Unknown
Monthly
Second-order SQL injection in Form Maker by 10Web WordPress plugin (all versions before 1.15.45) allows any subscriber-level authenticated user to execute arbitrary SQL against the WordPress database by submitting crafted input to database-backed choice fields, yielding high confidentiality and integrity impact. A publicly available proof-of-concept from WPScan lowers the exploitation barrier, and an EPSS of 16% reflects above-baseline real-world risk. No active exploitation is confirmed in CISA KEV at time of analysis, though the combination of low required privilege, network accessibility, and public exploit code makes this a credible near-term threat on unpatched installations.
Financial/business-logic bypass in the Wallet for WooCommerce WordPress plugin (all versions before 1.6.10) lets a customer credit their wallet balance for less than the amount actually paid, because the plugin credits the top-up before confirming the sum the payment gateway actually collected. Any registered store customer can effectively mint store credit at a discount, causing direct monetary loss to the merchant. Publicly available exploit code exists (WPScan); the flaw is not listed in CISA KEV, and EPSS is a moderate 13%.
Server-Side Request Forgery in the PowerPress Podcasting plugin by Blubrry for WordPress (versions before 11.17.1) allows any authenticated Contributor-level user to supply arbitrary URLs in the Podcast Episode URL settings field, causing the server to issue unvalidated HTTP requests that can reach internal network services, cloud metadata endpoints, or other systems not directly exposed to the internet. The CVSS 7.1 score reflects high confidentiality impact against reachable internal services, and a publicly available proof-of-concept combined with a 13% EPSS score makes this an actionable priority for WordPress site operators running the plugin. No active exploitation has been confirmed in CISA KEV at time of analysis.
Unauthenticated exposure of the backup authorization secret in Total Upkeep WordPress plugin (all versions before 1.17.3) enables remote attackers to both exfiltrate sensitive backup archives and trigger arbitrary full-site restores that overwrite live site files and the database. WPScan disclosed a publicly available proof-of-concept exploit, and SSVC rates the attack as automatable, creating conditions for mass exploitation campaigns. The vendor-reported CVSS score of 7.5 covers only the confidentiality dimension and substantially understates real-world risk by omitting the integrity and availability destruction possible through forced site restores.
Remote code execution in the WPMU DEV Dashboard (wpmudev-updates) WordPress plugin before 5.0.1 allows an attacker who can obtain or replay a single valid signed management request to push and execute arbitrary code on the site. The plugin's remote management interface installs packages without verifying their integrity and without replay protection, so a captured legitimate management call can be reused to install an attacker-controlled package. WPScan reports publicly available exploit code and the plugin scores CVSS 9.8; EPSS is elevated at 22%, but there is no public exploit identified as actively exploited in the wild (not in CISA KEV).
Unauthenticated arbitrary file upload in the Giftware WordPress plugin before 4.2.10 allows remote attackers to upload PHP files through an upload path that fails to validate file type (CWE-434), leading to remote code execution on the underlying web server. The flaw carries a CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N) and publicly available exploit code exists per WPScan, though it is not currently listed in CISA KEV; the EPSS score of 22% reflects meaningful but not top-tier near-term exploitation probability.
Unauthenticated export file disclosure in Import WP WordPress plugin (all versions before 2.14.23) allows any remote attacker to download administrator-generated export files without credentials. The export download handler performs no authorization check, exposing files that may contain user PII including email addresses, login names, and role assignments. A publicly available exploit exists (reported by WPScan), and EPSS sits at 16%, indicating meaningful real-world exploitation interest; exploitation is contingent on two prerequisites that meaningfully reduce actual exposure relative to the raw CVSS score.
SQL injection in the KiviCare WordPress plugin (all versions before 4.5.2) enables authenticated clinic staff users to execute arbitrary SQL against the underlying WordPress database. Unsanitized user-supplied parameters are passed directly into SQL queries, granting an attacker full read, write, and delete access to database contents including patient records and credentials. With a publicly available proof-of-concept, an EPSS of 17%, and a CVSS of 8.8, this is a high-priority patch for any healthcare-sector WordPress deployment running this plugin - though no CISA KEV-confirmed active exploitation has been identified at time of analysis.
Unauthenticated account creation in the Eventin WordPress plugin (all versions before 4.1.20) allows any remote attacker to register arbitrary email addresses as WordPress user accounts and inject order records by exploiting a missing authorization check on the waiting-list registration handler. The dual impact - rogue account creation and order record injection - can be chained with WordPress's built-in password reset flow to achieve full account takeover for any email address on the system. With a publicly available exploit and a 15% EPSS score placing this well above the median exploitation probability, this represents an elevated and realistic risk for all WordPress sites running the unpatched plugin; no CISA KEV listing is confirmed at time of analysis.
Unauthenticated remote code execution in the Product Input Fields for WooCommerce WordPress plugin before 2.0.2 arises because the plugin skips file-type validation whenever its accepted-types setting is left blank - a configuration the plugin's own documentation advertises as 'accept all files.' Attackers can upload arbitrary files, including PHP webshells, and execute them on servers whose upload directory does not enforce access restrictions. Publicly available exploit code exists (WPScan), though the EPSS score is low (0.20%, 10th percentile) and it is not listed in CISA KEV.
Privilege escalation via REST API authentication bypass in the CheckView WordPress plugin before 2.3.2 allows an unauthenticated attacker to perform any REST action available to a logged-in administrator - including creating a new administrator account - by tricking an admin into opening a crafted link. The plugin's authentication filter is applied globally to all REST routes rather than only to CheckView's own endpoints, and it unconditionally discards authentication errors for any request whose URI merely contains a CheckView-specific string, bypassing WordPress's nonce enforcement entirely. A publicly available exploit from WPScan demonstrates this path; no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Stored cross-site scripting in the Autopay WordPress plugin before 5.0.1 permits unauthenticated attackers to permanently inject arbitrary JavaScript into a site's checkout page by exploiting a missing capability check and nonce validation on a styling option endpoint. The injected payload executes in the browser of every visitor - including administrators - who loads the checkout page, enabling session hijacking, credential theft, or unauthorized admin actions. A publicly available exploit exists; EPSS is low at 0.17% (7th percentile), suggesting limited observed mass exploitation despite the public proof-of-concept.
Privilege escalation in the Vitepos WordPress point-of-sale plugin allows any user holding the custom Outlet Manager role to reset the password of any WordPress account - including site administrators - and achieve full account takeover. The flaw stems from a missing per-target authorization check in the password-reset API endpoint, combined with the plugin granting the Outlet Manager role overly broad reset capabilities by default. A publicly available proof-of-concept exists per WPScan, though EPSS remains low (0.13%, 3rd percentile), suggesting exploitation has not yet been observed at scale.
Unauthenticated booking record disclosure in the Salon Booking System WordPress plugin (through version 10.30.33) exposes other customers' personal information via sequential identifier enumeration. The booking-wizard confirmation flow loads booking records using a numeric booking ID without properly verifying that the requestor holds the associated ownership token, enabling any unauthenticated remote attacker to iterate through IDs and retrieve arbitrary bookings. A publicly available exploit exists per WPScan, and the vulnerability is trivially automatable, making mass customer PII harvesting a realistic outcome.
SQL injection in the ProSolution WP Client WordPress plugin (all versions before 2.0.6) lets remote attackers inject SQL through an unsanitized, unescaped parameter that is reachable without authentication, enabling blind extraction of database contents such as user credentials and secrets. Reported by WPScan, it carries a CVSS of 9.1 and has publicly available exploit code, though its EPSS probability is low (0.16%, 6th percentile) and it is not listed in CISA KEV. Exploitation status: publicly available exploit code exists.
Unauthenticated SQL injection in the ProSolution WP Client WordPress plugin (all versions before 2.0.9) exposes arbitrary WordPress database contents to any remote attacker and permits deletion of plugin-managed records without any login or capability check. The plugin blindly embeds an unsanitized cookie value into SQL queries and executes this logic on every HTTP request site-wide, meaning any page load against a vulnerable site is a valid attack surface. A publicly available exploit exists via WPScan; no confirmed active exploitation in CISA KEV, and EPSS sits at 0.21% (11th percentile), suggesting opportunistic rather than widespread automated attack activity at time of analysis.
File enumeration and unauthorized download is possible in the Contact Form to Any API WordPress plugin (all versions before 3.0.7) because uploaded contact form attachments are stored in a publicly accessible directory using predictable, non-random filenames. Unauthenticated remote attackers can discover the upload path by submitting a form themselves, then systematically enumerate filenames to retrieve files - potentially containing PII, identity documents, or sensitive business attachments - submitted by other users. A publicly available proof-of-concept exists, and a vendor patch (3.0.7) has been released.
Remote code execution in the Squeeze WordPress plugin (versions prior to 1.7.12) is achievable by any authenticated user holding the upload_files capability - granted by default to the Author role and above. The plugin's attachment-update action writes per-size image data to the uploads directory without validating file type or extension, permitting a PHP webshell to be placed in a web-accessible path and directly invoked via HTTP. A publicly available proof-of-concept exists per WPScan; no public exploit identified at time of analysis in CISA KEV, and EPSS is low at 0.19% (9th percentile), suggesting limited observed in-the-wild exploitation despite the public PoC.
Unauthenticated access to saved form draft data in the HT Contact Form WordPress plugin (versions before 2.9.3) exposes personally identifiable information - including names, email addresses, phone numbers, and physical addresses - to any remote attacker without credentials. The plugin's draft-retrieval endpoint performs no authorization check, meaning any unauthenticated HTTP request can enumerate or retrieve stored draft submissions. A publicly available exploit exists, though EPSS remains low at 0.16%, suggesting limited widespread automated scanning to date but real feasibility for targeted data harvesting against sites using this plugin.
Authentication bypass in the AutoNetTV Relay WordPress plugin (all versions before 3.0.14) allows unauthenticated remote attackers to obtain a WordPress administrator session cookie by triggering the plugin's scheduled content-synchronization task under a specific server configuration. The plugin issues an admin authentication cookie during the sync task without performing any capability or authorization check, and on servers where the scheduled task completes before the HTTP response is committed, the cookie is returned to the triggering request. A public proof-of-concept exploit exists, reported by WPScan; no KEV listing has been identified at time of analysis.
Local file inclusion in the Eventin WordPress plugin (all versions before 4.1.20) allows authenticated users holding editor-level or higher WordPress roles to supply an arbitrary local filesystem path as a template setting, causing the plugin to include and execute any reachable PHP file on the server. Full confidentiality, integrity, and availability impact is achievable on a successful exploitation. A publicly available proof-of-concept from WPScan exists, though the CVE carries no CISA KEV listing and an EPSS of only 0.16%, indicating no confirmed widespread active exploitation campaigns at time of analysis.
Unauthenticated email enumeration in the Login & Register Forms WordPress plugin (versions 3.0.0 through 4.0.1) exposes all registered user email addresses, including administrator accounts, via a flawed password reset mechanism. The plugin neither verifies that a reset request originates from the account owner nor adequately redacts email addresses in its HTTP response, allowing any unauthenticated attacker to harvest a site's full user roster through repeated requests. A publicly available proof-of-concept exploit exists, though EPSS remains low at 0.16%, indicating limited observed exploitation at time of analysis despite the trivial attack complexity.
Account takeover via broken password-reset rate limiting in the Login & Register Forms WordPress plugin (versions before 4.0.2) allows unauthenticated remote attackers to brute-force verification codes and seize any account, including administrator accounts. Both the verification code and the per-source attempt counter are keyed on client-controlled data, meaning an attacker can reset the rate limit at will by manipulating that value - rendering the lockout mechanism entirely ineffective. Exploitation requires the 'verification-code reset mode' to be enabled; a publicly available proof-of-concept from WPScan demonstrates the technique, though EPSS sits at only 0.15% (4th percentile), indicating limited observed exploitation activity to date.
Account takeover in the Login & Register Forms WordPress plugin (before 4.0.2) is enabled by a fundamentally broken password reset verification design: the plugin keys the 'verification completed' state to a client-controlled value rather than binding it server-side to the account under reset or to the authenticated session of the party completing verification. An unauthenticated attacker who can observe or manipulate this state during or after a legitimate reset flow can claim ownership of that completed verification and set a new password for any targeted account, including administrator accounts. A publicly available exploit has been published by WPScan, and no public exploit identified at time of analysis translates to KEV, though POC availability materially lowers the exploitation threshold.
Password reset abuse in the Single Sign On For TNG WordPress plugin (versions before 2.2.0) allows unauthenticated attackers to reset the password of any account, including administrators, resulting in full site takeover. The flaw stems from improper validation of the password reset request, and publicly available exploit code exists, though EPSS scores the exploitation probability at a low 0.15% (4th percentile). It is not listed in CISA KEV, so exploitation is currently proof-of-concept rather than confirmed active in-the-wild use.
Unauthenticated account takeover in the FoodBoxBooker WordPress plugin (versions before 1.0.7) lets remote attackers reset the password of any user - administrators included - because the plugin fails to properly validate password-reset requests. Successful exploitation yields full administrative control and effective site takeover. Publicly available exploit code exists; the flaw is not listed in CISA KEV and EPSS is low (0.15%, 4th percentile), indicating no confirmed mass exploitation yet.
Unauthenticated content injection in Arvow AI SEO Writer WordPress plugin (before 1.5.4) allows remote attackers to create arbitrary posts and pages and extract author account and taxonomy information by exploiting a PHP type juggling flaw in a REST endpoint. The bypass is effective exclusively when the plugin has not been configured post-installation, making freshly deployed or abandoned instances the primary target. A public proof-of-concept is available via WPScan; despite this, EPSS sits at 0.15% (5th percentile) and no CISA KEV listing exists, indicating no public exploit has driven mass exploitation at time of analysis.
Account takeover in the BricksForge WordPress plugin (versions before 3.1.8.8) is enabled by a missing server-side identity check during password change form submissions, allowing unauthenticated remote attackers to set arbitrary passwords for any WordPress user, including site administrators. The vulnerable state is effectively the default configuration for any site that has deployed BricksForge's password update form action, since current-password verification is disabled by default in that action. A publicly available exploit exists; active exploitation has not been confirmed by CISA KEV, but the direct path to admin-level account takeover makes this a critical remediation priority for affected deployments.
Missing capability checks in the File Manager WordPress plugin before version 6.9.1 expose the entire WordPress installation directory to any authenticated user, including low-privilege subscribers. Exploitation allows traversal of server-side directories and download of sensitive file types such as archives and documents, which frequently contain database credentials, configuration backups, and private documents. A publicly available exploit exists per WPScan, though EPSS remains low at 0.15% (5th percentile), suggesting opportunistic rather than widespread automated exploitation at this time; no CISA KEV listing is present.
Unauthenticated information disclosure in the File Manager WordPress plugin before 6.9.1 exposes a REST API route without any authorization controls, allowing any remote user to retrieve the plugin's complete file activity log. The leaked log reveals filesystem paths within the WordPress installation and the usernames of administrators who performed file operations, providing reconnaissance data useful for chaining further attacks. A publicly available proof-of-concept exploit exists per WPScan's disclosure, though EPSS at 0.16% (5th percentile) indicates limited observed exploitation activity; the vulnerability is not listed in CISA KEV.
Missing authorization controls in the File Manager WordPress plugin before version 6.9.1 allow any authenticated user - including low-privilege subscribers - to read and delete arbitrary files under the WordPress installation directory. The weakness exposes sensitive configuration secrets such as database credentials stored in wp-config.php, and enables deliberate denial of service through file deletion. A publicly available exploit exists per WPScan reporting, though EPSS remains very low (0.14%, 4th percentile), suggesting targeted rather than broadly automated exploitation at time of analysis.
Privilege escalation in the Solace Extra WordPress plugin (versions before 1.6.1) allows any authenticated user with Subscriber-level access to modify site-wide presentation settings and permanently delete imported site-builder content by exploiting missing capability checks across multiple AJAX endpoints. The plugin incorrectly exposes nonce values on admin-accessible pages that low-privileged users can reach, collapsing the intended authorization boundary between Subscriber and Administrator roles. A publicly available proof-of-concept exists via WPScan; no public exploit identified at time of analysis has been confirmed by CISA KEV, and the EPSS score of 0.13% (3rd percentile) reflects low observed exploitation probability to date.
WP Directory Kit versions before 1.5.5 expose the plugin's full settings - including sensitive API keys and third-party secrets - to any authenticated WordPress user, including low-privileged Subscribers, due to missing authorization and nonce validation on an AJAX endpoint. A vendor-released patch (version 1.5.5) is available, and a publicly available proof-of-concept exploit has been published by WPScan. Despite POC availability, EPSS sits at 0.14% (4th percentile), suggesting limited opportunistic exploitation at this time though the technical barrier to abuse is very low.
SQL injection via an unsecured AJAX endpoint in WP Directory Kit (WordPress plugin) before 1.5.5 allows any authenticated WordPress user - including low-privilege Subscribers - to query the underlying database and exfiltrate sensitive data. The AJAX action omits both authorization and nonce checks, collapsing what should be a privileged operation to the lowest authenticated tier. A public proof-of-concept exists per WPScan, though EPSS at 0.16% (6th percentile) indicates no widespread automated exploitation at time of analysis; this is not listed in CISA KEV.
Unauthenticated user enumeration in the Admin Safety Guard WordPress plugin (versions before 1.4.0) exposes the full registered user list - including usernames, email addresses, assigned roles, and two-factor authentication enrollment status - to any unauthenticated HTTP caller via an unprotected REST API endpoint. The irony is significant: a plugin marketed specifically for login security and brute-force protection inadvertently facilitates credential-stuffing and targeted attack preparation by leaking the exact user data attackers need. A publicly available proof-of-concept exploit exists, though EPSS sits at only 0.18% and CISA has not added this to the Known Exploited Vulnerabilities catalog.
PHP object injection in the Newsletters WordPress plugin (all versions before 4.16) permits unauthenticated remote attackers to supply arbitrary serialized PHP objects through a public-facing form, bypassing class restrictions entirely. If a suitable PHP gadget chain is present in the WordPress environment - commonly introduced by co-installed plugins or PHP libraries - this can escalate to remote code execution, data exfiltration, or full site compromise. A publicly available exploit has been confirmed by WPScan; however, EPSS stands at 0.16% (5th percentile), indicating limited observed mass exploitation at time of analysis despite the public PoC.
Local file inclusion via path traversal in WP Maps WordPress plugin (before 4.9.7) allows any authenticated Subscriber-level user to include and execute arbitrary existing PHP files on the server, resulting in full compromise of confidentiality, integrity, and availability. The root cause is a missing capability check on an AJAX action combined with unvalidated user-controlled path input - two compounding weaknesses that collectively drop the privilege bar to the lowest registered-user tier. A publicly available proof-of-concept exists (via WPScan), though EPSS sits at 0.30% (23rd percentile), indicating low observed exploitation activity at time of analysis despite the public POC.
Login CSRF in the Estatik Real Estate Plugin for WordPress (before 4.3.3) enables an unauthenticated attacker to hijack a victim's session by tricking them into completing an OAuth social login flow bound to an attacker-controlled account. Once the victim is logged in as the attacker, all subsequent activity - property searches, saved listings, contact forms, personal profile data - is captured and readable by the attacker. A publicly available proof-of-concept exists per WPScan, and SSVC classifies this as automatable with partial technical impact, though EPSS remains very low (0.10th percentile), suggesting limited observed exploitation to date.
PHP Object Injection in the Ajax Search Lite WordPress plugin before 4.14.5 lets unauthenticated remote attackers pass untrusted serialized data into a PHP unserialize() sink, and where a suitable POP gadget chain exists in a co-installed plugin or theme, this escalates to remote code execution. Reported by WPScan with publicly available exploit code, it carries a CVSS 9.8 rating but a low EPSS of 0.22% (13th percentile), and is not listed in CISA KEV. A vendor patch is available in version 4.14.5.
Integrity bypass in MStore API WordPress plugin (versions before 4.21.0) enables unauthenticated remote attackers to create fraudulent WooCommerce product reviews with arbitrary reviewer names, email addresses, and star ratings, completely circumventing the store's verified-purchase-only review restriction. The plugin's REST API review creation route applies neither authorization nor purchase-ownership validation, rendering the WooCommerce protection setting ineffective when the plugin is active. A publicly available proof-of-concept exists and SSVC confirms the attack is automatable, though the EPSS exploitation probability sits at just 0.14% (3rd percentile), suggesting limited real-world exploitation activity despite ease of execution.
Authentication bypass in the MStore API WordPress plugin before 4.21.0 lets an unauthenticated remote attacker mark any order as fully paid without processing a real payment, because several payment-completion endpoints trust the client-supplied completion signal instead of verifying it against the payment gateway. Any store using this plugin can be defrauded of goods, services, or digital downloads. A public exploit exists (WPScan) and a vendor patch is available, though EPSS remains low at 0.14%.
Account takeover in MStore API WordPress plugin before 4.21.0 is achievable by unauthenticated remote attackers who know a target's registered phone number, by forging a cryptographically invalid login token that the plugin fails to properly verify. This yields full control over the targeted account, including administrator-level WordPress accounts. A publicly available proof-of-concept exists; however, no CISA KEV listing is present and EPSS at 0.14% (3rd percentile) indicates low observed exploitation to date, likely constrained by the phone-number reconnaissance prerequisite.
SQL injection in the Content Views WordPress plugin before 4.5 exposes the underlying WordPress database to any authenticated user, including low-privilege Subscribers. Two compounding weaknesses drive this: a missing capability check on an AJAX action allows unprivileged users to reach a sensitive endpoint, and unsanitized attacker-controlled input is then passed directly into a raw SQL query. A publicly available POC exists via WPScan, and SSVC rates the technical impact as total, though EPSS remains low at 0.16%, suggesting no widespread automated exploitation at time of analysis.
Remote code execution in Subscriptions for WooCommerce WordPress plugin (before 2.0.1) is reachable by any authenticated Shop Manager through a missing capability check on a nonce-protected AJAX action that installs and activates arbitrary plugins from user-supplied slugs. Shop Managers, who by WordPress design are not granted plugin management capabilities, can exploit this gap to install a malicious plugin and achieve full server-side code execution. A publicly available proof-of-concept exists; however, EPSS is low (0.18%, 8th percentile) and the vulnerability is absent from CISA KEV, indicating exploitation remains opportunistic rather than widespread.
Unauthenticated REST API bypass in the 'Password Protected - Lock Entire Site' WordPress plugin (versions 2.6.8 through 2.8.3) exposes all password-gated content and account identifiers to unauthenticated visitors when the plugin's REST API restriction option is enabled. This is a confirmed regression of CVE-2024-0437, which was originally patched in version 2.6.7 but silently reintroduced in the very next release (2.6.8), leaving sites unprotected for any version in that range. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.15% (4th percentile), indicating limited observed exploitation at time of analysis.
Payment bypass in the WP Events Manager WordPress plugin before 2.2.5 lets any authenticated user register for a paid event and receive a fully completed booking without paying, because the plugin trusts an attacker-controlled quantity value and derives the charge from it. WPScan reports publicly available exploit code exists, though there is no evidence of active exploitation and the EPSS score is very low (0.13%, 3rd percentile). The flaw is a business-logic/authorization defect rather than a memory-safety issue, so impact is financial fraud against event organizers rather than server compromise.
Unauthenticated SQL injection in the Creative Mail WordPress plugin (versions 1.6.5-1.6.9) allows remote attackers to read the entire WordPress database without credentials. The vulnerability resides in an unsanitized parameter processed during abandoned cart email handling - a core feature of the plugin - making it exploitable against any site where the plugin is installed and that feature is active. A publicly available proof-of-concept exists via WPScan, raising the practical exploitation risk significantly beyond what CVSS base score alone conveys.
Unauthenticated information disclosure in the Gutenberg Essential Blocks WordPress plugin before 6.4.0 exposes published content from custom post types that site administrators deliberately registered as non-public. The plugin's public REST API route queries arbitrary post types supplied by the caller without first verifying their visibility setting, bypassing the access control intent of the post type registration. A publicly available proof-of-concept exists; EPSS sits at 0.14% (4th percentile) suggesting exploitation remains rare despite automatable conditions, and the vulnerability is not currently listed in the CISA KEV catalog.
Unauthenticated information disclosure in Gutenberg Essential Blocks for WordPress (versions before 6.4.0) exposes WooCommerce per-product lifetime sales unit counts to any internet user via an unrestricted public REST API route. The plugin over-fetches a non-public WooCommerce metric and surfaces it in the REST response without access control enforcement, meaning competitors, scrapers, or threat actors can query sales volumes for any published product on affected stores. A publicly available proof-of-concept exploit exists per WPScan, and SSVC assessment confirms the attack is automatable; however, EPSS sits at just 0.14% (4th percentile), indicating limited observed exploitation at time of analysis.
SQL injection in the WPCargo Track & Trace WordPress plugin before version 8.0.4 allows unauthenticated attackers to inject arbitrary SQL through an improperly sanitised parameter, exposing the WordPress database. Reported by WPScan with publicly available exploit code, this flaw is notable for affecting a code path distinct from the previously patched CVE-2024-44004, indicating an incomplete prior fix. Despite a CVSS 9.1 and public POC, the EPSS score is low (0.18%, 7th percentile) and the CVE is not on CISA KEV, so there is no public exploit identified as actively exploited in the wild.
Unauthenticated license-key erasure and premium deactivation is possible in the Checkimate WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through version 1.0.13. The plugin's license-management endpoint relies on a shared secret computed exclusively from publicly available site information - an authentication bypass that renders the access control trivially circumventable. Any remote attacker who can reach the WordPress site can permanently erase the stored license key and strip the installation of its paid premium status; a public proof-of-concept exists (reported by WPScan), though EPSS remains low at 0.14%, indicating opportunistic rather than widespread exploitation at time of analysis.
Events Manager WordPress plugin before version 7.4 exposes an unauthenticated REST API endpoint that serves temporarily stored file uploads without any authorization check, enabling an attacker who has obtained a victim's high-entropy temporary upload identifier to retrieve that user's in-progress file submission. Classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), the flaw represents a missing permission_callback on a WordPress REST route - effectively an IDOR variant against ephemeral upload objects. A public POC is available via WPScan; no CISA KEV listing exists, and the EPSS score of 0.14% (4th percentile) reflects the practical constraint imposed by identifier acquisition being the dominant bottleneck.
Payment amount manipulation in Stripe Payment Forms by WP Full Pay (WordPress plugin) before version 8.5.2 allows any unauthenticated visitor to arbitrarily lower - or potentially zero-out - the price of a Stripe payment intent before checkout completes. The flaw stems from an incomplete authorization fix in 8.5.0 that patched only one of the two vulnerable AJAX handlers, leaving the pricing-recalculation and payment-intent-update endpoints exposed. A publicly available proof-of-concept exists, and SSVC analysis confirms the vulnerability is automatable, raising the practical risk above what the low EPSS score (0.13%, 3rd percentile) alone would suggest.
Server-Side Request Forgery (SSRF) in the Newsletters WordPress plugin before 4.16 allows unauthenticated remote attackers to force the hosting server to issue HTTP requests to arbitrary internal or external URLs via the unauthenticated bounce-processing endpoint. A publicly available proof-of-concept exists per WPScan reporting. Despite the high CVSS score of 8.2, EPSS is very low at 0.14% (3rd percentile), and SSVC rates it non-automatable with only partial technical impact, suggesting opportunistic rather than mass exploitation at this time.
Unauthenticated arbitrary file deletion in the Drag and Drop Multiple File Upload for WooCommerce WordPress plugin (all versions before 1.1.8) lets anonymous attackers destroy customer order attachments staged in the plugin's upload directory. The plugin's only access control on its deletion routine is a nonce, but that nonce can be freely obtained by unauthenticated visitors, defeating the check entirely. Publicly available exploit code exists and a vendor patch has been released; EPSS is low (0.14%) and the issue is not in CISA KEV.
Contest Gallery WordPress plugin before version 30.0.7 implements a custom front-end login mechanism that issues authentication cookies directly after password validation, entirely bypassing WordPress's standard authentication pipeline. This architectural shortcut renders all brute-force protection plugins and two-factor authentication plugins completely ineffective, allowing unlimited, unthrottled password guessing against any WordPress account - including administrators - up to full account takeover. A publicly available proof-of-concept exists per WPScan reporting, though CISA has not listed this in KEV and SSVC indicates no confirmed active exploitation at time of analysis.
Account takeover in the miniOrange 2FA WordPress plugin before 6.2.7 is enabled when an attacker already possesses a target user's password - the plugin fails to bind a newly configured second factor to the target account's existing registered factor during the pre-login two-factor challenge, allowing the attacker to redirect 2FA enrollment to an attacker-controlled device, complete the challenge, and authenticate as the victim including as site administrators. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.14% (4th percentile), indicating exploitation has not yet become widespread. Critically, the published CVSS vector (C:N/I:N/A:H) severely misrepresents the actual impact - this is a full account-takeover flaw with high confidentiality and integrity consequences, not a denial-of-service; analysts should not use the published vector for risk calibration.
Two-factor authentication bypass in the WP 2FA WordPress plugin before 4.1.0 allows an attacker who possesses a valid user password to completely skip the second authentication factor and gain full account access, including administrator-level accounts. The plugin presents the 2FA challenge but fails to server-side validate the submitted factor for any of its supported methods, rendering 2FA protections entirely ineffective. A publicly available exploit exists (sourced from WPScan), though EPSS sits at 0.19% (9th percentile), indicating limited observed exploitation activity at time of analysis despite the public proof-of-concept.
SQL injection in the Ajax Load More WordPress plugin before 8.0.1 lets unauthenticated attackers inject into an unsanitised parameter used in a database query, enabling time-based blind extraction of sensitive data such as user credentials and secrets. Reported by WPScan with publicly available exploit detail and a vendor patch in 8.0.1; scored CVSS 9.1 with an unauthenticated network vector. EPSS is low (0.19%, 9th percentile), indicating limited observed exploitation despite the critical rating.
Account takeover in the WordPress plugin "OTP Login With Phone Number, OTP Verification" before 1.8.71 stems from missing rate-limiting and non-invalidation of one-time login codes, letting an unauthenticated attacker request a login OTP for any account and brute-force the short numeric code to seize control of any user, including administrators. CVSS 9.1 (AV:N/AC:L/PR:N/UI:N) reflects trivial network exploitation with high confidentiality and integrity impact. Publicly available exploit code exists (reported by WPScan), though EPSS is low at 0.15% (4th percentile) and it is not in CISA KEV, so there is no public exploit identified as actively exploited in the wild.
Missing capability checks across multiple REST API routes in the YayPricing WordPress plugin (all versions before 3.5.7) allow any subscriber-level authenticated user to overwrite a WooCommerce store's complete pricing configuration and extract private coupon codes. The plugin incorrectly relies on a shared nonce as its sole authorization gate rather than WordPress capability checks, a fundamental access control failure classified under CWE-284. A publicly available exploit exists per WPScan (EUVD-2026-53116), though EPSS sits at 0.14% (4th percentile), indicating low automated exploitation activity; CISA KEV listing is absent, so active exploitation in the wild is not confirmed.
Remote code execution in the zportals WordPress plugin (all versions before 6.3.4) is achievable by any authenticated user holding a Subscriber role or above, exploiting a server-side file upload validation failure that trusts the client-supplied Content-Type header and preserves the original file extension. By uploading a PHP webshell disguised with a benign MIME type, an attacker can plant executable server-side code and gain full control of the WordPress application layer. A publicly available proof-of-concept exploit exists; no confirmed active exploitation (CISA KEV) has been observed, but the low authentication barrier makes this a genuine risk for sites with open registration.
Arbitrary file deletion in the Custom Fields WordPress plugin before 1.5.1 allows unauthenticated attackers to delete any file on the server - including wp-config.php - leading to full site takeover. Because the plugin fails to validate a user-supplied path before deletion, a remote attacker needs no authentication or user interaction (CVSS 10.0). Publicly available exploit code exists via WPScan, though EPSS is low (0.17%) and the flaw is not listed in CISA KEV.
Registration enforcement bypass in the User Registration & Membership WordPress plugin (all versions before 5.2.6) allows unauthenticated users to create accounts on sites where the administrator has explicitly disabled open registration. The plugin processes registration form submissions without validating the site-level registration-disabled setting, effectively nullifying an administrative security control. A publicly available exploit exists per WPScan, though EPSS sits at a low 0.15% (4th percentile), indicating limited observed exploitation despite the accessible POC.
Broken object-level authorization in the MultiVendorX WordPress plugin before 5.0.11 allows any authenticated vendor (Store Owner role or above) to perform unauthorized cross-tenant operations against other vendors' stores via the REST API. The plugin fails to verify that the target store in a REST API request belongs to the authenticated vendor, enabling confidentiality breaches, store takeovers, permanent deletion, and arbitrary modification of competitor or co-platform stores. A publicly available exploit exists; EPSS probability is low (0.14%, 4th percentile) suggesting opportunistic or targeted exploitation rather than mass scanning, and this CVE is not currently listed in the CISA KEV catalog.
Password-protected block content in the Passster WordPress plugin (all versions before 4.3.6) is rendered into the public HTTP response body before the server evaluates the password check, making the gate purely cosmetic. Unauthenticated remote users can retrieve protected content by inspecting the raw response - no password required. A public proof-of-concept exploit is available via WPScan, and the CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N) confirms trivial remote exploitation with full confidentiality impact, though EPSS at 0.16% (5th percentile) and no CISA KEV listing indicate exploitation has not yet become widespread or automated.
Category-locked content in the Passster WordPress plugin (all versions before 4.3.6) is fully exposed through the native WordPress REST API, bypassing the plugin's access controls entirely. Unauthenticated remote users can retrieve the title, full body, and excerpt of any post that site owners intended to restrict using Passster's category-based protection. A publicly available exploit exists per WPScan; no CISA KEV listing and a low EPSS of 0.16% (5th percentile) indicate limited observed in-the-wild exploitation so far, but the trivial exploitation conditions make this an immediate upgrade priority for any site relying on Passster to gate sensitive content.
Unauthenticated content disclosure in the Passster WordPress plugin (versions before 4.3.6) allows any remote user to retrieve the full content of draft, private, and pending posts via a REST API endpoint that skips post-status validation. The flaw is conditional on the target site having a captcha provider configured, which is the typical deployment mode for Passster installations. Publicly available exploit code exists per WPScan reporting, though EPSS sits at only 0.16% (5th percentile), suggesting exploitation remains targeted rather than widespread. No CISA KEV listing has been issued.
Stored Cross-Site Scripting in the Bit Form WordPress plugin before 3.2.0 enables unauthenticated attackers to upload crafted SVG files containing embedded JavaScript as signature images, which execute in a victim's browser upon viewing the submission. Any authenticated user - most critically a WordPress administrator - who reviews form submissions containing the malicious SVG is at risk of session hijacking or unauthorized administrative action. A public proof-of-concept is available per WPScan; however, EPSS stands at 0.18% (8th percentile) and CISA KEV does not list active exploitation, indicating real-world opportunistic exploitation has not been widely observed.
Unauthenticated information disclosure in the Sunshine Photo Cart WordPress plugin (all versions before 3.6.12) allows any internet-connected user to retrieve image comments from private, password-protected, or otherwise access-restricted galleries by exploiting a missing authorization check on an AJAX endpoint. The flaw is classified as CWE-862 (Missing Authorization) and carries a CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N). A publicly available proof-of-concept exists via WPScan, though EPSS at 0.15% (4th percentile) and no CISA KEV listing indicate no confirmed widespread exploitation at time of analysis.
Unauthenticated arbitrary file access in the Easy Integration for Dropbox WordPress plugin before 2.2.0 lets remote attackers list, download, and upload files across the site's connected Dropbox account and harvest the connected-account and administrator email addresses. Several file-management AJAX actions are registered for logged-out users but skip authorization checks (CWE-862), turning the plugin into an open proxy to the linked cloud storage. Publicly available exploit code exists and a vendor patch is released, though EPSS estimates exploitation probability at only 0.14% (4th percentile).
PHP code injection in the Create Block Theme WordPress plugin (before 2.10.0) enables a multisite subsite administrator to execute arbitrary server-side code by exploiting insufficient output escaping when the plugin writes user-supplied text into generated PHP pattern files. The vulnerability leverages a capability boundary mismatch unique to WordPress multisite: subsite admins hold the capability gating pattern file generation but are denied the capability normally required for PHP file editing, creating an unintended privilege escalation path to full remote code execution. A public proof-of-concept is available via WPScan, though EPSS sits at 0.15% (5th percentile), indicating exploitation is currently targeted rather than widespread.
Unauthenticated remote code execution in the Improve SEO WordPress plugin (versions through 2.0.11) lets attackers upload executable PHP files by exploiting a file-upload routine that only validates MIME content type while writing files with the attacker-controlled extension into a web-accessible directory. Any visitor can drop a PHP webshell and execute arbitrary code on the server without credentials or user interaction. Publicly available exploit code exists (reported by WPScan), though the EPSS score is low (0.20%, 10th percentile) and it is not on CISA KEV.
SQL injection in the LogMyTrip WordPress plugin (≤1.9) lets unauthenticated remote attackers extract data from the underlying WordPress database by injecting malicious SQL through an unsanitized cookie value on any page rendering a plugin shortcode. A proof-of-concept is publicly available via WPScan, and the CVSS Scope:Changed rating reflects the injection crossing the application boundary into the database tier. Despite high CVSS (8.6) and a public exploit, EPSS sits at 0.19% (9th percentile) and SSVC records no observed exploitation, suggesting limited real-world targeting consistent with this plugin's niche footprint.
SQL injection in the sm page duplicator WordPress plugin (versions through 1.0.0) allows authenticated users holding the Editor role or above to execute arbitrary SQL against the WordPress database by exploiting an unsanitized stored value consumed during the page duplication workflow. A publicly available exploit exists via WPScan, though EPSS at 0.16% (5th percentile) signals limited observed exploitation activity and the vulnerability is not listed in CISA KEV. The high CVSS score of 8.1 reflects the potential for full database read and write access, tempered in practice by the requirement for a privileged authenticated account.
Account takeover in the ChamaWP WordPress plugin before 1.0.13 lets unauthenticated attackers reset the password of any user, including administrators, resulting in full site takeover. The flaw stems from improper validation of the password-reset request (CWE-862, missing authorization). Publicly available exploit code exists, though EPSS remains low (0.15%) and it is not listed in CISA KEV - no public in-the-wild exploitation confirmed at time of analysis.
Remote code execution in the Personal QR Message WordPress plugin (versions through 1.0) allows unauthenticated attackers to upload arbitrary PHP files via a handler that fails to restrict uploaded file types, and those files are directly reachable and executable on the server. Publicly available exploit code exists (published by WPScan), and the CVSS 3.1 base score is 9.8, though the EPSS probability is low at 0.22% (13th percentile). This is a classic unauthenticated file-upload-to-RCE flaw that grants full server compromise with no authentication or user interaction.
Remote code execution in the 'Insert or Embed Articulate Content into WordPress' plugin (versions up to and including 4.3000000027) allows an Editor-level user to upload a server-executable file by defeating a weak archive-content check, then have the web server run it from a public directory. Publicly available exploit code exists (WPScan), and the flaw carries a critical CVSS 9.8; however, EPSS is only 0.21% (11th percentile) and SSVC lists exploitation status as 'none', indicating no confirmed in-the-wild activity yet. The attack is fully automatable with total technical impact once an Editor account is available.
Account takeover of the primary WordPress administrator affects the Simple Membership plugin in all versions before 4.7.8. Because the registration routine never checks whether user creation actually succeeded before treating the returned value as a valid user ID, an unauthenticated attacker can trigger a failed user creation and cause the plugin to overwrite the existing admin account's data - notably the email address - then seize the account through the standard password-reset flow. A vendor patch (4.7.8) and publicly available exploit details from WPScan exist, though EPSS remains low at 0.14% (4th percentile), indicating no measured mass exploitation yet.
Authentication bypass in the SoftMarket - Digital Marketplace WordPress plugin (versions through 1.0.0) lets remote unauthenticated attackers impersonate any verified user by supplying only that user's numeric ID to a flawed branch of the email-verification flow, resulting in full account takeover. Publicly available exploit code exists (published by WPScan), and the CVSS 3.1 score of 9.1 reflects high confidentiality and integrity impact with no privileges or user interaction required. Despite the critical rating, the EPSS probability is low (0.19%, 9th percentile) and there is no evidence of active exploitation.
SQL injection in the Super Store Finder WordPress plugin (versions through 7.8) lets unauthenticated remote attackers inject arbitrary SQL via an unsanitized parameter in an AJAX action, enabling extraction of arbitrary database contents. Reported by WPScan with publicly available exploit code, the flaw carries a 9.1 CVSS and CISA SSVC rates it automatable with total technical impact, though EPSS remains low at 0.19% and it is not in CISA KEV. There is no public exploit identified as being used in active campaigns at time of analysis.
Unauthenticated remote code execution in the Webinfos WordPress plugin (versions through 1.2) lets any anonymous attacker upload arbitrary files - including PHP webshells - because the plugin's upload handler enforces no file-type validation, authentication, capability, or nonce checks. On servers that execute PHP from the uploads directory, this yields full server compromise. Publicly available exploit code exists (reported by WPScan), and while EPSS is currently low at 0.28%, the CVSS 9.8 rating and automatable, unauthenticated nature make this a high-priority patch target.
Privilege escalation in the "Import and export users and customers" WordPress plugin before 2.4.2 lets a user who holds only the user-creation capability create a full administrator account and overwrite an existing administrator's password or email via the CSV import routine. The plugin fails to re-check WordPress role-assignment and per-user edit permissions on imported rows, so a low-tier account can seize total control of the site. Publicly available exploit code exists (reported by WPScan) and a vendor patch is available; EPSS is low (0.13%), indicating limited widescale exploitation so far despite the high CVSS of 9.1.
Unauthenticated SQL injection in the Link Library WordPress plugin before 7.9.3 allows remote attackers to inject arbitrary SQL through an unsanitised, unescaped user-supplied value used directly in a database query. Publicly available exploit code exists (published by WPScan), and CISA's SSVC assessment rates the flaw as automatable with total technical impact, though the EPSS probability remains low at 0.18%. A vendor patch is available in version 7.9.3.
Unauthenticated exposure of OAuth credentials in the Gallery for Google Photos WordPress plugin (all versions before 1.2.1) allows any remote attacker to retrieve the stored Google access and refresh tokens of the connected account without authentication. Because refresh tokens are long-lived and self-renewing, a successful retrieval grants persistent, long-term access to the linked Google account well beyond any single session. A publicly available exploit exists per WPScan, though EPSS remains low (0.16%, 6th percentile), suggesting exploitation is not yet widespread.
Simply Schedule Appointments WordPress plugin before 1.6.12.6 exposes all site appointment records to unauthenticated users through a bulk operation endpoint lacking object-level authorization, enabling mass personal data (PII) disclosure across the entire WordPress installation. On premium editions, the same unauthenticated path allows permanent deletion of all appointment records, adding a destructive integrity and availability impact not reflected in the published CVSS score. A public proof-of-concept exists per WPScan, and the SSVC framework rates this as automatable with no active CISA KEV listing; EPSS at 0.19% suggests limited observed exploitation to date but does not negate the ease of scripted mass harvesting.
Unauthorized media file disclosure in the Product Attachment for WooCommerce WordPress plugin (all versions before 2.3.3) allows any unauthenticated internet user to download arbitrary WordPress media library files by enumerating sequential numeric attachment IDs. The plugin's file-streaming endpoint performs no authorization check whatsoever, exposing private or deliberately unlinked uploads - such as internal documents, confidential product specifications, or draft media - to the public. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.15% (5th percentile), indicating low observed exploitation rates at time of analysis despite easy weaponization.
Complete authentication bypass in the login-social WordPress plugin (≤1.0.4) enables unauthenticated remote attackers to reset any user's password without a valid reset key and to forge login sessions using unverified third-party identity data, giving attackers full administrator access and site takeover capability. Any WordPress site running this plugin is exposed regardless of configuration, as both failures reside in the plugin's core authentication flows. A publicly available exploit exists per WPScan; EPSS sits at 0.19% (9th percentile), suggesting exploitation is targeted rather than widespread at this time, though the public PoC lowers the technical barrier considerably.
Account takeover via unauthenticated password reset in the Lenxel WP WordPress theme (all versions through 1.0.31) allows any unauthenticated remote attacker to seize control of any WordPress account, including site administrators, by submitting a crafted reset request without owning or being authorized for the target account. The theme's reset action validates only a WordPress CSRF nonce - obtainable by any visitor loading the reset page - while performing no ownership or authorization check against the account being reset. No confirmed active exploitation (not in CISA KEV), though a public POC exists via WPScan and SSVC rates the technical impact as total; EPSS remains very low at 0.12% (2nd percentile), consistent with the niche theme footprint.
Unauthenticated administrator account creation in the POUCO Import Users WordPress plugin (versions through 1.0.0) lets remote attackers register a fully privileged admin user and take over the site. The plugin exposes AJAX actions for account creation/update without capability or nonce checks and blindly trusts an attacker-supplied role value, so any visitor can escalate to administrator. Publicly available exploit code exists (reported by WPScan), though the EPSS score is low (0.15%, 5th percentile) and it is not on the CISA KEV list.
Second-order SQL injection in Form Maker by 10Web WordPress plugin (all versions before 1.15.45) allows any subscriber-level authenticated user to execute arbitrary SQL against the WordPress database by submitting crafted input to database-backed choice fields, yielding high confidentiality and integrity impact. A publicly available proof-of-concept from WPScan lowers the exploitation barrier, and an EPSS of 16% reflects above-baseline real-world risk. No active exploitation is confirmed in CISA KEV at time of analysis, though the combination of low required privilege, network accessibility, and public exploit code makes this a credible near-term threat on unpatched installations.
Financial/business-logic bypass in the Wallet for WooCommerce WordPress plugin (all versions before 1.6.10) lets a customer credit their wallet balance for less than the amount actually paid, because the plugin credits the top-up before confirming the sum the payment gateway actually collected. Any registered store customer can effectively mint store credit at a discount, causing direct monetary loss to the merchant. Publicly available exploit code exists (WPScan); the flaw is not listed in CISA KEV, and EPSS is a moderate 13%.
Server-Side Request Forgery in the PowerPress Podcasting plugin by Blubrry for WordPress (versions before 11.17.1) allows any authenticated Contributor-level user to supply arbitrary URLs in the Podcast Episode URL settings field, causing the server to issue unvalidated HTTP requests that can reach internal network services, cloud metadata endpoints, or other systems not directly exposed to the internet. The CVSS 7.1 score reflects high confidentiality impact against reachable internal services, and a publicly available proof-of-concept combined with a 13% EPSS score makes this an actionable priority for WordPress site operators running the plugin. No active exploitation has been confirmed in CISA KEV at time of analysis.
Unauthenticated exposure of the backup authorization secret in Total Upkeep WordPress plugin (all versions before 1.17.3) enables remote attackers to both exfiltrate sensitive backup archives and trigger arbitrary full-site restores that overwrite live site files and the database. WPScan disclosed a publicly available proof-of-concept exploit, and SSVC rates the attack as automatable, creating conditions for mass exploitation campaigns. The vendor-reported CVSS score of 7.5 covers only the confidentiality dimension and substantially understates real-world risk by omitting the integrity and availability destruction possible through forced site restores.
Remote code execution in the WPMU DEV Dashboard (wpmudev-updates) WordPress plugin before 5.0.1 allows an attacker who can obtain or replay a single valid signed management request to push and execute arbitrary code on the site. The plugin's remote management interface installs packages without verifying their integrity and without replay protection, so a captured legitimate management call can be reused to install an attacker-controlled package. WPScan reports publicly available exploit code and the plugin scores CVSS 9.8; EPSS is elevated at 22%, but there is no public exploit identified as actively exploited in the wild (not in CISA KEV).
Unauthenticated arbitrary file upload in the Giftware WordPress plugin before 4.2.10 allows remote attackers to upload PHP files through an upload path that fails to validate file type (CWE-434), leading to remote code execution on the underlying web server. The flaw carries a CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N) and publicly available exploit code exists per WPScan, though it is not currently listed in CISA KEV; the EPSS score of 22% reflects meaningful but not top-tier near-term exploitation probability.
Unauthenticated export file disclosure in Import WP WordPress plugin (all versions before 2.14.23) allows any remote attacker to download administrator-generated export files without credentials. The export download handler performs no authorization check, exposing files that may contain user PII including email addresses, login names, and role assignments. A publicly available exploit exists (reported by WPScan), and EPSS sits at 16%, indicating meaningful real-world exploitation interest; exploitation is contingent on two prerequisites that meaningfully reduce actual exposure relative to the raw CVSS score.
SQL injection in the KiviCare WordPress plugin (all versions before 4.5.2) enables authenticated clinic staff users to execute arbitrary SQL against the underlying WordPress database. Unsanitized user-supplied parameters are passed directly into SQL queries, granting an attacker full read, write, and delete access to database contents including patient records and credentials. With a publicly available proof-of-concept, an EPSS of 17%, and a CVSS of 8.8, this is a high-priority patch for any healthcare-sector WordPress deployment running this plugin - though no CISA KEV-confirmed active exploitation has been identified at time of analysis.
Unauthenticated account creation in the Eventin WordPress plugin (all versions before 4.1.20) allows any remote attacker to register arbitrary email addresses as WordPress user accounts and inject order records by exploiting a missing authorization check on the waiting-list registration handler. The dual impact - rogue account creation and order record injection - can be chained with WordPress's built-in password reset flow to achieve full account takeover for any email address on the system. With a publicly available exploit and a 15% EPSS score placing this well above the median exploitation probability, this represents an elevated and realistic risk for all WordPress sites running the unpatched plugin; no CISA KEV listing is confirmed at time of analysis.
Unauthenticated remote code execution in the Product Input Fields for WooCommerce WordPress plugin before 2.0.2 arises because the plugin skips file-type validation whenever its accepted-types setting is left blank - a configuration the plugin's own documentation advertises as 'accept all files.' Attackers can upload arbitrary files, including PHP webshells, and execute them on servers whose upload directory does not enforce access restrictions. Publicly available exploit code exists (WPScan), though the EPSS score is low (0.20%, 10th percentile) and it is not listed in CISA KEV.
Privilege escalation via REST API authentication bypass in the CheckView WordPress plugin before 2.3.2 allows an unauthenticated attacker to perform any REST action available to a logged-in administrator - including creating a new administrator account - by tricking an admin into opening a crafted link. The plugin's authentication filter is applied globally to all REST routes rather than only to CheckView's own endpoints, and it unconditionally discards authentication errors for any request whose URI merely contains a CheckView-specific string, bypassing WordPress's nonce enforcement entirely. A publicly available exploit from WPScan demonstrates this path; no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Stored cross-site scripting in the Autopay WordPress plugin before 5.0.1 permits unauthenticated attackers to permanently inject arbitrary JavaScript into a site's checkout page by exploiting a missing capability check and nonce validation on a styling option endpoint. The injected payload executes in the browser of every visitor - including administrators - who loads the checkout page, enabling session hijacking, credential theft, or unauthorized admin actions. A publicly available exploit exists; EPSS is low at 0.17% (7th percentile), suggesting limited observed mass exploitation despite the public proof-of-concept.
Privilege escalation in the Vitepos WordPress point-of-sale plugin allows any user holding the custom Outlet Manager role to reset the password of any WordPress account - including site administrators - and achieve full account takeover. The flaw stems from a missing per-target authorization check in the password-reset API endpoint, combined with the plugin granting the Outlet Manager role overly broad reset capabilities by default. A publicly available proof-of-concept exists per WPScan, though EPSS remains low (0.13%, 3rd percentile), suggesting exploitation has not yet been observed at scale.
Unauthenticated booking record disclosure in the Salon Booking System WordPress plugin (through version 10.30.33) exposes other customers' personal information via sequential identifier enumeration. The booking-wizard confirmation flow loads booking records using a numeric booking ID without properly verifying that the requestor holds the associated ownership token, enabling any unauthenticated remote attacker to iterate through IDs and retrieve arbitrary bookings. A publicly available exploit exists per WPScan, and the vulnerability is trivially automatable, making mass customer PII harvesting a realistic outcome.
SQL injection in the ProSolution WP Client WordPress plugin (all versions before 2.0.6) lets remote attackers inject SQL through an unsanitized, unescaped parameter that is reachable without authentication, enabling blind extraction of database contents such as user credentials and secrets. Reported by WPScan, it carries a CVSS of 9.1 and has publicly available exploit code, though its EPSS probability is low (0.16%, 6th percentile) and it is not listed in CISA KEV. Exploitation status: publicly available exploit code exists.
Unauthenticated SQL injection in the ProSolution WP Client WordPress plugin (all versions before 2.0.9) exposes arbitrary WordPress database contents to any remote attacker and permits deletion of plugin-managed records without any login or capability check. The plugin blindly embeds an unsanitized cookie value into SQL queries and executes this logic on every HTTP request site-wide, meaning any page load against a vulnerable site is a valid attack surface. A publicly available exploit exists via WPScan; no confirmed active exploitation in CISA KEV, and EPSS sits at 0.21% (11th percentile), suggesting opportunistic rather than widespread automated attack activity at time of analysis.
File enumeration and unauthorized download is possible in the Contact Form to Any API WordPress plugin (all versions before 3.0.7) because uploaded contact form attachments are stored in a publicly accessible directory using predictable, non-random filenames. Unauthenticated remote attackers can discover the upload path by submitting a form themselves, then systematically enumerate filenames to retrieve files - potentially containing PII, identity documents, or sensitive business attachments - submitted by other users. A publicly available proof-of-concept exists, and a vendor patch (3.0.7) has been released.
Remote code execution in the Squeeze WordPress plugin (versions prior to 1.7.12) is achievable by any authenticated user holding the upload_files capability - granted by default to the Author role and above. The plugin's attachment-update action writes per-size image data to the uploads directory without validating file type or extension, permitting a PHP webshell to be placed in a web-accessible path and directly invoked via HTTP. A publicly available proof-of-concept exists per WPScan; no public exploit identified at time of analysis in CISA KEV, and EPSS is low at 0.19% (9th percentile), suggesting limited observed in-the-wild exploitation despite the public PoC.
Unauthenticated access to saved form draft data in the HT Contact Form WordPress plugin (versions before 2.9.3) exposes personally identifiable information - including names, email addresses, phone numbers, and physical addresses - to any remote attacker without credentials. The plugin's draft-retrieval endpoint performs no authorization check, meaning any unauthenticated HTTP request can enumerate or retrieve stored draft submissions. A publicly available exploit exists, though EPSS remains low at 0.16%, suggesting limited widespread automated scanning to date but real feasibility for targeted data harvesting against sites using this plugin.
Authentication bypass in the AutoNetTV Relay WordPress plugin (all versions before 3.0.14) allows unauthenticated remote attackers to obtain a WordPress administrator session cookie by triggering the plugin's scheduled content-synchronization task under a specific server configuration. The plugin issues an admin authentication cookie during the sync task without performing any capability or authorization check, and on servers where the scheduled task completes before the HTTP response is committed, the cookie is returned to the triggering request. A public proof-of-concept exploit exists, reported by WPScan; no KEV listing has been identified at time of analysis.
Local file inclusion in the Eventin WordPress plugin (all versions before 4.1.20) allows authenticated users holding editor-level or higher WordPress roles to supply an arbitrary local filesystem path as a template setting, causing the plugin to include and execute any reachable PHP file on the server. Full confidentiality, integrity, and availability impact is achievable on a successful exploitation. A publicly available proof-of-concept from WPScan exists, though the CVE carries no CISA KEV listing and an EPSS of only 0.16%, indicating no confirmed widespread active exploitation campaigns at time of analysis.
Unauthenticated email enumeration in the Login & Register Forms WordPress plugin (versions 3.0.0 through 4.0.1) exposes all registered user email addresses, including administrator accounts, via a flawed password reset mechanism. The plugin neither verifies that a reset request originates from the account owner nor adequately redacts email addresses in its HTTP response, allowing any unauthenticated attacker to harvest a site's full user roster through repeated requests. A publicly available proof-of-concept exploit exists, though EPSS remains low at 0.16%, indicating limited observed exploitation at time of analysis despite the trivial attack complexity.
Account takeover via broken password-reset rate limiting in the Login & Register Forms WordPress plugin (versions before 4.0.2) allows unauthenticated remote attackers to brute-force verification codes and seize any account, including administrator accounts. Both the verification code and the per-source attempt counter are keyed on client-controlled data, meaning an attacker can reset the rate limit at will by manipulating that value - rendering the lockout mechanism entirely ineffective. Exploitation requires the 'verification-code reset mode' to be enabled; a publicly available proof-of-concept from WPScan demonstrates the technique, though EPSS sits at only 0.15% (4th percentile), indicating limited observed exploitation activity to date.
Account takeover in the Login & Register Forms WordPress plugin (before 4.0.2) is enabled by a fundamentally broken password reset verification design: the plugin keys the 'verification completed' state to a client-controlled value rather than binding it server-side to the account under reset or to the authenticated session of the party completing verification. An unauthenticated attacker who can observe or manipulate this state during or after a legitimate reset flow can claim ownership of that completed verification and set a new password for any targeted account, including administrator accounts. A publicly available exploit has been published by WPScan, and no public exploit identified at time of analysis translates to KEV, though POC availability materially lowers the exploitation threshold.
Password reset abuse in the Single Sign On For TNG WordPress plugin (versions before 2.2.0) allows unauthenticated attackers to reset the password of any account, including administrators, resulting in full site takeover. The flaw stems from improper validation of the password reset request, and publicly available exploit code exists, though EPSS scores the exploitation probability at a low 0.15% (4th percentile). It is not listed in CISA KEV, so exploitation is currently proof-of-concept rather than confirmed active in-the-wild use.
Unauthenticated account takeover in the FoodBoxBooker WordPress plugin (versions before 1.0.7) lets remote attackers reset the password of any user - administrators included - because the plugin fails to properly validate password-reset requests. Successful exploitation yields full administrative control and effective site takeover. Publicly available exploit code exists; the flaw is not listed in CISA KEV and EPSS is low (0.15%, 4th percentile), indicating no confirmed mass exploitation yet.
Unauthenticated content injection in Arvow AI SEO Writer WordPress plugin (before 1.5.4) allows remote attackers to create arbitrary posts and pages and extract author account and taxonomy information by exploiting a PHP type juggling flaw in a REST endpoint. The bypass is effective exclusively when the plugin has not been configured post-installation, making freshly deployed or abandoned instances the primary target. A public proof-of-concept is available via WPScan; despite this, EPSS sits at 0.15% (5th percentile) and no CISA KEV listing exists, indicating no public exploit has driven mass exploitation at time of analysis.
Account takeover in the BricksForge WordPress plugin (versions before 3.1.8.8) is enabled by a missing server-side identity check during password change form submissions, allowing unauthenticated remote attackers to set arbitrary passwords for any WordPress user, including site administrators. The vulnerable state is effectively the default configuration for any site that has deployed BricksForge's password update form action, since current-password verification is disabled by default in that action. A publicly available exploit exists; active exploitation has not been confirmed by CISA KEV, but the direct path to admin-level account takeover makes this a critical remediation priority for affected deployments.
Missing capability checks in the File Manager WordPress plugin before version 6.9.1 expose the entire WordPress installation directory to any authenticated user, including low-privilege subscribers. Exploitation allows traversal of server-side directories and download of sensitive file types such as archives and documents, which frequently contain database credentials, configuration backups, and private documents. A publicly available exploit exists per WPScan, though EPSS remains low at 0.15% (5th percentile), suggesting opportunistic rather than widespread automated exploitation at this time; no CISA KEV listing is present.
Unauthenticated information disclosure in the File Manager WordPress plugin before 6.9.1 exposes a REST API route without any authorization controls, allowing any remote user to retrieve the plugin's complete file activity log. The leaked log reveals filesystem paths within the WordPress installation and the usernames of administrators who performed file operations, providing reconnaissance data useful for chaining further attacks. A publicly available proof-of-concept exploit exists per WPScan's disclosure, though EPSS at 0.16% (5th percentile) indicates limited observed exploitation activity; the vulnerability is not listed in CISA KEV.
Missing authorization controls in the File Manager WordPress plugin before version 6.9.1 allow any authenticated user - including low-privilege subscribers - to read and delete arbitrary files under the WordPress installation directory. The weakness exposes sensitive configuration secrets such as database credentials stored in wp-config.php, and enables deliberate denial of service through file deletion. A publicly available exploit exists per WPScan reporting, though EPSS remains very low (0.14%, 4th percentile), suggesting targeted rather than broadly automated exploitation at time of analysis.
Privilege escalation in the Solace Extra WordPress plugin (versions before 1.6.1) allows any authenticated user with Subscriber-level access to modify site-wide presentation settings and permanently delete imported site-builder content by exploiting missing capability checks across multiple AJAX endpoints. The plugin incorrectly exposes nonce values on admin-accessible pages that low-privileged users can reach, collapsing the intended authorization boundary between Subscriber and Administrator roles. A publicly available proof-of-concept exists via WPScan; no public exploit identified at time of analysis has been confirmed by CISA KEV, and the EPSS score of 0.13% (3rd percentile) reflects low observed exploitation probability to date.
WP Directory Kit versions before 1.5.5 expose the plugin's full settings - including sensitive API keys and third-party secrets - to any authenticated WordPress user, including low-privileged Subscribers, due to missing authorization and nonce validation on an AJAX endpoint. A vendor-released patch (version 1.5.5) is available, and a publicly available proof-of-concept exploit has been published by WPScan. Despite POC availability, EPSS sits at 0.14% (4th percentile), suggesting limited opportunistic exploitation at this time though the technical barrier to abuse is very low.
SQL injection via an unsecured AJAX endpoint in WP Directory Kit (WordPress plugin) before 1.5.5 allows any authenticated WordPress user - including low-privilege Subscribers - to query the underlying database and exfiltrate sensitive data. The AJAX action omits both authorization and nonce checks, collapsing what should be a privileged operation to the lowest authenticated tier. A public proof-of-concept exists per WPScan, though EPSS at 0.16% (6th percentile) indicates no widespread automated exploitation at time of analysis; this is not listed in CISA KEV.
Unauthenticated user enumeration in the Admin Safety Guard WordPress plugin (versions before 1.4.0) exposes the full registered user list - including usernames, email addresses, assigned roles, and two-factor authentication enrollment status - to any unauthenticated HTTP caller via an unprotected REST API endpoint. The irony is significant: a plugin marketed specifically for login security and brute-force protection inadvertently facilitates credential-stuffing and targeted attack preparation by leaking the exact user data attackers need. A publicly available proof-of-concept exploit exists, though EPSS sits at only 0.18% and CISA has not added this to the Known Exploited Vulnerabilities catalog.
PHP object injection in the Newsletters WordPress plugin (all versions before 4.16) permits unauthenticated remote attackers to supply arbitrary serialized PHP objects through a public-facing form, bypassing class restrictions entirely. If a suitable PHP gadget chain is present in the WordPress environment - commonly introduced by co-installed plugins or PHP libraries - this can escalate to remote code execution, data exfiltration, or full site compromise. A publicly available exploit has been confirmed by WPScan; however, EPSS stands at 0.16% (5th percentile), indicating limited observed mass exploitation at time of analysis despite the public PoC.
Local file inclusion via path traversal in WP Maps WordPress plugin (before 4.9.7) allows any authenticated Subscriber-level user to include and execute arbitrary existing PHP files on the server, resulting in full compromise of confidentiality, integrity, and availability. The root cause is a missing capability check on an AJAX action combined with unvalidated user-controlled path input - two compounding weaknesses that collectively drop the privilege bar to the lowest registered-user tier. A publicly available proof-of-concept exists (via WPScan), though EPSS sits at 0.30% (23rd percentile), indicating low observed exploitation activity at time of analysis despite the public POC.
Login CSRF in the Estatik Real Estate Plugin for WordPress (before 4.3.3) enables an unauthenticated attacker to hijack a victim's session by tricking them into completing an OAuth social login flow bound to an attacker-controlled account. Once the victim is logged in as the attacker, all subsequent activity - property searches, saved listings, contact forms, personal profile data - is captured and readable by the attacker. A publicly available proof-of-concept exists per WPScan, and SSVC classifies this as automatable with partial technical impact, though EPSS remains very low (0.10th percentile), suggesting limited observed exploitation to date.
PHP Object Injection in the Ajax Search Lite WordPress plugin before 4.14.5 lets unauthenticated remote attackers pass untrusted serialized data into a PHP unserialize() sink, and where a suitable POP gadget chain exists in a co-installed plugin or theme, this escalates to remote code execution. Reported by WPScan with publicly available exploit code, it carries a CVSS 9.8 rating but a low EPSS of 0.22% (13th percentile), and is not listed in CISA KEV. A vendor patch is available in version 4.14.5.
Integrity bypass in MStore API WordPress plugin (versions before 4.21.0) enables unauthenticated remote attackers to create fraudulent WooCommerce product reviews with arbitrary reviewer names, email addresses, and star ratings, completely circumventing the store's verified-purchase-only review restriction. The plugin's REST API review creation route applies neither authorization nor purchase-ownership validation, rendering the WooCommerce protection setting ineffective when the plugin is active. A publicly available proof-of-concept exists and SSVC confirms the attack is automatable, though the EPSS exploitation probability sits at just 0.14% (3rd percentile), suggesting limited real-world exploitation activity despite ease of execution.
Authentication bypass in the MStore API WordPress plugin before 4.21.0 lets an unauthenticated remote attacker mark any order as fully paid without processing a real payment, because several payment-completion endpoints trust the client-supplied completion signal instead of verifying it against the payment gateway. Any store using this plugin can be defrauded of goods, services, or digital downloads. A public exploit exists (WPScan) and a vendor patch is available, though EPSS remains low at 0.14%.
Account takeover in MStore API WordPress plugin before 4.21.0 is achievable by unauthenticated remote attackers who know a target's registered phone number, by forging a cryptographically invalid login token that the plugin fails to properly verify. This yields full control over the targeted account, including administrator-level WordPress accounts. A publicly available proof-of-concept exists; however, no CISA KEV listing is present and EPSS at 0.14% (3rd percentile) indicates low observed exploitation to date, likely constrained by the phone-number reconnaissance prerequisite.
SQL injection in the Content Views WordPress plugin before 4.5 exposes the underlying WordPress database to any authenticated user, including low-privilege Subscribers. Two compounding weaknesses drive this: a missing capability check on an AJAX action allows unprivileged users to reach a sensitive endpoint, and unsanitized attacker-controlled input is then passed directly into a raw SQL query. A publicly available POC exists via WPScan, and SSVC rates the technical impact as total, though EPSS remains low at 0.16%, suggesting no widespread automated exploitation at time of analysis.
Remote code execution in Subscriptions for WooCommerce WordPress plugin (before 2.0.1) is reachable by any authenticated Shop Manager through a missing capability check on a nonce-protected AJAX action that installs and activates arbitrary plugins from user-supplied slugs. Shop Managers, who by WordPress design are not granted plugin management capabilities, can exploit this gap to install a malicious plugin and achieve full server-side code execution. A publicly available proof-of-concept exists; however, EPSS is low (0.18%, 8th percentile) and the vulnerability is absent from CISA KEV, indicating exploitation remains opportunistic rather than widespread.
Unauthenticated REST API bypass in the 'Password Protected - Lock Entire Site' WordPress plugin (versions 2.6.8 through 2.8.3) exposes all password-gated content and account identifiers to unauthenticated visitors when the plugin's REST API restriction option is enabled. This is a confirmed regression of CVE-2024-0437, which was originally patched in version 2.6.7 but silently reintroduced in the very next release (2.6.8), leaving sites unprotected for any version in that range. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.15% (4th percentile), indicating limited observed exploitation at time of analysis.
Payment bypass in the WP Events Manager WordPress plugin before 2.2.5 lets any authenticated user register for a paid event and receive a fully completed booking without paying, because the plugin trusts an attacker-controlled quantity value and derives the charge from it. WPScan reports publicly available exploit code exists, though there is no evidence of active exploitation and the EPSS score is very low (0.13%, 3rd percentile). The flaw is a business-logic/authorization defect rather than a memory-safety issue, so impact is financial fraud against event organizers rather than server compromise.
Unauthenticated SQL injection in the Creative Mail WordPress plugin (versions 1.6.5-1.6.9) allows remote attackers to read the entire WordPress database without credentials. The vulnerability resides in an unsanitized parameter processed during abandoned cart email handling - a core feature of the plugin - making it exploitable against any site where the plugin is installed and that feature is active. A publicly available proof-of-concept exists via WPScan, raising the practical exploitation risk significantly beyond what CVSS base score alone conveys.
Unauthenticated information disclosure in the Gutenberg Essential Blocks WordPress plugin before 6.4.0 exposes published content from custom post types that site administrators deliberately registered as non-public. The plugin's public REST API route queries arbitrary post types supplied by the caller without first verifying their visibility setting, bypassing the access control intent of the post type registration. A publicly available proof-of-concept exists; EPSS sits at 0.14% (4th percentile) suggesting exploitation remains rare despite automatable conditions, and the vulnerability is not currently listed in the CISA KEV catalog.
Unauthenticated information disclosure in Gutenberg Essential Blocks for WordPress (versions before 6.4.0) exposes WooCommerce per-product lifetime sales unit counts to any internet user via an unrestricted public REST API route. The plugin over-fetches a non-public WooCommerce metric and surfaces it in the REST response without access control enforcement, meaning competitors, scrapers, or threat actors can query sales volumes for any published product on affected stores. A publicly available proof-of-concept exploit exists per WPScan, and SSVC assessment confirms the attack is automatable; however, EPSS sits at just 0.14% (4th percentile), indicating limited observed exploitation at time of analysis.
SQL injection in the WPCargo Track & Trace WordPress plugin before version 8.0.4 allows unauthenticated attackers to inject arbitrary SQL through an improperly sanitised parameter, exposing the WordPress database. Reported by WPScan with publicly available exploit code, this flaw is notable for affecting a code path distinct from the previously patched CVE-2024-44004, indicating an incomplete prior fix. Despite a CVSS 9.1 and public POC, the EPSS score is low (0.18%, 7th percentile) and the CVE is not on CISA KEV, so there is no public exploit identified as actively exploited in the wild.
Unauthenticated license-key erasure and premium deactivation is possible in the Checkimate WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through version 1.0.13. The plugin's license-management endpoint relies on a shared secret computed exclusively from publicly available site information - an authentication bypass that renders the access control trivially circumventable. Any remote attacker who can reach the WordPress site can permanently erase the stored license key and strip the installation of its paid premium status; a public proof-of-concept exists (reported by WPScan), though EPSS remains low at 0.14%, indicating opportunistic rather than widespread exploitation at time of analysis.
Events Manager WordPress plugin before version 7.4 exposes an unauthenticated REST API endpoint that serves temporarily stored file uploads without any authorization check, enabling an attacker who has obtained a victim's high-entropy temporary upload identifier to retrieve that user's in-progress file submission. Classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), the flaw represents a missing permission_callback on a WordPress REST route - effectively an IDOR variant against ephemeral upload objects. A public POC is available via WPScan; no CISA KEV listing exists, and the EPSS score of 0.14% (4th percentile) reflects the practical constraint imposed by identifier acquisition being the dominant bottleneck.
Payment amount manipulation in Stripe Payment Forms by WP Full Pay (WordPress plugin) before version 8.5.2 allows any unauthenticated visitor to arbitrarily lower - or potentially zero-out - the price of a Stripe payment intent before checkout completes. The flaw stems from an incomplete authorization fix in 8.5.0 that patched only one of the two vulnerable AJAX handlers, leaving the pricing-recalculation and payment-intent-update endpoints exposed. A publicly available proof-of-concept exists, and SSVC analysis confirms the vulnerability is automatable, raising the practical risk above what the low EPSS score (0.13%, 3rd percentile) alone would suggest.
Server-Side Request Forgery (SSRF) in the Newsletters WordPress plugin before 4.16 allows unauthenticated remote attackers to force the hosting server to issue HTTP requests to arbitrary internal or external URLs via the unauthenticated bounce-processing endpoint. A publicly available proof-of-concept exists per WPScan reporting. Despite the high CVSS score of 8.2, EPSS is very low at 0.14% (3rd percentile), and SSVC rates it non-automatable with only partial technical impact, suggesting opportunistic rather than mass exploitation at this time.
Unauthenticated arbitrary file deletion in the Drag and Drop Multiple File Upload for WooCommerce WordPress plugin (all versions before 1.1.8) lets anonymous attackers destroy customer order attachments staged in the plugin's upload directory. The plugin's only access control on its deletion routine is a nonce, but that nonce can be freely obtained by unauthenticated visitors, defeating the check entirely. Publicly available exploit code exists and a vendor patch has been released; EPSS is low (0.14%) and the issue is not in CISA KEV.
Contest Gallery WordPress plugin before version 30.0.7 implements a custom front-end login mechanism that issues authentication cookies directly after password validation, entirely bypassing WordPress's standard authentication pipeline. This architectural shortcut renders all brute-force protection plugins and two-factor authentication plugins completely ineffective, allowing unlimited, unthrottled password guessing against any WordPress account - including administrators - up to full account takeover. A publicly available proof-of-concept exists per WPScan reporting, though CISA has not listed this in KEV and SSVC indicates no confirmed active exploitation at time of analysis.
Account takeover in the miniOrange 2FA WordPress plugin before 6.2.7 is enabled when an attacker already possesses a target user's password - the plugin fails to bind a newly configured second factor to the target account's existing registered factor during the pre-login two-factor challenge, allowing the attacker to redirect 2FA enrollment to an attacker-controlled device, complete the challenge, and authenticate as the victim including as site administrators. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.14% (4th percentile), indicating exploitation has not yet become widespread. Critically, the published CVSS vector (C:N/I:N/A:H) severely misrepresents the actual impact - this is a full account-takeover flaw with high confidentiality and integrity consequences, not a denial-of-service; analysts should not use the published vector for risk calibration.
Two-factor authentication bypass in the WP 2FA WordPress plugin before 4.1.0 allows an attacker who possesses a valid user password to completely skip the second authentication factor and gain full account access, including administrator-level accounts. The plugin presents the 2FA challenge but fails to server-side validate the submitted factor for any of its supported methods, rendering 2FA protections entirely ineffective. A publicly available exploit exists (sourced from WPScan), though EPSS sits at 0.19% (9th percentile), indicating limited observed exploitation activity at time of analysis despite the public proof-of-concept.
SQL injection in the Ajax Load More WordPress plugin before 8.0.1 lets unauthenticated attackers inject into an unsanitised parameter used in a database query, enabling time-based blind extraction of sensitive data such as user credentials and secrets. Reported by WPScan with publicly available exploit detail and a vendor patch in 8.0.1; scored CVSS 9.1 with an unauthenticated network vector. EPSS is low (0.19%, 9th percentile), indicating limited observed exploitation despite the critical rating.
Account takeover in the WordPress plugin "OTP Login With Phone Number, OTP Verification" before 1.8.71 stems from missing rate-limiting and non-invalidation of one-time login codes, letting an unauthenticated attacker request a login OTP for any account and brute-force the short numeric code to seize control of any user, including administrators. CVSS 9.1 (AV:N/AC:L/PR:N/UI:N) reflects trivial network exploitation with high confidentiality and integrity impact. Publicly available exploit code exists (reported by WPScan), though EPSS is low at 0.15% (4th percentile) and it is not in CISA KEV, so there is no public exploit identified as actively exploited in the wild.
Missing capability checks across multiple REST API routes in the YayPricing WordPress plugin (all versions before 3.5.7) allow any subscriber-level authenticated user to overwrite a WooCommerce store's complete pricing configuration and extract private coupon codes. The plugin incorrectly relies on a shared nonce as its sole authorization gate rather than WordPress capability checks, a fundamental access control failure classified under CWE-284. A publicly available exploit exists per WPScan (EUVD-2026-53116), though EPSS sits at 0.14% (4th percentile), indicating low automated exploitation activity; CISA KEV listing is absent, so active exploitation in the wild is not confirmed.
Remote code execution in the zportals WordPress plugin (all versions before 6.3.4) is achievable by any authenticated user holding a Subscriber role or above, exploiting a server-side file upload validation failure that trusts the client-supplied Content-Type header and preserves the original file extension. By uploading a PHP webshell disguised with a benign MIME type, an attacker can plant executable server-side code and gain full control of the WordPress application layer. A publicly available proof-of-concept exploit exists; no confirmed active exploitation (CISA KEV) has been observed, but the low authentication barrier makes this a genuine risk for sites with open registration.
Arbitrary file deletion in the Custom Fields WordPress plugin before 1.5.1 allows unauthenticated attackers to delete any file on the server - including wp-config.php - leading to full site takeover. Because the plugin fails to validate a user-supplied path before deletion, a remote attacker needs no authentication or user interaction (CVSS 10.0). Publicly available exploit code exists via WPScan, though EPSS is low (0.17%) and the flaw is not listed in CISA KEV.
Registration enforcement bypass in the User Registration & Membership WordPress plugin (all versions before 5.2.6) allows unauthenticated users to create accounts on sites where the administrator has explicitly disabled open registration. The plugin processes registration form submissions without validating the site-level registration-disabled setting, effectively nullifying an administrative security control. A publicly available exploit exists per WPScan, though EPSS sits at a low 0.15% (4th percentile), indicating limited observed exploitation despite the accessible POC.
Broken object-level authorization in the MultiVendorX WordPress plugin before 5.0.11 allows any authenticated vendor (Store Owner role or above) to perform unauthorized cross-tenant operations against other vendors' stores via the REST API. The plugin fails to verify that the target store in a REST API request belongs to the authenticated vendor, enabling confidentiality breaches, store takeovers, permanent deletion, and arbitrary modification of competitor or co-platform stores. A publicly available exploit exists; EPSS probability is low (0.14%, 4th percentile) suggesting opportunistic or targeted exploitation rather than mass scanning, and this CVE is not currently listed in the CISA KEV catalog.
Password-protected block content in the Passster WordPress plugin (all versions before 4.3.6) is rendered into the public HTTP response body before the server evaluates the password check, making the gate purely cosmetic. Unauthenticated remote users can retrieve protected content by inspecting the raw response - no password required. A public proof-of-concept exploit is available via WPScan, and the CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N) confirms trivial remote exploitation with full confidentiality impact, though EPSS at 0.16% (5th percentile) and no CISA KEV listing indicate exploitation has not yet become widespread or automated.
Category-locked content in the Passster WordPress plugin (all versions before 4.3.6) is fully exposed through the native WordPress REST API, bypassing the plugin's access controls entirely. Unauthenticated remote users can retrieve the title, full body, and excerpt of any post that site owners intended to restrict using Passster's category-based protection. A publicly available exploit exists per WPScan; no CISA KEV listing and a low EPSS of 0.16% (5th percentile) indicate limited observed in-the-wild exploitation so far, but the trivial exploitation conditions make this an immediate upgrade priority for any site relying on Passster to gate sensitive content.
Unauthenticated content disclosure in the Passster WordPress plugin (versions before 4.3.6) allows any remote user to retrieve the full content of draft, private, and pending posts via a REST API endpoint that skips post-status validation. The flaw is conditional on the target site having a captcha provider configured, which is the typical deployment mode for Passster installations. Publicly available exploit code exists per WPScan reporting, though EPSS sits at only 0.16% (5th percentile), suggesting exploitation remains targeted rather than widespread. No CISA KEV listing has been issued.
Stored Cross-Site Scripting in the Bit Form WordPress plugin before 3.2.0 enables unauthenticated attackers to upload crafted SVG files containing embedded JavaScript as signature images, which execute in a victim's browser upon viewing the submission. Any authenticated user - most critically a WordPress administrator - who reviews form submissions containing the malicious SVG is at risk of session hijacking or unauthorized administrative action. A public proof-of-concept is available per WPScan; however, EPSS stands at 0.18% (8th percentile) and CISA KEV does not list active exploitation, indicating real-world opportunistic exploitation has not been widely observed.
Unauthenticated information disclosure in the Sunshine Photo Cart WordPress plugin (all versions before 3.6.12) allows any internet-connected user to retrieve image comments from private, password-protected, or otherwise access-restricted galleries by exploiting a missing authorization check on an AJAX endpoint. The flaw is classified as CWE-862 (Missing Authorization) and carries a CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N). A publicly available proof-of-concept exists via WPScan, though EPSS at 0.15% (4th percentile) and no CISA KEV listing indicate no confirmed widespread exploitation at time of analysis.
Unauthenticated arbitrary file access in the Easy Integration for Dropbox WordPress plugin before 2.2.0 lets remote attackers list, download, and upload files across the site's connected Dropbox account and harvest the connected-account and administrator email addresses. Several file-management AJAX actions are registered for logged-out users but skip authorization checks (CWE-862), turning the plugin into an open proxy to the linked cloud storage. Publicly available exploit code exists and a vendor patch is released, though EPSS estimates exploitation probability at only 0.14% (4th percentile).
PHP code injection in the Create Block Theme WordPress plugin (before 2.10.0) enables a multisite subsite administrator to execute arbitrary server-side code by exploiting insufficient output escaping when the plugin writes user-supplied text into generated PHP pattern files. The vulnerability leverages a capability boundary mismatch unique to WordPress multisite: subsite admins hold the capability gating pattern file generation but are denied the capability normally required for PHP file editing, creating an unintended privilege escalation path to full remote code execution. A public proof-of-concept is available via WPScan, though EPSS sits at 0.15% (5th percentile), indicating exploitation is currently targeted rather than widespread.
Unauthenticated remote code execution in the Improve SEO WordPress plugin (versions through 2.0.11) lets attackers upload executable PHP files by exploiting a file-upload routine that only validates MIME content type while writing files with the attacker-controlled extension into a web-accessible directory. Any visitor can drop a PHP webshell and execute arbitrary code on the server without credentials or user interaction. Publicly available exploit code exists (reported by WPScan), though the EPSS score is low (0.20%, 10th percentile) and it is not on CISA KEV.
SQL injection in the LogMyTrip WordPress plugin (≤1.9) lets unauthenticated remote attackers extract data from the underlying WordPress database by injecting malicious SQL through an unsanitized cookie value on any page rendering a plugin shortcode. A proof-of-concept is publicly available via WPScan, and the CVSS Scope:Changed rating reflects the injection crossing the application boundary into the database tier. Despite high CVSS (8.6) and a public exploit, EPSS sits at 0.19% (9th percentile) and SSVC records no observed exploitation, suggesting limited real-world targeting consistent with this plugin's niche footprint.
SQL injection in the sm page duplicator WordPress plugin (versions through 1.0.0) allows authenticated users holding the Editor role or above to execute arbitrary SQL against the WordPress database by exploiting an unsanitized stored value consumed during the page duplication workflow. A publicly available exploit exists via WPScan, though EPSS at 0.16% (5th percentile) signals limited observed exploitation activity and the vulnerability is not listed in CISA KEV. The high CVSS score of 8.1 reflects the potential for full database read and write access, tempered in practice by the requirement for a privileged authenticated account.
Account takeover in the ChamaWP WordPress plugin before 1.0.13 lets unauthenticated attackers reset the password of any user, including administrators, resulting in full site takeover. The flaw stems from improper validation of the password-reset request (CWE-862, missing authorization). Publicly available exploit code exists, though EPSS remains low (0.15%) and it is not listed in CISA KEV - no public in-the-wild exploitation confirmed at time of analysis.
Remote code execution in the Personal QR Message WordPress plugin (versions through 1.0) allows unauthenticated attackers to upload arbitrary PHP files via a handler that fails to restrict uploaded file types, and those files are directly reachable and executable on the server. Publicly available exploit code exists (published by WPScan), and the CVSS 3.1 base score is 9.8, though the EPSS probability is low at 0.22% (13th percentile). This is a classic unauthenticated file-upload-to-RCE flaw that grants full server compromise with no authentication or user interaction.
Remote code execution in the 'Insert or Embed Articulate Content into WordPress' plugin (versions up to and including 4.3000000027) allows an Editor-level user to upload a server-executable file by defeating a weak archive-content check, then have the web server run it from a public directory. Publicly available exploit code exists (WPScan), and the flaw carries a critical CVSS 9.8; however, EPSS is only 0.21% (11th percentile) and SSVC lists exploitation status as 'none', indicating no confirmed in-the-wild activity yet. The attack is fully automatable with total technical impact once an Editor account is available.
Account takeover of the primary WordPress administrator affects the Simple Membership plugin in all versions before 4.7.8. Because the registration routine never checks whether user creation actually succeeded before treating the returned value as a valid user ID, an unauthenticated attacker can trigger a failed user creation and cause the plugin to overwrite the existing admin account's data - notably the email address - then seize the account through the standard password-reset flow. A vendor patch (4.7.8) and publicly available exploit details from WPScan exist, though EPSS remains low at 0.14% (4th percentile), indicating no measured mass exploitation yet.
Authentication bypass in the SoftMarket - Digital Marketplace WordPress plugin (versions through 1.0.0) lets remote unauthenticated attackers impersonate any verified user by supplying only that user's numeric ID to a flawed branch of the email-verification flow, resulting in full account takeover. Publicly available exploit code exists (published by WPScan), and the CVSS 3.1 score of 9.1 reflects high confidentiality and integrity impact with no privileges or user interaction required. Despite the critical rating, the EPSS probability is low (0.19%, 9th percentile) and there is no evidence of active exploitation.
SQL injection in the Super Store Finder WordPress plugin (versions through 7.8) lets unauthenticated remote attackers inject arbitrary SQL via an unsanitized parameter in an AJAX action, enabling extraction of arbitrary database contents. Reported by WPScan with publicly available exploit code, the flaw carries a 9.1 CVSS and CISA SSVC rates it automatable with total technical impact, though EPSS remains low at 0.19% and it is not in CISA KEV. There is no public exploit identified as being used in active campaigns at time of analysis.
Unauthenticated remote code execution in the Webinfos WordPress plugin (versions through 1.2) lets any anonymous attacker upload arbitrary files - including PHP webshells - because the plugin's upload handler enforces no file-type validation, authentication, capability, or nonce checks. On servers that execute PHP from the uploads directory, this yields full server compromise. Publicly available exploit code exists (reported by WPScan), and while EPSS is currently low at 0.28%, the CVSS 9.8 rating and automatable, unauthenticated nature make this a high-priority patch target.
Privilege escalation in the "Import and export users and customers" WordPress plugin before 2.4.2 lets a user who holds only the user-creation capability create a full administrator account and overwrite an existing administrator's password or email via the CSV import routine. The plugin fails to re-check WordPress role-assignment and per-user edit permissions on imported rows, so a low-tier account can seize total control of the site. Publicly available exploit code exists (reported by WPScan) and a vendor patch is available; EPSS is low (0.13%), indicating limited widescale exploitation so far despite the high CVSS of 9.1.
Unauthenticated SQL injection in the Link Library WordPress plugin before 7.9.3 allows remote attackers to inject arbitrary SQL through an unsanitised, unescaped user-supplied value used directly in a database query. Publicly available exploit code exists (published by WPScan), and CISA's SSVC assessment rates the flaw as automatable with total technical impact, though the EPSS probability remains low at 0.18%. A vendor patch is available in version 7.9.3.
Unauthenticated exposure of OAuth credentials in the Gallery for Google Photos WordPress plugin (all versions before 1.2.1) allows any remote attacker to retrieve the stored Google access and refresh tokens of the connected account without authentication. Because refresh tokens are long-lived and self-renewing, a successful retrieval grants persistent, long-term access to the linked Google account well beyond any single session. A publicly available exploit exists per WPScan, though EPSS remains low (0.16%, 6th percentile), suggesting exploitation is not yet widespread.
Simply Schedule Appointments WordPress plugin before 1.6.12.6 exposes all site appointment records to unauthenticated users through a bulk operation endpoint lacking object-level authorization, enabling mass personal data (PII) disclosure across the entire WordPress installation. On premium editions, the same unauthenticated path allows permanent deletion of all appointment records, adding a destructive integrity and availability impact not reflected in the published CVSS score. A public proof-of-concept exists per WPScan, and the SSVC framework rates this as automatable with no active CISA KEV listing; EPSS at 0.19% suggests limited observed exploitation to date but does not negate the ease of scripted mass harvesting.
Unauthorized media file disclosure in the Product Attachment for WooCommerce WordPress plugin (all versions before 2.3.3) allows any unauthenticated internet user to download arbitrary WordPress media library files by enumerating sequential numeric attachment IDs. The plugin's file-streaming endpoint performs no authorization check whatsoever, exposing private or deliberately unlinked uploads - such as internal documents, confidential product specifications, or draft media - to the public. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.15% (5th percentile), indicating low observed exploitation rates at time of analysis despite easy weaponization.
Complete authentication bypass in the login-social WordPress plugin (≤1.0.4) enables unauthenticated remote attackers to reset any user's password without a valid reset key and to forge login sessions using unverified third-party identity data, giving attackers full administrator access and site takeover capability. Any WordPress site running this plugin is exposed regardless of configuration, as both failures reside in the plugin's core authentication flows. A publicly available exploit exists per WPScan; EPSS sits at 0.19% (9th percentile), suggesting exploitation is targeted rather than widespread at this time, though the public PoC lowers the technical barrier considerably.
Account takeover via unauthenticated password reset in the Lenxel WP WordPress theme (all versions through 1.0.31) allows any unauthenticated remote attacker to seize control of any WordPress account, including site administrators, by submitting a crafted reset request without owning or being authorized for the target account. The theme's reset action validates only a WordPress CSRF nonce - obtainable by any visitor loading the reset page - while performing no ownership or authorization check against the account being reset. No confirmed active exploitation (not in CISA KEV), though a public POC exists via WPScan and SSVC rates the technical impact as total; EPSS remains very low at 0.12% (2nd percentile), consistent with the niche theme footprint.
Unauthenticated administrator account creation in the POUCO Import Users WordPress plugin (versions through 1.0.0) lets remote attackers register a fully privileged admin user and take over the site. The plugin exposes AJAX actions for account creation/update without capability or nonce checks and blindly trusts an attacker-supplied role value, so any visitor can escalate to administrator. Publicly available exploit code exists (reported by WPScan), though the EPSS score is low (0.15%, 5th percentile) and it is not on the CISA KEV list.