname, but successful exploitation requires a victim who holds the aioseo_manage_seo capability to open the SEO Preview panel in the WordPress admin toolbar while visiting the malicious URL. No public exploit code or active exploitation in the wild has been identified at time of analysis, and the substantial victim interaction and privilege requirements make this a moderate-risk, defense-in-depth issue rather than an urgent threat.
Reflected cross-site scripting in the WPForms - AI Form Builder for WordPress plugin (versions up to and including 2.0.2) allows unauthenticated remote attackers to inject arbitrary JavaScript into a victim's browser by submitting a crafted 'page_title' POST value, which is then rendered unescaped through the {page_title} Smart Tag. Exploitation is conditional: it only works on forms where an administrator has deliberately placed the {page_title} Smart Tag inside an HTML attribute context within the form's confirmation message, so many default WPForms deployments are not exploitable. The attack requires user interaction (UI:R) - the victim must be tricked into clicking a crafted link or otherwise submitting the malicious POST value - and there is no public exploit identified at time of analysis and no CISA KEV confirmation of active exploitation; impact is limited to script execution in the victim's browser session (scope change), not server compromise.
Authenticated stored cross-site scripting in the Custom Twitter Feeds (A Tweets Widget or X Feed Widget) WordPress plugin affects all versions up to and including 2.8.0, allowing an attacker holding a contributor-level account or higher to embed arbitrary script in the 'buttoncolor' attribute of the plugin's legacy shortcode. The injected markup is stored and executes in the browser of any user - including an administrator - who later views the affected page, with the cross-boundary scope (S:C) reflecting that the payload runs in the context of the hosting site rather than the plugin itself. Exploitation is conditional: the legacy code path must actually be active, and per the vendor analysis this occurs by default on common installs where the admin configured access tokens together with zero or multiple legacy feeds, which sets the ctf_statuses 'support_legacy_shortcode' option to boolean true. At time of analysis there was no public exploit identified and the issue is not recorded as confirmed actively exploited (CISA KEV), so the practical risk is a post-authentication content-injection scenario rather than an unauthenticated remote compromise.
SQL Injection in the Charitable donation plugin for WordPress (versions through 1.8.12.1) allows authenticated attackers with contributor-level access to extract sensitive data from the WordPress database. The vulnerability resides in the `order` shortcode attribute of the `[charitable_donors]` shortcode, which is reachable by contributors via draft or pending post previews - a low-friction entry point requiring no special site permissions beyond the contributor role. No public exploit code or active KEV-listed exploitation has been identified at time of analysis, but the confidentiality impact is high given that WordPress databases routinely contain PII, donor payment metadata, and user credentials.
Stored Cross-Site Scripting in the Envira Gallery WordPress plugin (versions ≤1.12.4) permits authenticated attackers holding Author-level privileges or higher to inject persistent JavaScript payloads through the gallery description configuration field. The injected script executes in the browsers of any site visitor who loads a page rendering an affected gallery with its description enabled, enabling session hijacking, credential theft, or admin account takeover. No public exploit code or CISA KEV listing has been identified at time of analysis; a fix has been committed to the WordPress plugin repository trunk per changeset 3514026.
Stored Cross-Site Scripting in the Smash Balloon Social Post Feed WordPress plugin (all versions through 4.9.0) allows authenticated attackers holding at minimum a Contributor role to inject arbitrary JavaScript via the 'id' shortcode attribute, which then executes in the browser of any user who visits the compromised page. The CVSS Scope:Changed designation reflects that injected scripts escape the plugin's trust boundary and execute within victims' browser sessions, enabling session hijack or privilege escalation against higher-privileged users such as administrators. No public exploit code or CISA KEV listing has been identified at time of analysis, though a fix commit (changeset 3640517) has been applied to the plugin's trunk branch per WordPress plugin Trac.
Stored Cross-Site Scripting in WPForms (AI Form Builder for WordPress) through version 2.0.0.1 allows contributor-level authenticated attackers to inject persistent malicious scripts into WordPress pages via an unsanitized data-sitekey attribute in the OptinMonster integration handler. Exploitation is constrained by a high-complexity attack condition: the target site must have OptinMonster installed, configured with an active inline campaign emitting matching #om-{id} markup, since WPForms only processes the vulnerable attribute when OptinMonster fires its 'om.Campaign.load' event. No public exploit code or CISA KEV listing has been identified at time of analysis. The CVSS-assigned scope change (S:C) reflects that injected scripts execute in victims' browser sessions, crossing the security boundary from the server-side WordPress context.
Cross-Site Request Forgery in Smash Balloon Social Photo Feed - Easy Social Feeds Plugin for WordPress (all versions through 6.11.1) enables unauthenticated remote attackers to overwrite the site's Instagram and Facebook oEmbed access tokens by forging a request that a logged-in administrator unwittingly executes. The root cause is missing or incorrect nonce validation on the `maybe_connection_data` function, WordPress's primary CSRF defense mechanism. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, a patch changeset is confirmed in the WordPress plugin repository.
CRLF injection in WPForms plugin for WordPress (all versions up to and including 1.10.2) enables unauthenticated attackers to silently blind-copy all site notification emails to an attacker-controlled address. The flaw originates from `get_reply_to_address()` applying the wrong smart-tag expansion context, allowing CR/LF characters preserved by `wpforms_sanitize_textarea_field()` to pass unstripped into raw mail header concatenation. Exploitation requires a specific non-default site configuration but demands no authentication or elevated interaction beyond a standard form submission; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated webhook forgery in WPForms (wpforms-lite ≤1.10.0.1) enables payment fraud by allowing any remote attacker who knows a valid PayPal subscription_id to manipulate subscription payment records - including forcing a cancelled or suspended subscription back to active status - without any credentials or user interaction. The PayPal Commerce webhook endpoint accepts and acts on arbitrary JSON POST payloads, performing no HMAC-SHA256 origin verification, and trusts attacker-supplied resource data once the event_type field passes a whitelist check. No public exploit has been identified and this vulnerability is not listed in CISA KEV at time of analysis, but the zero-complexity attack path makes independent exploitation straightforward for anyone possessing a valid subscription_id.
Sensitive information exposure in the PDF Embedder WordPress plugin (all versions through 4.9.3) allows authenticated attackers with contributor-level access or higher to extract configuration data via the enqueue_block_assets hook. The severity of impact is installation-dependent: on sites running the premium add-on with a saved license key, attackers can exfiltrate that license key; on Lite-only installations, exposed data is limited to non-sensitive viewer settings such as dimensions, toolbar preferences, and usage tracking. No public exploit identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Sensitive information exposure in the Slider by Soliloquy WordPress plugin (versions ≤ 2.8.1) allows authenticated attackers with subscriber-level access to read draft slider content that should be restricted to administrators and editors. The flaw exists in the plugin's map_meta_cap implementation within posttype.php, where capability checks are insufficiently enforced, permitting low-privileged users to retrieve draft slider metadata including unpublished media URLs, captions, and full slider configuration details. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Insecure Direct Object Reference in NextGEN Gallery WordPress plugin through version 4.2.0 allows authenticated attackers with Subscriber-level privileges and the 'NextGEN Manage gallery' capability to delete gallery images belonging to other users, including their physical files from disk. The DELETE /imagely/v1/images/{id} REST endpoint validates only the 'NextGEN Manage gallery' capability, entirely omitting gallery ownership checks and the 'NextGEN Manage others gallery' permission - making cross-user image destruction possible at low privilege. No public exploit code identified at time of analysis and no CISA KEV listing; however, when deleteImg is enabled (default), exploitation results in irreversible file-level data loss beyond what the CVSS 4.3 integrity score alone conveys.
Sensitive credential exposure in the All in One SEO WordPress plugin (versions up to and including 4.9.7) allows authenticated contributors to harvest API tokens, OAuth credentials, and license keys directly from rendered page source. The plugin passes unmasked internal configuration data to the browser via WordPress's wp_localize_script() mechanism in post editor contexts, making sensitive values accessible to any user with contributor-level access or above. No public exploit code or active exploitation has been identified at time of analysis, but exposed credentials carry secondary risk - compromised API/OAuth tokens could enable account takeover or abuse of connected third-party services.
Stored Cross-Site Scripting in Envira Gallery Lite (WordPress plugin, versions ≤ 1.12.4) enables authenticated attackers with Author-level access to inject persistent arbitrary JavaScript into gallery pages via the REST API. The attack exploits a context mismatch: the `arrows` gallery parameter is omitted from `sanitize_config_values()` sanitization, and `gallery_init()` escapes it with `esc_attr()` — a function designed for HTML attribute contexts, not inline JavaScript — allowing JavaScript expression injection that executes in any visitor's browser. No public exploit or active exploitation has been identified; EPSS is 0.01% and CISA KEV status is absent, placing this firmly in the low-immediate-risk tier despite its persistent, cross-user impact.
SQL injection in Charitable - Donation Plugin for WordPress versions up to 1.8.10.4 allows authenticated users with donation management admin privileges to inject malicious SQL via the 's' search parameter, enabling extraction of sensitive database information. The vulnerability stems from insufficient escaping and lack of prepared statement usage in the donation search functionality. Attack requires administrator-level access to the donation management area (edit_others_donations capability), limiting scope to internal threats but carrying high confidentiality impact.
ExactMetrics Google Analytics Dashboard for WordPress versions up to 9.1.2 allow authenticated subscribers to retrieve Google Ads access tokens and reset Google Ads integration settings through missing authorization checks in AJAX handlers. Although a nonce is verified, two AJAX endpoints (get_ads_access_token and reset_experience) lack the capability checks present in similar endpoints, enabling attackers with subscriber-level access to perform administrative actions. The CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects network-accessible unauthenticated exploitation, but the description indicates authenticated subscriber access is required, creating a discrepancy between reported CVSS and actual attack prerequisites.
Unauthenticated attackers can forge Stripe webhook events in the Charitable donation plugin for WordPress up to version 1.8.9.7, allowing them to mark pending donations as completed without processing actual payments. The plugin fails to cryptographically verify incoming webhook payloads, enabling attackers to manipulate donation records and bypass payment validation. This impacts all WordPress sites using affected versions and could result in financial loss for fundraising organizations.