Unknown
Monthly
Shortcode injection in the Ninja Forms WordPress plugin (versions 3.14.10 through 3.15.1) allows unauthenticated network attackers to execute any shortcode registered on the target site by embedding shortcode syntax into form request fields the plugin later processes. The plugin fails to strip or escape shortcode markers before passing user-controlled values through WordPress's shortcode execution pipeline, meaning the server interprets and runs injected tags. A publicly available exploit exists per WPScan's advisory; real-world impact scales with the shortcodes registered on the site - ranging from benign output to sensitive data exposure or unintended privileged actions.
Shortcode injection in the Redirection for Contact Form 7 WordPress plugin (versions 2.2.7 through 3.2.10) enables unauthenticated remote attackers to execute arbitrary registered WordPress shortcodes server-side and capture their output. The plugin substitutes raw form submission values into its action settings and then evaluates those settings through WordPress's do_shortcode() pipeline without sanitizing or stripping user-supplied shortcode syntax first. A public proof-of-concept is available via WPScan; vendor-released patch version 3.2.11 addresses the issue.
Email header injection in JetFormBuilder WordPress plugin before 3.6.5.2 allows unauthenticated attackers to manipulate outgoing email headers by submitting CRLF sequences in form address fields. Exploitation enables adding hidden recipients via BCC, spoofing the sender address, and abusing the victim site's trusted email reputation as a phishing or spam relay. A publicly available exploit entry is documented by WPScan, though exploitation requires a non-default configuration in which the plugin is explicitly set to source message address headers from user-submitted form fields.
Shortcode injection in JetFormBuilder WordPress plugin before 3.6.5.2 allows unauthenticated remote attackers to execute any shortcode registered on the target WordPress site. The flaw stems from a misordered sanitization pipeline: user-supplied input in a request parameter is HTML-escaped before it is passed to WordPress's shortcode expansion function rather than after, meaning shortcode syntax survives the escape pass intact and is then evaluated server-side. A publicly available proof-of-concept exploit exists via WPScan, making this immediately actionable for attackers against unpatched installs.
Unauthorized role self-assignment in the B2BKing WooCommerce plugin before version 5.2.40 allows unauthenticated registrants to claim restricted B2B customer group memberships without admin approval by supplying arbitrary role parameters not bounded by server-side validation. The plugin fails to verify that a role submitted during account registration is actually one offered on the public registration form, enabling any user to bypass the manual account-approval workflow and gain access to wholesale pricing tiers or restricted catalogs. A publicly available proof-of-concept exists via WPScan, though no confirmed active exploitation has been identified in CISA KEV at time of analysis.
Stored cross-site scripting in the Kirki WordPress plugin before 6.3.0 allows unauthenticated remote attackers to persistently inject JavaScript into comment fields by bypassing the plugin's HTML entity decoding logic through alternate entity encodings. The malicious payload executes in the browser session of any user - including administrators - who views a page rendering the affected comment, and propagates site-wide when Kirki-managed headers or footers display comment data. A publicly available proof-of-concept exists and the vendor has released a patching fix in version 6.3.0.
Stored cross-site scripting in the Bold Page Builder WordPress plugin (all versions before 5.9.9) permits any user holding the Contributor role or higher to embed arbitrary JavaScript inside an HTML attribute via an unsanitized shortcode parameter. A publicly available exploit exists per WPScan (EUVD-2026-72064). When a higher-privileged user such as an administrator views a page containing the injected payload, the script executes in their browser, enabling session hijacking, nonce theft, or full administrative takeover of the WordPress installation.
Unauthenticated account registration bypass in SureCart WordPress plugin before 4.7.0 allows remote attackers to create WordPress user accounts and obtain authenticated sessions even when the site administrator has explicitly disabled user registration. The plugin fails to consult WordPress's native `users_can_register` site option before processing account creation through its own checkout/registration flow. A publicly available proof-of-concept exists per WPScan, and a vendor patch is available in version 4.7.0. No confirmed active exploitation (CISA KEV) at time of analysis.
Account takeover via insecure direct object reference in the SureCart WordPress plugin (versions 4.0.0 through 4.6.2) allows any subscriber-level authenticated user to seize full control of an administrator account. The plugin's customer update endpoint validates that the requester has permission to update customers, but fails to verify that the target customer record belongs to the requesting user - enabling arbitrary cross-user email modification followed by a password reset. A compounding information disclosure flaw leaks customer identifiers and email addresses to all authenticated users, providing the enumeration primitive needed to complete the takeover chain without any additional knowledge. A publicly available proof-of-concept exploit exists, and vendor patch 4.6.3 is available.
Real Estate Papi WordPress theme (≤1.0.5) exposes an AJAX endpoint that lacks both capability checks and CSRF validation, enabling any authenticated subscriber to silently force-install a fixed set of companion plugins from the WordPress.org repository. Because CSRF protection is also absent, an attacker can craft a cross-site request that fires in an active administrator session, causing those plugins to be activated as well - an escalation beyond what subscriber-level access alone would permit. WPScan published a proof-of-concept; SSVC rates exploitation as none with partial technical impact, indicating no confirmed in-the-wild abuse at time of analysis.
SQL injection in the Video Player for YouTube WordPress plugin (versions before 2.1.0) allows authenticated users holding the Contributor role or higher to inject arbitrary SQL commands via unsanitized input, enabling them to read any data stored in the underlying WordPress database. The scope change reflected in the CVSS vector (S:C) indicates that exploitation extends reads beyond the plugin's own tables to potentially include WordPress user credentials, secrets, and configuration data held elsewhere in the database. A public PoC exists via WPScan, but EPSS sits at 0.16% and CISA has not added this to KEV, indicating low observed exploitation activity.
Missing authorization on the EmbedPress WordPress plugin's review-loading action (versions 4.6.0-4.6.3) permits unauthenticated remote attackers to abuse the site's stored third-party API credentials - triggering repeated billable API calls against the site owner's account - while simultaneously injecting an unbounded number of attacker-controlled rows into the WordPress database. A publicly available PoC exploit was documented by WPScan. Although EPSS probability is low (0.14%), SSVC rates the attack as automatable, making mass targeting of vulnerable WordPress deployments feasible with minimal tooling.
Stored cross-site scripting in the HT Menu WordPress plugin before 1.2.7 allows any authenticated subscriber-level user to inject arbitrary JavaScript into navigation menu-item settings, which then executes in the browser of every site visitor - including administrators - who views the affected menu. The flaw combines two missing controls: no capability or ownership check on the settings-save endpoint, and no output escaping on render. A public exploit is available via WPScan, and vendor-released patch 1.2.7 is available. No public KEV listing; EPSS is low at 0.15%, consistent with targeted rather than mass exploitation.
Stored cross-site scripting in the JCH Optimize WordPress plugin before 6.0.1 allows any authenticated user with Subscriber-level access to import arbitrary plugin settings via an unprotected AJAX endpoint, injecting persistent JavaScript that executes in the browsers of site visitors and administrators. The missing capability check means that low-privilege accounts bypass the intended authorization boundary, enabling stored XSS delivery without administrative permissions. A publicly available proof-of-concept from WPScan exists, and the vendor has released a fix in version 6.0.1.
Stored cross-site scripting in the Joli Table Of Contents WordPress plugin (versions before 3.0.3) permits any user holding the Author role or higher to inject arbitrary HTML attributes and JavaScript via an unsanitized shortcode attribute, with the payload executing in the browser of any visitor - including administrators - who views the post. Because Authors in WordPress are explicitly barred from posting unfiltered HTML, this constitutes a privilege-boundary violation that can be leveraged to hijack administrator sessions or trigger privileged actions covertly. A public exploit is documented by WPScan; EPSS stands at 0.15% (5th percentile), indicating limited automated targeting, and no CISA KEV listing exists.
Stored XSS in CatFolders Document Gallery & PDF Library WordPress plugin before version 2.0.7 allows any user holding an Author account or higher to inject persistent malicious scripts via an unsanitized block attribute that is directly interpolated as an HTML tag name in gallery rendering output. Any visitor who views a post containing the crafted gallery block will execute the attacker's payload in their browser without additional interaction. No active exploitation has been confirmed in CISA KEV, but a publicly available proof-of-concept exists per WPScan disclosure, reducing the technical barrier for any authenticated attacker.
Insufficient authorization on the EmbedPress WordPress plugin's Google Reviews REST API endpoint allows any authenticated Contributor-role user to overwrite the site-wide reviews store in versions 4.6.0 through 4.6.3. An attacker with a Contributor account can delete administrator-configured review entries and inject fabricated ones that render publicly across the entire WordPress site, enabling reputation manipulation or social engineering. A publicly available exploit exists per WPScan; however, SSVC marks exploitation as none and EPSS sits at 0.13% (3rd percentile), reflecting the prerequisite of a legitimate account.
Information disclosure in the EmbedPress WordPress plugin (versions 4.6.0 through 4.6.3) allows any authenticated contributor-level user or above to retrieve the site administrator's email address via an improperly restricted Google Reviews REST API endpoint. WordPress core deliberately withholds administrator email from the contributor role as a privacy control; this plugin bypass defeats that restriction without requiring administrative privileges. A publicly available proof-of-concept has been published by WPScan, though EPSS at 0.14% and SSVC exploitation status of 'none' indicate no observed active exploitation at time of analysis.
Missing authorization on Eventin's event-management REST routes allows low-privilege WordPress contributors to perform integrity-impacting actions outside their permitted scope. Affected installations running Eventin before 4.1.22 expose endpoints that let contributor-role users redirect the site's public front page to an arbitrary event they do not own, and create, edit, or delete global event and speaker taxonomy terms site-wide. A publicly available exploit is documented by WPScan, though SSVC exploitation status is none and EPSS is 0.13%, indicating no confirmed active abuse at time of analysis.
Stored XSS in VikWidgetsLoader WordPress plugin before 1.12.0 allows Contributor-role users to permanently embed arbitrary JavaScript into posts by supplying a malicious block attribute that is output unsanitized inside an inline script tag. When an administrator reviews the pending submission, the payload executes in their browser, enabling full session hijacking and site takeover without any further attacker interaction. A publicly available exploit exists (via WPScan), though EPSS is low (0.15%, 5th percentile) and SSVC records no confirmed exploitation at this time.
Local file inclusion in Eventin WordPress plugin before 4.1.21 enables authenticated contributors and higher-privileged users to include and execute arbitrary PHP files on the web server. The plugin fails to validate a user-supplied template path parameter before passing it to a PHP file-inclusion routine, allowing path traversal to any locally accessible PHP file. A publicly available proof-of-concept has been published by WPScan; vendor patch 4.1.21 is available and should be applied immediately.
Stored cross-site scripting in King Addons for Elementor WordPress plugin before version 51.1.77 allows any Contributor-level (or higher) user to inject persistent JavaScript into a widget display-style setting that is written unescaped into an HTML attribute at render time. The payload fires in every visitor's browser upon page load - including logged-in administrators - enabling session hijacking, credential theft, or silent execution of privileged site actions. A publicly available proof-of-concept was disclosed via WPScan; no active exploitation is confirmed in the CISA KEV catalog at time of analysis.
The Events Calendar WordPress plugin before 6.17.3.1 exposes unpublished site content - drafts, pending posts, and private records from all users - through its public REST API archive endpoints to any contributor-level authenticated user. The plugin fails to enforce WordPress's standard post-status visibility controls on its custom REST routes, allowing a low-privilege account holder to enumerate and read the full body of every non-public record site-wide, bypassing intended access controls. A public proof-of-concept is documented via WPScan, and a vendor patch (6.17.3.1) is available.
Insufficient per-object authorization in the Kirki WordPress plugin before 6.3.0 allows users with administrator-granted content-level page builder access to alter the state of collaboration comments left by any user, including on pages those users cannot themselves open. The root cause is CWE-639 (Authorization Through User-Controlled Key / IDOR): the comment-state endpoint accepts a user-supplied comment identifier without verifying whether the requesting user holds authorization over that specific comment object. Despite a publicly available PoC from WPScan, EPSS sits at 0.13% (3rd percentile) and the vulnerability is not in the CISA KEV catalog, indicating negligible opportunistic exploitation risk.
SQL injection in the Kirki WordPress plugin (versions 6.0.0 through <6.3.0) enables authenticated users with editor-level access or above to append arbitrary SQL to an unescaped identifier, exfiltrating the full WordPress database including hashed credentials for all user accounts. The scope change (S:C) in the CVSS vector reflects that credential exposure extends impact beyond the attacker's own session to all other platform users. A publicly available proof-of-concept is documented by WPScan, and the vendor has released a remediated version (6.3.0).
Stored cross-site scripting in Bold Page Builder WordPress plugin (all versions before 5.9.8) allows authenticated Contributor-level users to inject persistent arbitrary JavaScript through unsanitized shortcode attribute values, which then execute in the browsers of any visitor rendering the affected page. A publicly available proof-of-concept exists via WPScan, and the vendor has released a patched version (5.9.8). Despite a low EPSS score (0.15%, 5th percentile), the public PoC and low privilege bar make this a realistic attack vector against sites with open contributor registration.
Stored cross-site scripting in the Bold Page Builder WordPress plugin before 5.9.8 allows authenticated users holding the Contributor role or higher to inject arbitrary JavaScript via a crafted link URL that bypasses the plugin's client-side filter. When a victim user subsequently clicks the malicious link rendered in the page builder output, the injected script executes in their browser session. A publicly available proof-of-concept exists per WPScan, though EPSS remains very low (0.15%), indicating limited observed exploitation despite public disclosure.
Stored cross-site scripting in the Greenshift WordPress plugin (all versions before 13.2.0) allows any user with Contributor-level access or higher to inject arbitrary JavaScript via an improperly escaped block animation attribute rendered into an HTML attribute context. When a higher-privileged user such as an administrator views the affected content, the injected script executes in their browser session, enabling session hijacking or unauthorized administrative actions. A publicly available proof-of-concept exists per WPScan reporting, making exploitation accessible to low-skilled threat actors despite the low EPSS score of 0.15%.
Server-side request forgery in the Greenshift WordPress plugin before 13.2.0 allows contributor-level (and higher) authenticated users to direct the server to fetch arbitrary external or internal URLs and read the response. The flaw stems from missing URL validation before server-side HTTP requests are dispatched, enabling internal network reconnaissance, port scanning, or cloud instance metadata credential theft in hosted environments. A publicly available exploit exists and was reported by WPScan; EPSS stands at 0.13% (3rd percentile), suggesting no widespread automated exploitation at time of analysis despite the public PoC.
Stored Cross-Site Scripting in the Masteriyo LMS WordPress plugin before version 3.4.0 allows any user holding the course-author role to inject unsanitized JavaScript into course settings fields, where it silently executes in the browser of every subsequent visitor - including logged-in administrators. Because the injected payload runs within the victim's full session context, a successful attack against a site administrator can result in complete WordPress site takeover through credential theft, rogue plugin installation, or arbitrary content modification. A publicly available proof-of-concept has been published by WPScan; no active exploitation is confirmed by CISA KEV, and the EPSS score of 0.15% (5th percentile) reflects limited observed exploitation probability at time of analysis.
SQL injection in the Music Store WordPress plugin (versions 1.0.245 through before 1.4.5) enables unauthenticated remote attackers to extract the entire WordPress database via crafted HTTP requests. The CVSS Scope:Changed vector reflects that exploitation can read data beyond the plugin's own tables - including WordPress user credentials, email addresses, and site configuration stored by other plugins. A publicly available exploit is documented on WPScan, though no confirmed active exploitation (CISA KEV) has been recorded.
Order-integrity bypass in the Accept Stripe Payments WordPress plugin before 2.1.4 allows unauthenticated customers who complete a genuine Stripe payment to receive fulfillment for a different product than the one they purchased. The plugin validates only that the payment amount is at least the referenced product's price at checkout completion, without verifying that the fulfilled product matches the product for which payment was originally captured. A public proof-of-concept is available via WPScan; no active exploitation is confirmed in CISA KEV, and the EPSS score (0.15%, 4th percentile) indicates low automated exploitation likelihood.
Open redirect in the Accept Stripe Payments WordPress plugin before version 2.1.4 enables unauthenticated attackers to craft URLs that silently redirect site visitors to arbitrary external destinations, creating a phishing vector against users who trust the legitimate domain. The vulnerability stems from unvalidated user-supplied redirect parameters in the plugin's payment flow. A publicly available proof-of-concept exists per WPScan, though the EPSS score of 0.16% (5th percentile) indicates minimal observed automated exploitation at time of analysis.
Reflected Cross-Site Scripting in the IPGP Visitors Origin WordPress plugin before version 1.6 allows unauthenticated remote attackers to inject arbitrary JavaScript into victims' browsers by delivering a crafted URL that the plugin echoes back unsanitized. No server-side authentication is required from the attacker, though victim interaction (clicking or submitting a crafted request) is mandatory for payload execution. A publicly available proof-of-concept via WPScan lowers the exploitation barrier, though EPSS of 0.18% indicates limited automated scanning activity to date and no active exploitation has been confirmed by CISA KEV.
Unauthenticated information disclosure in the My Private Site WordPress plugin (all versions before 4.2.3) exposes post content, post URLs, and comments to anonymous visitors, directly defeating the plugin's stated purpose of enforcing mandatory login across a WordPress site. The plugin fails to apply its privacy gate to certain front-end read surfaces, meaning requests to those endpoints bypass the authentication requirement entirely. A publicly available proof-of-concept exists; the vendor has released a corrective patch in version 4.2.3.
Site takeover in the SEO Flow by LupsOnline WordPress plugin (versions 3.0.0 through before 3.0.3) stems from improper validation of the credential supplied with the plugin's API requests, allowing unauthenticated attackers to be served in the security context of the administrator who configured the plugin. Because the flaw grants effective administrator-level access, an attacker can fully compromise the affected WordPress site. Publicly available exploit code exists (published by WPScan), though EPSS remains low at 0.15% (4th percentile), and there is no public exploit identified as active in the wild.
Unauthorized post-content disclosure in the Smart Post WordPress plugin before 4.0.8 allows any contributor-level authenticated user to duplicate any private or password-protected post into a personal draft, exposing the full content and metadata regardless of the original post's visibility or ownership restrictions. The flaw is rooted in the plugin's post-duplication feature entirely omitting checks on post type, status, and ownership before creating the copy. A public PoC is available via WPScan; no active exploitation has been confirmed by CISA KEV and the EPSS score sits at the 4th percentile.
Unauthenticated information disclosure in the Smart Post WordPress plugin (versions prior to 4.0.8) exposes both the content of password-protected posts and the passwords themselves via an unprotected AJAX endpoint. Any unauthenticated remote user can query the endpoint to bypass WordPress's native post-password protection mechanism entirely, retrieving guarded content without knowing the password - and also harvesting the password itself for reuse. A public exploit is documented by WPScan; a vendor patch (4.0.8) has been released.
RegistrationMagic WordPress plugin before version 6.0.9.9 omits audience validation on Facebook OAuth access tokens during social login, creating two exploitable paths: an attacker who obtains any valid Facebook token belonging to a site user - regardless of which Facebook application issued it - can authenticate to the WordPress site as that user, and a separate path allows account creation even when site registration is explicitly disabled. Publicly available exploit code has been published by WPScan, and the high CIA impact score reflects that full account compromise is achievable on affected installations with the Facebook login feature enabled.
HTML injection via unsanitized email notifications in JetFormBuilder WordPress plugin (versions before 3.6.5.2) allows unauthenticated form submitters to embed arbitrary HTML-and conditionally JavaScript-into notification emails delivered to administrators and other configured recipients. The scope change is real: a public form submission influences the admin's email client environment rather than the WordPress server itself, with JavaScript execution gated on the recipient's mail client rendering capability. A publicly available proof-of-concept exists via WPScan, though EPSS at 0.18% (8th percentile) reflects no widespread active exploitation; the vulnerability is not in CISA KEV.
JetFormBuilder - Dynamic Blocks Form Builder for WordPress before version 3.6.5.2 exposes sensitive site data to unauthenticated remote attackers due to missing authorization checks during page rendering. By submitting crafted requests that reference internal WordPress data sources, attackers can read arbitrary user properties including password hashes, private and draft post content, term metadata, and secrets stored by the plugin in post metadata fields. A publicly available proof-of-concept exploit exists, and the zero-privilege network attack path makes this a credible mass-scanning target for WordPress infrastructure.
Search Atlas SEO WordPress plugin before 2.6.24 allows any subscriber-level authenticated user to overwrite or permanently delete the site's stored Google service-account credentials by invoking a settings-update handler that performs no nonce verification or capability check. Any registered user on an affected WordPress site can trigger this handler via a crafted HTTP request, disrupting Google Search Console, Analytics, or other Google API integrations that depend on those credentials. A publicly available exploit is documented by WPScan; EPSS remains at 0.14% and CISA KEV status is absent, indicating no observed active exploitation at time of analysis.
Stored Cross-Site Scripting in the Joli Table Of Contents WordPress plugin (versions up to and including 2.8.0) allows authenticated administrator-level users to inject persistent malicious scripts into admin settings pages that execute in the browsers of other administrators who view those pages. The vulnerability bypasses WordPress's unfiltered_html capability restriction, making it particularly relevant in WordPress multisite deployments where that capability is intentionally withheld from site administrators. A vendor-released patch (2.8.1) is available, and a public proof-of-concept has been published by WPScan.
Path traversal in the JCH Optimize WordPress plugin (versions before 5.0.1) permits authenticated administrators - including sub-site administrators on WordPress multisite installations - to enumerate directories and file names outside the web root via an unsanitized path parameter in the plugin's administrative image-browsing feature. A public proof-of-concept is available through WPScan, though SSVC confirms no active exploitation and EPSS sits at the 5th percentile. Real-world impact is confined to confidentiality of filesystem structure: attackers can map server directory layouts and file names but cannot read file contents or modify data.
Client-side price manipulation in the E-cab Taxi Booking Manager for WooCommerce WordPress plugin (before 2.0.5) allows unauthenticated attackers to submit taxi booking orders at an arbitrary price, including zero, by supplying fabricated trip-distance and base-price values that the server accepts without validation. The plugin trusts the pricing parameters delivered in the booking request rather than computing cost authoritatively on the backend, constituting a classic business-logic bypass. A publicly available exploit exists per WPScan; no public exploitation tracking (KEV) is recorded, but the trivial exploitation requirements make this a meaningful financial risk for any operator running the affected plugin.
Unauthenticated information disclosure in the Xpro Addons - 140+ Widgets for Elementor WordPress plugin (versions before 1.7.8) exposes non-public WooCommerce product data - including titles, prices, SKUs, descriptions, and stock levels - to any visitor without authentication. The plugin renders product summaries via a widget endpoint without performing any post-status or capability check, meaning products in draft, pending, private, or scheduled states are fully retrievable by arbitrary external requesters. A publicly available exploit has been documented by WPScan, though no active exploitation has been confirmed by CISA KEV.
Missing post-ownership authorization in Directorist WordPress plugin before 8.9 allows any authenticated subscriber-level user to overwrite image metadata on posts belonging to other users. The plugin fails to verify that the uploading user owns the target post before writing file references to its metadata, enabling cross-user content tampering limited to image attachment references. No public exploit confirmed via CISA KEV, but WPScan has published a proof-of-concept, and a vendor patch is available at version 8.9.
Arbitrary file deletion in WPvivid - Backup, Migration & Staging WordPress plugin before 0.9.134 allows authenticated administrators to supply unsanitized path values to the plugin's file deletion routine, enabling deletion of files anywhere on the server filesystem including outside the web root. Exploitation requires WordPress administrator credentials but no other conditions, and a publicly available proof-of-concept has been published by WPScan. Patch version 0.9.134 is available from the vendor.
Arbitrary file-write via path traversal in WPvivid - Backup, Migration & Staging WordPress plugin before 0.9.134 allows authenticated administrators to place files of permitted types at any writable server path, including locations outside the WordPress installation root. The vulnerability stems from unsanitized user-supplied filenames used directly in write-path construction (CWE-22), with scope change (S:C) confirmed by the vendor CVSS vector. A publicly available proof-of-concept exists, and a patched release (0.9.134) has been issued; no active exploitation (CISA KEV) has been reported at time of analysis.
SQL injection in WPLP Cookie Consent WordPress plugin (versions 3.0.0 through before 4.4.2) allows authenticated administrators to execute arbitrary SQL queries via an unvalidated pagination parameter passed directly into a database query without sanitization. The vendor CVSS includes a scope-change flag (S:C), indicating the injection may permit cross-schema database reads beyond the plugin's own tables. A publicly available proof-of-concept exists via WPScan, though exploitation is gated behind WordPress administrator credentials.
Unauthenticated path traversal file deletion in the Frontend Admin by DynamiApps WordPress plugin before 3.29.13 allows remote attackers to delete index.php and .htaccess files from the WordPress root directory, rendering the site entirely inoperable. The flaw stems from insufficient validation of a user-controllable directory path parameter prior to file deletion operations, exploitable without any authentication credentials. A publicly available proof-of-concept exists; exploitation is constrained by a non-default form configuration requirement, reflected in the CVSS AC:H scoring.
Improper access control in Ninja Forms WordPress plugin (versions 3.14.0 through 3.15.1) allows any user holding a plugin-specific capability to exploit overly permissive REST API endpoints well beyond their intended scope. An attacker authenticated with that capability can read all stored form submissions and plugin settings, overwrite the plugin's configuration, and create or modify arbitrary WordPress posts and pages - operations ordinarily reserved for site administrators. A publicly available proof-of-concept exists per the WPScan advisory, though exploitation depends on a non-default administrative delegation step; no CISA KEV listing has been identified.
Unauthenticated email relay abuse in WPFunnels WordPress plugin versions 3.1.0 through 3.12.x allows any remote visitor to send emails from the affected site to arbitrary recipients with arbitrary subjects. The opt-in submission handler accepts notification recipients and email subject lines directly from HTTP request parameters without performing authorization checks or WordPress nonce validation, turning the site's trusted mail infrastructure into an open relay. A publicly available exploit exists via WPScan; vendor-released patch 3.13.0 closes the gap.
Unauthenticated log file exposure in WPFunnels WordPress plugin (versions 2.6.0 through <3.13.0) enables any remote visitor to retrieve customer order details and opt-in form submission data by directly requesting a predictable log file URL within the public uploads directory. The flaw affects e-commerce funnel operators who may store customer PII - names, emails, purchase data - in these logs, with potential GDPR/privacy regulatory consequences beyond the C:L CVSS rating suggests. A publicly available proof-of-concept exists; no public exploit or CISA KEV listing indicates active mass exploitation at time of analysis.
Price manipulation in WPFunnels WordPress plugin before 3.13.0 allows unauthenticated attackers to apply a configured order bump discount to any purchasable WooCommerce product rather than only the specific product the discount was intended for, causing the fraudulently reduced price to carry through to the completed order total. The vulnerability stems from absent server-side validation of the product-to-discount pairing during order bump processing, classified as CWE-639 (Authorization Bypass Through User-Controlled Key). A publicly available exploit exists via WPScan, and a vendor-released patch is available in version 3.13.0.
Arbitrary file read in the Pods WordPress plugin before 3.3.9.2 allows users holding the Author role or higher to exfiltrate any file accessible to the web server process, including sensitive files outside the web root such as wp-config.php or system credentials. The flaw stems from the plugin's display callback resolver accepting unrestricted PHP callable targets without allowlisting. A publicly available proof-of-concept exists per WPScan, and a vendor patch is available. The attack surface is limited to installations operating in restricted display-callback mode, which is the automatic default for WordPress sites whose initial Pods installation predated version 3.1.
Privilege escalation with arbitrary code execution in the Hummingbird Performance WordPress plugin (versions 3.15.0 through before 3.21.2) allows any site-level administrator on a WordPress multisite network to access and modify a network-wide configuration setting that should be gated to super admins, achieving code execution across all sites on the network. The vulnerability stems from missing capability enforcement (CWE-94) on a sensitive network-scope action. A publicly available proof-of-concept exists, and the vendor has released a patched version (3.21.2) addressing the access control gap.
Unauthenticated information disclosure in the Content Views WordPress plugin before 4.5.1.2 allows any remote visitor to read the title and full body of non-public posts - including drafts, pending, private, and scheduled posts - when a site administrator has configured a view to include them. The root cause is a missing authorization check: the plugin never verifies whether the requesting user holds the WordPress capability required to read posts in restricted statuses before serving them in view responses. A publicly available proof-of-concept exists via WPScan; the vendor has released a patched version (4.5.1.2).
Broken object-level authorization in the Classified Listing WordPress plugin (versions 5.3.0 through pre-6.1.1) allows any authenticated subscriber-level user to permanently delete media attachments from, or attach arbitrary files to, listings owned by other users by invoking the plugin's AI image-editing AJAX action with a victim's listing ID. The handler performs no ownership or capability verification before acting on the supplied identifier (CWE-639), meaning the lowest default WordPress role is sufficient to tamper with any listing on the platform. A publicly available proof-of-concept exists per WPScan; no active exploitation has been confirmed in the CISA KEV catalog at time of analysis.
Unauthorized WordPress account creation in WPFunnels (versions 3.6.3 through before 3.13.0) allows unauthenticated remote attackers to register user accounts on sites where WordPress registration is explicitly disabled. The plugin trusts a client-supplied boolean in the opt-in form submission request rather than querying the server-side registration setting, making the site-level restriction trivially bypassable. This is an incomplete patch for CVE-2025-12353 - the fix applied in 3.6.3 closed only one of three registration code paths, leaving sites that updated to 3.6.3 through 3.12.x still vulnerable and falsely believing they were protected.
HTTP Header Injection in the Ajaxify Comments WordPress plugin (before version 3.2) allows unauthenticated remote attackers to inject arbitrary HTTP response headers via unsanitized user-supplied input that is echoed into server responses. The plugin fails to neutralize CRLF sequences, enabling response splitting that could facilitate session fixation, cache poisoning, or cross-site scripting via crafted HTTP responses. A publicly available exploit has been documented by WPScan; no active exploitation (CISA KEV) has been confirmed at time of analysis.
Unauthenticated arbitrary file upload in the Developer Tools WordPress plugin (versions through 1.1.3) lets remote attackers upload malicious files via the bundled, legacy SWFUpload component, typically leading to remote code execution when a PHP webshell is placed in a web-accessible directory. Any WordPress site running this plugin at or below 1.1.3 is exposed with no authentication required. Publicly available exploit code exists (reported by WPScan), though there is no public evidence of active exploitation.
Unauthenticated information disclosure in the Wp Edit Password Protected WordPress plugin (before 1.3.5) exposes password-protected page and post content via the WordPress REST API. The plugin enforces content protection on standard page views but fails to apply the same restriction to REST API endpoints, allowing any remote unauthenticated requester to retrieve the full content of pages the site owner intended to keep gated behind a password. A publicly available proof-of-concept is documented by WPScan; no active exploitation has been confirmed in CISA KEV. The CVSS score of 5.3 reflects the limited scope - confidentiality only, no integrity or availability impact.
Global protection bypass in the Passster WordPress plugin (versions before 4.2.26) allows unauthenticated remote attackers to access password-protected content by submitting crafted URLs that circumvent the plugin's site-wide protection checks. Because Passster's entire purpose is content gating, this vulnerability entirely nullifies the plugin's security guarantee for affected sites. A publicly available PoC exists, reported by WPScan, making automated scanning and exploitation straightforward.
Unauthenticated information disclosure in the Passster WordPress plugin (versions before 4.2.24) allows remote attackers to retrieve the values of password-protected content via an improperly handled AJAX action. Because Passster's sole function is gating content behind passwords, this flaw entirely negates its intended protection guarantee. A public exploit is available via WPScan, and the zero-prerequisite attack vector makes this trivially exploitable against any affected installation.
Missing authorization on REST API endpoints in the Auto x LINE WordPress plugin (through version 1.0.0) allows unauthenticated remote attackers to read and modify plugin settings and erase log data. The plugin facilitates LINE messaging integration for WordPress sites, meaning exposed settings likely include LINE API credentials and channel tokens. A publicly available proof-of-concept exists per WPScan, and the unauthenticated network-accessible nature of the flaw (PR:N, AV:N) makes it trivially exploitable against any exposed instance. No actively exploited status confirmed in CISA KEV at time of analysis.
Unauthenticated information disclosure in the Notification Bar for WordPress plugin (through v1.1.8) allows any remote attacker to retrieve the full subscriber email list via an exposed CSV export script that performs no authentication or capability check. A publicly available proof-of-concept published by WPScan confirms trivial exploitation requiring only a single HTTP request. The vulnerability is not currently in CISA KEV, but the zero-friction exploitation path creates meaningful privacy and regulatory exposure (GDPR, CAN-SPAM) for any WordPress site running this plugin.
Stored Cross-Site Scripting in Xpro Addons for WordPress (before 1.7.4) allows any user holding the Contributor role or higher to inject malicious JavaScript through insufficiently escaped widget settings, which are then rendered unsanitized within HTML attributes on the front end. When a privileged user such as an administrator views a page containing the compromised widget, the attacker's payload executes in their browser session. A publicly available exploit has been documented by WPScan; no CISA KEV listing is present, but the low barrier to exploitation (any registered Contributor) makes this a meaningful risk on multi-author or membership WordPress sites.
Payment verification bypass in WP Express Checkout WordPress plugin before 2.4.9 allows unauthenticated remote attackers to forge completed orders without submitting actual payment. The plugin fails to perform server-side confirmation that a payment transaction was successfully processed before transitioning an order to 'paid' status, enabling fraudulent order completion. A publicly available exploit exists per WPScan, making active abuse by financially motivated actors a realistic near-term risk for any e-commerce site running an affected version.
Stored Cross-Site Scripting in the All in One SEO WordPress plugin before version 5.0.0.1 enables users holding the contributor role or above to inject persistent malicious scripts into post content that execute in the browser of any higher-privileged user who subsequently edits that post. The attack effectively allows a low-trust contributor to hijack administrator sessions, enabling full site compromise. A publicly available proof-of-concept from WPScan exists, and the plugin's broad deployment across millions of WordPress installations amplifies aggregate exposure.
Shortcode injection in the Brave WordPress plugin before 0.8.8 allows unauthenticated remote attackers to execute arbitrary WordPress shortcodes server-side by passing crafted values through URL parameters designed for pre-filling form fields. The exploitable shortcodes and their consequences depend entirely on which shortcodes are registered on the target installation - ranging from information disclosure to, in worst-case scenarios involving code-execution shortcodes, elevated impact. A publicly available proof-of-concept exists per WPScan; no active exploitation (KEV) has been confirmed. The CVSS score of 4.8 with AC:H reflects that real-world impact is highly site-dependent.
Cross-site request forgery in the Simple Membership MailChimp Integration WordPress plugin (versions before 1.9.8) allows a network-positioned attacker to replace the site's configured MailChimp API key with one under attacker control by tricking a logged-in administrator into loading a crafted page. Once the API key is substituted, all subsequent member registration data - including name, email address, and membership level - is silently forwarded to the attacker's MailChimp account until the change is detected. A publicly available exploit exists and a vendor patch (1.9.8) is available; no active exploitation has been confirmed in CISA KEV.
Route normalization bypass in the Restrict User Access WordPress plugin (all versions before 2.8.1) lets unauthenticated remote attackers read content the plugin is configured to restrict and enumerate WordPress user accounts. The plugin compares raw incoming REST API route strings against its protection rules without first canonicalizing the path, so a subtly non-canonical request (extra slash, encoded character, etc.) matches no rule and is passed through unrestricted. A publicly available PoC is documented by WPScan; the vulnerability is not in CISA KEV at time of analysis.
Payment bypass in the RegistrationMagic WordPress plugin before 6.0.9.9 allows unauthenticated users to register for paid forms without completing payment and immediately receive an activated account holding whatever role the form is configured to grant. The plugin fails to validate a client-supplied quantity multiplier when computing the total registration price server-side, enabling an attacker to force the calculated total to zero or an arbitrary value. A publicly available proof-of-concept exploit exists per WPScan, and no authentication is required. No public exploit identified at time of analysis for active exploitation, but the low attack complexity combined with public PoC makes this a realistic threat for any site monetizing registrations via this plugin.
Price validation bypass in the RegistrationMagic WordPress plugin before 6.0.9.9 allows unauthenticated users to complete paid registrations without payment and receive fully activated accounts. The plugin fails to verify the total registration price server-side, meaning client-submitted price values are accepted without cross-checking against the configured amount. A publicly available proof-of-concept exploit exists, and no CISA KEV listing has been recorded at time of analysis.
Remote code execution in the WatchMan-Site7 WordPress plugin (all versions through 4.2.0) allows any authenticated user - including a low-privilege subscriber - to run arbitrary PHP on the server because the plugin's debugging console, which evaluates user-supplied PHP, is not access-restricted. Publicly available exploit code exists (reported by WPScan), and with CVSS 9.9 this represents full server compromise from the lowest authenticated role. There is no public evidence of active in-the-wild exploitation at time of analysis.
Unrestricted file upload in the Embed HTML5 Game WordPress plugin (versions through 1.3) lets unauthenticated attackers upload arbitrary files - including PHP scripts - because the plugin neither restricts who may upload nor validates file type, enabling planting of PHP backdoors and full remote code execution. WPScan reports the flaw with a publicly available exploit, and the CVSS 10.0 rating reflects unauthenticated network exploitation with complete impact. No CISA KEV listing exists, but the combination of PR:N and a public PoC makes opportunistic scanning likely.
Unauthenticated attackers can bypass WordPress nonce validation in the HIPAA FORMS plugin (all versions before 3.2.0) by including a hardcoded parameter in any AJAX request, which causes the server to skip its nonce check entirely. Because the plugin handles HIPAA-regulated healthcare intake forms, this exposes protected AJAX endpoints to unauthorized read and write operations without any credentials. A public exploit is available via WPScan, and no exploitation complexity is required beyond knowledge of the hardcoded value.
CSS injection in GutenKit WordPress plugin (versions before 2.5.1) allows any authenticated user holding the Contributor role or above to embed arbitrary stylesheets into posts served to all site visitors and anonymous users. The plugin fails to validate or escape style settings before interpolating them into CSS output on the front end, enabling defacement, interface redressing, and forced loading of external resources. JavaScript execution is explicitly ruled out at the Contributor privilege tier, capping the attack surface below full cross-site scripting. A publicly available exploit has been disclosed by WPScan.
Unauthenticated post creation and publication is possible in the User Frontend WordPress plugin before 4.3.11 due to a server-side enforcement gap in its subscription-gating logic. The plugin validates subscription status only at form-render time, not during form submission processing, so an attacker who bypasses the rendered form and submits directly to the backend endpoint can create - and depending on form configuration, immediately publish - posts that should be restricted to paying subscribers. A publicly available proof-of-concept exists and was disclosed through WPScan. No public exploit in CISA KEV at time of analysis.
Broken object-level authorization in the Timetics WordPress plugin through version 1.0.61 allows authenticated users holding the plugin's custom staff role to modify, disable, or take over appointments belonging to other staff members via the REST API. The endpoint accepts appointment identifiers without validating ownership, enabling lateral privilege abuse among staff peers. A public WPScan PoC confirms exploitability, though real-world impact is bounded by the PR:H prerequisite of a pre-existing staff account.
Control-character (newline) injection in Yoast SEO Premium before 27.6.1 allows an authenticated WordPress Author to write arbitrary Apache directives into the site's root .htaccess file via unsanitized redirect origins in file-based redirect mode. On Apache servers that process PHP directives, the injected auto_prepend_file directive can be chained with a polyglot image upload (available to Author-role users) to achieve full Remote Code Execution as the web server process. A public exploit is available via WPScan, making real-world exploitation feasible wherever the three required conditions align.
Stored Cross-Site Scripting in Icegram Express WordPress plugin versions before 5.8.6 allows administrator-level users to inject malicious scripts into HTML attributes via the list description setting. When another user subsequently loads the affected page, the injected payload executes in their browser, enabling session hijacking, credential capture, or unauthorized actions on their behalf. A publicly available proof-of-concept exploit has been confirmed by WPScan, though real-world impact is substantially constrained by the high-privilege prerequisite required to plant the payload.
Authentication bypass in the OAuth Single Sign On WordPress plugin (versions 6.25.0 through <7.0.1) allows unauthenticated remote attackers to log in as any non-administrator WordPress user by forging the identity assertion returned during the Steam SSO flow, without possessing valid credentials. Attackers can additionally register entirely new accounts, providing persistent footholds. A publicly available proof-of-concept exploit reported by WPScan materially elevates real-world risk and makes this an immediate patching priority for affected sites.
SQL injection in the WPvivid Backup, Migration & Staging WordPress plugin (all versions before 0.9.133) allows authenticated WordPress administrators to inject arbitrary SQL through an unsanitized list of identifiers passed directly to database queries. The CVSS scope change (S:C) indicates injected queries may reach beyond the plugin's own data, potentially touching other schemas on the shared MySQL host. A publicly available proof-of-concept has been disclosed via WPScan, though SSVC reports no confirmed active exploitation; vendor-released patch 0.9.133 is available.
Stored cross-site scripting in the Simple Ajax Chat WordPress plugin (versions before 20260827) permits unauthenticated users to inject arbitrary HTML and JavaScript into chat messages, which execute in the browser of any viewer including site administrators. Because no authentication is required to post messages and the plugin does not sanitize or escape content before rendering, a single malicious chat post persists and fires against every subsequent visitor. A publicly available exploit demonstrates the issue, and CVSS PR:N/UI:R confirms the attacker-to-victim delivery model: the attacker posts once, then waits for an administrator to trigger code execution by viewing the chat.
Stored XSS in the FAQ Builder AYS WordPress plugin (versions before 1.8.5) permits unauthenticated remote attackers to inject persistent JavaScript payloads via visitor-submitted content that is stored without sanitization and later rendered in the WordPress admin dashboard. A double-bypass condition compounds the flaw: the plugin's own partial HTML escaping is undone by a subsequent server-side decoding step, ensuring injected scripts reach the admin browser intact. When a logged-in administrator views the affected admin panel page, the payload executes with full administrative privileges, enabling session hijacking or complete site takeover. A publicly available exploit exists per WPScan; vendor patch version 1.8.5 is available.
Privilege escalation in the Theme My Login WordPress plugin (versions before 7.2.0) allows low-privileged users to silently bypass the network's site-creation restrictions on multisite WordPress installations, gaining administrator-level control over a newly created site. Subscriber-level authenticated users - and on some networks, unauthenticated users - can invoke the site-signup flow to create sites even when the network's registration setting prohibits it. A publicly available proof-of-concept exploit exists, raising the urgency for patching. The vendor has released a fix in version 7.2.0.
Cross-site request forgery vulnerabilities in JetStyleManager for Gutenberg WordPress plugin (all versions before 1.3.9) allow an unauthenticated attacker to delete or modify custom widget skins by tricking a logged-in Contributor-level (or higher) user into visiting a crafted page or clicking a malicious link. The missing CSRF token (nonce) validation on affected AJAX endpoints means the victim's authenticated browser session is silently weaponized against their own site. A publicly available exploit exists via WPScan and vendor-released patch version 1.3.9 resolves the issue.
Insecure Direct Object Reference in the WC Vendors WordPress plugin before 2.7.2.1 allows any authenticated user holding the vendor role to tamper with product variations owned by other vendors and to overwrite the status and title of arbitrary WordPress posts. The root cause is that the plugin never validates whether a user-supplied object ID actually belongs to the requesting vendor before persisting changes. A publicly available proof-of-concept exploit exists; the issue is not currently listed in CISA KEV.
Shortcode injection in the Ninja Forms WordPress plugin (versions 3.14.10 through 3.15.1) allows unauthenticated network attackers to execute any shortcode registered on the target site by embedding shortcode syntax into form request fields the plugin later processes. The plugin fails to strip or escape shortcode markers before passing user-controlled values through WordPress's shortcode execution pipeline, meaning the server interprets and runs injected tags. A publicly available exploit exists per WPScan's advisory; real-world impact scales with the shortcodes registered on the site - ranging from benign output to sensitive data exposure or unintended privileged actions.
Shortcode injection in the Redirection for Contact Form 7 WordPress plugin (versions 2.2.7 through 3.2.10) enables unauthenticated remote attackers to execute arbitrary registered WordPress shortcodes server-side and capture their output. The plugin substitutes raw form submission values into its action settings and then evaluates those settings through WordPress's do_shortcode() pipeline without sanitizing or stripping user-supplied shortcode syntax first. A public proof-of-concept is available via WPScan; vendor-released patch version 3.2.11 addresses the issue.
Email header injection in JetFormBuilder WordPress plugin before 3.6.5.2 allows unauthenticated attackers to manipulate outgoing email headers by submitting CRLF sequences in form address fields. Exploitation enables adding hidden recipients via BCC, spoofing the sender address, and abusing the victim site's trusted email reputation as a phishing or spam relay. A publicly available exploit entry is documented by WPScan, though exploitation requires a non-default configuration in which the plugin is explicitly set to source message address headers from user-submitted form fields.
Shortcode injection in JetFormBuilder WordPress plugin before 3.6.5.2 allows unauthenticated remote attackers to execute any shortcode registered on the target WordPress site. The flaw stems from a misordered sanitization pipeline: user-supplied input in a request parameter is HTML-escaped before it is passed to WordPress's shortcode expansion function rather than after, meaning shortcode syntax survives the escape pass intact and is then evaluated server-side. A publicly available proof-of-concept exploit exists via WPScan, making this immediately actionable for attackers against unpatched installs.
Unauthorized role self-assignment in the B2BKing WooCommerce plugin before version 5.2.40 allows unauthenticated registrants to claim restricted B2B customer group memberships without admin approval by supplying arbitrary role parameters not bounded by server-side validation. The plugin fails to verify that a role submitted during account registration is actually one offered on the public registration form, enabling any user to bypass the manual account-approval workflow and gain access to wholesale pricing tiers or restricted catalogs. A publicly available proof-of-concept exists via WPScan, though no confirmed active exploitation has been identified in CISA KEV at time of analysis.
Stored cross-site scripting in the Kirki WordPress plugin before 6.3.0 allows unauthenticated remote attackers to persistently inject JavaScript into comment fields by bypassing the plugin's HTML entity decoding logic through alternate entity encodings. The malicious payload executes in the browser session of any user - including administrators - who views a page rendering the affected comment, and propagates site-wide when Kirki-managed headers or footers display comment data. A publicly available proof-of-concept exists and the vendor has released a patching fix in version 6.3.0.
Stored cross-site scripting in the Bold Page Builder WordPress plugin (all versions before 5.9.9) permits any user holding the Contributor role or higher to embed arbitrary JavaScript inside an HTML attribute via an unsanitized shortcode parameter. A publicly available exploit exists per WPScan (EUVD-2026-72064). When a higher-privileged user such as an administrator views a page containing the injected payload, the script executes in their browser, enabling session hijacking, nonce theft, or full administrative takeover of the WordPress installation.
Unauthenticated account registration bypass in SureCart WordPress plugin before 4.7.0 allows remote attackers to create WordPress user accounts and obtain authenticated sessions even when the site administrator has explicitly disabled user registration. The plugin fails to consult WordPress's native `users_can_register` site option before processing account creation through its own checkout/registration flow. A publicly available proof-of-concept exists per WPScan, and a vendor patch is available in version 4.7.0. No confirmed active exploitation (CISA KEV) at time of analysis.
Account takeover via insecure direct object reference in the SureCart WordPress plugin (versions 4.0.0 through 4.6.2) allows any subscriber-level authenticated user to seize full control of an administrator account. The plugin's customer update endpoint validates that the requester has permission to update customers, but fails to verify that the target customer record belongs to the requesting user - enabling arbitrary cross-user email modification followed by a password reset. A compounding information disclosure flaw leaks customer identifiers and email addresses to all authenticated users, providing the enumeration primitive needed to complete the takeover chain without any additional knowledge. A publicly available proof-of-concept exploit exists, and vendor patch 4.6.3 is available.
Real Estate Papi WordPress theme (≤1.0.5) exposes an AJAX endpoint that lacks both capability checks and CSRF validation, enabling any authenticated subscriber to silently force-install a fixed set of companion plugins from the WordPress.org repository. Because CSRF protection is also absent, an attacker can craft a cross-site request that fires in an active administrator session, causing those plugins to be activated as well - an escalation beyond what subscriber-level access alone would permit. WPScan published a proof-of-concept; SSVC rates exploitation as none with partial technical impact, indicating no confirmed in-the-wild abuse at time of analysis.
SQL injection in the Video Player for YouTube WordPress plugin (versions before 2.1.0) allows authenticated users holding the Contributor role or higher to inject arbitrary SQL commands via unsanitized input, enabling them to read any data stored in the underlying WordPress database. The scope change reflected in the CVSS vector (S:C) indicates that exploitation extends reads beyond the plugin's own tables to potentially include WordPress user credentials, secrets, and configuration data held elsewhere in the database. A public PoC exists via WPScan, but EPSS sits at 0.16% and CISA has not added this to KEV, indicating low observed exploitation activity.
Missing authorization on the EmbedPress WordPress plugin's review-loading action (versions 4.6.0-4.6.3) permits unauthenticated remote attackers to abuse the site's stored third-party API credentials - triggering repeated billable API calls against the site owner's account - while simultaneously injecting an unbounded number of attacker-controlled rows into the WordPress database. A publicly available PoC exploit was documented by WPScan. Although EPSS probability is low (0.14%), SSVC rates the attack as automatable, making mass targeting of vulnerable WordPress deployments feasible with minimal tooling.
Stored cross-site scripting in the HT Menu WordPress plugin before 1.2.7 allows any authenticated subscriber-level user to inject arbitrary JavaScript into navigation menu-item settings, which then executes in the browser of every site visitor - including administrators - who views the affected menu. The flaw combines two missing controls: no capability or ownership check on the settings-save endpoint, and no output escaping on render. A public exploit is available via WPScan, and vendor-released patch 1.2.7 is available. No public KEV listing; EPSS is low at 0.15%, consistent with targeted rather than mass exploitation.
Stored cross-site scripting in the JCH Optimize WordPress plugin before 6.0.1 allows any authenticated user with Subscriber-level access to import arbitrary plugin settings via an unprotected AJAX endpoint, injecting persistent JavaScript that executes in the browsers of site visitors and administrators. The missing capability check means that low-privilege accounts bypass the intended authorization boundary, enabling stored XSS delivery without administrative permissions. A publicly available proof-of-concept from WPScan exists, and the vendor has released a fix in version 6.0.1.
Stored cross-site scripting in the Joli Table Of Contents WordPress plugin (versions before 3.0.3) permits any user holding the Author role or higher to inject arbitrary HTML attributes and JavaScript via an unsanitized shortcode attribute, with the payload executing in the browser of any visitor - including administrators - who views the post. Because Authors in WordPress are explicitly barred from posting unfiltered HTML, this constitutes a privilege-boundary violation that can be leveraged to hijack administrator sessions or trigger privileged actions covertly. A public exploit is documented by WPScan; EPSS stands at 0.15% (5th percentile), indicating limited automated targeting, and no CISA KEV listing exists.
Stored XSS in CatFolders Document Gallery & PDF Library WordPress plugin before version 2.0.7 allows any user holding an Author account or higher to inject persistent malicious scripts via an unsanitized block attribute that is directly interpolated as an HTML tag name in gallery rendering output. Any visitor who views a post containing the crafted gallery block will execute the attacker's payload in their browser without additional interaction. No active exploitation has been confirmed in CISA KEV, but a publicly available proof-of-concept exists per WPScan disclosure, reducing the technical barrier for any authenticated attacker.
Insufficient authorization on the EmbedPress WordPress plugin's Google Reviews REST API endpoint allows any authenticated Contributor-role user to overwrite the site-wide reviews store in versions 4.6.0 through 4.6.3. An attacker with a Contributor account can delete administrator-configured review entries and inject fabricated ones that render publicly across the entire WordPress site, enabling reputation manipulation or social engineering. A publicly available exploit exists per WPScan; however, SSVC marks exploitation as none and EPSS sits at 0.13% (3rd percentile), reflecting the prerequisite of a legitimate account.
Information disclosure in the EmbedPress WordPress plugin (versions 4.6.0 through 4.6.3) allows any authenticated contributor-level user or above to retrieve the site administrator's email address via an improperly restricted Google Reviews REST API endpoint. WordPress core deliberately withholds administrator email from the contributor role as a privacy control; this plugin bypass defeats that restriction without requiring administrative privileges. A publicly available proof-of-concept has been published by WPScan, though EPSS at 0.14% and SSVC exploitation status of 'none' indicate no observed active exploitation at time of analysis.
Missing authorization on Eventin's event-management REST routes allows low-privilege WordPress contributors to perform integrity-impacting actions outside their permitted scope. Affected installations running Eventin before 4.1.22 expose endpoints that let contributor-role users redirect the site's public front page to an arbitrary event they do not own, and create, edit, or delete global event and speaker taxonomy terms site-wide. A publicly available exploit is documented by WPScan, though SSVC exploitation status is none and EPSS is 0.13%, indicating no confirmed active abuse at time of analysis.
Stored XSS in VikWidgetsLoader WordPress plugin before 1.12.0 allows Contributor-role users to permanently embed arbitrary JavaScript into posts by supplying a malicious block attribute that is output unsanitized inside an inline script tag. When an administrator reviews the pending submission, the payload executes in their browser, enabling full session hijacking and site takeover without any further attacker interaction. A publicly available exploit exists (via WPScan), though EPSS is low (0.15%, 5th percentile) and SSVC records no confirmed exploitation at this time.
Local file inclusion in Eventin WordPress plugin before 4.1.21 enables authenticated contributors and higher-privileged users to include and execute arbitrary PHP files on the web server. The plugin fails to validate a user-supplied template path parameter before passing it to a PHP file-inclusion routine, allowing path traversal to any locally accessible PHP file. A publicly available proof-of-concept has been published by WPScan; vendor patch 4.1.21 is available and should be applied immediately.
Stored cross-site scripting in King Addons for Elementor WordPress plugin before version 51.1.77 allows any Contributor-level (or higher) user to inject persistent JavaScript into a widget display-style setting that is written unescaped into an HTML attribute at render time. The payload fires in every visitor's browser upon page load - including logged-in administrators - enabling session hijacking, credential theft, or silent execution of privileged site actions. A publicly available proof-of-concept was disclosed via WPScan; no active exploitation is confirmed in the CISA KEV catalog at time of analysis.
The Events Calendar WordPress plugin before 6.17.3.1 exposes unpublished site content - drafts, pending posts, and private records from all users - through its public REST API archive endpoints to any contributor-level authenticated user. The plugin fails to enforce WordPress's standard post-status visibility controls on its custom REST routes, allowing a low-privilege account holder to enumerate and read the full body of every non-public record site-wide, bypassing intended access controls. A public proof-of-concept is documented via WPScan, and a vendor patch (6.17.3.1) is available.
Insufficient per-object authorization in the Kirki WordPress plugin before 6.3.0 allows users with administrator-granted content-level page builder access to alter the state of collaboration comments left by any user, including on pages those users cannot themselves open. The root cause is CWE-639 (Authorization Through User-Controlled Key / IDOR): the comment-state endpoint accepts a user-supplied comment identifier without verifying whether the requesting user holds authorization over that specific comment object. Despite a publicly available PoC from WPScan, EPSS sits at 0.13% (3rd percentile) and the vulnerability is not in the CISA KEV catalog, indicating negligible opportunistic exploitation risk.
SQL injection in the Kirki WordPress plugin (versions 6.0.0 through <6.3.0) enables authenticated users with editor-level access or above to append arbitrary SQL to an unescaped identifier, exfiltrating the full WordPress database including hashed credentials for all user accounts. The scope change (S:C) in the CVSS vector reflects that credential exposure extends impact beyond the attacker's own session to all other platform users. A publicly available proof-of-concept is documented by WPScan, and the vendor has released a remediated version (6.3.0).
Stored cross-site scripting in Bold Page Builder WordPress plugin (all versions before 5.9.8) allows authenticated Contributor-level users to inject persistent arbitrary JavaScript through unsanitized shortcode attribute values, which then execute in the browsers of any visitor rendering the affected page. A publicly available proof-of-concept exists via WPScan, and the vendor has released a patched version (5.9.8). Despite a low EPSS score (0.15%, 5th percentile), the public PoC and low privilege bar make this a realistic attack vector against sites with open contributor registration.
Stored cross-site scripting in the Bold Page Builder WordPress plugin before 5.9.8 allows authenticated users holding the Contributor role or higher to inject arbitrary JavaScript via a crafted link URL that bypasses the plugin's client-side filter. When a victim user subsequently clicks the malicious link rendered in the page builder output, the injected script executes in their browser session. A publicly available proof-of-concept exists per WPScan, though EPSS remains very low (0.15%), indicating limited observed exploitation despite public disclosure.
Stored cross-site scripting in the Greenshift WordPress plugin (all versions before 13.2.0) allows any user with Contributor-level access or higher to inject arbitrary JavaScript via an improperly escaped block animation attribute rendered into an HTML attribute context. When a higher-privileged user such as an administrator views the affected content, the injected script executes in their browser session, enabling session hijacking or unauthorized administrative actions. A publicly available proof-of-concept exists per WPScan reporting, making exploitation accessible to low-skilled threat actors despite the low EPSS score of 0.15%.
Server-side request forgery in the Greenshift WordPress plugin before 13.2.0 allows contributor-level (and higher) authenticated users to direct the server to fetch arbitrary external or internal URLs and read the response. The flaw stems from missing URL validation before server-side HTTP requests are dispatched, enabling internal network reconnaissance, port scanning, or cloud instance metadata credential theft in hosted environments. A publicly available exploit exists and was reported by WPScan; EPSS stands at 0.13% (3rd percentile), suggesting no widespread automated exploitation at time of analysis despite the public PoC.
Stored Cross-Site Scripting in the Masteriyo LMS WordPress plugin before version 3.4.0 allows any user holding the course-author role to inject unsanitized JavaScript into course settings fields, where it silently executes in the browser of every subsequent visitor - including logged-in administrators. Because the injected payload runs within the victim's full session context, a successful attack against a site administrator can result in complete WordPress site takeover through credential theft, rogue plugin installation, or arbitrary content modification. A publicly available proof-of-concept has been published by WPScan; no active exploitation is confirmed by CISA KEV, and the EPSS score of 0.15% (5th percentile) reflects limited observed exploitation probability at time of analysis.
SQL injection in the Music Store WordPress plugin (versions 1.0.245 through before 1.4.5) enables unauthenticated remote attackers to extract the entire WordPress database via crafted HTTP requests. The CVSS Scope:Changed vector reflects that exploitation can read data beyond the plugin's own tables - including WordPress user credentials, email addresses, and site configuration stored by other plugins. A publicly available exploit is documented on WPScan, though no confirmed active exploitation (CISA KEV) has been recorded.
Order-integrity bypass in the Accept Stripe Payments WordPress plugin before 2.1.4 allows unauthenticated customers who complete a genuine Stripe payment to receive fulfillment for a different product than the one they purchased. The plugin validates only that the payment amount is at least the referenced product's price at checkout completion, without verifying that the fulfilled product matches the product for which payment was originally captured. A public proof-of-concept is available via WPScan; no active exploitation is confirmed in CISA KEV, and the EPSS score (0.15%, 4th percentile) indicates low automated exploitation likelihood.
Open redirect in the Accept Stripe Payments WordPress plugin before version 2.1.4 enables unauthenticated attackers to craft URLs that silently redirect site visitors to arbitrary external destinations, creating a phishing vector against users who trust the legitimate domain. The vulnerability stems from unvalidated user-supplied redirect parameters in the plugin's payment flow. A publicly available proof-of-concept exists per WPScan, though the EPSS score of 0.16% (5th percentile) indicates minimal observed automated exploitation at time of analysis.
Reflected Cross-Site Scripting in the IPGP Visitors Origin WordPress plugin before version 1.6 allows unauthenticated remote attackers to inject arbitrary JavaScript into victims' browsers by delivering a crafted URL that the plugin echoes back unsanitized. No server-side authentication is required from the attacker, though victim interaction (clicking or submitting a crafted request) is mandatory for payload execution. A publicly available proof-of-concept via WPScan lowers the exploitation barrier, though EPSS of 0.18% indicates limited automated scanning activity to date and no active exploitation has been confirmed by CISA KEV.
Unauthenticated information disclosure in the My Private Site WordPress plugin (all versions before 4.2.3) exposes post content, post URLs, and comments to anonymous visitors, directly defeating the plugin's stated purpose of enforcing mandatory login across a WordPress site. The plugin fails to apply its privacy gate to certain front-end read surfaces, meaning requests to those endpoints bypass the authentication requirement entirely. A publicly available proof-of-concept exists; the vendor has released a corrective patch in version 4.2.3.
Site takeover in the SEO Flow by LupsOnline WordPress plugin (versions 3.0.0 through before 3.0.3) stems from improper validation of the credential supplied with the plugin's API requests, allowing unauthenticated attackers to be served in the security context of the administrator who configured the plugin. Because the flaw grants effective administrator-level access, an attacker can fully compromise the affected WordPress site. Publicly available exploit code exists (published by WPScan), though EPSS remains low at 0.15% (4th percentile), and there is no public exploit identified as active in the wild.
Unauthorized post-content disclosure in the Smart Post WordPress plugin before 4.0.8 allows any contributor-level authenticated user to duplicate any private or password-protected post into a personal draft, exposing the full content and metadata regardless of the original post's visibility or ownership restrictions. The flaw is rooted in the plugin's post-duplication feature entirely omitting checks on post type, status, and ownership before creating the copy. A public PoC is available via WPScan; no active exploitation has been confirmed by CISA KEV and the EPSS score sits at the 4th percentile.
Unauthenticated information disclosure in the Smart Post WordPress plugin (versions prior to 4.0.8) exposes both the content of password-protected posts and the passwords themselves via an unprotected AJAX endpoint. Any unauthenticated remote user can query the endpoint to bypass WordPress's native post-password protection mechanism entirely, retrieving guarded content without knowing the password - and also harvesting the password itself for reuse. A public exploit is documented by WPScan; a vendor patch (4.0.8) has been released.
RegistrationMagic WordPress plugin before version 6.0.9.9 omits audience validation on Facebook OAuth access tokens during social login, creating two exploitable paths: an attacker who obtains any valid Facebook token belonging to a site user - regardless of which Facebook application issued it - can authenticate to the WordPress site as that user, and a separate path allows account creation even when site registration is explicitly disabled. Publicly available exploit code has been published by WPScan, and the high CIA impact score reflects that full account compromise is achievable on affected installations with the Facebook login feature enabled.
HTML injection via unsanitized email notifications in JetFormBuilder WordPress plugin (versions before 3.6.5.2) allows unauthenticated form submitters to embed arbitrary HTML-and conditionally JavaScript-into notification emails delivered to administrators and other configured recipients. The scope change is real: a public form submission influences the admin's email client environment rather than the WordPress server itself, with JavaScript execution gated on the recipient's mail client rendering capability. A publicly available proof-of-concept exists via WPScan, though EPSS at 0.18% (8th percentile) reflects no widespread active exploitation; the vulnerability is not in CISA KEV.
JetFormBuilder - Dynamic Blocks Form Builder for WordPress before version 3.6.5.2 exposes sensitive site data to unauthenticated remote attackers due to missing authorization checks during page rendering. By submitting crafted requests that reference internal WordPress data sources, attackers can read arbitrary user properties including password hashes, private and draft post content, term metadata, and secrets stored by the plugin in post metadata fields. A publicly available proof-of-concept exploit exists, and the zero-privilege network attack path makes this a credible mass-scanning target for WordPress infrastructure.
Search Atlas SEO WordPress plugin before 2.6.24 allows any subscriber-level authenticated user to overwrite or permanently delete the site's stored Google service-account credentials by invoking a settings-update handler that performs no nonce verification or capability check. Any registered user on an affected WordPress site can trigger this handler via a crafted HTTP request, disrupting Google Search Console, Analytics, or other Google API integrations that depend on those credentials. A publicly available exploit is documented by WPScan; EPSS remains at 0.14% and CISA KEV status is absent, indicating no observed active exploitation at time of analysis.
Stored Cross-Site Scripting in the Joli Table Of Contents WordPress plugin (versions up to and including 2.8.0) allows authenticated administrator-level users to inject persistent malicious scripts into admin settings pages that execute in the browsers of other administrators who view those pages. The vulnerability bypasses WordPress's unfiltered_html capability restriction, making it particularly relevant in WordPress multisite deployments where that capability is intentionally withheld from site administrators. A vendor-released patch (2.8.1) is available, and a public proof-of-concept has been published by WPScan.
Path traversal in the JCH Optimize WordPress plugin (versions before 5.0.1) permits authenticated administrators - including sub-site administrators on WordPress multisite installations - to enumerate directories and file names outside the web root via an unsanitized path parameter in the plugin's administrative image-browsing feature. A public proof-of-concept is available through WPScan, though SSVC confirms no active exploitation and EPSS sits at the 5th percentile. Real-world impact is confined to confidentiality of filesystem structure: attackers can map server directory layouts and file names but cannot read file contents or modify data.
Client-side price manipulation in the E-cab Taxi Booking Manager for WooCommerce WordPress plugin (before 2.0.5) allows unauthenticated attackers to submit taxi booking orders at an arbitrary price, including zero, by supplying fabricated trip-distance and base-price values that the server accepts without validation. The plugin trusts the pricing parameters delivered in the booking request rather than computing cost authoritatively on the backend, constituting a classic business-logic bypass. A publicly available exploit exists per WPScan; no public exploitation tracking (KEV) is recorded, but the trivial exploitation requirements make this a meaningful financial risk for any operator running the affected plugin.
Unauthenticated information disclosure in the Xpro Addons - 140+ Widgets for Elementor WordPress plugin (versions before 1.7.8) exposes non-public WooCommerce product data - including titles, prices, SKUs, descriptions, and stock levels - to any visitor without authentication. The plugin renders product summaries via a widget endpoint without performing any post-status or capability check, meaning products in draft, pending, private, or scheduled states are fully retrievable by arbitrary external requesters. A publicly available exploit has been documented by WPScan, though no active exploitation has been confirmed by CISA KEV.
Missing post-ownership authorization in Directorist WordPress plugin before 8.9 allows any authenticated subscriber-level user to overwrite image metadata on posts belonging to other users. The plugin fails to verify that the uploading user owns the target post before writing file references to its metadata, enabling cross-user content tampering limited to image attachment references. No public exploit confirmed via CISA KEV, but WPScan has published a proof-of-concept, and a vendor patch is available at version 8.9.
Arbitrary file deletion in WPvivid - Backup, Migration & Staging WordPress plugin before 0.9.134 allows authenticated administrators to supply unsanitized path values to the plugin's file deletion routine, enabling deletion of files anywhere on the server filesystem including outside the web root. Exploitation requires WordPress administrator credentials but no other conditions, and a publicly available proof-of-concept has been published by WPScan. Patch version 0.9.134 is available from the vendor.
Arbitrary file-write via path traversal in WPvivid - Backup, Migration & Staging WordPress plugin before 0.9.134 allows authenticated administrators to place files of permitted types at any writable server path, including locations outside the WordPress installation root. The vulnerability stems from unsanitized user-supplied filenames used directly in write-path construction (CWE-22), with scope change (S:C) confirmed by the vendor CVSS vector. A publicly available proof-of-concept exists, and a patched release (0.9.134) has been issued; no active exploitation (CISA KEV) has been reported at time of analysis.
SQL injection in WPLP Cookie Consent WordPress plugin (versions 3.0.0 through before 4.4.2) allows authenticated administrators to execute arbitrary SQL queries via an unvalidated pagination parameter passed directly into a database query without sanitization. The vendor CVSS includes a scope-change flag (S:C), indicating the injection may permit cross-schema database reads beyond the plugin's own tables. A publicly available proof-of-concept exists via WPScan, though exploitation is gated behind WordPress administrator credentials.
Unauthenticated path traversal file deletion in the Frontend Admin by DynamiApps WordPress plugin before 3.29.13 allows remote attackers to delete index.php and .htaccess files from the WordPress root directory, rendering the site entirely inoperable. The flaw stems from insufficient validation of a user-controllable directory path parameter prior to file deletion operations, exploitable without any authentication credentials. A publicly available proof-of-concept exists; exploitation is constrained by a non-default form configuration requirement, reflected in the CVSS AC:H scoring.
Improper access control in Ninja Forms WordPress plugin (versions 3.14.0 through 3.15.1) allows any user holding a plugin-specific capability to exploit overly permissive REST API endpoints well beyond their intended scope. An attacker authenticated with that capability can read all stored form submissions and plugin settings, overwrite the plugin's configuration, and create or modify arbitrary WordPress posts and pages - operations ordinarily reserved for site administrators. A publicly available proof-of-concept exists per the WPScan advisory, though exploitation depends on a non-default administrative delegation step; no CISA KEV listing has been identified.
Unauthenticated email relay abuse in WPFunnels WordPress plugin versions 3.1.0 through 3.12.x allows any remote visitor to send emails from the affected site to arbitrary recipients with arbitrary subjects. The opt-in submission handler accepts notification recipients and email subject lines directly from HTTP request parameters without performing authorization checks or WordPress nonce validation, turning the site's trusted mail infrastructure into an open relay. A publicly available exploit exists via WPScan; vendor-released patch 3.13.0 closes the gap.
Unauthenticated log file exposure in WPFunnels WordPress plugin (versions 2.6.0 through <3.13.0) enables any remote visitor to retrieve customer order details and opt-in form submission data by directly requesting a predictable log file URL within the public uploads directory. The flaw affects e-commerce funnel operators who may store customer PII - names, emails, purchase data - in these logs, with potential GDPR/privacy regulatory consequences beyond the C:L CVSS rating suggests. A publicly available proof-of-concept exists; no public exploit or CISA KEV listing indicates active mass exploitation at time of analysis.
Price manipulation in WPFunnels WordPress plugin before 3.13.0 allows unauthenticated attackers to apply a configured order bump discount to any purchasable WooCommerce product rather than only the specific product the discount was intended for, causing the fraudulently reduced price to carry through to the completed order total. The vulnerability stems from absent server-side validation of the product-to-discount pairing during order bump processing, classified as CWE-639 (Authorization Bypass Through User-Controlled Key). A publicly available exploit exists via WPScan, and a vendor-released patch is available in version 3.13.0.
Arbitrary file read in the Pods WordPress plugin before 3.3.9.2 allows users holding the Author role or higher to exfiltrate any file accessible to the web server process, including sensitive files outside the web root such as wp-config.php or system credentials. The flaw stems from the plugin's display callback resolver accepting unrestricted PHP callable targets without allowlisting. A publicly available proof-of-concept exists per WPScan, and a vendor patch is available. The attack surface is limited to installations operating in restricted display-callback mode, which is the automatic default for WordPress sites whose initial Pods installation predated version 3.1.
Privilege escalation with arbitrary code execution in the Hummingbird Performance WordPress plugin (versions 3.15.0 through before 3.21.2) allows any site-level administrator on a WordPress multisite network to access and modify a network-wide configuration setting that should be gated to super admins, achieving code execution across all sites on the network. The vulnerability stems from missing capability enforcement (CWE-94) on a sensitive network-scope action. A publicly available proof-of-concept exists, and the vendor has released a patched version (3.21.2) addressing the access control gap.
Unauthenticated information disclosure in the Content Views WordPress plugin before 4.5.1.2 allows any remote visitor to read the title and full body of non-public posts - including drafts, pending, private, and scheduled posts - when a site administrator has configured a view to include them. The root cause is a missing authorization check: the plugin never verifies whether the requesting user holds the WordPress capability required to read posts in restricted statuses before serving them in view responses. A publicly available proof-of-concept exists via WPScan; the vendor has released a patched version (4.5.1.2).
Broken object-level authorization in the Classified Listing WordPress plugin (versions 5.3.0 through pre-6.1.1) allows any authenticated subscriber-level user to permanently delete media attachments from, or attach arbitrary files to, listings owned by other users by invoking the plugin's AI image-editing AJAX action with a victim's listing ID. The handler performs no ownership or capability verification before acting on the supplied identifier (CWE-639), meaning the lowest default WordPress role is sufficient to tamper with any listing on the platform. A publicly available proof-of-concept exists per WPScan; no active exploitation has been confirmed in the CISA KEV catalog at time of analysis.
Unauthorized WordPress account creation in WPFunnels (versions 3.6.3 through before 3.13.0) allows unauthenticated remote attackers to register user accounts on sites where WordPress registration is explicitly disabled. The plugin trusts a client-supplied boolean in the opt-in form submission request rather than querying the server-side registration setting, making the site-level restriction trivially bypassable. This is an incomplete patch for CVE-2025-12353 - the fix applied in 3.6.3 closed only one of three registration code paths, leaving sites that updated to 3.6.3 through 3.12.x still vulnerable and falsely believing they were protected.
HTTP Header Injection in the Ajaxify Comments WordPress plugin (before version 3.2) allows unauthenticated remote attackers to inject arbitrary HTTP response headers via unsanitized user-supplied input that is echoed into server responses. The plugin fails to neutralize CRLF sequences, enabling response splitting that could facilitate session fixation, cache poisoning, or cross-site scripting via crafted HTTP responses. A publicly available exploit has been documented by WPScan; no active exploitation (CISA KEV) has been confirmed at time of analysis.
Unauthenticated arbitrary file upload in the Developer Tools WordPress plugin (versions through 1.1.3) lets remote attackers upload malicious files via the bundled, legacy SWFUpload component, typically leading to remote code execution when a PHP webshell is placed in a web-accessible directory. Any WordPress site running this plugin at or below 1.1.3 is exposed with no authentication required. Publicly available exploit code exists (reported by WPScan), though there is no public evidence of active exploitation.
Unauthenticated information disclosure in the Wp Edit Password Protected WordPress plugin (before 1.3.5) exposes password-protected page and post content via the WordPress REST API. The plugin enforces content protection on standard page views but fails to apply the same restriction to REST API endpoints, allowing any remote unauthenticated requester to retrieve the full content of pages the site owner intended to keep gated behind a password. A publicly available proof-of-concept is documented by WPScan; no active exploitation has been confirmed in CISA KEV. The CVSS score of 5.3 reflects the limited scope - confidentiality only, no integrity or availability impact.
Global protection bypass in the Passster WordPress plugin (versions before 4.2.26) allows unauthenticated remote attackers to access password-protected content by submitting crafted URLs that circumvent the plugin's site-wide protection checks. Because Passster's entire purpose is content gating, this vulnerability entirely nullifies the plugin's security guarantee for affected sites. A publicly available PoC exists, reported by WPScan, making automated scanning and exploitation straightforward.
Unauthenticated information disclosure in the Passster WordPress plugin (versions before 4.2.24) allows remote attackers to retrieve the values of password-protected content via an improperly handled AJAX action. Because Passster's sole function is gating content behind passwords, this flaw entirely negates its intended protection guarantee. A public exploit is available via WPScan, and the zero-prerequisite attack vector makes this trivially exploitable against any affected installation.
Missing authorization on REST API endpoints in the Auto x LINE WordPress plugin (through version 1.0.0) allows unauthenticated remote attackers to read and modify plugin settings and erase log data. The plugin facilitates LINE messaging integration for WordPress sites, meaning exposed settings likely include LINE API credentials and channel tokens. A publicly available proof-of-concept exists per WPScan, and the unauthenticated network-accessible nature of the flaw (PR:N, AV:N) makes it trivially exploitable against any exposed instance. No actively exploited status confirmed in CISA KEV at time of analysis.
Unauthenticated information disclosure in the Notification Bar for WordPress plugin (through v1.1.8) allows any remote attacker to retrieve the full subscriber email list via an exposed CSV export script that performs no authentication or capability check. A publicly available proof-of-concept published by WPScan confirms trivial exploitation requiring only a single HTTP request. The vulnerability is not currently in CISA KEV, but the zero-friction exploitation path creates meaningful privacy and regulatory exposure (GDPR, CAN-SPAM) for any WordPress site running this plugin.
Stored Cross-Site Scripting in Xpro Addons for WordPress (before 1.7.4) allows any user holding the Contributor role or higher to inject malicious JavaScript through insufficiently escaped widget settings, which are then rendered unsanitized within HTML attributes on the front end. When a privileged user such as an administrator views a page containing the compromised widget, the attacker's payload executes in their browser session. A publicly available exploit has been documented by WPScan; no CISA KEV listing is present, but the low barrier to exploitation (any registered Contributor) makes this a meaningful risk on multi-author or membership WordPress sites.
Payment verification bypass in WP Express Checkout WordPress plugin before 2.4.9 allows unauthenticated remote attackers to forge completed orders without submitting actual payment. The plugin fails to perform server-side confirmation that a payment transaction was successfully processed before transitioning an order to 'paid' status, enabling fraudulent order completion. A publicly available exploit exists per WPScan, making active abuse by financially motivated actors a realistic near-term risk for any e-commerce site running an affected version.
Stored Cross-Site Scripting in the All in One SEO WordPress plugin before version 5.0.0.1 enables users holding the contributor role or above to inject persistent malicious scripts into post content that execute in the browser of any higher-privileged user who subsequently edits that post. The attack effectively allows a low-trust contributor to hijack administrator sessions, enabling full site compromise. A publicly available proof-of-concept from WPScan exists, and the plugin's broad deployment across millions of WordPress installations amplifies aggregate exposure.
Shortcode injection in the Brave WordPress plugin before 0.8.8 allows unauthenticated remote attackers to execute arbitrary WordPress shortcodes server-side by passing crafted values through URL parameters designed for pre-filling form fields. The exploitable shortcodes and their consequences depend entirely on which shortcodes are registered on the target installation - ranging from information disclosure to, in worst-case scenarios involving code-execution shortcodes, elevated impact. A publicly available proof-of-concept exists per WPScan; no active exploitation (KEV) has been confirmed. The CVSS score of 4.8 with AC:H reflects that real-world impact is highly site-dependent.
Cross-site request forgery in the Simple Membership MailChimp Integration WordPress plugin (versions before 1.9.8) allows a network-positioned attacker to replace the site's configured MailChimp API key with one under attacker control by tricking a logged-in administrator into loading a crafted page. Once the API key is substituted, all subsequent member registration data - including name, email address, and membership level - is silently forwarded to the attacker's MailChimp account until the change is detected. A publicly available exploit exists and a vendor patch (1.9.8) is available; no active exploitation has been confirmed in CISA KEV.
Route normalization bypass in the Restrict User Access WordPress plugin (all versions before 2.8.1) lets unauthenticated remote attackers read content the plugin is configured to restrict and enumerate WordPress user accounts. The plugin compares raw incoming REST API route strings against its protection rules without first canonicalizing the path, so a subtly non-canonical request (extra slash, encoded character, etc.) matches no rule and is passed through unrestricted. A publicly available PoC is documented by WPScan; the vulnerability is not in CISA KEV at time of analysis.
Payment bypass in the RegistrationMagic WordPress plugin before 6.0.9.9 allows unauthenticated users to register for paid forms without completing payment and immediately receive an activated account holding whatever role the form is configured to grant. The plugin fails to validate a client-supplied quantity multiplier when computing the total registration price server-side, enabling an attacker to force the calculated total to zero or an arbitrary value. A publicly available proof-of-concept exploit exists per WPScan, and no authentication is required. No public exploit identified at time of analysis for active exploitation, but the low attack complexity combined with public PoC makes this a realistic threat for any site monetizing registrations via this plugin.
Price validation bypass in the RegistrationMagic WordPress plugin before 6.0.9.9 allows unauthenticated users to complete paid registrations without payment and receive fully activated accounts. The plugin fails to verify the total registration price server-side, meaning client-submitted price values are accepted without cross-checking against the configured amount. A publicly available proof-of-concept exploit exists, and no CISA KEV listing has been recorded at time of analysis.
Remote code execution in the WatchMan-Site7 WordPress plugin (all versions through 4.2.0) allows any authenticated user - including a low-privilege subscriber - to run arbitrary PHP on the server because the plugin's debugging console, which evaluates user-supplied PHP, is not access-restricted. Publicly available exploit code exists (reported by WPScan), and with CVSS 9.9 this represents full server compromise from the lowest authenticated role. There is no public evidence of active in-the-wild exploitation at time of analysis.
Unrestricted file upload in the Embed HTML5 Game WordPress plugin (versions through 1.3) lets unauthenticated attackers upload arbitrary files - including PHP scripts - because the plugin neither restricts who may upload nor validates file type, enabling planting of PHP backdoors and full remote code execution. WPScan reports the flaw with a publicly available exploit, and the CVSS 10.0 rating reflects unauthenticated network exploitation with complete impact. No CISA KEV listing exists, but the combination of PR:N and a public PoC makes opportunistic scanning likely.
Unauthenticated attackers can bypass WordPress nonce validation in the HIPAA FORMS plugin (all versions before 3.2.0) by including a hardcoded parameter in any AJAX request, which causes the server to skip its nonce check entirely. Because the plugin handles HIPAA-regulated healthcare intake forms, this exposes protected AJAX endpoints to unauthorized read and write operations without any credentials. A public exploit is available via WPScan, and no exploitation complexity is required beyond knowledge of the hardcoded value.
CSS injection in GutenKit WordPress plugin (versions before 2.5.1) allows any authenticated user holding the Contributor role or above to embed arbitrary stylesheets into posts served to all site visitors and anonymous users. The plugin fails to validate or escape style settings before interpolating them into CSS output on the front end, enabling defacement, interface redressing, and forced loading of external resources. JavaScript execution is explicitly ruled out at the Contributor privilege tier, capping the attack surface below full cross-site scripting. A publicly available exploit has been disclosed by WPScan.
Unauthenticated post creation and publication is possible in the User Frontend WordPress plugin before 4.3.11 due to a server-side enforcement gap in its subscription-gating logic. The plugin validates subscription status only at form-render time, not during form submission processing, so an attacker who bypasses the rendered form and submits directly to the backend endpoint can create - and depending on form configuration, immediately publish - posts that should be restricted to paying subscribers. A publicly available proof-of-concept exists and was disclosed through WPScan. No public exploit in CISA KEV at time of analysis.
Broken object-level authorization in the Timetics WordPress plugin through version 1.0.61 allows authenticated users holding the plugin's custom staff role to modify, disable, or take over appointments belonging to other staff members via the REST API. The endpoint accepts appointment identifiers without validating ownership, enabling lateral privilege abuse among staff peers. A public WPScan PoC confirms exploitability, though real-world impact is bounded by the PR:H prerequisite of a pre-existing staff account.
Control-character (newline) injection in Yoast SEO Premium before 27.6.1 allows an authenticated WordPress Author to write arbitrary Apache directives into the site's root .htaccess file via unsanitized redirect origins in file-based redirect mode. On Apache servers that process PHP directives, the injected auto_prepend_file directive can be chained with a polyglot image upload (available to Author-role users) to achieve full Remote Code Execution as the web server process. A public exploit is available via WPScan, making real-world exploitation feasible wherever the three required conditions align.
Stored Cross-Site Scripting in Icegram Express WordPress plugin versions before 5.8.6 allows administrator-level users to inject malicious scripts into HTML attributes via the list description setting. When another user subsequently loads the affected page, the injected payload executes in their browser, enabling session hijacking, credential capture, or unauthorized actions on their behalf. A publicly available proof-of-concept exploit has been confirmed by WPScan, though real-world impact is substantially constrained by the high-privilege prerequisite required to plant the payload.
Authentication bypass in the OAuth Single Sign On WordPress plugin (versions 6.25.0 through <7.0.1) allows unauthenticated remote attackers to log in as any non-administrator WordPress user by forging the identity assertion returned during the Steam SSO flow, without possessing valid credentials. Attackers can additionally register entirely new accounts, providing persistent footholds. A publicly available proof-of-concept exploit reported by WPScan materially elevates real-world risk and makes this an immediate patching priority for affected sites.
SQL injection in the WPvivid Backup, Migration & Staging WordPress plugin (all versions before 0.9.133) allows authenticated WordPress administrators to inject arbitrary SQL through an unsanitized list of identifiers passed directly to database queries. The CVSS scope change (S:C) indicates injected queries may reach beyond the plugin's own data, potentially touching other schemas on the shared MySQL host. A publicly available proof-of-concept has been disclosed via WPScan, though SSVC reports no confirmed active exploitation; vendor-released patch 0.9.133 is available.
Stored cross-site scripting in the Simple Ajax Chat WordPress plugin (versions before 20260827) permits unauthenticated users to inject arbitrary HTML and JavaScript into chat messages, which execute in the browser of any viewer including site administrators. Because no authentication is required to post messages and the plugin does not sanitize or escape content before rendering, a single malicious chat post persists and fires against every subsequent visitor. A publicly available exploit demonstrates the issue, and CVSS PR:N/UI:R confirms the attacker-to-victim delivery model: the attacker posts once, then waits for an administrator to trigger code execution by viewing the chat.
Stored XSS in the FAQ Builder AYS WordPress plugin (versions before 1.8.5) permits unauthenticated remote attackers to inject persistent JavaScript payloads via visitor-submitted content that is stored without sanitization and later rendered in the WordPress admin dashboard. A double-bypass condition compounds the flaw: the plugin's own partial HTML escaping is undone by a subsequent server-side decoding step, ensuring injected scripts reach the admin browser intact. When a logged-in administrator views the affected admin panel page, the payload executes with full administrative privileges, enabling session hijacking or complete site takeover. A publicly available exploit exists per WPScan; vendor patch version 1.8.5 is available.
Privilege escalation in the Theme My Login WordPress plugin (versions before 7.2.0) allows low-privileged users to silently bypass the network's site-creation restrictions on multisite WordPress installations, gaining administrator-level control over a newly created site. Subscriber-level authenticated users - and on some networks, unauthenticated users - can invoke the site-signup flow to create sites even when the network's registration setting prohibits it. A publicly available proof-of-concept exploit exists, raising the urgency for patching. The vendor has released a fix in version 7.2.0.
Cross-site request forgery vulnerabilities in JetStyleManager for Gutenberg WordPress plugin (all versions before 1.3.9) allow an unauthenticated attacker to delete or modify custom widget skins by tricking a logged-in Contributor-level (or higher) user into visiting a crafted page or clicking a malicious link. The missing CSRF token (nonce) validation on affected AJAX endpoints means the victim's authenticated browser session is silently weaponized against their own site. A publicly available exploit exists via WPScan and vendor-released patch version 1.3.9 resolves the issue.
Insecure Direct Object Reference in the WC Vendors WordPress plugin before 2.7.2.1 allows any authenticated user holding the vendor role to tamper with product variations owned by other vendors and to overwrite the status and title of arbitrary WordPress posts. The root cause is that the plugin never validates whether a user-supplied object ID actually belongs to the requesting vendor before persisting changes. A publicly available proof-of-concept exploit exists; the issue is not currently listed in CISA KEV.