Unknown
Monthly
Unauthenticated permanent deletion of arbitrary WordPress content is possible in sites running the MDJM Event Management plugin (before 1.7.8.5) or Mobile Events Manager plugin (through 1.4.8.3). Both plugins expose a playlist entry removal endpoint that performs no capability check, nonce validation, or post-type verification before permanently deleting the post identified in the request, bypassing the WordPress trash mechanism. A publicly available proof-of-concept exploit reported by WPScan makes this trivially exploitable against any affected installation, with irreversible content destruction as the outcome.
Unauthenticated stored XSS in the YouTube Embed WordPress plugin (versions 10.0-10.3) allows any unauthenticated site visitor to inject and persist arbitrary JavaScript in the WordPress database by exploiting an AJAX endpoint that performs no authorization check beyond a nonce embedded in every public-facing page. The stored payload executes in the browser session of any subsequent visitor or administrator who views the affected content, enabling session hijacking, administrative account takeover, or full site compromise. A publicly available exploit exists (reported by WPScan), materially elevating real-world risk for any site running the affected plugin versions.
Unauthenticated stored XSS and theme settings destruction in the Hoo Companion WordPress plugin (≤1.0.2) allows any remote attacker to inject persistent JavaScript into the active theme's settings via the plugin's ungated import endpoint, causing malicious scripts to execute in every visitor's browser including administrators. The same single request unconditionally overwrites and destroys the site's existing theme settings, combining a persistent cross-site scripting attack with immediate site defacement. A publicly available exploit exists via WPScan; no public exploit identified at time of analysis for active exploitation (not in CISA KEV).
Missing authorization on an AJAX endpoint in the CryptoPayment Gateway WordPress plugin (versions 1.2.1 through 1.2.2) lets remote unauthenticated attackers invoke administrative operations. An attacker can delete arbitrary files on the server, overwrite the payment gateway configuration, and read stored wallet credentials in cleartext. Publicly available exploit detail exists (reported by WPScan); there is no public evidence of active exploitation at time of analysis, though the CVSS vector (10.0, AV:N/AC:L/PR:N/UI:N/S:C) marks it as trivially exploitable.
The GenieWords WordPress plugin versions 1.5.27 through 1.5.34 allows unauthenticated attackers to overwrite plugin configuration via unprotected REST API and AJAX endpoints, then achieves persistent stored XSS on every front-end page because stored values are decoded and printed without sanitization. Any site visitor who loads a front-end page becomes an XSS victim, enabling session hijacking, credential theft, or malicious redirects at scale. A publicly available exploit exists (WPScan); no active exploitation is confirmed in CISA KEV at the time of analysis, but the unauthenticated attack path and low complexity make opportunistic mass-scanning feasible.
Two-factor authentication bypass in the Really Simple Security WordPress plugin (versions before 9.8.1) allows an attacker who already holds a target account's password to eliminate that account's email 2FA requirement entirely and obtain the resulting session, up to administrator level. The root flaw is an unauthenticated endpoint that resets a completed email 2FA enrollment, collapsing multi-factor authentication to single-factor for the attack window. A publicly available exploit has been published via WPScan, and the vendor has released a fix in version 9.8.1.
Privilege escalation in the User Registration & Membership WordPress plugin (versions 4.4.6 through pre-5.2.8) allows any subscriber-level authenticated user to be granted the WordPress role attached to a paid membership plan without completing payment, by exploiting a missing capability check and absent payment method and plan validation on the purchase endpoint. Where site administrators have configured membership plans mapped to privileged WordPress roles - including administrator - this results in full privilege escalation from subscriber to administrator without financial transaction. A publicly available proof-of-concept exploit from WPScan confirms the attack path is well-documented and reproducible against sites with open user registration.
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.8 allows any authenticated user holding an Author-level role or above to assign themselves an arbitrary WordPress role, including Administrator, resulting in full site takeover. The plugin fails to enforce server-side authorization checks when creating membership plans and when users attach plans to their own accounts, permitting role manipulation that bypasses WordPress's native access-control hierarchy. A publicly available exploit exists via WPScan, and the CVSS 7.2 score understates real-world risk because the provided PR:H metric conflicts with the description's requirement of only Author-level access - a low-privilege role - suggesting a closer real-world base score of approximately 8.8.
Stored cross-site scripting in the Gutenverse News WordPress plugin (before 3.3.3) enables unauthenticated attackers to inject persistent JavaScript via the comment submission form. The plugin registers additional HTML elements into WordPress's global sanitization allowlist rather than scoping them to the block editor context, causing the relaxed ruleset to be applied to untrusted comment input. The payload executes in two distinct phases: immediately when an administrator opens the comment moderation queue, enabling pre-approval admin session hijacking, and again for every visitor once the comment is approved. A public proof-of-concept exploit is available via WPScan.
Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant administrator-level WordPress capabilities to the vendor role, enabling full site takeover. The plugin's role and capability settings update mechanism fails to enforce access boundaries, letting any vendor - a legitimately registered but low-privileged marketplace seller - rewrite role permissions without restriction. A publicly available exploit exists via WPScan, and the vendor has released a patch in version 5.0.16.
Authentication bypass in the Advanced Customized Prompts WordPress plugin (versions through 1.0.1) lets an unauthenticated attacker obtain a valid authenticated session for any registered account by supplying only an email address, because an unauthenticated action issues the session without ever verifying the password. Attackers can log in as any user - including administrators - or create arbitrary new accounts, yielding full site takeover. Publicly available exploit code exists (reported by WPScan), though there is no public exploit identified as actively exploited in CISA KEV.
Unauthenticated remote code execution in the Teddy Bear Customize Addon WordPress plugin (all versions through 1.0.5) allows attackers to upload arbitrary PHP files to the server and execute code. The plugin's upload handler trusts the client-supplied MIME/content type and preserves the original attacker-controlled filename, so a request declaring an image content type while carrying a .php payload lands as an executable script in the webroot. Publicly available exploit details have been published by WPScan; no active exploitation has been confirmed in CISA KEV at time of analysis.
Authentication bypass in the Teddy Bear Customize Addon WordPress plugin (through version 1.0.5) lets unauthenticated attackers log in as any registered user - including administrators - by supplying only that user's email address, because the login routine never verifies the account password. WPScan reports a publicly available exploit, and with CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) this is a trivially weaponizable full account-takeover; no active-exploitation (KEV) listing exists at this time.
PHP object injection in the Site Reviews WordPress plugin before 8.3.0 allows unauthenticated remote attackers to deserialize arbitrary PHP objects on installations where the WordPress nonce key is absent, set to its sample/placeholder value, or too short to be secret. The plugin derives its deserialization protection key by padding the site's nonce key, making that derived key trivially computable under these common misconfiguration conditions. Exploitation impact is chained to PHP gadget chains present in other installed plugins or themes; no confirmed active exploitation (SSVC: none), but a public POC exists and full site compromise - including code execution, credential theft, and data loss - is achievable on sites with both a weak nonce key and a usable gadget chain.
Privilege escalation in the Registration Form for WooCommerce WordPress plugin (versions before 1.1.3) allows any authenticated Contributor-level user to register new WordPress accounts with arbitrary roles, including Administrator. The plugin fails to verify that the form ID supplied during registration belongs to a legitimate registration form, instead blindly reading the permitted-role allow-list from any post the attacker controls. Exploitation results in full site takeover. A publicly available proof-of-concept exists. This vulnerability is an incomplete fix of a prior privilege escalation issue tracked as CVE-2026-54807.
Unauthenticated arbitrary WordPress option deletion in the zipMoney (Zip Co) Payments Plugin for WooCommerce before 2.4.0 lets remote attackers destroy site configuration and take the site offline. One front-end request handler performs no authorization checks and does not restrict which option name the caller supplies, so any unauthenticated visitor can delete critical wp_options entries. Publicly available exploit code exists and a vendor patch (2.4.0) is available; no active exploitation has been confirmed (not in CISA KEV).
Two-factor authentication bypass in the miniOrange 2FA WordPress plugin allows an attacker who has already obtained a victim's password to defeat the second factor through unlimited OTP brute-forcing. The plugin keys its attempt-rate limit to a client-controlled identifier rather than the target account, enabling an adversary to rotate that identifier and circumvent lockout entirely; a separate validation endpoint applies no rate limit at all. A publicly available exploit (WPScan) confirms practical exploitability against plugin versions below 6.3.1 and 19.3.
Unauthenticated arbitrary site-option deletion in the miniOrange 2FA WordPress plugin (versions 5.3.24 through before 6.3.1, and 18.0 through before 19.3) lets any visitor delete arbitrary wp_options entries because option names are taken directly from request input without validating a legitimate transaction. Deleting the right options can lock every administrator out of the WordPress dashboard or fully deactivate the two-factor plugin, stripping the site of its 2FA protection. Publicly available exploit code exists (WPScan) and a vendor patch is available; the flaw is rated CVSS 10.0.
Unauthenticated information disclosure in Ultimate Gift Cards for WooCommerce (WordPress plugin, versions 3.0.3 through 3.2.9) exposes customer PII, gift card balances, and transaction dates tied to arbitrary orders with no authorization check. Version 3.2.9 raises the severity significantly: the live redemption code is also leaked, allowing any anonymous attacker who retrieves it to spend the gift card balance, crossing from information disclosure into tangible financial fraud. A publicly available proof-of-concept was published by WPScan, and the vulnerability is automatable per CISA SSVC, making mass enumeration of orders and gift card theft realistic.
Price reconciliation failure in the Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 allows unauthenticated users to obtain gift card coupons worth more than they actually paid at checkout. The plugin issues coupon codes without verifying that the face value matches the payment amount collected by WooCommerce, creating a directly monetizable fraud vector against any store running the affected plugin. A publicly available exploit exists per WPScan, lowering the bar for financial abuse of vulnerable storefronts.
Stored cross-site scripting in the Kirki WordPress plugin before 6.3.0 allows unauthenticated remote attackers to persistently inject JavaScript into comment fields by bypassing the plugin's HTML entity decoding logic through alternate entity encodings. The malicious payload executes in the browser session of any user - including administrators - who views a page rendering the affected comment, and propagates site-wide when Kirki-managed headers or footers display comment data. A publicly available proof-of-concept exists and the vendor has released a patching fix in version 6.3.0.
Account takeover via insecure direct object reference in the SureCart WordPress plugin (versions 4.0.0 through 4.6.2) allows any subscriber-level authenticated user to seize full control of an administrator account. The plugin's customer update endpoint validates that the requester has permission to update customers, but fails to verify that the target customer record belongs to the requesting user - enabling arbitrary cross-user email modification followed by a password reset. A compounding information disclosure flaw leaks customer identifiers and email addresses to all authenticated users, providing the enumeration primitive needed to complete the takeover chain without any additional knowledge. A publicly available proof-of-concept exploit exists, and vendor patch 4.6.3 is available.
Stored cross-site scripting in the HT Menu WordPress plugin before 1.2.7 allows any authenticated subscriber-level user to inject arbitrary JavaScript into navigation menu-item settings, which then executes in the browser of every site visitor - including administrators - who views the affected menu. The flaw combines two missing controls: no capability or ownership check on the settings-save endpoint, and no output escaping on render. A public exploit is available via WPScan, and vendor-released patch 1.2.7 is available. No public KEV listing; EPSS is low at 0.15%, consistent with targeted rather than mass exploitation.
Stored cross-site scripting in the JCH Optimize WordPress plugin before 6.0.1 allows any authenticated user with Subscriber-level access to import arbitrary plugin settings via an unprotected AJAX endpoint, injecting persistent JavaScript that executes in the browsers of site visitors and administrators. The missing capability check means that low-privilege accounts bypass the intended authorization boundary, enabling stored XSS delivery without administrative permissions. A publicly available proof-of-concept from WPScan exists, and the vendor has released a fix in version 6.0.1.
SQL injection in the Music Store WordPress plugin (versions 1.0.245 through before 1.4.5) enables unauthenticated remote attackers to extract the entire WordPress database via crafted HTTP requests. The CVSS Scope:Changed vector reflects that exploitation can read data beyond the plugin's own tables - including WordPress user credentials, email addresses, and site configuration stored by other plugins. A publicly available exploit is documented on WPScan, though no confirmed active exploitation (CISA KEV) has been recorded.
Reflected Cross-Site Scripting in the IPGP Visitors Origin WordPress plugin before version 1.6 allows unauthenticated remote attackers to inject arbitrary JavaScript into victims' browsers by delivering a crafted URL that the plugin echoes back unsanitized. No server-side authentication is required from the attacker, though victim interaction (clicking or submitting a crafted request) is mandatory for payload execution. A publicly available proof-of-concept via WPScan lowers the exploitation barrier, though EPSS of 0.18% indicates limited automated scanning activity to date and no active exploitation has been confirmed by CISA KEV.
Site takeover in the SEO Flow by LupsOnline WordPress plugin (versions 3.0.0 through before 3.0.3) stems from improper validation of the credential supplied with the plugin's API requests, allowing unauthenticated attackers to be served in the security context of the administrator who configured the plugin. Because the flaw grants effective administrator-level access, an attacker can fully compromise the affected WordPress site. Publicly available exploit code exists (published by WPScan), though EPSS remains low at 0.15% (4th percentile), and there is no public exploit identified as active in the wild.
RegistrationMagic WordPress plugin before version 6.0.9.9 omits audience validation on Facebook OAuth access tokens during social login, creating two exploitable paths: an attacker who obtains any valid Facebook token belonging to a site user - regardless of which Facebook application issued it - can authenticate to the WordPress site as that user, and a separate path allows account creation even when site registration is explicitly disabled. Publicly available exploit code has been published by WPScan, and the high CIA impact score reflects that full account compromise is achievable on affected installations with the Facebook login feature enabled.
JetFormBuilder - Dynamic Blocks Form Builder for WordPress before version 3.6.5.2 exposes sensitive site data to unauthenticated remote attackers due to missing authorization checks during page rendering. By submitting crafted requests that reference internal WordPress data sources, attackers can read arbitrary user properties including password hashes, private and draft post content, term metadata, and secrets stored by the plugin in post metadata fields. A publicly available proof-of-concept exploit exists, and the zero-privilege network attack path makes this a credible mass-scanning target for WordPress infrastructure.
Privilege escalation with arbitrary code execution in the Hummingbird Performance WordPress plugin (versions 3.15.0 through before 3.21.2) allows any site-level administrator on a WordPress multisite network to access and modify a network-wide configuration setting that should be gated to super admins, achieving code execution across all sites on the network. The vulnerability stems from missing capability enforcement (CWE-94) on a sensitive network-scope action. A publicly available proof-of-concept exists, and the vendor has released a patched version (3.21.2) addressing the access control gap.
Broken object-level authorization in the Classified Listing WordPress plugin (versions 5.3.0 through pre-6.1.1) allows any authenticated subscriber-level user to permanently delete media attachments from, or attach arbitrary files to, listings owned by other users by invoking the plugin's AI image-editing AJAX action with a victim's listing ID. The handler performs no ownership or capability verification before acting on the supplied identifier (CWE-639), meaning the lowest default WordPress role is sufficient to tamper with any listing on the platform. A publicly available proof-of-concept exists per WPScan; no active exploitation has been confirmed in the CISA KEV catalog at time of analysis.
Unauthenticated arbitrary file upload in the Developer Tools WordPress plugin (versions through 1.1.3) lets remote attackers upload malicious files via the bundled, legacy SWFUpload component, typically leading to remote code execution when a PHP webshell is placed in a web-accessible directory. Any WordPress site running this plugin at or below 1.1.3 is exposed with no authentication required. Publicly available exploit code exists (reported by WPScan), though there is no public evidence of active exploitation.
Missing authorization on REST API endpoints in the Auto x LINE WordPress plugin (through version 1.0.0) allows unauthenticated remote attackers to read and modify plugin settings and erase log data. The plugin facilitates LINE messaging integration for WordPress sites, meaning exposed settings likely include LINE API credentials and channel tokens. A publicly available proof-of-concept exists per WPScan, and the unauthenticated network-accessible nature of the flaw (PR:N, AV:N) makes it trivially exploitable against any exposed instance. No actively exploited status confirmed in CISA KEV at time of analysis.
Remote code execution in the WatchMan-Site7 WordPress plugin (all versions through 4.2.0) allows any authenticated user - including a low-privilege subscriber - to run arbitrary PHP on the server because the plugin's debugging console, which evaluates user-supplied PHP, is not access-restricted. Publicly available exploit code exists (reported by WPScan), and with CVSS 9.9 this represents full server compromise from the lowest authenticated role. There is no public evidence of active in-the-wild exploitation at time of analysis.
Unrestricted file upload in the Embed HTML5 Game WordPress plugin (versions through 1.3) lets unauthenticated attackers upload arbitrary files - including PHP scripts - because the plugin neither restricts who may upload nor validates file type, enabling planting of PHP backdoors and full remote code execution. WPScan reports the flaw with a publicly available exploit, and the CVSS 10.0 rating reflects unauthenticated network exploitation with complete impact. No CISA KEV listing exists, but the combination of PR:N and a public PoC makes opportunistic scanning likely.
Authentication bypass in the OAuth Single Sign On WordPress plugin (versions 6.25.0 through <7.0.1) allows unauthenticated remote attackers to log in as any non-administrator WordPress user by forging the identity assertion returned during the Steam SSO flow, without possessing valid credentials. Attackers can additionally register entirely new accounts, providing persistent footholds. A publicly available proof-of-concept exploit reported by WPScan materially elevates real-world risk and makes this an immediate patching priority for affected sites.
Stored cross-site scripting in the Simple Ajax Chat WordPress plugin (versions before 20260827) permits unauthenticated users to inject arbitrary HTML and JavaScript into chat messages, which execute in the browser of any viewer including site administrators. Because no authentication is required to post messages and the plugin does not sanitize or escape content before rendering, a single malicious chat post persists and fires against every subsequent visitor. A publicly available exploit demonstrates the issue, and CVSS PR:N/UI:R confirms the attacker-to-victim delivery model: the attacker posts once, then waits for an administrator to trigger code execution by viewing the chat.
Stored XSS in the FAQ Builder AYS WordPress plugin (versions before 1.8.5) permits unauthenticated remote attackers to inject persistent JavaScript payloads via visitor-submitted content that is stored without sanitization and later rendered in the WordPress admin dashboard. A double-bypass condition compounds the flaw: the plugin's own partial HTML escaping is undone by a subsequent server-side decoding step, ensuring injected scripts reach the admin browser intact. When a logged-in administrator views the affected admin panel page, the payload executes with full administrative privileges, enabling session hijacking or complete site takeover. A publicly available exploit exists per WPScan; vendor patch version 1.8.5 is available.
Privilege escalation to administrator in the Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 allows unauthenticated visitors to bypass role restrictions enforced on front-end user registration forms. The plugin fails to validate that a submitted role value matches those actually offered by the configured form, and its blocklist against privileged roles is incomplete, enabling a two-stage attack: register with an elevated role, then escalate that account to full site administrator. A publicly available exploit exists per WPScan disclosure, raising the urgency of patching; no public KEV listing has been identified at time of analysis.
Stored XSS in the RegistrationMagic WordPress plugin prior to version 6.0.9.9 allows unauthenticated attackers to inject malicious scripts into registration form fields that are rendered unescaped within HTML attributes on WordPress administrative pages. When a privileged administrator subsequently views the affected backend page, the attacker's payload executes in the admin's browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. A publicly available proof-of-concept exists via WPScan, and a vendor-released patch (6.0.9.9) is confirmed available.
Reflected Cross-Site Scripting in the Social Media Share Buttons & Social Sharing Icons WordPress plugin (all versions before 3.0.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by embedding a malicious payload in a crafted URL targeting an unescaped request parameter rendered inside an inline JavaScript event handler. Exploitation is constrained to sites running a non-default icon display configuration, and requires the victim to interact with the affected share button. A public proof-of-concept is available via WPScan; no active exploitation has been confirmed by CISA KEV.
Privilege escalation in the JetBackup WordPress plugin before 3.1.23.5 allows a subscriber-level user to gain full administrator access by exploiting the plugin's failure to validate account roles during a site restore or migration. When the site owner performs a legitimate backup restore or migration, JetBackup blindly preserves and promotes accounts in the backup set without re-verifying their roles or capabilities, silently elevating an attacker's low-privilege account to administrator. A publicly available proof-of-concept exists per WPScan, though no confirmed mass exploitation (CISA KEV) is on record; the CVSS 7.1 score (AC:H/UI:R) reflects real-world complexity imposed by the site-owner trigger.
PHP Object Injection in the User Frontend WordPress plugin (versions before 4.3.11) allows any authenticated subscriber-level user to trigger deserialization of attacker-controlled field values by reopening a previously submitted post in the plugin's frontend editing form. If a suitable PHP gadget chain is present in the WordPress installation - supplied by other installed themes or plugins - this escalates to full remote code execution. A public proof-of-concept is available via WPScan, making exploitation accessible to low-skilled attackers on vulnerable installs.
Reflected XSS in Photo Gallery by 10Web WordPress plugin (all versions before 1.8.44) lets an unauthenticated attacker execute arbitrary JavaScript inside the authenticated browser session of an administrator or contributor by tricking them into clicking a crafted link. Two distinct injection sinks exist: the Shortcode admin page (exploitable against contributors and above) and the Galleries/Albums list page (requires the site to have more than 20 galleries, and targets administrators). Both sinks reflect unsanitized request parameters into HTML input-attribute values and weaponize an auto-firing onfocus event handler, bypassing some user-interaction defenses. A publicly available PoC via WPScan confirms the issue; vendor-patched version 1.8.44 is available.
Unauthenticated administrator account takeover in the Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 is possible when a site exposes a front-end user-update form configured to target an administrator account with a visitor-supplied password field. The plugin's Forms module skips the authorization check on who may edit the targeted account unless the submitted role is administrator or super_admin, creating a gap exploitable by any site visitor. A publicly available proof-of-concept from WPScan exists and a vendor patch is available at version 0.9.2.7.
Stored Cross-Site Scripting in the Groundhogg - CRM, Newsletters, and Marketing Automation WordPress plugin before version 4.5.13 allows unauthenticated attackers to inject persistent malicious scripts through optional web form fields, which subsequently execute in the browsers of privileged administrative users. Successful exploitation can yield full administrative session compromise, unauthorized rogue account creation, or arbitrary site modification. A publicly available proof-of-concept is confirmed by WPScan; however, EPSS remains low at 0.17% (7th percentile), indicating limited observed mass exploitation despite that availability.
Stored Cross-Site Scripting in Customer Reviews for WooCommerce (all versions before 5.118.0) lets unauthenticated attackers inject persistent malicious scripts by submitting crafted review content through a vulnerable plugin endpoint, with the payload stored in the WordPress database. When an authenticated user - particularly a store administrator - views the affected review, the injected script executes in their browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. A publicly available exploit exists per WPScan; EPSS sits at 0.17% (7th percentile), indicating limited observed mass exploitation despite POC availability, and the vulnerability is not currently in CISA KEV.
Reflected XSS in the geotargetingwp WordPress plugin before 3.5.6.2 enables unauthenticated attackers to inject arbitrary JavaScript into victims' browsers via unsanitized parameters echoed back in HTML-typed AJAX responses. Exploitation requires social engineering to trick a target - ideally an authenticated WordPress administrator - into submitting a crafted request, after which the reflected payload executes in the victim's browser session. A publicly available proof-of-concept exists per WPScan; the vulnerability is not listed in CISA KEV, and EPSS sits at 0.17%, indicating limited observed exploitation to date.
Unauthenticated file read, SSRF, and arbitrary file write affect the 爱采集数据采集和发布插件 (an auto-collection/scraping-and-publishing) WordPress plugin through version 1.0.0, because one of its unauthenticated endpoints trusts a hardcoded default secret instead of a per-install value and fails to validate supplied URLs and destination paths. Remote attackers with no authentication can read arbitrary server files, coerce the server into issuing arbitrary outbound requests and returning the responses, and write attacker-controlled content outside the uploads directory. Publicly available exploit code exists (reported by WPScan), though EPSS remains low at 0.14% (3rd percentile).
Unauthenticated information disclosure in the HEL Online Classroom WordPress plugin (versions ≤ 1.0.3) exposes the BigBlueButton shared secret through an unprotected REST API route, enabling any remote attacker to retrieve stored plugin settings without credentials. With the exposed shared secret, an attacker can forge valid HMAC-signed API requests directly against the connected BigBlueButton server, allowing unauthorized access to or disruption of virtual classroom sessions. No public KEV confirmation exists, but a public exploit is available via WPScan; EPSS is low at 0.14%, consistent with the plugin's niche footprint.
Payment confirmation bypass in the Appointment Booking Calendar Plugin and Scheduling Plugin for WordPress (versions before 1.6.3) lets unauthenticated users complete paid appointment bookings by submitting only a fraction of the listed price. The plugin stages a server-side price for each booking but fails to validate the amount actually received from the payment processor against that staged figure before confirming the appointment. A publicly available proof-of-concept exists per WPScan; no active exploitation is confirmed in CISA KEV, and EPSS sits at just 0.14%, indicating limited observed mass exploitation despite the PoC.
Unauthenticated access to privileged operations in the User Profile Builder WordPress plugin (versions up to 4.0.1) allows any visitor to enumerate the site's media library and alter unpublished posts, pages, and media items belonging to other users. The front-end file upload feature omits the required WordPress role capability checks, effectively granting anonymous users the access level of a trusted content author. A publicly available proof-of-concept exploit exists via WPScan, though EPSS at 0.13% (3rd percentile) indicates limited observed in-the-wild activity despite POC disclosure.
Server-side request forgery in the Total Processing card payments plugin for WooCommerce (all versions through 7.3) lets unauthenticated remote attackers control the destination of the plugin's server-side payment-verification request. Because the plugin neither validates the user-supplied path nor authenticates the gateway's response, an attacker can redirect the verification call to a host they control to harvest the merchant's payment-gateway credentials and forge a fake success response that marks arbitrary WooCommerce orders as paid. Publicly available exploit code exists (reported by WPScan); it is not listed in CISA KEV and EPSS is low (0.14%, 3rd percentile).
Full-read Server-Side Request Forgery in the SmartAIPress WordPress plugin (through version 1.2.0) allows any subscriber-level authenticated user to force the WordPress server to fetch arbitrary internal or external URLs and return the full response body. The vulnerability stems from a missing capability check on an AJAX action combined with zero server-side URL validation, making internal cloud metadata endpoints, intranet services, and private API surfaces reachable by low-privilege users. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.13% (3rd percentile), indicating limited mass automated exploitation at time of analysis.
Account takeover in the Uix UserCenter WordPress plugin (all versions through 1.0.3) lets unauthenticated attackers seize any account, including administrators. The plugin's profile-update action never checks that the targeted account belongs to the requester and authorizes the action with a token signed by a hardcoded key that is identical on every installation, so an attacker can forge a valid token for any user and overwrite that user's email and password. Rated CVSS 9.8 with publicly available exploit code (WPScan), though EPSS is low at 0.14%.
Unauthenticated SQL injection in the Rest Routes WordPress plugin (through version 5.5.5) allows any remote attacker to extract sensitive data from the underlying WordPress database by crafting a malicious request to a publicly accessible REST endpoint. The flaw stems from a URL-derived parameter being passed directly into a SQL query without sanitization or parameterization, requiring no authentication and no user interaction. A publicly available proof-of-concept exists per WPScan, though the EPSS score of 0.18% (7th percentile) indicates exploitation remains infrequent despite the PoC's accessibility.
Privilege escalation to full site takeover affects the MemberHero WordPress plugin through version 6.9, where the frontend registration flow fails to restrict which account fields a visitor may set, letting unauthenticated attackers self-register with an arbitrary role - including Administrator. Version 6.9 was advertised as the fix but the patch is incomplete, so current installs remain exploitable to gain admin access and hijack existing accounts, and no fully-fixed release exists at time of analysis. Publicly available exploit code exists (WPScan), though EPSS remains low at 0.15% (4th percentile).
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.6 lets authenticated users holding the plugin's delegated management capability overwrite arbitrary WordPress site options, including those governing user roles, enabling full administrator takeover. The root cause is a missing capability check on the login settings save handler - the plugin fails to verify the caller's WordPress capabilities before persisting changes to the wp_options table. A public proof-of-concept exploit exists per WPScan; however, SSVC reports no active exploitation and the CVE is absent from CISA KEV.
Privilege escalation to administrator in the Ultimate Member WordPress plugin (versions 2.6.7 through 2.12.x) allows unauthenticated users registering via the plugin's own forms to self-assign any WordPress role, including administrator, by exploiting a logic failure in role validation. When the plugin cannot resolve the allowed roles for a given profile form, it falls back to validating the submitted role against the full site-wide role registry rather than the form's own allow-list - accepting any valid registered role. A publicly available exploit exists per WPScan, though SSVC assessment indicates no confirmed active exploitation campaigns at time of analysis. Vendor-released patch is available in version 2.13.0.
Unauthenticated arbitrary file read in the Shared Files Pro WordPress plugin (all versions before 1.7.70) allows remote attackers to supply an unvalidated path parameter during featured image creation, causing the plugin to read and republish any file accessible to the web server process at a public URL. This compound impact - read plus republication - means sensitive data such as wp-config.php database credentials or secret keys can be exfiltrated and exposed to any internet user, not just the attacker. A publicly available proof-of-concept exists, and the CVSS vector confirms no authentication or user interaction is required against any default installation of the affected plugin.
PHP object injection via unsafe deserialization in the User Frontend WordPress plugin (versions before 4.3.10) grants Editor-level users the ability to execute arbitrary PHP code on the host server. The plugin fails to validate field type definitions and deserializes user-controlled post metadata at render time - a CWE-502 flaw exploitable through any available POP chain present in the WordPress environment. A public proof-of-concept exists per WPScan, though SSVC assessment notes no confirmed active exploitation at time of analysis.
Unauthenticated arbitrary PHP function invocation in the Tutor LMS WordPress plugin before 4.0.6 lets remote attackers overwrite internal template variables via request data and call any zero-argument PHP function, returning its output to the attacker. This enables information disclosure and potentially broader compromise depending on which functions are reachable. Publicly available exploit code exists (reported by WPScan), though the flaw is not listed in CISA KEV.
Remote unauthenticated command execution affects a broad range of Zbtlink MT7620-based routers and gateways (WE1326, WE2426-C, WE5926 family, WE826 family, WG108/WG3526, WF3526-P, CTN720-W1, LF-1541, MT7620N, WRC1) whose infosrvd service listens on UDP/9992. A single crafted UDP packet lets an attacker run arbitrary commands as root, because the service's authentication relies on a hardcoded salt and accepts an all-zero wildcard MAC, defeating the intended check. Publicly available exploit code exists (research and advisory published by VulnCheck), the CVSS 4.0 base score is 9.3, and no active exploitation has been confirmed in CISA KEV at time of analysis.
Root-level remote code execution affects a family of Zbtlink, MoreQuick, and related OEM routers/APs (e.g. L3_V2_8 3.0.0.4.528, WE826-T2 19.1101, ZBT-7628, ZBT-ZBT7621, AP522, AP7628, HC5661A, HK300, MAP-N10) that ship a factory backdoor implant named 'yunmgrd' beaconing to a hardcoded cloud C2 over unauthenticated cleartext UDP. Because the channel is unauthenticated and in cleartext, a remote attacker on the network path can hijack it, impersonate the C2, and run arbitrary commands as root - additionally tampering with DNS, stealing PPPoE credentials, and opening reverse SSH tunnels. Reported by VulnCheck with publicly available exploit code; not currently listed in CISA KEV.
Arbitrary file deletion in the Order Tip for WooCommerce WordPress plugin (versions before 1.6.0) allows authenticated Shop Managers to delete any file on the web server by exploiting missing capability checks and absent path restrictions on the deletion endpoint. The plugin fails to validate both the requesting user's permissions and the target file path, meaning a malicious or compromised Shop Manager account could remove critical WordPress files such as wp-config.php, leading to full site compromise. A publicly available proof-of-concept exists per WPScan; however, EPSS sits at only 0.17% (6th percentile) and CISA has not added this to KEV, consistent with the SSVC assessment of no observed exploitation.
Path traversal in the AI Engine WordPress plugin (versions 3.3.3 through 3.7.1) allows arbitrary server file reads with subsequent exfiltration to an external service. When the plugin's non-default public API feature is enabled, subscriber-level users can supply a crafted URL that the plugin maps to a local filesystem path without confinement, reads, and forwards to an external AI endpoint. In default configurations the flaw is limited to administrator-level users, but on WordPress multisite networks this allows unprivileged subsite administrators to extract network-wide configuration secrets. A publicly available POC exists, though EPSS at 0.19% indicates no widespread automated exploitation at time of analysis.
Unauthenticated account creation in the Project Manager WordPress plugin before version 4.0.7 allows any remote attacker to register WordPress user accounts regardless of the site's registration settings. The import routes in the plugin carry no authorization checks whatsoever (CWE-862), enabling an attacker who already knows the password they will submit to establish a persistent, valid WordPress account on the target site. A publicly available proof-of-concept exploit exists; however, EPSS is currently 0.18% (7th percentile), indicating low observed exploitation volume at the time of analysis.
Remote code execution in the Pods WordPress plugin (versions 3.1.0 through 3.3.9.1) allows authenticated users holding the author role or higher to invoke arbitrary PHP functions on the server by submitting a crafted display callback that bypasses the plugin's blocked-function comparison logic. Exploitation is limited to sites where restricted display-callback mode is active - the automatic default on installations first deployed on Pods versions predating 3.1 - meaning a large subset of long-running Pods deployments are in-scope. A public exploit exists per WPScan reporting, though EPSS at 0.21% (11th percentile) indicates low observed exploitation activity and no CISA KEV listing at time of analysis.
Remote unauthenticated administrative compromise is possible across three WordPress plugins - BlogVault Backup & Staging, MalCare WordPress Security Plugin, and WP Remote WordPress Plugin - in versions 5.16 through 6.64, due to the combination of a weak pseudo-random number generator used to create site-binding secrets and unauthenticated endpoints leaking data derived from those secrets. An attacker who can observe the leaked derived values can reverse the weak PRNG to reconstruct the original secret, then authenticate to the remote management service with administrative privileges and achieve full site takeover. A publicly available proof-of-concept exists; no CISA KEV listing is present, and EPSS sits at 0.17%, indicating limited observed mass exploitation despite the public exploit.
PHP Object Injection in the Kalles Addons WordPress plugin (all versions up to and including 1.0.6) allows unauthenticated remote attackers to deserialize untrusted PHP objects via a network-accessible deserialization endpoint. Exploitation is strictly conditional: the plugin itself contains no known POP (Property-Oriented Programming) chain, so real-world impact - ranging from arbitrary file deletion and sensitive data retrieval to remote code execution - only materializes when a separately installed plugin or theme on the same WordPress instance supplies a usable POP chain. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Privilege escalation in the AI Engine WordPress plugin (versions 2.8.0 through 3.6.0) enables any sub-site Administrator in a WordPress Multisite network to take over arbitrary accounts-including the Network Administrator-due to missing authorization checks on user management operations. A publicly available proof-of-concept exists per WPScan, and a vendor patch has been released at version 3.6.1. No active exploitation is confirmed by CISA KEV at time of analysis, though POC availability substantially lowers the bar for abuse by any authenticated sub-site admin.
Remote code execution via file upload bypass in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin (versions before 1.3.9.9) is exploitable by unauthenticated attackers against public-facing WordPress contact forms. The plugin strips certain characters from uploaded filenames as a sanitization step but fails to re-validate the resulting filename against its file type allowlist, enabling an attacker to craft a filename that survives stripping as a server-executable extension (e.g., PHP). A publicly available proof-of-concept exploit exists; a vendor patch is available at version 1.3.9.9 and should be applied immediately given the no-authentication, network-accessible attack surface.
Improper access control in the Dokan WooCommerce Multivendor Marketplace WordPress plugin before 5.0.14 enables authenticated Shop Managers to install and activate arbitrary WordPress plugins via the Dokan admin REST API. The plugin's capability check on these endpoints validates only for WooCommerce management capability rather than the required Dokan plugin-installation capability, granting Shop Managers an escalated privilege not intended for their role. With publicly available exploit code and a vendor-released patch, this warrants immediate remediation on any WordPress site running Dokan with untrusted shop manager accounts.
Full site takeover in the JSON Options WordPress plugin (versions through 0.0.4) is possible because one of its actions runs on every request without any capability check or nonce verification, exposing arbitrary WordPress option updates to unauthenticated users. An attacker can flip the users_can_register option on and set default_role to administrator, then self-register an admin account. Publicly available exploit code exists (reported by WPScan), and the flaw is rated CVSS 9.8 with SSVC technical impact assessed as total.
Remote code execution in the Depicter Popup & Slider Builder WordPress plugin (all versions before 4.8.0) is achievable by authenticated editor-level users who exploit the plugin's import feature to upload arbitrary PHP files to web-accessible directories. The plugin performs no file type validation and does not remove malformed or rejected uploads, allowing a PHP webshell to persist and be directly executed via HTTP request. A publicly available POC from WPScan exists; however, SSVC data indicates no confirmed exploitation to date and the attack is not automatable due to the mandatory editor-privilege requirement.
Customer-uploaded file disclosure in Extra Product Options Builder for WooCommerce (all versions before 1.2.176) allows unauthenticated requesters who know a file's stored name to retrieve it via an unprotected plugin endpoint, bypassing a missing authorization check (CWE-862). The real-world severity is conditional on web server type: the plugin writes deny-all rules to upload directories, meaning this endpoint only crosses a new security boundary on Apache-hosted sites; on default nginx deployments, those files are already directly URL-accessible and the endpoint adds no measurable additional exposure. Publicly available exploit code exists, but no public exploit identified at time of analysis confirms active exploitation, and EPSS sits at 0.22% (12th percentile) despite the elevated CVSS score.
Path traversal in the WPvivid - Backup, Migration & Staging WordPress plugin before 0.9.131 lets an attacker who possesses a valid site-to-site transfer key write a plugin-generated log file into any writable directory, including the web root, because an unsanitised value from the request is used to build the log file path. Publicly available exploit code exists (WPScan), but the impact is bounded: only the file's location is attacker-controlled while the filename suffix and the file contents (the plugin's own log header) are fixed, so this is arbitrary file placement rather than arbitrary content injection. Not listed in CISA KEV and EPSS is low (0.16%, 6th percentile), indicating little observed real-world exploitation.
Unauthenticated information disclosure in CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 exposes media attachment metadata - including titles, file types, sizes, and direct URLs - from any configured folder, including those never published to a gallery. The missing authorization checks on REST API endpoints mean any external party can enumerate private document libraries without credentials. A publicly available exploit exists per WPScan, though EPSS sits at just 0.17% (7th percentile), suggesting limited observed exploitation activity at time of analysis.
Authentication bypass in the Simple JWT Login WordPress plugin before 3.6.8 lets unauthenticated attackers log in as any user - including administrators - by presenting a valid Google identity token that carries the victim's email address. Because the plugin never checks the token's audience (aud) claim, a Google-issued ID token minted for an entirely different OAuth application is accepted as proof of identity, turning any site with Google sign-in enabled into a full-account-takeover target. Publicly available exploit details exist (WPScan), though EPSS remains low (0.16%) and the flaw is not listed in CISA KEV.
SQL injection in WP Directory Kit WordPress plugin before 1.5.7 is exploitable by authenticated administrators, with materially elevated impact on WordPress multisite networks where a single-site admin can read data belonging to the entire network - data outside their authorized scope. A public PoC is available via WPScan, though EPSS sits at 0.17% (6th percentile), indicating targeted rather than opportunistic exploitation. No CISA KEV listing confirms active in-the-wild exploitation at time of analysis.
Privilege escalation in the All-in-One WP Migration and Backup WordPress plugin (versions prior to 7.108) on multisite installations allows subsite administrators to execute arbitrary PHP code across the entire WordPress network. The vulnerability stems from missing access control enforcement on the migration import feature, which should be restricted to network-level administrators but is accessible to lower-privileged subsite admins. A publicly available exploit exists per WPScan and SSVC classification; however, EPSS sits at only 0.14% (4th percentile), and CISA KEV does not list this as actively exploited at time of analysis.
Full site compromise in the Link Factory WordPress plugin stems from the plugin itself being a deliberate backdoor rather than a coding flaw. Marketed as a 'homepage sentence publisher', it silently exposes an operator-controlled REST API under /wp-json/link-factory/v1/ that grants the plugin's author covert command-and-control over any site that installs it. Publicly available exploit code exists (reported by WPScan); the endpoints require no WordPress authentication and are gated only by a detached Ed25519 signature tied to the operator's hardcoded public key, so the operator retains privileged access indefinitely.
Unauthenticated database export exposure in the Ezoic WordPress plugin (versions 2.6.35 through before 2.23.1) allows any remote attacker to trigger a full server-side export of the site's database, harvesting user password hashes and active password reset tokens - the latter enabling immediate account takeover without password cracking. The same missing authorization flaw (CWE-862) additionally permits unauthenticated persistent modification of plugin settings. A publicly available exploit exists per WPScan, and the CVSS vector confirms trivial remote exploitation with no authentication, interaction, or special conditions required.
Unauthenticated SQL injection in WP Directory Kit WordPress plugin (all versions before 1.5.6) allows remote attackers to read arbitrary data from the WordPress database, including user credentials and sensitive site content. The flaw was reported by WPScan, a public proof-of-concept exploit is available, and exploitation requires no authentication - though it is conditioned on a non-default search field type being configured in the plugin. Patch version 1.5.6 resolves the vulnerability; sites using customized search field configurations are the exposed population.
PHP Object Injection escalating to unauthenticated remote code execution affects the WooCommerce Subscriptions WordPress plugin from version 4.7.0 up to (but not including) 9.1.0, but only on stores running WooCommerce's High-Performance Order Storage (HPOS). The plugin unserializes attacker-controlled input without validation, and a gadget chain in bundled dependencies turns that into arbitrary code execution. Publicly available exploit code exists and a vendor patch (9.1.0) is available, but this is not listed in CISA KEV; the EPSS score of 28% is elevated, indicating meaningful exploitation probability.
Privilege escalation and account takeover in the Events Manager WordPress plugin before 7.4.1 lets unauthenticated attackers reset passwords, promote accounts to Administrator, or delete accounts whose user ID collides with the ID of one of the plugin's own posts. The flaw stems from the plugin overriding WordPress's own capability decisions for unrelated privileged user actions. Publicly available exploit code exists (WPScan), EPSS is a notable 15%, and SSVC rates it automatable with total technical impact, though it is not currently listed in CISA KEV.
SQL injection in WP Directory Kit WordPress plugin (all versions before 1.5.6) allows any authenticated user - including low-privilege Subscribers - to query or manipulate the WordPress database via an AJAX endpoint that performs no input sanitization and enforces no authorization check. With a publicly available proof-of-concept reported by WPScan and an EPSS of 16%, the exploitation barrier is low for any site with user registration enabled. A vendor patch is available in version 1.5.6.
SQL injection in the Events Manager WordPress plugin (versions before 7.4.1) allows any subscriber-level or higher authenticated user to manipulate raw SQL queries and tamper with booking consent records belonging to other users. The flaw arises from a user-controlled value being interpolated directly into a database query without sanitization (CWE-89), enabling both unauthorized data disclosure and integrity violations against other users' booking records. A publicly available proof-of-concept exists per WPScan's disclosure, and an EPSS score of 16% reflects meaningful exploitation likelihood, though active exploitation has not been formally confirmed in CISA's KEV catalog.
Unauthenticated information disclosure in WP Photo Album Plus (WordPress plugin, all versions before 9.2.07.002) allows any remote attacker to read arbitrary autoloaded WordPress option values by supplying a crafted suffix to a public, unprotected endpoint. The plugin constructs an option name from client-controlled input without restricting it to its own namespace or verifying any capability or nonce, exposing site-wide secrets stored in wp_options. A publicly available proof-of-concept exists, SSVC rates this as automatable with partial technical impact, and EPSS sits at 16%, indicating meaningful real-world exploitation interest despite the absence of a CISA KEV listing.
Unauthenticated arbitrary file deletion in WP Photo Album Plus (versions before 9.2.07.002) exposes WordPress sites to path traversal attacks through a public endpoint that accepts unvalidated client-controlled file path values with no authorization check in place. Any remote unauthenticated attacker can manipulate this path parameter to target and delete ZIP archives stored anywhere on the server, including directories outside the web root. A publicly available proof-of-concept exists, EPSS scores this at 16%, and no public exploit identified at time of analysis maps to confirmed mass exploitation - but the low attack complexity and zero authentication barrier make rapid weaponization realistic.
Unauthenticated permanent deletion of arbitrary WordPress content is possible in sites running the MDJM Event Management plugin (before 1.7.8.5) or Mobile Events Manager plugin (through 1.4.8.3). Both plugins expose a playlist entry removal endpoint that performs no capability check, nonce validation, or post-type verification before permanently deleting the post identified in the request, bypassing the WordPress trash mechanism. A publicly available proof-of-concept exploit reported by WPScan makes this trivially exploitable against any affected installation, with irreversible content destruction as the outcome.
Unauthenticated stored XSS in the YouTube Embed WordPress plugin (versions 10.0-10.3) allows any unauthenticated site visitor to inject and persist arbitrary JavaScript in the WordPress database by exploiting an AJAX endpoint that performs no authorization check beyond a nonce embedded in every public-facing page. The stored payload executes in the browser session of any subsequent visitor or administrator who views the affected content, enabling session hijacking, administrative account takeover, or full site compromise. A publicly available exploit exists (reported by WPScan), materially elevating real-world risk for any site running the affected plugin versions.
Unauthenticated stored XSS and theme settings destruction in the Hoo Companion WordPress plugin (≤1.0.2) allows any remote attacker to inject persistent JavaScript into the active theme's settings via the plugin's ungated import endpoint, causing malicious scripts to execute in every visitor's browser including administrators. The same single request unconditionally overwrites and destroys the site's existing theme settings, combining a persistent cross-site scripting attack with immediate site defacement. A publicly available exploit exists via WPScan; no public exploit identified at time of analysis for active exploitation (not in CISA KEV).
Missing authorization on an AJAX endpoint in the CryptoPayment Gateway WordPress plugin (versions 1.2.1 through 1.2.2) lets remote unauthenticated attackers invoke administrative operations. An attacker can delete arbitrary files on the server, overwrite the payment gateway configuration, and read stored wallet credentials in cleartext. Publicly available exploit detail exists (reported by WPScan); there is no public evidence of active exploitation at time of analysis, though the CVSS vector (10.0, AV:N/AC:L/PR:N/UI:N/S:C) marks it as trivially exploitable.
The GenieWords WordPress plugin versions 1.5.27 through 1.5.34 allows unauthenticated attackers to overwrite plugin configuration via unprotected REST API and AJAX endpoints, then achieves persistent stored XSS on every front-end page because stored values are decoded and printed without sanitization. Any site visitor who loads a front-end page becomes an XSS victim, enabling session hijacking, credential theft, or malicious redirects at scale. A publicly available exploit exists (WPScan); no active exploitation is confirmed in CISA KEV at the time of analysis, but the unauthenticated attack path and low complexity make opportunistic mass-scanning feasible.
Two-factor authentication bypass in the Really Simple Security WordPress plugin (versions before 9.8.1) allows an attacker who already holds a target account's password to eliminate that account's email 2FA requirement entirely and obtain the resulting session, up to administrator level. The root flaw is an unauthenticated endpoint that resets a completed email 2FA enrollment, collapsing multi-factor authentication to single-factor for the attack window. A publicly available exploit has been published via WPScan, and the vendor has released a fix in version 9.8.1.
Privilege escalation in the User Registration & Membership WordPress plugin (versions 4.4.6 through pre-5.2.8) allows any subscriber-level authenticated user to be granted the WordPress role attached to a paid membership plan without completing payment, by exploiting a missing capability check and absent payment method and plan validation on the purchase endpoint. Where site administrators have configured membership plans mapped to privileged WordPress roles - including administrator - this results in full privilege escalation from subscriber to administrator without financial transaction. A publicly available proof-of-concept exploit from WPScan confirms the attack path is well-documented and reproducible against sites with open user registration.
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.8 allows any authenticated user holding an Author-level role or above to assign themselves an arbitrary WordPress role, including Administrator, resulting in full site takeover. The plugin fails to enforce server-side authorization checks when creating membership plans and when users attach plans to their own accounts, permitting role manipulation that bypasses WordPress's native access-control hierarchy. A publicly available exploit exists via WPScan, and the CVSS 7.2 score understates real-world risk because the provided PR:H metric conflicts with the description's requirement of only Author-level access - a low-privilege role - suggesting a closer real-world base score of approximately 8.8.
Stored cross-site scripting in the Gutenverse News WordPress plugin (before 3.3.3) enables unauthenticated attackers to inject persistent JavaScript via the comment submission form. The plugin registers additional HTML elements into WordPress's global sanitization allowlist rather than scoping them to the block editor context, causing the relaxed ruleset to be applied to untrusted comment input. The payload executes in two distinct phases: immediately when an administrator opens the comment moderation queue, enabling pre-approval admin session hijacking, and again for every visitor once the comment is approved. A public proof-of-concept exploit is available via WPScan.
Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant administrator-level WordPress capabilities to the vendor role, enabling full site takeover. The plugin's role and capability settings update mechanism fails to enforce access boundaries, letting any vendor - a legitimately registered but low-privileged marketplace seller - rewrite role permissions without restriction. A publicly available exploit exists via WPScan, and the vendor has released a patch in version 5.0.16.
Authentication bypass in the Advanced Customized Prompts WordPress plugin (versions through 1.0.1) lets an unauthenticated attacker obtain a valid authenticated session for any registered account by supplying only an email address, because an unauthenticated action issues the session without ever verifying the password. Attackers can log in as any user - including administrators - or create arbitrary new accounts, yielding full site takeover. Publicly available exploit code exists (reported by WPScan), though there is no public exploit identified as actively exploited in CISA KEV.
Unauthenticated remote code execution in the Teddy Bear Customize Addon WordPress plugin (all versions through 1.0.5) allows attackers to upload arbitrary PHP files to the server and execute code. The plugin's upload handler trusts the client-supplied MIME/content type and preserves the original attacker-controlled filename, so a request declaring an image content type while carrying a .php payload lands as an executable script in the webroot. Publicly available exploit details have been published by WPScan; no active exploitation has been confirmed in CISA KEV at time of analysis.
Authentication bypass in the Teddy Bear Customize Addon WordPress plugin (through version 1.0.5) lets unauthenticated attackers log in as any registered user - including administrators - by supplying only that user's email address, because the login routine never verifies the account password. WPScan reports a publicly available exploit, and with CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) this is a trivially weaponizable full account-takeover; no active-exploitation (KEV) listing exists at this time.
PHP object injection in the Site Reviews WordPress plugin before 8.3.0 allows unauthenticated remote attackers to deserialize arbitrary PHP objects on installations where the WordPress nonce key is absent, set to its sample/placeholder value, or too short to be secret. The plugin derives its deserialization protection key by padding the site's nonce key, making that derived key trivially computable under these common misconfiguration conditions. Exploitation impact is chained to PHP gadget chains present in other installed plugins or themes; no confirmed active exploitation (SSVC: none), but a public POC exists and full site compromise - including code execution, credential theft, and data loss - is achievable on sites with both a weak nonce key and a usable gadget chain.
Privilege escalation in the Registration Form for WooCommerce WordPress plugin (versions before 1.1.3) allows any authenticated Contributor-level user to register new WordPress accounts with arbitrary roles, including Administrator. The plugin fails to verify that the form ID supplied during registration belongs to a legitimate registration form, instead blindly reading the permitted-role allow-list from any post the attacker controls. Exploitation results in full site takeover. A publicly available proof-of-concept exists. This vulnerability is an incomplete fix of a prior privilege escalation issue tracked as CVE-2026-54807.
Unauthenticated arbitrary WordPress option deletion in the zipMoney (Zip Co) Payments Plugin for WooCommerce before 2.4.0 lets remote attackers destroy site configuration and take the site offline. One front-end request handler performs no authorization checks and does not restrict which option name the caller supplies, so any unauthenticated visitor can delete critical wp_options entries. Publicly available exploit code exists and a vendor patch (2.4.0) is available; no active exploitation has been confirmed (not in CISA KEV).
Two-factor authentication bypass in the miniOrange 2FA WordPress plugin allows an attacker who has already obtained a victim's password to defeat the second factor through unlimited OTP brute-forcing. The plugin keys its attempt-rate limit to a client-controlled identifier rather than the target account, enabling an adversary to rotate that identifier and circumvent lockout entirely; a separate validation endpoint applies no rate limit at all. A publicly available exploit (WPScan) confirms practical exploitability against plugin versions below 6.3.1 and 19.3.
Unauthenticated arbitrary site-option deletion in the miniOrange 2FA WordPress plugin (versions 5.3.24 through before 6.3.1, and 18.0 through before 19.3) lets any visitor delete arbitrary wp_options entries because option names are taken directly from request input without validating a legitimate transaction. Deleting the right options can lock every administrator out of the WordPress dashboard or fully deactivate the two-factor plugin, stripping the site of its 2FA protection. Publicly available exploit code exists (WPScan) and a vendor patch is available; the flaw is rated CVSS 10.0.
Unauthenticated information disclosure in Ultimate Gift Cards for WooCommerce (WordPress plugin, versions 3.0.3 through 3.2.9) exposes customer PII, gift card balances, and transaction dates tied to arbitrary orders with no authorization check. Version 3.2.9 raises the severity significantly: the live redemption code is also leaked, allowing any anonymous attacker who retrieves it to spend the gift card balance, crossing from information disclosure into tangible financial fraud. A publicly available proof-of-concept was published by WPScan, and the vulnerability is automatable per CISA SSVC, making mass enumeration of orders and gift card theft realistic.
Price reconciliation failure in the Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 allows unauthenticated users to obtain gift card coupons worth more than they actually paid at checkout. The plugin issues coupon codes without verifying that the face value matches the payment amount collected by WooCommerce, creating a directly monetizable fraud vector against any store running the affected plugin. A publicly available exploit exists per WPScan, lowering the bar for financial abuse of vulnerable storefronts.
Stored cross-site scripting in the Kirki WordPress plugin before 6.3.0 allows unauthenticated remote attackers to persistently inject JavaScript into comment fields by bypassing the plugin's HTML entity decoding logic through alternate entity encodings. The malicious payload executes in the browser session of any user - including administrators - who views a page rendering the affected comment, and propagates site-wide when Kirki-managed headers or footers display comment data. A publicly available proof-of-concept exists and the vendor has released a patching fix in version 6.3.0.
Account takeover via insecure direct object reference in the SureCart WordPress plugin (versions 4.0.0 through 4.6.2) allows any subscriber-level authenticated user to seize full control of an administrator account. The plugin's customer update endpoint validates that the requester has permission to update customers, but fails to verify that the target customer record belongs to the requesting user - enabling arbitrary cross-user email modification followed by a password reset. A compounding information disclosure flaw leaks customer identifiers and email addresses to all authenticated users, providing the enumeration primitive needed to complete the takeover chain without any additional knowledge. A publicly available proof-of-concept exploit exists, and vendor patch 4.6.3 is available.
Stored cross-site scripting in the HT Menu WordPress plugin before 1.2.7 allows any authenticated subscriber-level user to inject arbitrary JavaScript into navigation menu-item settings, which then executes in the browser of every site visitor - including administrators - who views the affected menu. The flaw combines two missing controls: no capability or ownership check on the settings-save endpoint, and no output escaping on render. A public exploit is available via WPScan, and vendor-released patch 1.2.7 is available. No public KEV listing; EPSS is low at 0.15%, consistent with targeted rather than mass exploitation.
Stored cross-site scripting in the JCH Optimize WordPress plugin before 6.0.1 allows any authenticated user with Subscriber-level access to import arbitrary plugin settings via an unprotected AJAX endpoint, injecting persistent JavaScript that executes in the browsers of site visitors and administrators. The missing capability check means that low-privilege accounts bypass the intended authorization boundary, enabling stored XSS delivery without administrative permissions. A publicly available proof-of-concept from WPScan exists, and the vendor has released a fix in version 6.0.1.
SQL injection in the Music Store WordPress plugin (versions 1.0.245 through before 1.4.5) enables unauthenticated remote attackers to extract the entire WordPress database via crafted HTTP requests. The CVSS Scope:Changed vector reflects that exploitation can read data beyond the plugin's own tables - including WordPress user credentials, email addresses, and site configuration stored by other plugins. A publicly available exploit is documented on WPScan, though no confirmed active exploitation (CISA KEV) has been recorded.
Reflected Cross-Site Scripting in the IPGP Visitors Origin WordPress plugin before version 1.6 allows unauthenticated remote attackers to inject arbitrary JavaScript into victims' browsers by delivering a crafted URL that the plugin echoes back unsanitized. No server-side authentication is required from the attacker, though victim interaction (clicking or submitting a crafted request) is mandatory for payload execution. A publicly available proof-of-concept via WPScan lowers the exploitation barrier, though EPSS of 0.18% indicates limited automated scanning activity to date and no active exploitation has been confirmed by CISA KEV.
Site takeover in the SEO Flow by LupsOnline WordPress plugin (versions 3.0.0 through before 3.0.3) stems from improper validation of the credential supplied with the plugin's API requests, allowing unauthenticated attackers to be served in the security context of the administrator who configured the plugin. Because the flaw grants effective administrator-level access, an attacker can fully compromise the affected WordPress site. Publicly available exploit code exists (published by WPScan), though EPSS remains low at 0.15% (4th percentile), and there is no public exploit identified as active in the wild.
RegistrationMagic WordPress plugin before version 6.0.9.9 omits audience validation on Facebook OAuth access tokens during social login, creating two exploitable paths: an attacker who obtains any valid Facebook token belonging to a site user - regardless of which Facebook application issued it - can authenticate to the WordPress site as that user, and a separate path allows account creation even when site registration is explicitly disabled. Publicly available exploit code has been published by WPScan, and the high CIA impact score reflects that full account compromise is achievable on affected installations with the Facebook login feature enabled.
JetFormBuilder - Dynamic Blocks Form Builder for WordPress before version 3.6.5.2 exposes sensitive site data to unauthenticated remote attackers due to missing authorization checks during page rendering. By submitting crafted requests that reference internal WordPress data sources, attackers can read arbitrary user properties including password hashes, private and draft post content, term metadata, and secrets stored by the plugin in post metadata fields. A publicly available proof-of-concept exploit exists, and the zero-privilege network attack path makes this a credible mass-scanning target for WordPress infrastructure.
Privilege escalation with arbitrary code execution in the Hummingbird Performance WordPress plugin (versions 3.15.0 through before 3.21.2) allows any site-level administrator on a WordPress multisite network to access and modify a network-wide configuration setting that should be gated to super admins, achieving code execution across all sites on the network. The vulnerability stems from missing capability enforcement (CWE-94) on a sensitive network-scope action. A publicly available proof-of-concept exists, and the vendor has released a patched version (3.21.2) addressing the access control gap.
Broken object-level authorization in the Classified Listing WordPress plugin (versions 5.3.0 through pre-6.1.1) allows any authenticated subscriber-level user to permanently delete media attachments from, or attach arbitrary files to, listings owned by other users by invoking the plugin's AI image-editing AJAX action with a victim's listing ID. The handler performs no ownership or capability verification before acting on the supplied identifier (CWE-639), meaning the lowest default WordPress role is sufficient to tamper with any listing on the platform. A publicly available proof-of-concept exists per WPScan; no active exploitation has been confirmed in the CISA KEV catalog at time of analysis.
Unauthenticated arbitrary file upload in the Developer Tools WordPress plugin (versions through 1.1.3) lets remote attackers upload malicious files via the bundled, legacy SWFUpload component, typically leading to remote code execution when a PHP webshell is placed in a web-accessible directory. Any WordPress site running this plugin at or below 1.1.3 is exposed with no authentication required. Publicly available exploit code exists (reported by WPScan), though there is no public evidence of active exploitation.
Missing authorization on REST API endpoints in the Auto x LINE WordPress plugin (through version 1.0.0) allows unauthenticated remote attackers to read and modify plugin settings and erase log data. The plugin facilitates LINE messaging integration for WordPress sites, meaning exposed settings likely include LINE API credentials and channel tokens. A publicly available proof-of-concept exists per WPScan, and the unauthenticated network-accessible nature of the flaw (PR:N, AV:N) makes it trivially exploitable against any exposed instance. No actively exploited status confirmed in CISA KEV at time of analysis.
Remote code execution in the WatchMan-Site7 WordPress plugin (all versions through 4.2.0) allows any authenticated user - including a low-privilege subscriber - to run arbitrary PHP on the server because the plugin's debugging console, which evaluates user-supplied PHP, is not access-restricted. Publicly available exploit code exists (reported by WPScan), and with CVSS 9.9 this represents full server compromise from the lowest authenticated role. There is no public evidence of active in-the-wild exploitation at time of analysis.
Unrestricted file upload in the Embed HTML5 Game WordPress plugin (versions through 1.3) lets unauthenticated attackers upload arbitrary files - including PHP scripts - because the plugin neither restricts who may upload nor validates file type, enabling planting of PHP backdoors and full remote code execution. WPScan reports the flaw with a publicly available exploit, and the CVSS 10.0 rating reflects unauthenticated network exploitation with complete impact. No CISA KEV listing exists, but the combination of PR:N and a public PoC makes opportunistic scanning likely.
Authentication bypass in the OAuth Single Sign On WordPress plugin (versions 6.25.0 through <7.0.1) allows unauthenticated remote attackers to log in as any non-administrator WordPress user by forging the identity assertion returned during the Steam SSO flow, without possessing valid credentials. Attackers can additionally register entirely new accounts, providing persistent footholds. A publicly available proof-of-concept exploit reported by WPScan materially elevates real-world risk and makes this an immediate patching priority for affected sites.
Stored cross-site scripting in the Simple Ajax Chat WordPress plugin (versions before 20260827) permits unauthenticated users to inject arbitrary HTML and JavaScript into chat messages, which execute in the browser of any viewer including site administrators. Because no authentication is required to post messages and the plugin does not sanitize or escape content before rendering, a single malicious chat post persists and fires against every subsequent visitor. A publicly available exploit demonstrates the issue, and CVSS PR:N/UI:R confirms the attacker-to-victim delivery model: the attacker posts once, then waits for an administrator to trigger code execution by viewing the chat.
Stored XSS in the FAQ Builder AYS WordPress plugin (versions before 1.8.5) permits unauthenticated remote attackers to inject persistent JavaScript payloads via visitor-submitted content that is stored without sanitization and later rendered in the WordPress admin dashboard. A double-bypass condition compounds the flaw: the plugin's own partial HTML escaping is undone by a subsequent server-side decoding step, ensuring injected scripts reach the admin browser intact. When a logged-in administrator views the affected admin panel page, the payload executes with full administrative privileges, enabling session hijacking or complete site takeover. A publicly available exploit exists per WPScan; vendor patch version 1.8.5 is available.
Privilege escalation to administrator in the Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 allows unauthenticated visitors to bypass role restrictions enforced on front-end user registration forms. The plugin fails to validate that a submitted role value matches those actually offered by the configured form, and its blocklist against privileged roles is incomplete, enabling a two-stage attack: register with an elevated role, then escalate that account to full site administrator. A publicly available exploit exists per WPScan disclosure, raising the urgency of patching; no public KEV listing has been identified at time of analysis.
Stored XSS in the RegistrationMagic WordPress plugin prior to version 6.0.9.9 allows unauthenticated attackers to inject malicious scripts into registration form fields that are rendered unescaped within HTML attributes on WordPress administrative pages. When a privileged administrator subsequently views the affected backend page, the attacker's payload executes in the admin's browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. A publicly available proof-of-concept exists via WPScan, and a vendor-released patch (6.0.9.9) is confirmed available.
Reflected Cross-Site Scripting in the Social Media Share Buttons & Social Sharing Icons WordPress plugin (all versions before 3.0.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by embedding a malicious payload in a crafted URL targeting an unescaped request parameter rendered inside an inline JavaScript event handler. Exploitation is constrained to sites running a non-default icon display configuration, and requires the victim to interact with the affected share button. A public proof-of-concept is available via WPScan; no active exploitation has been confirmed by CISA KEV.
Privilege escalation in the JetBackup WordPress plugin before 3.1.23.5 allows a subscriber-level user to gain full administrator access by exploiting the plugin's failure to validate account roles during a site restore or migration. When the site owner performs a legitimate backup restore or migration, JetBackup blindly preserves and promotes accounts in the backup set without re-verifying their roles or capabilities, silently elevating an attacker's low-privilege account to administrator. A publicly available proof-of-concept exists per WPScan, though no confirmed mass exploitation (CISA KEV) is on record; the CVSS 7.1 score (AC:H/UI:R) reflects real-world complexity imposed by the site-owner trigger.
PHP Object Injection in the User Frontend WordPress plugin (versions before 4.3.11) allows any authenticated subscriber-level user to trigger deserialization of attacker-controlled field values by reopening a previously submitted post in the plugin's frontend editing form. If a suitable PHP gadget chain is present in the WordPress installation - supplied by other installed themes or plugins - this escalates to full remote code execution. A public proof-of-concept is available via WPScan, making exploitation accessible to low-skilled attackers on vulnerable installs.
Reflected XSS in Photo Gallery by 10Web WordPress plugin (all versions before 1.8.44) lets an unauthenticated attacker execute arbitrary JavaScript inside the authenticated browser session of an administrator or contributor by tricking them into clicking a crafted link. Two distinct injection sinks exist: the Shortcode admin page (exploitable against contributors and above) and the Galleries/Albums list page (requires the site to have more than 20 galleries, and targets administrators). Both sinks reflect unsanitized request parameters into HTML input-attribute values and weaponize an auto-firing onfocus event handler, bypassing some user-interaction defenses. A publicly available PoC via WPScan confirms the issue; vendor-patched version 1.8.44 is available.
Unauthenticated administrator account takeover in the Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 is possible when a site exposes a front-end user-update form configured to target an administrator account with a visitor-supplied password field. The plugin's Forms module skips the authorization check on who may edit the targeted account unless the submitted role is administrator or super_admin, creating a gap exploitable by any site visitor. A publicly available proof-of-concept from WPScan exists and a vendor patch is available at version 0.9.2.7.
Stored Cross-Site Scripting in the Groundhogg - CRM, Newsletters, and Marketing Automation WordPress plugin before version 4.5.13 allows unauthenticated attackers to inject persistent malicious scripts through optional web form fields, which subsequently execute in the browsers of privileged administrative users. Successful exploitation can yield full administrative session compromise, unauthorized rogue account creation, or arbitrary site modification. A publicly available proof-of-concept is confirmed by WPScan; however, EPSS remains low at 0.17% (7th percentile), indicating limited observed mass exploitation despite that availability.
Stored Cross-Site Scripting in Customer Reviews for WooCommerce (all versions before 5.118.0) lets unauthenticated attackers inject persistent malicious scripts by submitting crafted review content through a vulnerable plugin endpoint, with the payload stored in the WordPress database. When an authenticated user - particularly a store administrator - views the affected review, the injected script executes in their browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. A publicly available exploit exists per WPScan; EPSS sits at 0.17% (7th percentile), indicating limited observed mass exploitation despite POC availability, and the vulnerability is not currently in CISA KEV.
Reflected XSS in the geotargetingwp WordPress plugin before 3.5.6.2 enables unauthenticated attackers to inject arbitrary JavaScript into victims' browsers via unsanitized parameters echoed back in HTML-typed AJAX responses. Exploitation requires social engineering to trick a target - ideally an authenticated WordPress administrator - into submitting a crafted request, after which the reflected payload executes in the victim's browser session. A publicly available proof-of-concept exists per WPScan; the vulnerability is not listed in CISA KEV, and EPSS sits at 0.17%, indicating limited observed exploitation to date.
Unauthenticated file read, SSRF, and arbitrary file write affect the 爱采集数据采集和发布插件 (an auto-collection/scraping-and-publishing) WordPress plugin through version 1.0.0, because one of its unauthenticated endpoints trusts a hardcoded default secret instead of a per-install value and fails to validate supplied URLs and destination paths. Remote attackers with no authentication can read arbitrary server files, coerce the server into issuing arbitrary outbound requests and returning the responses, and write attacker-controlled content outside the uploads directory. Publicly available exploit code exists (reported by WPScan), though EPSS remains low at 0.14% (3rd percentile).
Unauthenticated information disclosure in the HEL Online Classroom WordPress plugin (versions ≤ 1.0.3) exposes the BigBlueButton shared secret through an unprotected REST API route, enabling any remote attacker to retrieve stored plugin settings without credentials. With the exposed shared secret, an attacker can forge valid HMAC-signed API requests directly against the connected BigBlueButton server, allowing unauthorized access to or disruption of virtual classroom sessions. No public KEV confirmation exists, but a public exploit is available via WPScan; EPSS is low at 0.14%, consistent with the plugin's niche footprint.
Payment confirmation bypass in the Appointment Booking Calendar Plugin and Scheduling Plugin for WordPress (versions before 1.6.3) lets unauthenticated users complete paid appointment bookings by submitting only a fraction of the listed price. The plugin stages a server-side price for each booking but fails to validate the amount actually received from the payment processor against that staged figure before confirming the appointment. A publicly available proof-of-concept exists per WPScan; no active exploitation is confirmed in CISA KEV, and EPSS sits at just 0.14%, indicating limited observed mass exploitation despite the PoC.
Unauthenticated access to privileged operations in the User Profile Builder WordPress plugin (versions up to 4.0.1) allows any visitor to enumerate the site's media library and alter unpublished posts, pages, and media items belonging to other users. The front-end file upload feature omits the required WordPress role capability checks, effectively granting anonymous users the access level of a trusted content author. A publicly available proof-of-concept exploit exists via WPScan, though EPSS at 0.13% (3rd percentile) indicates limited observed in-the-wild activity despite POC disclosure.
Server-side request forgery in the Total Processing card payments plugin for WooCommerce (all versions through 7.3) lets unauthenticated remote attackers control the destination of the plugin's server-side payment-verification request. Because the plugin neither validates the user-supplied path nor authenticates the gateway's response, an attacker can redirect the verification call to a host they control to harvest the merchant's payment-gateway credentials and forge a fake success response that marks arbitrary WooCommerce orders as paid. Publicly available exploit code exists (reported by WPScan); it is not listed in CISA KEV and EPSS is low (0.14%, 3rd percentile).
Full-read Server-Side Request Forgery in the SmartAIPress WordPress plugin (through version 1.2.0) allows any subscriber-level authenticated user to force the WordPress server to fetch arbitrary internal or external URLs and return the full response body. The vulnerability stems from a missing capability check on an AJAX action combined with zero server-side URL validation, making internal cloud metadata endpoints, intranet services, and private API surfaces reachable by low-privilege users. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.13% (3rd percentile), indicating limited mass automated exploitation at time of analysis.
Account takeover in the Uix UserCenter WordPress plugin (all versions through 1.0.3) lets unauthenticated attackers seize any account, including administrators. The plugin's profile-update action never checks that the targeted account belongs to the requester and authorizes the action with a token signed by a hardcoded key that is identical on every installation, so an attacker can forge a valid token for any user and overwrite that user's email and password. Rated CVSS 9.8 with publicly available exploit code (WPScan), though EPSS is low at 0.14%.
Unauthenticated SQL injection in the Rest Routes WordPress plugin (through version 5.5.5) allows any remote attacker to extract sensitive data from the underlying WordPress database by crafting a malicious request to a publicly accessible REST endpoint. The flaw stems from a URL-derived parameter being passed directly into a SQL query without sanitization or parameterization, requiring no authentication and no user interaction. A publicly available proof-of-concept exists per WPScan, though the EPSS score of 0.18% (7th percentile) indicates exploitation remains infrequent despite the PoC's accessibility.
Privilege escalation to full site takeover affects the MemberHero WordPress plugin through version 6.9, where the frontend registration flow fails to restrict which account fields a visitor may set, letting unauthenticated attackers self-register with an arbitrary role - including Administrator. Version 6.9 was advertised as the fix but the patch is incomplete, so current installs remain exploitable to gain admin access and hijack existing accounts, and no fully-fixed release exists at time of analysis. Publicly available exploit code exists (WPScan), though EPSS remains low at 0.15% (4th percentile).
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.6 lets authenticated users holding the plugin's delegated management capability overwrite arbitrary WordPress site options, including those governing user roles, enabling full administrator takeover. The root cause is a missing capability check on the login settings save handler - the plugin fails to verify the caller's WordPress capabilities before persisting changes to the wp_options table. A public proof-of-concept exploit exists per WPScan; however, SSVC reports no active exploitation and the CVE is absent from CISA KEV.
Privilege escalation to administrator in the Ultimate Member WordPress plugin (versions 2.6.7 through 2.12.x) allows unauthenticated users registering via the plugin's own forms to self-assign any WordPress role, including administrator, by exploiting a logic failure in role validation. When the plugin cannot resolve the allowed roles for a given profile form, it falls back to validating the submitted role against the full site-wide role registry rather than the form's own allow-list - accepting any valid registered role. A publicly available exploit exists per WPScan, though SSVC assessment indicates no confirmed active exploitation campaigns at time of analysis. Vendor-released patch is available in version 2.13.0.
Unauthenticated arbitrary file read in the Shared Files Pro WordPress plugin (all versions before 1.7.70) allows remote attackers to supply an unvalidated path parameter during featured image creation, causing the plugin to read and republish any file accessible to the web server process at a public URL. This compound impact - read plus republication - means sensitive data such as wp-config.php database credentials or secret keys can be exfiltrated and exposed to any internet user, not just the attacker. A publicly available proof-of-concept exists, and the CVSS vector confirms no authentication or user interaction is required against any default installation of the affected plugin.
PHP object injection via unsafe deserialization in the User Frontend WordPress plugin (versions before 4.3.10) grants Editor-level users the ability to execute arbitrary PHP code on the host server. The plugin fails to validate field type definitions and deserializes user-controlled post metadata at render time - a CWE-502 flaw exploitable through any available POP chain present in the WordPress environment. A public proof-of-concept exists per WPScan, though SSVC assessment notes no confirmed active exploitation at time of analysis.
Unauthenticated arbitrary PHP function invocation in the Tutor LMS WordPress plugin before 4.0.6 lets remote attackers overwrite internal template variables via request data and call any zero-argument PHP function, returning its output to the attacker. This enables information disclosure and potentially broader compromise depending on which functions are reachable. Publicly available exploit code exists (reported by WPScan), though the flaw is not listed in CISA KEV.
Remote unauthenticated command execution affects a broad range of Zbtlink MT7620-based routers and gateways (WE1326, WE2426-C, WE5926 family, WE826 family, WG108/WG3526, WF3526-P, CTN720-W1, LF-1541, MT7620N, WRC1) whose infosrvd service listens on UDP/9992. A single crafted UDP packet lets an attacker run arbitrary commands as root, because the service's authentication relies on a hardcoded salt and accepts an all-zero wildcard MAC, defeating the intended check. Publicly available exploit code exists (research and advisory published by VulnCheck), the CVSS 4.0 base score is 9.3, and no active exploitation has been confirmed in CISA KEV at time of analysis.
Root-level remote code execution affects a family of Zbtlink, MoreQuick, and related OEM routers/APs (e.g. L3_V2_8 3.0.0.4.528, WE826-T2 19.1101, ZBT-7628, ZBT-ZBT7621, AP522, AP7628, HC5661A, HK300, MAP-N10) that ship a factory backdoor implant named 'yunmgrd' beaconing to a hardcoded cloud C2 over unauthenticated cleartext UDP. Because the channel is unauthenticated and in cleartext, a remote attacker on the network path can hijack it, impersonate the C2, and run arbitrary commands as root - additionally tampering with DNS, stealing PPPoE credentials, and opening reverse SSH tunnels. Reported by VulnCheck with publicly available exploit code; not currently listed in CISA KEV.
Arbitrary file deletion in the Order Tip for WooCommerce WordPress plugin (versions before 1.6.0) allows authenticated Shop Managers to delete any file on the web server by exploiting missing capability checks and absent path restrictions on the deletion endpoint. The plugin fails to validate both the requesting user's permissions and the target file path, meaning a malicious or compromised Shop Manager account could remove critical WordPress files such as wp-config.php, leading to full site compromise. A publicly available proof-of-concept exists per WPScan; however, EPSS sits at only 0.17% (6th percentile) and CISA has not added this to KEV, consistent with the SSVC assessment of no observed exploitation.
Path traversal in the AI Engine WordPress plugin (versions 3.3.3 through 3.7.1) allows arbitrary server file reads with subsequent exfiltration to an external service. When the plugin's non-default public API feature is enabled, subscriber-level users can supply a crafted URL that the plugin maps to a local filesystem path without confinement, reads, and forwards to an external AI endpoint. In default configurations the flaw is limited to administrator-level users, but on WordPress multisite networks this allows unprivileged subsite administrators to extract network-wide configuration secrets. A publicly available POC exists, though EPSS at 0.19% indicates no widespread automated exploitation at time of analysis.
Unauthenticated account creation in the Project Manager WordPress plugin before version 4.0.7 allows any remote attacker to register WordPress user accounts regardless of the site's registration settings. The import routes in the plugin carry no authorization checks whatsoever (CWE-862), enabling an attacker who already knows the password they will submit to establish a persistent, valid WordPress account on the target site. A publicly available proof-of-concept exploit exists; however, EPSS is currently 0.18% (7th percentile), indicating low observed exploitation volume at the time of analysis.
Remote code execution in the Pods WordPress plugin (versions 3.1.0 through 3.3.9.1) allows authenticated users holding the author role or higher to invoke arbitrary PHP functions on the server by submitting a crafted display callback that bypasses the plugin's blocked-function comparison logic. Exploitation is limited to sites where restricted display-callback mode is active - the automatic default on installations first deployed on Pods versions predating 3.1 - meaning a large subset of long-running Pods deployments are in-scope. A public exploit exists per WPScan reporting, though EPSS at 0.21% (11th percentile) indicates low observed exploitation activity and no CISA KEV listing at time of analysis.
Remote unauthenticated administrative compromise is possible across three WordPress plugins - BlogVault Backup & Staging, MalCare WordPress Security Plugin, and WP Remote WordPress Plugin - in versions 5.16 through 6.64, due to the combination of a weak pseudo-random number generator used to create site-binding secrets and unauthenticated endpoints leaking data derived from those secrets. An attacker who can observe the leaked derived values can reverse the weak PRNG to reconstruct the original secret, then authenticate to the remote management service with administrative privileges and achieve full site takeover. A publicly available proof-of-concept exists; no CISA KEV listing is present, and EPSS sits at 0.17%, indicating limited observed mass exploitation despite the public exploit.
PHP Object Injection in the Kalles Addons WordPress plugin (all versions up to and including 1.0.6) allows unauthenticated remote attackers to deserialize untrusted PHP objects via a network-accessible deserialization endpoint. Exploitation is strictly conditional: the plugin itself contains no known POP (Property-Oriented Programming) chain, so real-world impact - ranging from arbitrary file deletion and sensitive data retrieval to remote code execution - only materializes when a separately installed plugin or theme on the same WordPress instance supplies a usable POP chain. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Privilege escalation in the AI Engine WordPress plugin (versions 2.8.0 through 3.6.0) enables any sub-site Administrator in a WordPress Multisite network to take over arbitrary accounts-including the Network Administrator-due to missing authorization checks on user management operations. A publicly available proof-of-concept exists per WPScan, and a vendor patch has been released at version 3.6.1. No active exploitation is confirmed by CISA KEV at time of analysis, though POC availability substantially lowers the bar for abuse by any authenticated sub-site admin.
Remote code execution via file upload bypass in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin (versions before 1.3.9.9) is exploitable by unauthenticated attackers against public-facing WordPress contact forms. The plugin strips certain characters from uploaded filenames as a sanitization step but fails to re-validate the resulting filename against its file type allowlist, enabling an attacker to craft a filename that survives stripping as a server-executable extension (e.g., PHP). A publicly available proof-of-concept exploit exists; a vendor patch is available at version 1.3.9.9 and should be applied immediately given the no-authentication, network-accessible attack surface.
Improper access control in the Dokan WooCommerce Multivendor Marketplace WordPress plugin before 5.0.14 enables authenticated Shop Managers to install and activate arbitrary WordPress plugins via the Dokan admin REST API. The plugin's capability check on these endpoints validates only for WooCommerce management capability rather than the required Dokan plugin-installation capability, granting Shop Managers an escalated privilege not intended for their role. With publicly available exploit code and a vendor-released patch, this warrants immediate remediation on any WordPress site running Dokan with untrusted shop manager accounts.
Full site takeover in the JSON Options WordPress plugin (versions through 0.0.4) is possible because one of its actions runs on every request without any capability check or nonce verification, exposing arbitrary WordPress option updates to unauthenticated users. An attacker can flip the users_can_register option on and set default_role to administrator, then self-register an admin account. Publicly available exploit code exists (reported by WPScan), and the flaw is rated CVSS 9.8 with SSVC technical impact assessed as total.
Remote code execution in the Depicter Popup & Slider Builder WordPress plugin (all versions before 4.8.0) is achievable by authenticated editor-level users who exploit the plugin's import feature to upload arbitrary PHP files to web-accessible directories. The plugin performs no file type validation and does not remove malformed or rejected uploads, allowing a PHP webshell to persist and be directly executed via HTTP request. A publicly available POC from WPScan exists; however, SSVC data indicates no confirmed exploitation to date and the attack is not automatable due to the mandatory editor-privilege requirement.
Customer-uploaded file disclosure in Extra Product Options Builder for WooCommerce (all versions before 1.2.176) allows unauthenticated requesters who know a file's stored name to retrieve it via an unprotected plugin endpoint, bypassing a missing authorization check (CWE-862). The real-world severity is conditional on web server type: the plugin writes deny-all rules to upload directories, meaning this endpoint only crosses a new security boundary on Apache-hosted sites; on default nginx deployments, those files are already directly URL-accessible and the endpoint adds no measurable additional exposure. Publicly available exploit code exists, but no public exploit identified at time of analysis confirms active exploitation, and EPSS sits at 0.22% (12th percentile) despite the elevated CVSS score.
Path traversal in the WPvivid - Backup, Migration & Staging WordPress plugin before 0.9.131 lets an attacker who possesses a valid site-to-site transfer key write a plugin-generated log file into any writable directory, including the web root, because an unsanitised value from the request is used to build the log file path. Publicly available exploit code exists (WPScan), but the impact is bounded: only the file's location is attacker-controlled while the filename suffix and the file contents (the plugin's own log header) are fixed, so this is arbitrary file placement rather than arbitrary content injection. Not listed in CISA KEV and EPSS is low (0.16%, 6th percentile), indicating little observed real-world exploitation.
Unauthenticated information disclosure in CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 exposes media attachment metadata - including titles, file types, sizes, and direct URLs - from any configured folder, including those never published to a gallery. The missing authorization checks on REST API endpoints mean any external party can enumerate private document libraries without credentials. A publicly available exploit exists per WPScan, though EPSS sits at just 0.17% (7th percentile), suggesting limited observed exploitation activity at time of analysis.
Authentication bypass in the Simple JWT Login WordPress plugin before 3.6.8 lets unauthenticated attackers log in as any user - including administrators - by presenting a valid Google identity token that carries the victim's email address. Because the plugin never checks the token's audience (aud) claim, a Google-issued ID token minted for an entirely different OAuth application is accepted as proof of identity, turning any site with Google sign-in enabled into a full-account-takeover target. Publicly available exploit details exist (WPScan), though EPSS remains low (0.16%) and the flaw is not listed in CISA KEV.
SQL injection in WP Directory Kit WordPress plugin before 1.5.7 is exploitable by authenticated administrators, with materially elevated impact on WordPress multisite networks where a single-site admin can read data belonging to the entire network - data outside their authorized scope. A public PoC is available via WPScan, though EPSS sits at 0.17% (6th percentile), indicating targeted rather than opportunistic exploitation. No CISA KEV listing confirms active in-the-wild exploitation at time of analysis.
Privilege escalation in the All-in-One WP Migration and Backup WordPress plugin (versions prior to 7.108) on multisite installations allows subsite administrators to execute arbitrary PHP code across the entire WordPress network. The vulnerability stems from missing access control enforcement on the migration import feature, which should be restricted to network-level administrators but is accessible to lower-privileged subsite admins. A publicly available exploit exists per WPScan and SSVC classification; however, EPSS sits at only 0.14% (4th percentile), and CISA KEV does not list this as actively exploited at time of analysis.
Full site compromise in the Link Factory WordPress plugin stems from the plugin itself being a deliberate backdoor rather than a coding flaw. Marketed as a 'homepage sentence publisher', it silently exposes an operator-controlled REST API under /wp-json/link-factory/v1/ that grants the plugin's author covert command-and-control over any site that installs it. Publicly available exploit code exists (reported by WPScan); the endpoints require no WordPress authentication and are gated only by a detached Ed25519 signature tied to the operator's hardcoded public key, so the operator retains privileged access indefinitely.
Unauthenticated database export exposure in the Ezoic WordPress plugin (versions 2.6.35 through before 2.23.1) allows any remote attacker to trigger a full server-side export of the site's database, harvesting user password hashes and active password reset tokens - the latter enabling immediate account takeover without password cracking. The same missing authorization flaw (CWE-862) additionally permits unauthenticated persistent modification of plugin settings. A publicly available exploit exists per WPScan, and the CVSS vector confirms trivial remote exploitation with no authentication, interaction, or special conditions required.
Unauthenticated SQL injection in WP Directory Kit WordPress plugin (all versions before 1.5.6) allows remote attackers to read arbitrary data from the WordPress database, including user credentials and sensitive site content. The flaw was reported by WPScan, a public proof-of-concept exploit is available, and exploitation requires no authentication - though it is conditioned on a non-default search field type being configured in the plugin. Patch version 1.5.6 resolves the vulnerability; sites using customized search field configurations are the exposed population.
PHP Object Injection escalating to unauthenticated remote code execution affects the WooCommerce Subscriptions WordPress plugin from version 4.7.0 up to (but not including) 9.1.0, but only on stores running WooCommerce's High-Performance Order Storage (HPOS). The plugin unserializes attacker-controlled input without validation, and a gadget chain in bundled dependencies turns that into arbitrary code execution. Publicly available exploit code exists and a vendor patch (9.1.0) is available, but this is not listed in CISA KEV; the EPSS score of 28% is elevated, indicating meaningful exploitation probability.
Privilege escalation and account takeover in the Events Manager WordPress plugin before 7.4.1 lets unauthenticated attackers reset passwords, promote accounts to Administrator, or delete accounts whose user ID collides with the ID of one of the plugin's own posts. The flaw stems from the plugin overriding WordPress's own capability decisions for unrelated privileged user actions. Publicly available exploit code exists (WPScan), EPSS is a notable 15%, and SSVC rates it automatable with total technical impact, though it is not currently listed in CISA KEV.
SQL injection in WP Directory Kit WordPress plugin (all versions before 1.5.6) allows any authenticated user - including low-privilege Subscribers - to query or manipulate the WordPress database via an AJAX endpoint that performs no input sanitization and enforces no authorization check. With a publicly available proof-of-concept reported by WPScan and an EPSS of 16%, the exploitation barrier is low for any site with user registration enabled. A vendor patch is available in version 1.5.6.
SQL injection in the Events Manager WordPress plugin (versions before 7.4.1) allows any subscriber-level or higher authenticated user to manipulate raw SQL queries and tamper with booking consent records belonging to other users. The flaw arises from a user-controlled value being interpolated directly into a database query without sanitization (CWE-89), enabling both unauthorized data disclosure and integrity violations against other users' booking records. A publicly available proof-of-concept exists per WPScan's disclosure, and an EPSS score of 16% reflects meaningful exploitation likelihood, though active exploitation has not been formally confirmed in CISA's KEV catalog.
Unauthenticated information disclosure in WP Photo Album Plus (WordPress plugin, all versions before 9.2.07.002) allows any remote attacker to read arbitrary autoloaded WordPress option values by supplying a crafted suffix to a public, unprotected endpoint. The plugin constructs an option name from client-controlled input without restricting it to its own namespace or verifying any capability or nonce, exposing site-wide secrets stored in wp_options. A publicly available proof-of-concept exists, SSVC rates this as automatable with partial technical impact, and EPSS sits at 16%, indicating meaningful real-world exploitation interest despite the absence of a CISA KEV listing.
Unauthenticated arbitrary file deletion in WP Photo Album Plus (versions before 9.2.07.002) exposes WordPress sites to path traversal attacks through a public endpoint that accepts unvalidated client-controlled file path values with no authorization check in place. Any remote unauthenticated attacker can manipulate this path parameter to target and delete ZIP archives stored anywhere on the server, including directories outside the web root. A publicly available proof-of-concept exists, EPSS scores this at 16%, and no public exploit identified at time of analysis maps to confirmed mass exploitation - but the low attack complexity and zero authentication barrier make rapid weaponization realistic.