Unknown
Monthly
Stored cross-site scripting in the WebP Express WordPress plugin before 0.25.16 lets unauthenticated visitors submit values that the plugin's bundled HTML parser later re-emits into element attributes without escaping, so the payload breaks out of the attribute context and executes in the browser of anyone who loads the affected page, including administrators. The vulnerable code path is only reached when a non-default image delivery mode is enabled; default installations do not exercise it, and the stored payload only fires when a victim views the page, which is why the assessed vector carries UI:R and AC:H despite PR:N. A public PoC reference exists in the WPScan entry but is not verified as working exploit code, and there is no CISA KEV confirmation of active exploitation; vendor patch 0.25.16 is available and the issue is prioritized as this_week rather than emergency-level.
Royal MCP, a WordPress plugin, issues preview-link tokens that are not bound to the single preview they were created for; in versions before 1.5.7 any party holding a valid token is authenticated as the token's owning user - an administrator in a default install - across the entire REST API without a nonce check, enabling full site takeover. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects that the hard part is obtaining such a token, and the available sources do not describe how a token is acquired or how long it stays valid, so practical acquisition difficulty is unverified. A public PoC reference exists (the WPScan entry) but it is not verified as working exploit code, and no CISA KEV listing or EPSS scoring is present in the supplied data.
Stored cross-site scripting in the PixelYourSite WordPress plugin before 11.4.3 and PixelYourSite Pro before 12.6.8 lets unauthenticated remote attackers plant script in a page that is then served to other visitors. The plugin prints an attacker-supplied cookie value into page output without sanitising or escaping it, so on a site running a full-page cache the payload is persisted in the cached copy rather than only reflected back to the sender. Scored CVSS 3.1 at 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) with a scope change because the script executes in other users' browsers; a vendor patch is released (11.4.3 / 12.6.8), a public PoC reference exists but is not verified as working exploit code, and no confirmed active exploitation or KEV listing was reported.
Privilege escalation in the HIPAA Forms WordPress plugin (versions before 3.3.2) lets an account that already holds the plugin's own custom user role push that role up to administrator-level capabilities. The plugin handles a request that rebuilds its custom role without any capability check, so a role holder can rewrite their own permissions; per the assessed vector the attacker must be authenticated and must already possess that specific custom role (PR:H), making this an insider or role-holder escalation path rather than unauthenticated remote takeover, and no victim interaction is required. A public PoC reference exists but is not verified as working exploit code, there is no CISA KEV listing, and a vendor fix is available in 3.3.2.
Unauthenticated stored cross-site scripting in the Jane Menu WordPress plugin before 1.5.1 lets remote attackers bind any published page to an attacker-controlled remote document that the plugin fetches and renders without escaping, causing arbitrary JavaScript to execute for visitors, including administrators. Authentication is not required, but exploitation is not automatic: the payload fires only when a victim visits the tampered published page (UI:R). Publicly available exploit code exists; CISA KEV does not list this CVE, and the independent assessment rates this as a genuine high-priority issue rather than an inflated score.
SQL injection in the Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 allows unauthenticated remote attackers to read arbitrary WordPress database contents by controlling a sort parameter that is placed directly into an SQL ORDER BY clause. The assessed vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, so the practical impact is high confidentiality loss with no integrity or availability effect, and no authentication or user interaction is needed. Publicly available exploit code exists; exposure is limited to sites running an affected plugin version with the chat-widget request handler reachable.
Unauthenticated SQL injection in Click n Chat (Chat Widget Integration) before 1.1.3 allows remote attackers to influence SQL query structure by supplying a parameter that the plugin uses as a column identifier without validation, giving high confidentiality impact through database data exposure with no integrity or availability impact assessed. Publicly available exploit code exists, and only WordPress sites with this specific plugin below version 1.1.3 are exposed, making the affected population narrow. The independent assessment rates the issue as network-reachable, low-complexity, and unauthenticated with scope unchanged, while the supplied base score is 8.6.
Stored cross-site scripting in the Weglot WordPress plugin before 6.4.3 lets unauthenticated attackers plant a payload that executes in the browser of anyone who views an affected page in a translated language. The flaw appears when Weglot rewrites links for translated content: it re-inserts URLs without escaping and reverses earlier encoding. Exploitation requires the site to have link rewriting/translation rendering active with at least one additional language and a victim to load the translated view; publicly available exploit code exists, and the issue is moderate priority rather than a critical fire-drill.
Unauthenticated remote attackers can exhaust the daily rate-limit allowance for payment gateway verification in the Formidable Forms WordPress plugin on sites running versions 6.5 through 6.x with a payment gateway configured, causing legitimate verification attempts to be refused for up to 24 hours. The plugin records the rate-limit timestamp without verifying the caller's identity, so the issue is a bounded availability impact against the verification function rather than a full site outage or system compromise. Publicly available exploit code exists, a vendor patch is available in version 7.0, and the independently assessed impact is availability-only.
Stored cross-site scripting in the Advanced File Manager WordPress plugin (versions 5.4.13 through before 6.0.0) lets an attacker with file-manager access plant a file whose embedded script survives sanitisation, which then executes in the browser of any user who opens or previews it - typically an administrator. Exploitation requires a low-privileged account that an administrator has explicitly delegated file-manager access to (PR:L) plus a victim opening the crafted file (UI:R), which is why public exploit code exists but no active exploitation has been confirmed. Fixed in 6.0.0; the vendor advisory and WPScan entry document the detection flaw.
miniOrange 2FA versions 6.2.9 to before 6.3.1 permit an attacker who already knows a victim's WordPress password to add an attacker-controlled passkey during a pending passkey login, bypassing the second factor on accounts that already have a passkey. The assessed vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N, so exploitation is authenticated (PR:L) and depends on a timing/state window (AC:H), with high confidentiality and integrity impact but no availability impact; publicly available exploit code exists, while no CISA KEV entry was supplied.
Reflected cross-site scripting in the User Profile Builder WordPress plugin before 4.0.1 allows an attacker to craft a URL that executes script in the browser of a logged-in high-privilege user, such as an administrator, when that user loads the vulnerable plugin admin page. The attacker needs no WordPress credentials (PR:N), but exploitation requires the victim to click the crafted link (UI:R) and succeeds only against users who can already access that admin page. Publicly available exploit code exists, and the vendor has released version 4.0.1 to address the flaw.
Stored cross-site scripting in CF7 Redirection before 3.2.12 allows unauthenticated visitors to submit form data that is retained and later rendered without proper sanitization or escaping in the lead debug metabox. The payload executes only when a logged-in user, typically an administrator, opens the crafted entry's debug metabox while the plugin's non-default debug mode is enabled. Publicly available exploit code exists, but exploitation is constrained by that configuration dependency and the required privileged user interaction; no CISA KEV confirmation was provided.
Unauthenticated privilege escalation in the WP User Manager WordPress plugin (versions 2.9.21 through 2.9.25) allows an attacker to submit a live paid registration form and receive its configured administrator-equivalent role once the associated payment gateway has been disconnected - the payment gate is silently dropped instead of failing closed. The flaw is rated CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H, CWE-269), but practical exploitation requires the non-default combination of a published paid registration form that assigns a privileged role plus an inactive gateway, so sites that never offered paid registration, never mapped the form to a high-privilege role, or have unpublished the form are not exposed. Publicly available exploit code exists and the issue is fixed in 2.9.26; no KEV listing appears in the supplied intelligence.
Reflected cross-site scripting (CVSS 7.1) in WP Booking System before 2.1.0.3 allows unauthenticated remote attackers to inject script into an administrative page by luring a logged-in administrator to a crafted URL. The plugin reflects one of its parameters without validation or escaping, so the payload executes in the victim administrator's browser session and can perform actions with that user's privileges; exploitation requires user interaction (UI:R). Publicly available exploit code exists, and the vendor has released version 2.1.0.3 as a fix.
Privilege escalation in the Simple Banner WordPress plugin before 3.3.3 lets any role that an administrator has permitted to manage banners gain the full 'administrator' capability, allowing an authenticated low-privileged user to take complete control of the site. The flaw is only reachable when an admin has explicitly delegated banner management to a non-administrator role and the attacker holds an account in that role - a non-default configuration reflected in the AC:H/PR:L vector - so default installs and unauthenticated visitors are not exposed. Publicly available exploit code exists and the vendor has released version 3.3.3 as a fix; no CISA KEV listing is associated with this CVE at time of analysis.
Missing authorization in Backup and Staging by WP Time Capsule before 1.22.28 allows an authenticated Subscriber on a WP Time Capsule staging site to invoke the staging-to-live deployment handler and overwrite the linked live site's database and configuration, potentially taking it offline. Exploitation is conditional on the plugin's staging-to-live workflow being configured with a separate live site, and publicly available exploit code exists. The vendor-released fixed version is 1.22.28.
Account takeover is possible in Uncanny Toolkit for LearnDash (WordPress plugin) before 3.8.2: the plugin's password-reset handler accepts forged cross-site requests without validating their origin, so an unauthenticated attacker who induces a victim - one who is already partway through a reset - into loading a crafted page can set that account's password to an attacker-chosen value. Publicly available exploit code exists and the vendor shipped a fix in 3.8.2, though exploitation is gated by the timing of an in-progress reset plus victim interaction (CVSS 7.5, AC:H/UI:R).
Stored cross-site scripting in the Falang Multilanguage plugin for WordPress before 1.4.6 lets any authenticated user at Subscriber level or above plant script-bearing content that later renders in an administrator's browser session. The plugin's term-translation save handler performs no capability check and hands a valid nonce to any logged-in user, so a low-privilege account is enough to store the payload; execution still depends on a higher-privileged user opening the affected translation screen, which limits the real-world blast radius below the headline 8.0 score. Publicly available exploit code exists and the flaw is fixed in 1.4.6, but exploitation is only realistic on sites that allow self-registration or where the attacker already holds a low-tier account.
Authenticated SQL injection in the Modern Events Calendar Lite and Modern Event Calendar Pro WordPress plugins before version 7.37.0 allows any logged-in user with Subscriber-level access or higher to append additional SQL clauses to an existing query and read sensitive data from the site's database. Only confidentiality is affected - the vulnerable code path provides no route to modify or delete data, and no user interaction is needed (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N per independent assessment). Publicly available exploit code exists, and the practical blast radius is largest on event, membership and community sites that permit open or self-service registration, where an attacker can simply sign up for a low-privilege account.
SQL injection in Modern Events Calendar Lite and Pro versions before 7.37.0 allows authenticated users with Subscriber-level access or higher to read arbitrary data from the WordPress database. Publicly available exploit code exists, though CISA's SSVC assessment finds no active exploitation; the practical barrier is the requirement for a valid low-privilege account, making this a credible mid-tier priority rather than an emergency.
Reflected cross-site scripting in WP Photo Album Plus before 9.2.11.002 allows remote unauthenticated attackers to inject script through a category navigation value that is reflected into a JavaScript event handler on gallery breadcrumb links. The victim must first open a crafted gallery link and then click the breadcrumb, so exploitation depends on that two-step user interaction; targeting a logged-in administrator yields script execution in a privileged session. Publicly available exploit code exists, and the vendor has released a patched version, 9.2.11.002.
Privilege escalation in the Salon Booking System WordPress plugin (10.17 through versions before 10.31.11) lets authenticated users who hold the plugin's custom salon staff role assign arbitrary capabilities, including administrator, to other accounts through the customer-editing function, enabling full site takeover. Publicly available exploit code exists, but the flaw is access-gated: it is not reachable by anonymous visitors or ordinary subscribers and requires a provisioned salon staff account, so exposure depends on how widely that role is granted and on the hygiene of those accounts. It is not confirmed actively exploited (no CISA KEV entry) and no EPSS score was provided.
Unauthenticated remote attackers can force-publish, rewrite, and create the managed pages of any WordPress site running Tutor LMS below 4.1.1, because the plugin's page-regeneration routine omits a capability check (CWE-862). Impact is confined to integrity - unpublished pages can be pushed live, existing page content overwritten, missing pages created, and the plugin options that reference those pages changed - with no confidentiality or availability effect and no code execution, so realistic damage is content tampering and manipulation of plugin page references rather than site takeover. Publicly available exploit code exists, and the CVSS 3.1 base score is 7.5 (HIGH) with vector AV:N/AC:L/PR:N/UI:N, making it trivially reachable on exposed sites; there is no CISA KEV entry indicating confirmed active exploitation at time of analysis.
Reflected cross-site scripting in the Document Gallery WordPress plugin (versions through 5.1.1) lets an unauthenticated attacker inject script into an HTML attribute returned by one of the plugin's AJAX actions, and the payload executes in the browser of any user who opens the crafted link - including a logged-in administrator. Publicly available exploit code exists and the issue is documented in the WPScan vulnerability database (EUVD-2026-101853), so exploitation only requires luring a victim into clicking or loading a malicious URL; no credentials are needed to deliver the payload (CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). At CVSS 7.1 the assessed impact is moderate rather than critical: script execution is confined to the victim's browser session instead of granting direct server control, there is no CISA KEV entry indicating confirmed actively exploited, and the decisive limiting factor is the mandatory victim interaction.
Unauthenticated attackers can register an administrator-equivalent account on any WordPress site running the User Rights Access Manager plugin through version 1.1.3, resulting in full site takeover. The plugin leaves one of its AJAX account-registration handlers accessible without any capability or nonce check, and assigns newly self-registered users a role that was created as a direct copy of the administrator role, so a single crafted request yields a fully privileged account. Publicly available exploit code exists, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms the attack is remote, unauthenticated, and requires no user interaction; no CISA KEV entry has been reported, so active exploitation is not confirmed, but the low complexity and public proof-of-concept make this a high-priority patch target wherever the plugin is deployed.
Stored cross-site scripting in the Forms WordPress plugin (versions before 3.0.2) allows an unauthenticated attacker to submit a crafted form value that the plugin neither sanitises on storage nor escapes when rendering the form submissions screen, so the injected script executes in the browser of any administrator who later opens that dashboard view. Exploitation depends on the site actually using the plugin's public-facing submission feature and on a privileged user subsequently viewing the submissions list, which makes execution deferred and not attacker-controlled in timing; public exploit code exists, but exploitation is not confirmed active (CISA SSVC: exploitation none) and EPSS is low at 0.21% (10th percentile). Our independent assessment re-scores the issue as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - a genuine but non-urgent risk rather than a widespread emergency.
Remote code execution in the affiliate-toolkit WordPress plugin (versions before 3.9.1) lets an authenticated user holding the Contributor role or higher submit a template body that the plugin's bundled templating engine compiles and runs as PHP, giving full server-side code execution with high confidentiality, integrity, and availability impact. Any WordPress site running an affected version is exposed, and because Contributors are unprivileged content authors, sites with open author self-registration or large multi-author teams carry the greatest practical risk; no end-user interaction is required. Publicly available exploit code exists (documented via WPScan) and the EPSS score is low at roughly 0.18% (8th percentile), with no indication of confirmed active exploitation (CISA KEV) and no SSVC exploitation signal, so this rates as a moderate-but-real priority for sites that actually run the plugin.
Unauthenticated remote attackers can delete arbitrary files from WordPress installations running the File Upload to Order plugin before 1.1.4, because the plugin's deletion routine trusts a file path taken from attacker-controlled session data and applies neither validation nor path confinement (CWE-73). The assessed vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H) confirms no authentication or user interaction is needed and that impact crosses the plugin's own security scope into the host WordPress installation, where deleting a file such as wp-config.php can escalate to full site compromise. Publicly available exploit code exists, but SSVC records no observed exploitation and EPSS remains low at 0.19% (8th percentile), so this is currently an easy-to-automate, high-impact integrity/availability risk rather than a confirmed active campaign.
Unauthenticated local file inclusion in the Ultimate Multisite WordPress plugin before 2.17.2 allows remote attackers to traverse the filesystem and read arbitrary local files, including wp-config.php with its database credentials and authentication salts. The plugin passes a user-supplied file-selection value directly into an include operation without validation, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) confirms no authentication and no user interaction are required. Publicly available exploit code exists, but EPSS is low at 0.20% (10th percentile) and CISA SSVC records no known exploitation, so real-world risk is concentrated in internet-reachable WordPress sites that have the plugin active.
Stored cross-site scripting in the WP Booking System WordPress plugin before 2.1.0.1 lets unauthenticated attackers plant a malicious payload through a public-facing booking form; the value is stored without sanitisation or escaping and is later rendered unescaped inside an administration screen, where it executes in the session of any administrator who views the record. Exploitation is gated by that administrator interaction - the payload is inert until an admin opens the affected admin view - and CISA's SSVC assessment rates the issue as not automatable with no observed exploitation, while our own assessment caps the realistic impact at low confidentiality and integrity within a changed scope (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) rather than the 8.8 score reported by NVD. Publicly available exploit code exists and the plugin is widely deployed, but EPSS is only 0.22% (12th percentile) and there is no confirmed in-the-wild activity, so the practical risk hinges on whether an administrator can be induced to open the poisoned admin screen.
Unauthenticated attackers can exploit the Walletdoc Payment Gateway for WooCommerce plugin before version 1.8.5 to execute SQL injection and forge payment webhooks, marking arbitrary WooCommerce orders as paid. The webhook signature check uses a signing secret that is empty by default, so any default installation is vulnerable; the SQL injection works without authentication or user interaction. Publicly available exploit code exists, but EPSS is low (0.21%, 11th percentile) and CISA SSVC indicates no observed exploitation; the vendor has released patch version 1.8.5.
Unauthenticated file-upload handling in the Piotnet Forms WordPress plugin through 1.0.30 lets an attacker store a browser-renderable file (HTML, SVG or similar) inside the site's own origin, so that opening the file executes arbitrary JavaScript - a stored XSS condition. The storage step requires no account and no special configuration, only a publicly reachable form that exposes an upload field; execution is not self-triggering and depends on a victim, typically an administrator reviewing a submission or any user following the file's direct URL, opening the payload (UI:R), with the highest impact when that opener holds an authenticated admin session in the same origin. Publicly available exploit code exists per the WPScan disclosure, and while the vendor-classified score is 8.8, our independent assessment scores the realistic vector lower (S:C, C:L/I:L) because the write and the execution are separated by user interaction and the observable impact depends on who opens the file.
Reflected cross-site scripting in the Subscribe to Comments WordPress plugin (all versions before 2.3.3) allows remote attackers to inject script through a crafted URL whose parameter is reflected unvalidated into a link target, executing in the browser of anyone who clicks it, including logged-in administrators. Per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) the attacker needs no authentication (PR:N), but exploitation is gated by mandatory user interaction (UI:R) and is confined to a single victim's browser session per click - it is reflected, not stored, and does not compromise the server. Publicly available exploit code exists, the vendor has released a patched version (2.3.3), and the issue is not listed in CISA KEV, so confirmed active exploitation is not established; risk is moderate and user-interaction-gated rather than an emergency.
Unauthenticated SQL injection in the WordPress plugin Post Voting System 1.0 and earlier allows remote attackers to inject arbitrary SQL through a request parameter that is passed into a database query without sanitization or escaping, exposing the contents of the site's WordPress database. Every installation with the plugin active is potentially reachable, because exploitation requires no authentication, no user interaction, and no non-default configuration - publicly available exploit code exists, and WPScan has published the vulnerability, so mass scanning is plausible. The practical risk is bounded by deployment: the plugin is niche, and the impact is confined to confidentiality (database read), since the assessed vector is S:U with C:H and no integrity or availability effect; no fixed version is confirmed at the time of analysis, so removal or virtual patching is the current mitigation.
Unauthenticated SQL injection in the WP Verify API WordPress plugin through version 1.0.0 lets remote attackers supply malicious input to a parameter used directly in a SQL query, allowing extraction of database contents. Publicly available exploit code exists, while no EPSS score or CISA KEV entry was provided; the input CVSS is 8.6 (network, low complexity, no privileges or user interaction), and the independent assessment keeps scope unchanged and rates confidentiality impact high with no integrity or availability impact. The practical prerequisite is that a target WordPress site has this specific plugin installed and the vulnerable endpoint reachable.
Unauthenticated SQL injection in the Loja Automática WordPress plugin (versions through 1.0.0) allows remote attackers to read data from a site's backend database by supplying crafted input to a parameter that is not sanitized or escaped before being placed in a SQL query, resulting in a high confidentiality impact per the assessed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 8.6 as published). No authentication, privileges, or user interaction are required, and publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been reported; realistic exposure is limited almost entirely by how rarely this obscure plugin is installed and active. WPScan reported the issue, which is tracked as EUVD-2026-96788.
Unauthenticated SQL injection in the ASPL Product Quotation WordPress plugin through version 1.1.0 allows remote attackers to read arbitrary data from the site's database without credentials or user interaction. Publicly available exploit code exists (reported via the WPScan vulnerability entry), but the flaw is not flagged as confirmed actively exploited (CISA KEV). Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 8.6), impact is confidentiality-only - injected queries can disclose data but do not modify it or affect site availability.
Unauthenticated SQL injection in the Datalist it WordPress plugin through version 0.0.3 allows anonymous attackers to execute arbitrary database queries and read sensitive data from the underlying WordPress database. Publicly available exploit code exists, and the provided CVSS score is high, though the independent assessment scopes confirmed impact to unauthorized database reads under unchanged scope; real-world exposure is likely limited by the plugin's apparent small install base and requires only that the plugin be active and reachable on a WordPress site.
Unauthenticated attackers can reset, overwrite, or replace the post password of every published post on any WordPress site running the WP Posts Password Batch Manager plugin through version 1.1, because the plugin's bulk post-password handler is registered on an always-loaded admin handler and performs neither a capability check nor a nonce check. Successful exploitation with a single crafted request gives the attacker either disclosure of all password-protected post content (by clearing or resetting known/blank passwords) or a denial-of-service/lockout condition by setting every published post behind an attacker-chosen password, matching the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L (high integrity impact, low confidentiality and availability impact). Publicly available exploit code exists (the WPScan entry is tagged as an exploit reference), and no CISA KEV entry is associated with this CVE, so this is not confirmed as actively exploited; the practical risk is concentrated in the narrow set of sites that actually have this low-prevalence plugin installed and active, with published, password-protected content.
Unauthenticated SQL injection in the WP-Partner WordPress plugin (all versions through 1.2.1) allows remote attackers to append arbitrary SQL to an existing query and exfiltrate data from the underlying WordPress database, including user credentials, hashes, and other sensitive site content. The flaw carries a CVSS v3.1 base score of 8.6 (the independent assessment re-scores it as AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, i.e. high confidentiality impact with no direct integrity or availability effect), requires no authentication or user interaction, and publicly available exploit code exists - though there is no confirmation of active exploitation (no CISA KEV listing). Risk is concentrated on sites that actually run this specific, low-footprint plugin; any such site exposing the vulnerable endpoint over HTTP(S) is directly exploitable with default configuration.
Unauthenticated SQL injection in the Recordbrowser WordPress plugin (all versions through 1.1.7) allows remote attackers to append arbitrary SQL to plugin-issued database queries and read sensitive data from the underlying WordPress database. The vulnerable endpoint requires no authentication, no privileges and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), so any reachable site with the plugin installed and active is exposed; publicly available exploit code exists, and the flaw is not currently listed in CISA KEV, so confirmed active exploitation has not been established. The practical risk is limited mainly by deployment footprint - the plugin must be present and its vulnerable parameter reachable - but for sites that do run it, this is a genuine priority.
Unauthenticated SQL injection in the WpCues Basic Quiz WordPress plugin through version 1.6.5 allows remote attackers to read arbitrary data from the site's database. Publicly available exploit code exists, but no confirmed active exploitation (CISA KEV) is reported. The independent assessment rates confidentiality impact as High with no integrity or availability impact and scope unchanged, so the practical risk is data disclosure for sites running the vulnerable plugin.
Unauthenticated SQL injection in the Llavero.io WordPress plugin (versions through 0.1.4) allows remote attackers to inject arbitrary SQL through an unsanitized parameter and read data from the site's WordPress database. Exploitation requires no authentication and no user interaction (CVSS PR:N/UI:N), and publicly available exploit code exists via the WPScan disclosure, though CISA KEV does not list this as confirmed actively exploited. Based on the independent assessment, impact is confined to confidentiality (read-only data disclosure, C:H/I:N/A:N), and the practical exposure is limited by the plugin's niche, early-version footprint.
Unauthenticated SQL injection in the Site Setup Wizard WordPress plugin through 1.5.8 allows any remote attacker who can reach a site running the plugin to inject arbitrary SQL through an improperly sanitised parameter and read data from the site's database, including potentially password hashes, user records and stored configuration secrets. Exploitation requires no authentication, no user interaction and no special configuration - only that the plugin be installed and active at version 1.5.8 or earlier - and publicly available exploit code exists. The flaw is read-only in effect (Confidentiality High, Integrity None, Availability None per our assessed vector), so it does not by itself permit data modification or full site takeover, and there is no indication of confirmed active exploitation (CISA KEV).
Unauthenticated SQL injection in the Social Web Suite WordPress plugin through 4.1.12 lets remote attackers read arbitrary data from the site's database, because the plugin accepts requests supposedly authorized by its shared secret before ever requiring that secret to be configured, and then passes an unsanitized parameter directly into an SQL statement. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that no authentication, privileges, or user interaction are needed: any internet-facing WordPress installation running a vulnerable version in the unconfigured state is directly exploitable. Publicly available exploit code exists, and while the primary limiting factor is the deployment footprint of this specific plugin (and the unset-secret prerequisite), the high confidentiality impact makes this a credible, actionable priority rather than a theoretical high-CVSS issue.
Stored cross-site scripting in the WordPress plugin KeyWord Collector through version 1.4 allows an unauthenticated remote attacker to POST arbitrary values directly to the plugin's settings-save routine, which enforces neither a capability/authorization check nor a nonce (CSRF) check, and the stored values are then rendered without output escaping. The injected JavaScript executes when a logged-in administrator later opens the plugin settings page, or when any site visitor loads a front-end page that displays the plugin's output; publicly available exploit code exists for this issue. Our independent assessment scores the flaw 6.1 under CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, which is more conservative than the 8.8 figure circulated elsewhere: exploitation is unauthenticated and requires no non-default configuration, but it is constrained by user interaction (UI:R) and the demonstrated consequence is script execution in a victim's browser session rather than direct server-side compromise.
WordPress sites running the Topcontent plugin through version 1.2.1 are exposed to stored cross-site scripting when the plugin's API key has never been configured, because an unauthenticated request handler lacks authorization and stores submitted content as posts without HTML sanitization. Publicly available exploit code exists, and a victim must load the malicious post for the injected JavaScript to execute. The issue is rated 8.8 by the input CVSS but the independent assessment assigns a more limited impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting that exploitation requires an unconfigured API key and user interaction; it is not confirmed as actively exploited in CISA KEV.
The Disable Users WordPress plugin (versions through 1.0.5) fails to apply its account-disabling control consistently across all authentication paths, so an attacker who holds the credentials of an account an administrator has disabled can still log in and operate with that account's original privileges. Exploitation requires pre-existing valid credentials for a previously disabled account (CVSS PR:L, base score 8.8), and the regained access is bounded by the role that account held - but where the disabled user was an administrator, the result is full site compromise (C:H/I:H/A:H). Publicly available exploit code exists per the WPScan disclosure; there is no indication of confirmed active exploitation (no CISA KEV entry in the provided data).
Stored cross-site scripting in the SmugMug Embed WordPress plugin through 3.13 allows unauthenticated remote users to store arbitrary gallery data via an AJAX action that lacks authorization and CSRF checks, with the payload executing when a logged-in administrator views the plugin's settings screen. Publicly available exploit code exists, but the independent assessment keeps impact limited: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, requiring administrator interaction and yielding low confidentiality and integrity impact. There is no CISA KEV confirmation in the provided data, so this should be treated as exploitable via public PoC rather than confirmed actively exploited.
Stored cross-site scripting in the BuddyPress Instant Chat WordPress plugin (versions through 1.6) lets remote, unauthenticated users inject persistent JavaScript into a chat conversation they do not belong to, because the plugin neither verifies that the message sender is a participant in the target conversation nor escapes message content when rendering it. The injected script stays dormant until a legitimate member - potentially an administrator or other privileged user - loads and views that conversation, which is why exploitation requires user interaction rather than being fully automatic. WPScan has published a proof-of-concept advisory, so publicly available exploit code exists, and although the vendor/NVD score is 8.8, the realistic impact is more contained: script execution within a member's authenticated WordPress session in the context of the affected site, with no direct server-side compromise shown.
Unauthenticated attackers can plant persistent JavaScript that executes in the browser of every visitor to a WordPress site running the Adwised Web Push Notification plugin through version 2.5.7, because several state-changing plugin operations lack authorization checks and the plugin's secret-comparison routine can be defeated on installations where a secret key was never configured. Publicly available exploit code exists (WPScan published a proof-of-concept write-up), though there is no KEV confirmation of active exploitation. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) shows a network-reachable, unauthenticated attack that requires a victim visitor to load an affected page, so real-world impact is bounded by the unconfigured-secret precondition, and hardened installs that have set a secret are not affected.
Stored cross-site scripting in the Adwised Web Push Notification WordPress plugin through version 2.5.7 allows any authenticated user - including a low-privileged subscriber - to overwrite the plugin's site-wide configuration and plant JavaScript that executes for every visitor of every front-end page, administrators included. The plugin performs no capability or nonce check on the configuration-update action and prints the stored settings unescaped inside an inline script block, so exploitation is trivial on any site with open user registration. Publicly available exploit code exists (WPScan reference), no CISA KEV listing has been recorded, and successful abuse yields session theft, administrator account takeover, and persistent compromise of the front end; no vendor-released patch was identified at time of analysis.
Stored cross-site scripting in the WordPress plugin Web Vitals Tracking (versions through 5.4.2) allows unauthenticated visitors to inject arbitrary script content by submitting unvalidated, unescaped performance measurements that the plugin persists and later renders inside a script context on an administrative reporting page. The attack is remote and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R), but the payload only executes when a logged-in administrator loads the affected admin page, so exploitation depends on administrator activity rather than firing automatically; publicly available exploit code exists and the issue is tracked by WPScan as well as EUVD-2026-96769. Our independent assessment rates the impact more conservatively than the vendor/NVD score (scope-changed XSS with low confidentiality and integrity impact and no availability impact), so this should be treated as a credible, medium-to-high priority issue rather than a top-tier emergency.
Unauthenticated stored cross-site scripting in the HootBoard WordPress plugin (all versions through 3.1.4) lets any remote attacker inject arbitrary JavaScript through the plugin's REST endpoints, which lack authorization checks and store values without escaping before rendering them on a public page. The injected script executes in the browser of any visitor to that page - most dangerously a logged-in administrator, which is the path to full site compromise - but it requires the victim to view the poisoned page, so the impact is client-side and conditional rather than direct server takeover. Publicly available exploit code exists (the WPScan disclosure entry doubles as an exploit reference) and no vendor patch has been confirmed; our independent vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) rates this below the 8.8 vendor score, reflecting the interaction requirement and the typically low-severity confidentiality/integrity effect on the victim's browser session alone. No EPSS or CISA KEV data is present in the feed, so this should be treated as an actionable priority rather than a confirmed active exploitation event.
Unauthenticated remote attackers can delete arbitrary WordPress options in sites running the Insurify WordPress plugin through version 1.0, due to missing authorization and nonce checks on an AJAX action, potentially taking the site offline and stripping every user of their role. Publicly available exploit code exists, and the vulnerability is remotely exploitable with no authentication required (CVSS 9.1). Any site with the vulnerable plugin active is at risk.
Unauthenticated remote attackers can rewrite arbitrary WordPress site settings through an AJAX action exposed by the Quick Quotes plugin through version 1.0.0, which performs no capability or nonce validation on the request. Successful abuse allows an attacker to change site-wide options - including those that can render the site unreachable - with no authentication, no user interaction, and no non-default configuration required, yielding an assessed CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H). Publicly available exploit code exists per the WPScan disclosure, though the plugin's obscure deployment footprint limits the broader blast radius; there is no indication of confirmed active exploitation (not in CISA KEV) and no vendor-released patch was identified at time of analysis.
Privilege escalation in the Crowdfundly WordPress plugin (versions through 2.2.2) allows an attacker who already holds one of the plugin's own low-privileged roles to grant themselves the WordPress administrator role or arbitrary capabilities, resulting in full site takeover. The flaw sits in AJAX actions that lack capability checks, so it is reachable remotely with no victim interaction, but the attacker must first obtain a legitimate low-privilege Crowdfundly account - trivial on sites that permit open self-registration of backers/campaigners, and a hard blocker on sites that restrict account creation. Publicly available exploit code exists (per the WPScan entry), while there is no confirmed active exploitation (CISA KEV); the independent assessment rates this as an authenticated privilege-escalation issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rather than the higher-privilege PR:H rating shown in some feeds.
Unauthenticated remote attackers can overwrite arbitrary WordPress options on any site running the Insurify plugin through version 1.0, because one of the plugin's AJAX actions performs neither a capability (authorization) check nor a nonce/CSRF check - a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) reflects high integrity and availability impact with no privileges or user interaction required. Exploitation can rewrite site-critical options, take the site offline, and deactivate the plugin itself, and publicly available exploit code exists (per the WPScan report and its exploit-tagged reference); there is no indication of confirmed active exploitation (not listed in CISA KEV). The practical constraint is the plugin's limited deployment footprint, not any technical barrier.
Unauthenticated attackers can update and delete arbitrary WordPress options through the AI Content Generator Marketing plugin (versions through 1.0.0), a capability that typically enables full site takeover by, for example, flipping the default new-user role to administrator and enabling open registration. The plugin's AJAX handlers perform neither a nonce check nor a capability check, and because the CVSS vector is AV:N/AC:L/PR:N/UI:N with C/I/A all High, no authentication, user interaction, or non-default configuration is required - only that the plugin be installed and active and its endpoints reachable. Publicly available exploit code exists (ratings from WPScan), making opportunistic mass scanning realistic; there is no CISA KEV confirmation of active exploitation and no EPSS score was supplied, so this should be treated as high-severity, readily exploitable, but not yet confirmed as exploited in the wild. All available signals point to genuinely high risk.
Authentication bypass in the Freeton WP WordPress plugin through version 1.0.0 lets unauthenticated attackers log in as any existing user, including administrators, using only that user's email address, because the plugin does not correctly validate the activation code used during authentication. The flaw is rated 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-287) and requires no credentials and no user interaction; publicly available exploit code exists (referenced from the WPScan entry), and no CISA KEV listing indicates confirmed active exploitation. Exposure is limited to WordPress sites where the plugin is installed and active - an important qualifier given the plugin's small footprint - but for those sites the practical barrier is only knowledge of a valid account email, which is commonly obtainable through WordPress author enumeration.
Authentication bypass in the Mindstien Quick Login WordPress plugin through version 1.0 allows unauthenticated remote attackers to obtain an administrator session on any affected site where the plugin is active and configured with an administrator account. The flaw (CWE-287) stems from the plugin failing to validate a request-supplied value against the visitor's own session before authenticating them, yielding a CVSS 3.1 base score of 9.8. Publicly available exploit code exists, and while the vulnerability is not confirmed as actively exploited (CISA KEV), the low attack complexity and lack of required authentication make immediate remediation critical.
Stored cross-site scripting in the click5 CRM add-on for Contact Form 7 (all versions up to and including 1.0.4) lets unauthenticated attackers submit crafted content through the plugin's submission endpoint, which is stored and later rendered into an administrative page without sanitisation or escaping, so the injected script executes in the browser of a high-privilege user such as an administrator. Publicly available exploit code exists, and the add-on must be installed and active for exposure, but the attack is not autonomous: it succeeds only when a logged-in privileged user subsequently opens the poisoned admin screen. No confirmed active exploitation (CISA KEV) has been reported, and an independent reassessment rates the realistic severity considerably lower than the headline CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), with the required admin interaction as the primary limiting factor.
Stored cross-site scripting in the click5 CRM add-on to Gravity Forms (all versions through 1.0.3) lets an unauthenticated attacker plant script into CRM content submitted through the plugin's public, unauthenticated content-submission endpoint; the input is neither sanitised on entry nor escaped on output, so the payload executes when a high-privilege user - typically an administrator - later opens the admin page that renders the stored CRM data. Publicly available exploit code exists (WPScan published a proof-of-concept reference), but there is no CISA KEV entry or other confirmation of active exploitation. Although the bundled score of 8.8 implies severe impact, our independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, because exploitation is conditional: the plugin must be installed with its submission endpoint reachable, and an administrator must subsequently review the poisoned entry before the script fires.
Stored cross-site scripting (XSS) in the click5 CRM add-on to the WordPress plugin WPForms through version 1.0.3 lets an unauthenticated attacker plant a persistent script payload through the add-on's public submission endpoint; the payload is later rendered without sanitisation or escaping on an administrative page, so it executes in the browser session of a high-privilege user such as an administrator who views that page - a UI:R condition that gates actual code execution. Publicly available exploit code exists (WPScan published the vulnerability entry), but there is no confirmed active exploitation (no CISA KEV listing) and no EPSS figure was supplied; the risk is further bounded by the add-on's niche deployment and by the fact that the script runs in an admin browser rather than on the server. Our independent assessment rates this lower than the input's 8.8 (High), using a scope-changed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), which keeps the exploit prerequisites - installed and active add-on, unauthenticated submission, and administrator interaction - central to any real-world prioritisation.
Stored cross-site scripting in the click5 CRM add-on for Ninja Forms (all versions through 1.0.1) allows an unauthenticated attacker to submit crafted content through the add-on's public form endpoint and have it persisted without sanitisation, so the payload executes in the browser of any high-privilege user - typically an administrator - who later opens the admin page that renders those submissions. Exploitation requires no credentials to plant the payload (CVSS vector PR:N), but it does require user interaction (UI:R), meaning an administrator must actually view the poisoned submission for the script to fire; publicly available exploit code exists and the bug was reported by WPScan, though there is no confirmed active exploitation (CISA KEV) at time of analysis. Scored 8.8 under the NVD/A:H/C:H/I:H vector, but our independent assessment rebases it to CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (scope change, limited confidentiality and integrity, no availability impact), making this a moderate rather than top-tier priority that is bounded by whether admins routinely review unfiltered submission data.
Unauthenticated option manipulation in the click5 CRM add-on to Contact Form 7 (versions through 1.0.4) lets remote attackers rewrite arbitrary WordPress options without authorization, a nonce, or any user interaction, which is sufficient to enable user registration and create a new administrator account for full site takeover. The flaw carries a 9.8 CVSS score (AV:N/AC:L/PR:N/UI:N), and publicly available exploit code exists, making this a realistic and high-priority target for mass scanning against any WordPress site that has this specific add-on installed and active; Contact Form 7 alone, or WordPress without the add-on, is not affected. No CISA KEV entry was provided, so active exploitation is not independently confirmed, but the combination of unauthenticated reachability, trivial preconditions, and published exploit code warrants urgent triage and removal or blocking of the vulnerable endpoint.
Unauthenticated option manipulation in the click5 CRM add-on to Gravity Forms (versions up to and including 1.0.3) lets any remote attacker rewrite arbitrary WordPress blog options and escalate to complete site takeover by enabling open registration with an administrator default role, thereby creating a new admin account. The flaw is a missing authorization/CSRF class issue exposed through a REST endpoint that neither checks the caller's capabilities nor verifies that the targeted option belongs to the add-on, so no credentials, nonce token, or user interaction are required against a default configuration. Publicly available exploit code exists, and the only real prerequisite is that the affected add-on be installed and active on a reachable WordPress site; no CISA KEV entry was present in the supplied intelligence, so active exploitation is not confirmed.
Unauthenticated attackers can take over any WordPress site running the click5 CRM add-on for WPForms (versions through 1.0.3) by abusing a REST endpoint that updates blog options without authorization, CSRF validation, or any check that the targeted option belongs to the add-on. Because the endpoint accepts arbitrary option names, an attacker can set registration-related options and a default administrator role to create a new admin account, or otherwise alter site configuration, leading to full site compromise. The flaw carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), publicly available exploit code exists, and exploitation requires only that this niche add-on be installed and active.
Unauthenticated option overwrite in the click5 CRM add-on to Ninja Forms allows any remote attacker to write arbitrary WordPress blog options on sites running the add-on at version 1.0.1 or earlier, a primitive that can be chained into creating a rogue administrator account and complete site takeover. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact (9.8), so the CVSS vector confirms no authentication and no user interaction are required against default configurations that simply have the add-on active. Publicly available exploit code exists, tracked by WPScan and mirrored in ENISA EUVD as EUVD-2026-96753, while there is no confirmed actively exploited (CISA KEV) status at time of analysis; exposure is bounded by the add-on's niche deployment rather than by any authentication or non-default configuration requirement.
Unauthenticated remote attackers can seize control of the payment configuration on WordPress stores running the Fundiin cho WooCommerce plugin through 3.4.0, because several of its REST API routes enforce authorization only through a credential that is hardcoded identically in every installation. Exploiting this yields disclosure of the store's payment gateway credentials and customer order data, allows the gateway configuration to be rewritten so that payments are credited to an attacker-controlled destination, and permits unpaid orders to be marked as paid; the same missing authorization additionally allows script to be stored and rendered unescaped on the classic WooCommerce checkout, producing unauthenticated stored XSS. CVSS 3.1 scores this 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and publicly available exploit code exists per the WPScan report, while no CISA KEV entry was present in the supplied intelligence.
Unauthenticated SQL injection in the Tcard WP WordPress plugin (all versions through 1.8.0) allows remote attackers to inject arbitrary SQL through one of the plugin's AJAX actions, exposing data from the underlying WordPress database. Exploitation requires no authentication, no user interaction, and no non-default configuration - only that the plugin be installed and active - and publicly available exploit code exists, though there is no confirmed actively exploited (CISA KEV) signal. The assessed impact is read-oriented (high confidentiality, no integrity or availability impact), so the practical risk is sensitive-data disclosure rather than site takeover, with real-world exposure bounded by how widely this low-footprint plugin is deployed.
Memory exhaustion denial of service in WooCommerce Bookings (versions before 3.11.0) allows unauthenticated remote attackers to take a WordPress site offline with a single crafted request, because one of the plugin's unauthenticated AJAX actions feeds a user-supplied value directly into a memory allocation routine without validating or capping its size (CWE-400). Exposure is limited in scope but not in ease: only sites running the paid WooCommerce Bookings extension below 3.11.0 are affected (core WooCommerce is not), while the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, A:H, score 7.5) confirms that no credentials, user interaction, or non-default configuration are required. Publicly available exploit code exists, so any internet-facing site meeting the version condition should be treated as trivially reachable; the consequence is availability loss only, with no confidentiality or integrity impact.
Unauthenticated attackers can permanently delete arbitrary posts, pages, and media attachments on WordPress sites running WeddingCity Lite version 1.0.4 or earlier due to missing authorization checks in the plugin's deletion handler. The flaw, tracked as CWE-862, is remotely exploitable without authentication (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) and affects default installations with the plugin active. Publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been reported; the risk is high for affected sites due to the trivial attack requirements, but exposure is limited by the plugin's niche install base.
Envira Gallery WordPress plugin versions before 1.16.2 fail to verify the capability WordPress reserves for plugin installation when handling the setup-wizard plugin-installation request, letting an authenticated Multisite subsite Administrator install any WordPress.org-published plugin into the network-shared plugins directory - an action Multisite reserves for the network Super Admin. The issue is gated: it only crosses a privilege boundary on WordPress Multisite networks and requires the attacker to already hold subsite-Administrator credentials (CVSS 3.1 AV:N/AC:L/PR:H/UI:N, assessed with S:C/C:H/I:H/A:H, scored 7.2), and it is not exploitable on standard single-site WordPress where Administrators legitimately install plugins. Publicly available exploit code exists (WPScan-published), and the vendor has released a fixed version 1.16.2.
Unauthenticated remote code execution in the Anton Extensions WordPress plugin (versions ≤1.2.2) allows attackers to upload arbitrary PHP files to attacker-chosen paths, because the plugin omits capability checks, nonce verification, and file-type validation in its file upload handler. Publicly available exploit code exists according to WPScan, and exploitation requires only that the plugin be installed and active on a reachable WordPress site. The CVSS score of 9.8 reflects critical severity with no authentication required.
Unauthenticated SQL injection in the Mobile builder WordPress plugin (all versions through 1.4.2) lets any remote attacker inject arbitrary SQL into the site's backend database and read data the application can access. The assessed vector (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms no authentication, no user interaction and no special configuration are required, with the sole precondition being that this non-default plugin is installed and active, and impact is confined to confidentiality. Publicly available exploit code exists (published via the WPScan vulnerability entry), and while this is not confirmed actively exploited (CISA KEV), the unauthenticated reachability and low skill barrier make it a genuine priority for any site running the plugin.
Privilege escalation in the Mobile Builder WordPress plugin (versions through 1.4.2) allows any authenticated low-privilege user - including a self-registered customer account - to grant themselves the administrator role by writing unrestricted user meta keys through one of the plugin's REST routes. The flaw requires only a valid low-privilege account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) and no administrator interaction, and publicly available exploit code exists according to WPScan. Sites with open user self-registration enabled are the easiest to attack, but any existing low-privilege user can still exploit the vulnerable route; CISA's SSVC rates technical impact as total while noting no observed exploitation and no known automatable exploitation at this time.
Stored cross-site scripting in the Prenotazioni WordPress plugin (all versions up to and including 1.7.5) lets an unauthenticated attacker write arbitrary JavaScript into plugin settings that are saved without any capability or CSRF check and then rendered without output escaping. The payload persists in the site database and executes in the browser of any administrator opening the affected settings screen or any visitor viewing the affected front-end rendering, so impact is scoped to the privileges of the victim's own session rather than to the server itself. A public proof-of-concept/write-up is available (WPScan), while SSVC records exploitation status as 'none' and non-automatable; no EPSS score was supplied. Note the discrepancy between the researcher-assigned 8.8 (S:U/C:H/I:H/A:H) and our independent assessment (S:C/C:L/I:L/A:N), which treats confidentiality and integrity impact as limited because execution requires a page view (UI:R) and only affects the victim's browser session.
Remote code execution in the AWP Classifieds WordPress plugin before 4.4.9 allows an authenticated user holding the plugin's management capability to import a crafted ZIP archive whose contents are extracted without file-type validation, planting arbitrary PHP into a publicly accessible, network-shared directory. Because the extraction target is web-reachable, the uploaded PHP can be requested and executed, yielding code execution under the web server account. Exploitation is gated by the required management capability (CVSS PR:L), and a vendor patch is available in 4.4.9; publicly available exploit code exists and EPSS is low at 0.19% (8th percentile), with no CISA KEV listing indicating confirmed active exploitation. CWE-434 (unrestricted upload of a file with a dangerous type) is the root cause class.
Unauthenticated attackers can forge payment-notification callbacks to the Nexi XPay Build WordPress plugin (through version 7.6.2) and mark arbitrary WooCommerce orders as paid - or downgrade genuinely paid orders to a failed status - because the plugin skips its security-token comparison whenever the targeted order has no stored token. The issue is remotely reachable at low complexity with no authentication and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5), and the impact is purely integrity-based: no confidentiality loss, but direct tampering with order and payment state on the store. Publicly available exploit code exists; however, no CISA KEV listing or other confirmation of active exploitation is present in the supplied intelligence, and exploitation is constrained to orders that happen to be in the tokenless condition.
Unauthenticated payment-result forgery in the Nexi XPay Build WordPress plugin through 7.6.2 lets any remote attacker mark arbitrary orders as paid or failed, cancel those orders at will, and retrieve the order keys that unlock guest buyers' personal details. The vulnerable surface is the plugin's payment-result handling routes, which accept a supplied payment result without verifying it, so no credentials, user interaction, or non-default configuration are needed beyond a site running the plugin as an active Nexi XPay gateway. Publicly available exploit code exists via the WPScan advisory, and although there is no confirmed active exploitation (not listed in CISA KEV), the high integrity impact on order state and the exposure of guest customer data make this an actionable priority; exploitation is limited in practice only by the narrow installed base of this specific gateway plugin.
Unauthenticated PHP object injection in the String Locator WordPress plugin (versions before 2.6.8) lets an attacker store a crafted serialized PHP object in a database row via the plugin's database editor, with no authentication required (PR:N per the assessed vector). The payload only fires when a site administrator subsequently opens and saves that row in the editor, which is the UI:R precondition, and it escalates to remote code execution, arbitrary file deletion, or sensitive data disclosure only if a suitable POP gadget chain exists in another installed plugin or component, which is why our independent assessment rates attack complexity as High (AC:H) despite the raw CVSS 8.8 vector using AC:L. Publicly available exploit code exists, but the two gating conditions (an admin save action plus a usable gadget chain) meaningfully reduce real-world exploitability, and no CISA KEV listing confirms active exploitation.
Reflected cross-site scripting in the If-So Dynamic Content WordPress plugin (versions 1.4.4 through below 1.10.2) lets an unauthenticated attacker supply a value whose URL scheme is not validated, which is then reflected into a link on a plugin admin page and executed as arbitrary JavaScript in the browser of a logged-in administrator who opens a crafted link. Publicly available exploit code exists and is documented in the WPScan advisory (also tracked as ENISA EUVD-2026-94188), so this is a non-persistent, socially-engineered attack that must be delivered to each victim individually rather than mass-exploited. The assessed CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, with no availability impact in our assessment) reflects the scope change inherent to XSS in a privileged admin context, but the practical impact is bounded by the user-interaction prerequisite and by the fact that a privileged WordPress user must be lured into clicking the link.
Privilege escalation in the Koinonia Link WordPress plugin (versions 1.1.2 through earlier than 1.1.5) lets any authenticated user, including a low-privileged subscriber, grant themselves the Administrator role by tampering with the role value submitted during a profile update. The flaw is a missing authorization check on the role-save routine (CWE-269), not a memory-safety or injection bug, and it is remotely reachable with no user interaction (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8), meaning successful exploitation yields total control of the WordPress site. Publicly available exploit code exists and the vendor has released a fix in 1.1.5; the practical barrier is only the need for a valid account, so sites with open self-service registration are exposed to unauthenticated attackers who simply register first, while sites with registration disabled limit the threat to existing users.
Reflected cross-site scripting in the Magee Shortcodes WordPress plugin through version 2.1.1 lets unauthenticated attackers inject script into pages by abusing AJAX actions that reflect unsanitised user input back to the browser. Exploitation requires a victim with an active session to be socially engineered into clicking a crafted link pointing at one of the plugin's unauthenticated AJAX endpoints, and the resulting impact is bounded by that victim's privileges - a moderated session yields limited damage, while an administrator session could enable actions such as session or content manipulation. CVSS 3.1 scores the issue 7.1 (AV:N/AC:L/PR:N/UI:R/S:C), WPScan is credited with the report, and publicly available exploit code exists, though there is no evidence of confirmed active exploitation (CISA KEV) and no vendor-released fixed version has been identified at time of analysis.
Authenticated users holding the WordPress Editor role on sites running the WP Coder plugin (versions 4.0 up to but not including 4.5.2) can save and execute arbitrary PHP code on the server, resulting in full site compromise. The flaw is a privilege-boundary failure: the plugin gates its PHP code-execution feature on a content capability that the Editor role holds by default rather than restricting it to administrators, so no plugin misconfiguration is needed. Exploitation requires an existing Editor-level (or higher) account - it is not remote-unauthenticated - but publicly available exploit code exists, and the vendor has released WP Coder 4.5.2 to fix it. No confirmed active exploitation (CISA KEV) has been reported, so risk is concentrated on sites that hand Editor access to semi-trusted contributors.
Cross-site request forgery in the CoCart WordPress plugin before 4.9.7 lets an unauthenticated remote attacker create a new administrator account on a victim site by luring a currently logged-in administrator to an attacker-controlled page. Because the plugin's REST API authentication filter is not scoped to its own endpoints, it disables WordPress core's REST nonce protection for every /wp-json/ route once the plugin is active (versions 4.9.0 through 4.9.6), so the forged write rides the administrator's live cookie session (CVSS:3.1/AV:N/AC:L/PR:N/UI:R, base 8.8). Publicly available exploit code exists and successful exploitation yields full site takeover, though EPSS is only 0.11% (1st percentile) and the attack cannot be automated against anonymous visitors - it is gated on an active admin session plus social-engineering interaction.
Unauthenticated attackers can seize a privileged point-of-sale session on WordPress sites running the TillKit plugin before 1.0.5, letting them read customer and site-user personal data and modify store records. On activation the plugin creates a privileged POS account protected by a hard-coded, publicly known PIN that it never forces administrators to change, and its public POS login endpoint authenticates on that PIN alone with no identity or capability check (CWE-287); the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N confirms this is remotely reachable with no credentials and no user interaction. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV) and EPSS is low at 0.14% (3rd percentile), so real-world urgency depends on whether TillKit is actually deployed and whether the default PIN is still in place.
Unauthenticated SQL injection in the SaveTo Wishlist Lite WordPress plugin before 1.1.5 allows remote attackers to append arbitrary SQL queries to the ORDER BY clause of a database query, enabling extraction of sensitive information from the WordPress database. Publicly available exploit code exists, though EPSS is low (0.17%, 6th percentile) and there is no indication of active exploitation (CISA KEV not listed). The vendor has released a patch in version 1.1.5.
Stored cross-site scripting in the WebP Express WordPress plugin before 0.25.16 lets unauthenticated visitors submit values that the plugin's bundled HTML parser later re-emits into element attributes without escaping, so the payload breaks out of the attribute context and executes in the browser of anyone who loads the affected page, including administrators. The vulnerable code path is only reached when a non-default image delivery mode is enabled; default installations do not exercise it, and the stored payload only fires when a victim views the page, which is why the assessed vector carries UI:R and AC:H despite PR:N. A public PoC reference exists in the WPScan entry but is not verified as working exploit code, and there is no CISA KEV confirmation of active exploitation; vendor patch 0.25.16 is available and the issue is prioritized as this_week rather than emergency-level.
Royal MCP, a WordPress plugin, issues preview-link tokens that are not bound to the single preview they were created for; in versions before 1.5.7 any party holding a valid token is authenticated as the token's owning user - an administrator in a default install - across the entire REST API without a nonce check, enabling full site takeover. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects that the hard part is obtaining such a token, and the available sources do not describe how a token is acquired or how long it stays valid, so practical acquisition difficulty is unverified. A public PoC reference exists (the WPScan entry) but it is not verified as working exploit code, and no CISA KEV listing or EPSS scoring is present in the supplied data.
Stored cross-site scripting in the PixelYourSite WordPress plugin before 11.4.3 and PixelYourSite Pro before 12.6.8 lets unauthenticated remote attackers plant script in a page that is then served to other visitors. The plugin prints an attacker-supplied cookie value into page output without sanitising or escaping it, so on a site running a full-page cache the payload is persisted in the cached copy rather than only reflected back to the sender. Scored CVSS 3.1 at 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) with a scope change because the script executes in other users' browsers; a vendor patch is released (11.4.3 / 12.6.8), a public PoC reference exists but is not verified as working exploit code, and no confirmed active exploitation or KEV listing was reported.
Privilege escalation in the HIPAA Forms WordPress plugin (versions before 3.3.2) lets an account that already holds the plugin's own custom user role push that role up to administrator-level capabilities. The plugin handles a request that rebuilds its custom role without any capability check, so a role holder can rewrite their own permissions; per the assessed vector the attacker must be authenticated and must already possess that specific custom role (PR:H), making this an insider or role-holder escalation path rather than unauthenticated remote takeover, and no victim interaction is required. A public PoC reference exists but is not verified as working exploit code, there is no CISA KEV listing, and a vendor fix is available in 3.3.2.
Unauthenticated stored cross-site scripting in the Jane Menu WordPress plugin before 1.5.1 lets remote attackers bind any published page to an attacker-controlled remote document that the plugin fetches and renders without escaping, causing arbitrary JavaScript to execute for visitors, including administrators. Authentication is not required, but exploitation is not automatic: the payload fires only when a victim visits the tampered published page (UI:R). Publicly available exploit code exists; CISA KEV does not list this CVE, and the independent assessment rates this as a genuine high-priority issue rather than an inflated score.
SQL injection in the Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 allows unauthenticated remote attackers to read arbitrary WordPress database contents by controlling a sort parameter that is placed directly into an SQL ORDER BY clause. The assessed vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, so the practical impact is high confidentiality loss with no integrity or availability effect, and no authentication or user interaction is needed. Publicly available exploit code exists; exposure is limited to sites running an affected plugin version with the chat-widget request handler reachable.
Unauthenticated SQL injection in Click n Chat (Chat Widget Integration) before 1.1.3 allows remote attackers to influence SQL query structure by supplying a parameter that the plugin uses as a column identifier without validation, giving high confidentiality impact through database data exposure with no integrity or availability impact assessed. Publicly available exploit code exists, and only WordPress sites with this specific plugin below version 1.1.3 are exposed, making the affected population narrow. The independent assessment rates the issue as network-reachable, low-complexity, and unauthenticated with scope unchanged, while the supplied base score is 8.6.
Stored cross-site scripting in the Weglot WordPress plugin before 6.4.3 lets unauthenticated attackers plant a payload that executes in the browser of anyone who views an affected page in a translated language. The flaw appears when Weglot rewrites links for translated content: it re-inserts URLs without escaping and reverses earlier encoding. Exploitation requires the site to have link rewriting/translation rendering active with at least one additional language and a victim to load the translated view; publicly available exploit code exists, and the issue is moderate priority rather than a critical fire-drill.
Unauthenticated remote attackers can exhaust the daily rate-limit allowance for payment gateway verification in the Formidable Forms WordPress plugin on sites running versions 6.5 through 6.x with a payment gateway configured, causing legitimate verification attempts to be refused for up to 24 hours. The plugin records the rate-limit timestamp without verifying the caller's identity, so the issue is a bounded availability impact against the verification function rather than a full site outage or system compromise. Publicly available exploit code exists, a vendor patch is available in version 7.0, and the independently assessed impact is availability-only.
Stored cross-site scripting in the Advanced File Manager WordPress plugin (versions 5.4.13 through before 6.0.0) lets an attacker with file-manager access plant a file whose embedded script survives sanitisation, which then executes in the browser of any user who opens or previews it - typically an administrator. Exploitation requires a low-privileged account that an administrator has explicitly delegated file-manager access to (PR:L) plus a victim opening the crafted file (UI:R), which is why public exploit code exists but no active exploitation has been confirmed. Fixed in 6.0.0; the vendor advisory and WPScan entry document the detection flaw.
miniOrange 2FA versions 6.2.9 to before 6.3.1 permit an attacker who already knows a victim's WordPress password to add an attacker-controlled passkey during a pending passkey login, bypassing the second factor on accounts that already have a passkey. The assessed vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N, so exploitation is authenticated (PR:L) and depends on a timing/state window (AC:H), with high confidentiality and integrity impact but no availability impact; publicly available exploit code exists, while no CISA KEV entry was supplied.
Reflected cross-site scripting in the User Profile Builder WordPress plugin before 4.0.1 allows an attacker to craft a URL that executes script in the browser of a logged-in high-privilege user, such as an administrator, when that user loads the vulnerable plugin admin page. The attacker needs no WordPress credentials (PR:N), but exploitation requires the victim to click the crafted link (UI:R) and succeeds only against users who can already access that admin page. Publicly available exploit code exists, and the vendor has released version 4.0.1 to address the flaw.
Stored cross-site scripting in CF7 Redirection before 3.2.12 allows unauthenticated visitors to submit form data that is retained and later rendered without proper sanitization or escaping in the lead debug metabox. The payload executes only when a logged-in user, typically an administrator, opens the crafted entry's debug metabox while the plugin's non-default debug mode is enabled. Publicly available exploit code exists, but exploitation is constrained by that configuration dependency and the required privileged user interaction; no CISA KEV confirmation was provided.
Unauthenticated privilege escalation in the WP User Manager WordPress plugin (versions 2.9.21 through 2.9.25) allows an attacker to submit a live paid registration form and receive its configured administrator-equivalent role once the associated payment gateway has been disconnected - the payment gate is silently dropped instead of failing closed. The flaw is rated CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H, CWE-269), but practical exploitation requires the non-default combination of a published paid registration form that assigns a privileged role plus an inactive gateway, so sites that never offered paid registration, never mapped the form to a high-privilege role, or have unpublished the form are not exposed. Publicly available exploit code exists and the issue is fixed in 2.9.26; no KEV listing appears in the supplied intelligence.
Reflected cross-site scripting (CVSS 7.1) in WP Booking System before 2.1.0.3 allows unauthenticated remote attackers to inject script into an administrative page by luring a logged-in administrator to a crafted URL. The plugin reflects one of its parameters without validation or escaping, so the payload executes in the victim administrator's browser session and can perform actions with that user's privileges; exploitation requires user interaction (UI:R). Publicly available exploit code exists, and the vendor has released version 2.1.0.3 as a fix.
Privilege escalation in the Simple Banner WordPress plugin before 3.3.3 lets any role that an administrator has permitted to manage banners gain the full 'administrator' capability, allowing an authenticated low-privileged user to take complete control of the site. The flaw is only reachable when an admin has explicitly delegated banner management to a non-administrator role and the attacker holds an account in that role - a non-default configuration reflected in the AC:H/PR:L vector - so default installs and unauthenticated visitors are not exposed. Publicly available exploit code exists and the vendor has released version 3.3.3 as a fix; no CISA KEV listing is associated with this CVE at time of analysis.
Missing authorization in Backup and Staging by WP Time Capsule before 1.22.28 allows an authenticated Subscriber on a WP Time Capsule staging site to invoke the staging-to-live deployment handler and overwrite the linked live site's database and configuration, potentially taking it offline. Exploitation is conditional on the plugin's staging-to-live workflow being configured with a separate live site, and publicly available exploit code exists. The vendor-released fixed version is 1.22.28.
Account takeover is possible in Uncanny Toolkit for LearnDash (WordPress plugin) before 3.8.2: the plugin's password-reset handler accepts forged cross-site requests without validating their origin, so an unauthenticated attacker who induces a victim - one who is already partway through a reset - into loading a crafted page can set that account's password to an attacker-chosen value. Publicly available exploit code exists and the vendor shipped a fix in 3.8.2, though exploitation is gated by the timing of an in-progress reset plus victim interaction (CVSS 7.5, AC:H/UI:R).
Stored cross-site scripting in the Falang Multilanguage plugin for WordPress before 1.4.6 lets any authenticated user at Subscriber level or above plant script-bearing content that later renders in an administrator's browser session. The plugin's term-translation save handler performs no capability check and hands a valid nonce to any logged-in user, so a low-privilege account is enough to store the payload; execution still depends on a higher-privileged user opening the affected translation screen, which limits the real-world blast radius below the headline 8.0 score. Publicly available exploit code exists and the flaw is fixed in 1.4.6, but exploitation is only realistic on sites that allow self-registration or where the attacker already holds a low-tier account.
Authenticated SQL injection in the Modern Events Calendar Lite and Modern Event Calendar Pro WordPress plugins before version 7.37.0 allows any logged-in user with Subscriber-level access or higher to append additional SQL clauses to an existing query and read sensitive data from the site's database. Only confidentiality is affected - the vulnerable code path provides no route to modify or delete data, and no user interaction is needed (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N per independent assessment). Publicly available exploit code exists, and the practical blast radius is largest on event, membership and community sites that permit open or self-service registration, where an attacker can simply sign up for a low-privilege account.
SQL injection in Modern Events Calendar Lite and Pro versions before 7.37.0 allows authenticated users with Subscriber-level access or higher to read arbitrary data from the WordPress database. Publicly available exploit code exists, though CISA's SSVC assessment finds no active exploitation; the practical barrier is the requirement for a valid low-privilege account, making this a credible mid-tier priority rather than an emergency.
Reflected cross-site scripting in WP Photo Album Plus before 9.2.11.002 allows remote unauthenticated attackers to inject script through a category navigation value that is reflected into a JavaScript event handler on gallery breadcrumb links. The victim must first open a crafted gallery link and then click the breadcrumb, so exploitation depends on that two-step user interaction; targeting a logged-in administrator yields script execution in a privileged session. Publicly available exploit code exists, and the vendor has released a patched version, 9.2.11.002.
Privilege escalation in the Salon Booking System WordPress plugin (10.17 through versions before 10.31.11) lets authenticated users who hold the plugin's custom salon staff role assign arbitrary capabilities, including administrator, to other accounts through the customer-editing function, enabling full site takeover. Publicly available exploit code exists, but the flaw is access-gated: it is not reachable by anonymous visitors or ordinary subscribers and requires a provisioned salon staff account, so exposure depends on how widely that role is granted and on the hygiene of those accounts. It is not confirmed actively exploited (no CISA KEV entry) and no EPSS score was provided.
Unauthenticated remote attackers can force-publish, rewrite, and create the managed pages of any WordPress site running Tutor LMS below 4.1.1, because the plugin's page-regeneration routine omits a capability check (CWE-862). Impact is confined to integrity - unpublished pages can be pushed live, existing page content overwritten, missing pages created, and the plugin options that reference those pages changed - with no confidentiality or availability effect and no code execution, so realistic damage is content tampering and manipulation of plugin page references rather than site takeover. Publicly available exploit code exists, and the CVSS 3.1 base score is 7.5 (HIGH) with vector AV:N/AC:L/PR:N/UI:N, making it trivially reachable on exposed sites; there is no CISA KEV entry indicating confirmed active exploitation at time of analysis.
Reflected cross-site scripting in the Document Gallery WordPress plugin (versions through 5.1.1) lets an unauthenticated attacker inject script into an HTML attribute returned by one of the plugin's AJAX actions, and the payload executes in the browser of any user who opens the crafted link - including a logged-in administrator. Publicly available exploit code exists and the issue is documented in the WPScan vulnerability database (EUVD-2026-101853), so exploitation only requires luring a victim into clicking or loading a malicious URL; no credentials are needed to deliver the payload (CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). At CVSS 7.1 the assessed impact is moderate rather than critical: script execution is confined to the victim's browser session instead of granting direct server control, there is no CISA KEV entry indicating confirmed actively exploited, and the decisive limiting factor is the mandatory victim interaction.
Unauthenticated attackers can register an administrator-equivalent account on any WordPress site running the User Rights Access Manager plugin through version 1.1.3, resulting in full site takeover. The plugin leaves one of its AJAX account-registration handlers accessible without any capability or nonce check, and assigns newly self-registered users a role that was created as a direct copy of the administrator role, so a single crafted request yields a fully privileged account. Publicly available exploit code exists, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms the attack is remote, unauthenticated, and requires no user interaction; no CISA KEV entry has been reported, so active exploitation is not confirmed, but the low complexity and public proof-of-concept make this a high-priority patch target wherever the plugin is deployed.
Stored cross-site scripting in the Forms WordPress plugin (versions before 3.0.2) allows an unauthenticated attacker to submit a crafted form value that the plugin neither sanitises on storage nor escapes when rendering the form submissions screen, so the injected script executes in the browser of any administrator who later opens that dashboard view. Exploitation depends on the site actually using the plugin's public-facing submission feature and on a privileged user subsequently viewing the submissions list, which makes execution deferred and not attacker-controlled in timing; public exploit code exists, but exploitation is not confirmed active (CISA SSVC: exploitation none) and EPSS is low at 0.21% (10th percentile). Our independent assessment re-scores the issue as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - a genuine but non-urgent risk rather than a widespread emergency.
Remote code execution in the affiliate-toolkit WordPress plugin (versions before 3.9.1) lets an authenticated user holding the Contributor role or higher submit a template body that the plugin's bundled templating engine compiles and runs as PHP, giving full server-side code execution with high confidentiality, integrity, and availability impact. Any WordPress site running an affected version is exposed, and because Contributors are unprivileged content authors, sites with open author self-registration or large multi-author teams carry the greatest practical risk; no end-user interaction is required. Publicly available exploit code exists (documented via WPScan) and the EPSS score is low at roughly 0.18% (8th percentile), with no indication of confirmed active exploitation (CISA KEV) and no SSVC exploitation signal, so this rates as a moderate-but-real priority for sites that actually run the plugin.
Unauthenticated remote attackers can delete arbitrary files from WordPress installations running the File Upload to Order plugin before 1.1.4, because the plugin's deletion routine trusts a file path taken from attacker-controlled session data and applies neither validation nor path confinement (CWE-73). The assessed vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H) confirms no authentication or user interaction is needed and that impact crosses the plugin's own security scope into the host WordPress installation, where deleting a file such as wp-config.php can escalate to full site compromise. Publicly available exploit code exists, but SSVC records no observed exploitation and EPSS remains low at 0.19% (8th percentile), so this is currently an easy-to-automate, high-impact integrity/availability risk rather than a confirmed active campaign.
Unauthenticated local file inclusion in the Ultimate Multisite WordPress plugin before 2.17.2 allows remote attackers to traverse the filesystem and read arbitrary local files, including wp-config.php with its database credentials and authentication salts. The plugin passes a user-supplied file-selection value directly into an include operation without validation, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) confirms no authentication and no user interaction are required. Publicly available exploit code exists, but EPSS is low at 0.20% (10th percentile) and CISA SSVC records no known exploitation, so real-world risk is concentrated in internet-reachable WordPress sites that have the plugin active.
Stored cross-site scripting in the WP Booking System WordPress plugin before 2.1.0.1 lets unauthenticated attackers plant a malicious payload through a public-facing booking form; the value is stored without sanitisation or escaping and is later rendered unescaped inside an administration screen, where it executes in the session of any administrator who views the record. Exploitation is gated by that administrator interaction - the payload is inert until an admin opens the affected admin view - and CISA's SSVC assessment rates the issue as not automatable with no observed exploitation, while our own assessment caps the realistic impact at low confidentiality and integrity within a changed scope (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) rather than the 8.8 score reported by NVD. Publicly available exploit code exists and the plugin is widely deployed, but EPSS is only 0.22% (12th percentile) and there is no confirmed in-the-wild activity, so the practical risk hinges on whether an administrator can be induced to open the poisoned admin screen.
Unauthenticated attackers can exploit the Walletdoc Payment Gateway for WooCommerce plugin before version 1.8.5 to execute SQL injection and forge payment webhooks, marking arbitrary WooCommerce orders as paid. The webhook signature check uses a signing secret that is empty by default, so any default installation is vulnerable; the SQL injection works without authentication or user interaction. Publicly available exploit code exists, but EPSS is low (0.21%, 11th percentile) and CISA SSVC indicates no observed exploitation; the vendor has released patch version 1.8.5.
Unauthenticated file-upload handling in the Piotnet Forms WordPress plugin through 1.0.30 lets an attacker store a browser-renderable file (HTML, SVG or similar) inside the site's own origin, so that opening the file executes arbitrary JavaScript - a stored XSS condition. The storage step requires no account and no special configuration, only a publicly reachable form that exposes an upload field; execution is not self-triggering and depends on a victim, typically an administrator reviewing a submission or any user following the file's direct URL, opening the payload (UI:R), with the highest impact when that opener holds an authenticated admin session in the same origin. Publicly available exploit code exists per the WPScan disclosure, and while the vendor-classified score is 8.8, our independent assessment scores the realistic vector lower (S:C, C:L/I:L) because the write and the execution are separated by user interaction and the observable impact depends on who opens the file.
Reflected cross-site scripting in the Subscribe to Comments WordPress plugin (all versions before 2.3.3) allows remote attackers to inject script through a crafted URL whose parameter is reflected unvalidated into a link target, executing in the browser of anyone who clicks it, including logged-in administrators. Per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) the attacker needs no authentication (PR:N), but exploitation is gated by mandatory user interaction (UI:R) and is confined to a single victim's browser session per click - it is reflected, not stored, and does not compromise the server. Publicly available exploit code exists, the vendor has released a patched version (2.3.3), and the issue is not listed in CISA KEV, so confirmed active exploitation is not established; risk is moderate and user-interaction-gated rather than an emergency.
Unauthenticated SQL injection in the WordPress plugin Post Voting System 1.0 and earlier allows remote attackers to inject arbitrary SQL through a request parameter that is passed into a database query without sanitization or escaping, exposing the contents of the site's WordPress database. Every installation with the plugin active is potentially reachable, because exploitation requires no authentication, no user interaction, and no non-default configuration - publicly available exploit code exists, and WPScan has published the vulnerability, so mass scanning is plausible. The practical risk is bounded by deployment: the plugin is niche, and the impact is confined to confidentiality (database read), since the assessed vector is S:U with C:H and no integrity or availability effect; no fixed version is confirmed at the time of analysis, so removal or virtual patching is the current mitigation.
Unauthenticated SQL injection in the WP Verify API WordPress plugin through version 1.0.0 lets remote attackers supply malicious input to a parameter used directly in a SQL query, allowing extraction of database contents. Publicly available exploit code exists, while no EPSS score or CISA KEV entry was provided; the input CVSS is 8.6 (network, low complexity, no privileges or user interaction), and the independent assessment keeps scope unchanged and rates confidentiality impact high with no integrity or availability impact. The practical prerequisite is that a target WordPress site has this specific plugin installed and the vulnerable endpoint reachable.
Unauthenticated SQL injection in the Loja Automática WordPress plugin (versions through 1.0.0) allows remote attackers to read data from a site's backend database by supplying crafted input to a parameter that is not sanitized or escaped before being placed in a SQL query, resulting in a high confidentiality impact per the assessed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 8.6 as published). No authentication, privileges, or user interaction are required, and publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been reported; realistic exposure is limited almost entirely by how rarely this obscure plugin is installed and active. WPScan reported the issue, which is tracked as EUVD-2026-96788.
Unauthenticated SQL injection in the ASPL Product Quotation WordPress plugin through version 1.1.0 allows remote attackers to read arbitrary data from the site's database without credentials or user interaction. Publicly available exploit code exists (reported via the WPScan vulnerability entry), but the flaw is not flagged as confirmed actively exploited (CISA KEV). Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 8.6), impact is confidentiality-only - injected queries can disclose data but do not modify it or affect site availability.
Unauthenticated SQL injection in the Datalist it WordPress plugin through version 0.0.3 allows anonymous attackers to execute arbitrary database queries and read sensitive data from the underlying WordPress database. Publicly available exploit code exists, and the provided CVSS score is high, though the independent assessment scopes confirmed impact to unauthorized database reads under unchanged scope; real-world exposure is likely limited by the plugin's apparent small install base and requires only that the plugin be active and reachable on a WordPress site.
Unauthenticated attackers can reset, overwrite, or replace the post password of every published post on any WordPress site running the WP Posts Password Batch Manager plugin through version 1.1, because the plugin's bulk post-password handler is registered on an always-loaded admin handler and performs neither a capability check nor a nonce check. Successful exploitation with a single crafted request gives the attacker either disclosure of all password-protected post content (by clearing or resetting known/blank passwords) or a denial-of-service/lockout condition by setting every published post behind an attacker-chosen password, matching the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L (high integrity impact, low confidentiality and availability impact). Publicly available exploit code exists (the WPScan entry is tagged as an exploit reference), and no CISA KEV entry is associated with this CVE, so this is not confirmed as actively exploited; the practical risk is concentrated in the narrow set of sites that actually have this low-prevalence plugin installed and active, with published, password-protected content.
Unauthenticated SQL injection in the WP-Partner WordPress plugin (all versions through 1.2.1) allows remote attackers to append arbitrary SQL to an existing query and exfiltrate data from the underlying WordPress database, including user credentials, hashes, and other sensitive site content. The flaw carries a CVSS v3.1 base score of 8.6 (the independent assessment re-scores it as AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, i.e. high confidentiality impact with no direct integrity or availability effect), requires no authentication or user interaction, and publicly available exploit code exists - though there is no confirmation of active exploitation (no CISA KEV listing). Risk is concentrated on sites that actually run this specific, low-footprint plugin; any such site exposing the vulnerable endpoint over HTTP(S) is directly exploitable with default configuration.
Unauthenticated SQL injection in the Recordbrowser WordPress plugin (all versions through 1.1.7) allows remote attackers to append arbitrary SQL to plugin-issued database queries and read sensitive data from the underlying WordPress database. The vulnerable endpoint requires no authentication, no privileges and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), so any reachable site with the plugin installed and active is exposed; publicly available exploit code exists, and the flaw is not currently listed in CISA KEV, so confirmed active exploitation has not been established. The practical risk is limited mainly by deployment footprint - the plugin must be present and its vulnerable parameter reachable - but for sites that do run it, this is a genuine priority.
Unauthenticated SQL injection in the WpCues Basic Quiz WordPress plugin through version 1.6.5 allows remote attackers to read arbitrary data from the site's database. Publicly available exploit code exists, but no confirmed active exploitation (CISA KEV) is reported. The independent assessment rates confidentiality impact as High with no integrity or availability impact and scope unchanged, so the practical risk is data disclosure for sites running the vulnerable plugin.
Unauthenticated SQL injection in the Llavero.io WordPress plugin (versions through 0.1.4) allows remote attackers to inject arbitrary SQL through an unsanitized parameter and read data from the site's WordPress database. Exploitation requires no authentication and no user interaction (CVSS PR:N/UI:N), and publicly available exploit code exists via the WPScan disclosure, though CISA KEV does not list this as confirmed actively exploited. Based on the independent assessment, impact is confined to confidentiality (read-only data disclosure, C:H/I:N/A:N), and the practical exposure is limited by the plugin's niche, early-version footprint.
Unauthenticated SQL injection in the Site Setup Wizard WordPress plugin through 1.5.8 allows any remote attacker who can reach a site running the plugin to inject arbitrary SQL through an improperly sanitised parameter and read data from the site's database, including potentially password hashes, user records and stored configuration secrets. Exploitation requires no authentication, no user interaction and no special configuration - only that the plugin be installed and active at version 1.5.8 or earlier - and publicly available exploit code exists. The flaw is read-only in effect (Confidentiality High, Integrity None, Availability None per our assessed vector), so it does not by itself permit data modification or full site takeover, and there is no indication of confirmed active exploitation (CISA KEV).
Unauthenticated SQL injection in the Social Web Suite WordPress plugin through 4.1.12 lets remote attackers read arbitrary data from the site's database, because the plugin accepts requests supposedly authorized by its shared secret before ever requiring that secret to be configured, and then passes an unsanitized parameter directly into an SQL statement. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that no authentication, privileges, or user interaction are needed: any internet-facing WordPress installation running a vulnerable version in the unconfigured state is directly exploitable. Publicly available exploit code exists, and while the primary limiting factor is the deployment footprint of this specific plugin (and the unset-secret prerequisite), the high confidentiality impact makes this a credible, actionable priority rather than a theoretical high-CVSS issue.
Stored cross-site scripting in the WordPress plugin KeyWord Collector through version 1.4 allows an unauthenticated remote attacker to POST arbitrary values directly to the plugin's settings-save routine, which enforces neither a capability/authorization check nor a nonce (CSRF) check, and the stored values are then rendered without output escaping. The injected JavaScript executes when a logged-in administrator later opens the plugin settings page, or when any site visitor loads a front-end page that displays the plugin's output; publicly available exploit code exists for this issue. Our independent assessment scores the flaw 6.1 under CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, which is more conservative than the 8.8 figure circulated elsewhere: exploitation is unauthenticated and requires no non-default configuration, but it is constrained by user interaction (UI:R) and the demonstrated consequence is script execution in a victim's browser session rather than direct server-side compromise.
WordPress sites running the Topcontent plugin through version 1.2.1 are exposed to stored cross-site scripting when the plugin's API key has never been configured, because an unauthenticated request handler lacks authorization and stores submitted content as posts without HTML sanitization. Publicly available exploit code exists, and a victim must load the malicious post for the injected JavaScript to execute. The issue is rated 8.8 by the input CVSS but the independent assessment assigns a more limited impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting that exploitation requires an unconfigured API key and user interaction; it is not confirmed as actively exploited in CISA KEV.
The Disable Users WordPress plugin (versions through 1.0.5) fails to apply its account-disabling control consistently across all authentication paths, so an attacker who holds the credentials of an account an administrator has disabled can still log in and operate with that account's original privileges. Exploitation requires pre-existing valid credentials for a previously disabled account (CVSS PR:L, base score 8.8), and the regained access is bounded by the role that account held - but where the disabled user was an administrator, the result is full site compromise (C:H/I:H/A:H). Publicly available exploit code exists per the WPScan disclosure; there is no indication of confirmed active exploitation (no CISA KEV entry in the provided data).
Stored cross-site scripting in the SmugMug Embed WordPress plugin through 3.13 allows unauthenticated remote users to store arbitrary gallery data via an AJAX action that lacks authorization and CSRF checks, with the payload executing when a logged-in administrator views the plugin's settings screen. Publicly available exploit code exists, but the independent assessment keeps impact limited: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, requiring administrator interaction and yielding low confidentiality and integrity impact. There is no CISA KEV confirmation in the provided data, so this should be treated as exploitable via public PoC rather than confirmed actively exploited.
Stored cross-site scripting in the BuddyPress Instant Chat WordPress plugin (versions through 1.6) lets remote, unauthenticated users inject persistent JavaScript into a chat conversation they do not belong to, because the plugin neither verifies that the message sender is a participant in the target conversation nor escapes message content when rendering it. The injected script stays dormant until a legitimate member - potentially an administrator or other privileged user - loads and views that conversation, which is why exploitation requires user interaction rather than being fully automatic. WPScan has published a proof-of-concept advisory, so publicly available exploit code exists, and although the vendor/NVD score is 8.8, the realistic impact is more contained: script execution within a member's authenticated WordPress session in the context of the affected site, with no direct server-side compromise shown.
Unauthenticated attackers can plant persistent JavaScript that executes in the browser of every visitor to a WordPress site running the Adwised Web Push Notification plugin through version 2.5.7, because several state-changing plugin operations lack authorization checks and the plugin's secret-comparison routine can be defeated on installations where a secret key was never configured. Publicly available exploit code exists (WPScan published a proof-of-concept write-up), though there is no KEV confirmation of active exploitation. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) shows a network-reachable, unauthenticated attack that requires a victim visitor to load an affected page, so real-world impact is bounded by the unconfigured-secret precondition, and hardened installs that have set a secret are not affected.
Stored cross-site scripting in the Adwised Web Push Notification WordPress plugin through version 2.5.7 allows any authenticated user - including a low-privileged subscriber - to overwrite the plugin's site-wide configuration and plant JavaScript that executes for every visitor of every front-end page, administrators included. The plugin performs no capability or nonce check on the configuration-update action and prints the stored settings unescaped inside an inline script block, so exploitation is trivial on any site with open user registration. Publicly available exploit code exists (WPScan reference), no CISA KEV listing has been recorded, and successful abuse yields session theft, administrator account takeover, and persistent compromise of the front end; no vendor-released patch was identified at time of analysis.
Stored cross-site scripting in the WordPress plugin Web Vitals Tracking (versions through 5.4.2) allows unauthenticated visitors to inject arbitrary script content by submitting unvalidated, unescaped performance measurements that the plugin persists and later renders inside a script context on an administrative reporting page. The attack is remote and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R), but the payload only executes when a logged-in administrator loads the affected admin page, so exploitation depends on administrator activity rather than firing automatically; publicly available exploit code exists and the issue is tracked by WPScan as well as EUVD-2026-96769. Our independent assessment rates the impact more conservatively than the vendor/NVD score (scope-changed XSS with low confidentiality and integrity impact and no availability impact), so this should be treated as a credible, medium-to-high priority issue rather than a top-tier emergency.
Unauthenticated stored cross-site scripting in the HootBoard WordPress plugin (all versions through 3.1.4) lets any remote attacker inject arbitrary JavaScript through the plugin's REST endpoints, which lack authorization checks and store values without escaping before rendering them on a public page. The injected script executes in the browser of any visitor to that page - most dangerously a logged-in administrator, which is the path to full site compromise - but it requires the victim to view the poisoned page, so the impact is client-side and conditional rather than direct server takeover. Publicly available exploit code exists (the WPScan disclosure entry doubles as an exploit reference) and no vendor patch has been confirmed; our independent vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) rates this below the 8.8 vendor score, reflecting the interaction requirement and the typically low-severity confidentiality/integrity effect on the victim's browser session alone. No EPSS or CISA KEV data is present in the feed, so this should be treated as an actionable priority rather than a confirmed active exploitation event.
Unauthenticated remote attackers can delete arbitrary WordPress options in sites running the Insurify WordPress plugin through version 1.0, due to missing authorization and nonce checks on an AJAX action, potentially taking the site offline and stripping every user of their role. Publicly available exploit code exists, and the vulnerability is remotely exploitable with no authentication required (CVSS 9.1). Any site with the vulnerable plugin active is at risk.
Unauthenticated remote attackers can rewrite arbitrary WordPress site settings through an AJAX action exposed by the Quick Quotes plugin through version 1.0.0, which performs no capability or nonce validation on the request. Successful abuse allows an attacker to change site-wide options - including those that can render the site unreachable - with no authentication, no user interaction, and no non-default configuration required, yielding an assessed CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H). Publicly available exploit code exists per the WPScan disclosure, though the plugin's obscure deployment footprint limits the broader blast radius; there is no indication of confirmed active exploitation (not in CISA KEV) and no vendor-released patch was identified at time of analysis.
Privilege escalation in the Crowdfundly WordPress plugin (versions through 2.2.2) allows an attacker who already holds one of the plugin's own low-privileged roles to grant themselves the WordPress administrator role or arbitrary capabilities, resulting in full site takeover. The flaw sits in AJAX actions that lack capability checks, so it is reachable remotely with no victim interaction, but the attacker must first obtain a legitimate low-privilege Crowdfundly account - trivial on sites that permit open self-registration of backers/campaigners, and a hard blocker on sites that restrict account creation. Publicly available exploit code exists (per the WPScan entry), while there is no confirmed active exploitation (CISA KEV); the independent assessment rates this as an authenticated privilege-escalation issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rather than the higher-privilege PR:H rating shown in some feeds.
Unauthenticated remote attackers can overwrite arbitrary WordPress options on any site running the Insurify plugin through version 1.0, because one of the plugin's AJAX actions performs neither a capability (authorization) check nor a nonce/CSRF check - a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) reflects high integrity and availability impact with no privileges or user interaction required. Exploitation can rewrite site-critical options, take the site offline, and deactivate the plugin itself, and publicly available exploit code exists (per the WPScan report and its exploit-tagged reference); there is no indication of confirmed active exploitation (not listed in CISA KEV). The practical constraint is the plugin's limited deployment footprint, not any technical barrier.
Unauthenticated attackers can update and delete arbitrary WordPress options through the AI Content Generator Marketing plugin (versions through 1.0.0), a capability that typically enables full site takeover by, for example, flipping the default new-user role to administrator and enabling open registration. The plugin's AJAX handlers perform neither a nonce check nor a capability check, and because the CVSS vector is AV:N/AC:L/PR:N/UI:N with C/I/A all High, no authentication, user interaction, or non-default configuration is required - only that the plugin be installed and active and its endpoints reachable. Publicly available exploit code exists (ratings from WPScan), making opportunistic mass scanning realistic; there is no CISA KEV confirmation of active exploitation and no EPSS score was supplied, so this should be treated as high-severity, readily exploitable, but not yet confirmed as exploited in the wild. All available signals point to genuinely high risk.
Authentication bypass in the Freeton WP WordPress plugin through version 1.0.0 lets unauthenticated attackers log in as any existing user, including administrators, using only that user's email address, because the plugin does not correctly validate the activation code used during authentication. The flaw is rated 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-287) and requires no credentials and no user interaction; publicly available exploit code exists (referenced from the WPScan entry), and no CISA KEV listing indicates confirmed active exploitation. Exposure is limited to WordPress sites where the plugin is installed and active - an important qualifier given the plugin's small footprint - but for those sites the practical barrier is only knowledge of a valid account email, which is commonly obtainable through WordPress author enumeration.
Authentication bypass in the Mindstien Quick Login WordPress plugin through version 1.0 allows unauthenticated remote attackers to obtain an administrator session on any affected site where the plugin is active and configured with an administrator account. The flaw (CWE-287) stems from the plugin failing to validate a request-supplied value against the visitor's own session before authenticating them, yielding a CVSS 3.1 base score of 9.8. Publicly available exploit code exists, and while the vulnerability is not confirmed as actively exploited (CISA KEV), the low attack complexity and lack of required authentication make immediate remediation critical.
Stored cross-site scripting in the click5 CRM add-on for Contact Form 7 (all versions up to and including 1.0.4) lets unauthenticated attackers submit crafted content through the plugin's submission endpoint, which is stored and later rendered into an administrative page without sanitisation or escaping, so the injected script executes in the browser of a high-privilege user such as an administrator. Publicly available exploit code exists, and the add-on must be installed and active for exposure, but the attack is not autonomous: it succeeds only when a logged-in privileged user subsequently opens the poisoned admin screen. No confirmed active exploitation (CISA KEV) has been reported, and an independent reassessment rates the realistic severity considerably lower than the headline CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), with the required admin interaction as the primary limiting factor.
Stored cross-site scripting in the click5 CRM add-on to Gravity Forms (all versions through 1.0.3) lets an unauthenticated attacker plant script into CRM content submitted through the plugin's public, unauthenticated content-submission endpoint; the input is neither sanitised on entry nor escaped on output, so the payload executes when a high-privilege user - typically an administrator - later opens the admin page that renders the stored CRM data. Publicly available exploit code exists (WPScan published a proof-of-concept reference), but there is no CISA KEV entry or other confirmation of active exploitation. Although the bundled score of 8.8 implies severe impact, our independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, because exploitation is conditional: the plugin must be installed with its submission endpoint reachable, and an administrator must subsequently review the poisoned entry before the script fires.
Stored cross-site scripting (XSS) in the click5 CRM add-on to the WordPress plugin WPForms through version 1.0.3 lets an unauthenticated attacker plant a persistent script payload through the add-on's public submission endpoint; the payload is later rendered without sanitisation or escaping on an administrative page, so it executes in the browser session of a high-privilege user such as an administrator who views that page - a UI:R condition that gates actual code execution. Publicly available exploit code exists (WPScan published the vulnerability entry), but there is no confirmed active exploitation (no CISA KEV listing) and no EPSS figure was supplied; the risk is further bounded by the add-on's niche deployment and by the fact that the script runs in an admin browser rather than on the server. Our independent assessment rates this lower than the input's 8.8 (High), using a scope-changed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), which keeps the exploit prerequisites - installed and active add-on, unauthenticated submission, and administrator interaction - central to any real-world prioritisation.
Stored cross-site scripting in the click5 CRM add-on for Ninja Forms (all versions through 1.0.1) allows an unauthenticated attacker to submit crafted content through the add-on's public form endpoint and have it persisted without sanitisation, so the payload executes in the browser of any high-privilege user - typically an administrator - who later opens the admin page that renders those submissions. Exploitation requires no credentials to plant the payload (CVSS vector PR:N), but it does require user interaction (UI:R), meaning an administrator must actually view the poisoned submission for the script to fire; publicly available exploit code exists and the bug was reported by WPScan, though there is no confirmed active exploitation (CISA KEV) at time of analysis. Scored 8.8 under the NVD/A:H/C:H/I:H vector, but our independent assessment rebases it to CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (scope change, limited confidentiality and integrity, no availability impact), making this a moderate rather than top-tier priority that is bounded by whether admins routinely review unfiltered submission data.
Unauthenticated option manipulation in the click5 CRM add-on to Contact Form 7 (versions through 1.0.4) lets remote attackers rewrite arbitrary WordPress options without authorization, a nonce, or any user interaction, which is sufficient to enable user registration and create a new administrator account for full site takeover. The flaw carries a 9.8 CVSS score (AV:N/AC:L/PR:N/UI:N), and publicly available exploit code exists, making this a realistic and high-priority target for mass scanning against any WordPress site that has this specific add-on installed and active; Contact Form 7 alone, or WordPress without the add-on, is not affected. No CISA KEV entry was provided, so active exploitation is not independently confirmed, but the combination of unauthenticated reachability, trivial preconditions, and published exploit code warrants urgent triage and removal or blocking of the vulnerable endpoint.
Unauthenticated option manipulation in the click5 CRM add-on to Gravity Forms (versions up to and including 1.0.3) lets any remote attacker rewrite arbitrary WordPress blog options and escalate to complete site takeover by enabling open registration with an administrator default role, thereby creating a new admin account. The flaw is a missing authorization/CSRF class issue exposed through a REST endpoint that neither checks the caller's capabilities nor verifies that the targeted option belongs to the add-on, so no credentials, nonce token, or user interaction are required against a default configuration. Publicly available exploit code exists, and the only real prerequisite is that the affected add-on be installed and active on a reachable WordPress site; no CISA KEV entry was present in the supplied intelligence, so active exploitation is not confirmed.
Unauthenticated attackers can take over any WordPress site running the click5 CRM add-on for WPForms (versions through 1.0.3) by abusing a REST endpoint that updates blog options without authorization, CSRF validation, or any check that the targeted option belongs to the add-on. Because the endpoint accepts arbitrary option names, an attacker can set registration-related options and a default administrator role to create a new admin account, or otherwise alter site configuration, leading to full site compromise. The flaw carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), publicly available exploit code exists, and exploitation requires only that this niche add-on be installed and active.
Unauthenticated option overwrite in the click5 CRM add-on to Ninja Forms allows any remote attacker to write arbitrary WordPress blog options on sites running the add-on at version 1.0.1 or earlier, a primitive that can be chained into creating a rogue administrator account and complete site takeover. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact (9.8), so the CVSS vector confirms no authentication and no user interaction are required against default configurations that simply have the add-on active. Publicly available exploit code exists, tracked by WPScan and mirrored in ENISA EUVD as EUVD-2026-96753, while there is no confirmed actively exploited (CISA KEV) status at time of analysis; exposure is bounded by the add-on's niche deployment rather than by any authentication or non-default configuration requirement.
Unauthenticated remote attackers can seize control of the payment configuration on WordPress stores running the Fundiin cho WooCommerce plugin through 3.4.0, because several of its REST API routes enforce authorization only through a credential that is hardcoded identically in every installation. Exploiting this yields disclosure of the store's payment gateway credentials and customer order data, allows the gateway configuration to be rewritten so that payments are credited to an attacker-controlled destination, and permits unpaid orders to be marked as paid; the same missing authorization additionally allows script to be stored and rendered unescaped on the classic WooCommerce checkout, producing unauthenticated stored XSS. CVSS 3.1 scores this 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and publicly available exploit code exists per the WPScan report, while no CISA KEV entry was present in the supplied intelligence.
Unauthenticated SQL injection in the Tcard WP WordPress plugin (all versions through 1.8.0) allows remote attackers to inject arbitrary SQL through one of the plugin's AJAX actions, exposing data from the underlying WordPress database. Exploitation requires no authentication, no user interaction, and no non-default configuration - only that the plugin be installed and active - and publicly available exploit code exists, though there is no confirmed actively exploited (CISA KEV) signal. The assessed impact is read-oriented (high confidentiality, no integrity or availability impact), so the practical risk is sensitive-data disclosure rather than site takeover, with real-world exposure bounded by how widely this low-footprint plugin is deployed.
Memory exhaustion denial of service in WooCommerce Bookings (versions before 3.11.0) allows unauthenticated remote attackers to take a WordPress site offline with a single crafted request, because one of the plugin's unauthenticated AJAX actions feeds a user-supplied value directly into a memory allocation routine without validating or capping its size (CWE-400). Exposure is limited in scope but not in ease: only sites running the paid WooCommerce Bookings extension below 3.11.0 are affected (core WooCommerce is not), while the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, A:H, score 7.5) confirms that no credentials, user interaction, or non-default configuration are required. Publicly available exploit code exists, so any internet-facing site meeting the version condition should be treated as trivially reachable; the consequence is availability loss only, with no confidentiality or integrity impact.
Unauthenticated attackers can permanently delete arbitrary posts, pages, and media attachments on WordPress sites running WeddingCity Lite version 1.0.4 or earlier due to missing authorization checks in the plugin's deletion handler. The flaw, tracked as CWE-862, is remotely exploitable without authentication (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) and affects default installations with the plugin active. Publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been reported; the risk is high for affected sites due to the trivial attack requirements, but exposure is limited by the plugin's niche install base.
Envira Gallery WordPress plugin versions before 1.16.2 fail to verify the capability WordPress reserves for plugin installation when handling the setup-wizard plugin-installation request, letting an authenticated Multisite subsite Administrator install any WordPress.org-published plugin into the network-shared plugins directory - an action Multisite reserves for the network Super Admin. The issue is gated: it only crosses a privilege boundary on WordPress Multisite networks and requires the attacker to already hold subsite-Administrator credentials (CVSS 3.1 AV:N/AC:L/PR:H/UI:N, assessed with S:C/C:H/I:H/A:H, scored 7.2), and it is not exploitable on standard single-site WordPress where Administrators legitimately install plugins. Publicly available exploit code exists (WPScan-published), and the vendor has released a fixed version 1.16.2.
Unauthenticated remote code execution in the Anton Extensions WordPress plugin (versions ≤1.2.2) allows attackers to upload arbitrary PHP files to attacker-chosen paths, because the plugin omits capability checks, nonce verification, and file-type validation in its file upload handler. Publicly available exploit code exists according to WPScan, and exploitation requires only that the plugin be installed and active on a reachable WordPress site. The CVSS score of 9.8 reflects critical severity with no authentication required.
Unauthenticated SQL injection in the Mobile builder WordPress plugin (all versions through 1.4.2) lets any remote attacker inject arbitrary SQL into the site's backend database and read data the application can access. The assessed vector (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms no authentication, no user interaction and no special configuration are required, with the sole precondition being that this non-default plugin is installed and active, and impact is confined to confidentiality. Publicly available exploit code exists (published via the WPScan vulnerability entry), and while this is not confirmed actively exploited (CISA KEV), the unauthenticated reachability and low skill barrier make it a genuine priority for any site running the plugin.
Privilege escalation in the Mobile Builder WordPress plugin (versions through 1.4.2) allows any authenticated low-privilege user - including a self-registered customer account - to grant themselves the administrator role by writing unrestricted user meta keys through one of the plugin's REST routes. The flaw requires only a valid low-privilege account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) and no administrator interaction, and publicly available exploit code exists according to WPScan. Sites with open user self-registration enabled are the easiest to attack, but any existing low-privilege user can still exploit the vulnerable route; CISA's SSVC rates technical impact as total while noting no observed exploitation and no known automatable exploitation at this time.
Stored cross-site scripting in the Prenotazioni WordPress plugin (all versions up to and including 1.7.5) lets an unauthenticated attacker write arbitrary JavaScript into plugin settings that are saved without any capability or CSRF check and then rendered without output escaping. The payload persists in the site database and executes in the browser of any administrator opening the affected settings screen or any visitor viewing the affected front-end rendering, so impact is scoped to the privileges of the victim's own session rather than to the server itself. A public proof-of-concept/write-up is available (WPScan), while SSVC records exploitation status as 'none' and non-automatable; no EPSS score was supplied. Note the discrepancy between the researcher-assigned 8.8 (S:U/C:H/I:H/A:H) and our independent assessment (S:C/C:L/I:L/A:N), which treats confidentiality and integrity impact as limited because execution requires a page view (UI:R) and only affects the victim's browser session.
Remote code execution in the AWP Classifieds WordPress plugin before 4.4.9 allows an authenticated user holding the plugin's management capability to import a crafted ZIP archive whose contents are extracted without file-type validation, planting arbitrary PHP into a publicly accessible, network-shared directory. Because the extraction target is web-reachable, the uploaded PHP can be requested and executed, yielding code execution under the web server account. Exploitation is gated by the required management capability (CVSS PR:L), and a vendor patch is available in 4.4.9; publicly available exploit code exists and EPSS is low at 0.19% (8th percentile), with no CISA KEV listing indicating confirmed active exploitation. CWE-434 (unrestricted upload of a file with a dangerous type) is the root cause class.
Unauthenticated attackers can forge payment-notification callbacks to the Nexi XPay Build WordPress plugin (through version 7.6.2) and mark arbitrary WooCommerce orders as paid - or downgrade genuinely paid orders to a failed status - because the plugin skips its security-token comparison whenever the targeted order has no stored token. The issue is remotely reachable at low complexity with no authentication and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5), and the impact is purely integrity-based: no confidentiality loss, but direct tampering with order and payment state on the store. Publicly available exploit code exists; however, no CISA KEV listing or other confirmation of active exploitation is present in the supplied intelligence, and exploitation is constrained to orders that happen to be in the tokenless condition.
Unauthenticated payment-result forgery in the Nexi XPay Build WordPress plugin through 7.6.2 lets any remote attacker mark arbitrary orders as paid or failed, cancel those orders at will, and retrieve the order keys that unlock guest buyers' personal details. The vulnerable surface is the plugin's payment-result handling routes, which accept a supplied payment result without verifying it, so no credentials, user interaction, or non-default configuration are needed beyond a site running the plugin as an active Nexi XPay gateway. Publicly available exploit code exists via the WPScan advisory, and although there is no confirmed active exploitation (not listed in CISA KEV), the high integrity impact on order state and the exposure of guest customer data make this an actionable priority; exploitation is limited in practice only by the narrow installed base of this specific gateway plugin.
Unauthenticated PHP object injection in the String Locator WordPress plugin (versions before 2.6.8) lets an attacker store a crafted serialized PHP object in a database row via the plugin's database editor, with no authentication required (PR:N per the assessed vector). The payload only fires when a site administrator subsequently opens and saves that row in the editor, which is the UI:R precondition, and it escalates to remote code execution, arbitrary file deletion, or sensitive data disclosure only if a suitable POP gadget chain exists in another installed plugin or component, which is why our independent assessment rates attack complexity as High (AC:H) despite the raw CVSS 8.8 vector using AC:L. Publicly available exploit code exists, but the two gating conditions (an admin save action plus a usable gadget chain) meaningfully reduce real-world exploitability, and no CISA KEV listing confirms active exploitation.
Reflected cross-site scripting in the If-So Dynamic Content WordPress plugin (versions 1.4.4 through below 1.10.2) lets an unauthenticated attacker supply a value whose URL scheme is not validated, which is then reflected into a link on a plugin admin page and executed as arbitrary JavaScript in the browser of a logged-in administrator who opens a crafted link. Publicly available exploit code exists and is documented in the WPScan advisory (also tracked as ENISA EUVD-2026-94188), so this is a non-persistent, socially-engineered attack that must be delivered to each victim individually rather than mass-exploited. The assessed CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, with no availability impact in our assessment) reflects the scope change inherent to XSS in a privileged admin context, but the practical impact is bounded by the user-interaction prerequisite and by the fact that a privileged WordPress user must be lured into clicking the link.
Privilege escalation in the Koinonia Link WordPress plugin (versions 1.1.2 through earlier than 1.1.5) lets any authenticated user, including a low-privileged subscriber, grant themselves the Administrator role by tampering with the role value submitted during a profile update. The flaw is a missing authorization check on the role-save routine (CWE-269), not a memory-safety or injection bug, and it is remotely reachable with no user interaction (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8), meaning successful exploitation yields total control of the WordPress site. Publicly available exploit code exists and the vendor has released a fix in 1.1.5; the practical barrier is only the need for a valid account, so sites with open self-service registration are exposed to unauthenticated attackers who simply register first, while sites with registration disabled limit the threat to existing users.
Reflected cross-site scripting in the Magee Shortcodes WordPress plugin through version 2.1.1 lets unauthenticated attackers inject script into pages by abusing AJAX actions that reflect unsanitised user input back to the browser. Exploitation requires a victim with an active session to be socially engineered into clicking a crafted link pointing at one of the plugin's unauthenticated AJAX endpoints, and the resulting impact is bounded by that victim's privileges - a moderated session yields limited damage, while an administrator session could enable actions such as session or content manipulation. CVSS 3.1 scores the issue 7.1 (AV:N/AC:L/PR:N/UI:R/S:C), WPScan is credited with the report, and publicly available exploit code exists, though there is no evidence of confirmed active exploitation (CISA KEV) and no vendor-released fixed version has been identified at time of analysis.
Authenticated users holding the WordPress Editor role on sites running the WP Coder plugin (versions 4.0 up to but not including 4.5.2) can save and execute arbitrary PHP code on the server, resulting in full site compromise. The flaw is a privilege-boundary failure: the plugin gates its PHP code-execution feature on a content capability that the Editor role holds by default rather than restricting it to administrators, so no plugin misconfiguration is needed. Exploitation requires an existing Editor-level (or higher) account - it is not remote-unauthenticated - but publicly available exploit code exists, and the vendor has released WP Coder 4.5.2 to fix it. No confirmed active exploitation (CISA KEV) has been reported, so risk is concentrated on sites that hand Editor access to semi-trusted contributors.
Cross-site request forgery in the CoCart WordPress plugin before 4.9.7 lets an unauthenticated remote attacker create a new administrator account on a victim site by luring a currently logged-in administrator to an attacker-controlled page. Because the plugin's REST API authentication filter is not scoped to its own endpoints, it disables WordPress core's REST nonce protection for every /wp-json/ route once the plugin is active (versions 4.9.0 through 4.9.6), so the forged write rides the administrator's live cookie session (CVSS:3.1/AV:N/AC:L/PR:N/UI:R, base 8.8). Publicly available exploit code exists and successful exploitation yields full site takeover, though EPSS is only 0.11% (1st percentile) and the attack cannot be automated against anonymous visitors - it is gated on an active admin session plus social-engineering interaction.
Unauthenticated attackers can seize a privileged point-of-sale session on WordPress sites running the TillKit plugin before 1.0.5, letting them read customer and site-user personal data and modify store records. On activation the plugin creates a privileged POS account protected by a hard-coded, publicly known PIN that it never forces administrators to change, and its public POS login endpoint authenticates on that PIN alone with no identity or capability check (CWE-287); the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N confirms this is remotely reachable with no credentials and no user interaction. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV) and EPSS is low at 0.14% (3rd percentile), so real-world urgency depends on whether TillKit is actually deployed and whether the default PIN is still in place.
Unauthenticated SQL injection in the SaveTo Wishlist Lite WordPress plugin before 1.1.5 allows remote attackers to append arbitrary SQL queries to the ORDER BY clause of a database query, enabling extraction of sensitive information from the WordPress database. Publicly available exploit code exists, though EPSS is low (0.17%, 6th percentile) and there is no indication of active exploitation (CISA KEV not listed). The vendor has released a patch in version 1.1.5.