Unknown
Monthly
Unauthenticated API abuse in the AI ChatBot for WooCommerce WordPress plugin (all versions before 4.8.4) permits any remote visitor to trigger a backend AJAX action with no authorization check or nonce validation, causing the plugin to forward requests to the site owner's stored third-party AI API credentials - generating charges billed directly to the owner's account. A publicly available exploit exists per WPScan, though EPSS sits at 0.15% (5th percentile), indicating limited current automated exploitation; this CVE is not listed in the CISA KEV catalog. When the plugin's optional knowledge-base indexing feature is enabled, the same unprotected endpoint additionally exposes indexed site content to unauthenticated retrieval, introducing a confidentiality dimension alongside the financial abuse risk.
Authentication bypass in the SMS Alert WordPress plugin before 3.9.8 allows unauthenticated remote attackers to log in as any registered user - including site administrators - by exploiting broken OTP session binding. The plugin marks a session as 'mobile verified' after an attacker validates an OTP to their own phone, then naively trusts a separately supplied, attacker-controlled phone number to resolve and authenticate the target account. A public proof-of-concept is available via WPScan; while EPSS remains low at 0.15% (5th percentile), the combination of administrative account takeover potential and available exploit code makes this a high-priority patch for affected WordPress deployments.
Missing capability check on a WordPress AJAX action in Five Star Restaurant Reservations before 2.7.23 permits any user holding the plugin's lowest booking-management role to reset the site's configured booking notification rules - a setting they are explicitly barred from accessing through the UI. Notably, the provided CVSS vector (PR:N, C:H) conflicts materially with the description, which requires an authenticated role and describes an integrity-only impact; defenders should not rely on the published score at face value. A publicly available exploit exists via WPScan, though EPSS at 0.13% (3rd percentile) indicates no meaningful opportunistic exploitation has been observed.
Unauthenticated SQL injection in AcyMailing WordPress plugin (versions before 10.11.1) allows remote attackers to read sensitive data from the underlying database and perform limited data modification without any credentials. Reported by WPScan and assigned CVSS 8.2, the flaw is network-exploitable with no user interaction required. A publicly available proof-of-concept exists; however, EPSS sits at 0.19% (8th percentile), indicating minimal observed exploitation activity at time of analysis despite the public PoC, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated information disclosure in the Mapster WP Maps WordPress plugin (all versions before 1.24.0) exposes the full title and body content of any post - including drafts, private, pending, and trashed posts - through an unprotected public REST API endpoint. Any remote attacker with network access to the WordPress site can enumerate and read content that site owners explicitly withheld from publication, bypassing WordPress's native post-status and capability access controls. A publicly available proof-of-concept exists per WPScan reporting; however, the EPSS score of 0.14% (4th percentile) indicates exploitation has not yet become widespread, and the vulnerability is not listed in the CISA KEV catalog.
Reflected XSS in the Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin (all versions before 5.0.0) enables unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by exploiting an AJAX endpoint that lacks both nonce validation and capability checks. A publicly available exploit exists per WPScan, lowering the bar for abuse, though EPSS sits at just 0.17% (7th percentile) and CISA has not added this to KEV - suggesting opportunistic rather than widespread active exploitation. The scope-changed CVSS vector (S:C) reflects that a successful attack breaks out of the plugin context into the victim's browser session, enabling session hijacking or credential theft against authenticated WordPress users.
SQL injection in the Participants Database WordPress plugin before 2.7.8.4 lets remote unauthenticated attackers inject arbitrary SQL through an improperly sanitized user-supplied parameter, exposing and tampering with the WordPress database. Publicly available exploit code exists (disclosed by WPScan), though EPSS remains low at 0.18% and the flaw is not on CISA KEV. The high 9.1 CVSS reflects full read/write database compromise without authentication.
Unrestricted PHP file upload in the Theme Demo Import WordPress plugin (≤1.1.3) enables administrator-level users - including non-super-admin site admins on multisite installs - to bypass WordPress's native file-type validation and upload executable PHP files to the server's uploads directory, resulting in full remote code execution. A publicly available proof-of-concept exists per WPScan reporting, though EPSS sits at 0.14% (4th percentile), suggesting exploitation remains uncommon. No confirmed active exploitation in CISA KEV; however, SSVC rates technical impact as total.
Unrestricted PHP file upload in Everest Toolkit (WordPress plugin ≤1.2.3) enables authenticated Administrators - including non-super-admin site administrators on multisite networks - to place executable PHP web shells in the wp-content/uploads directory via the demo-content import feature. Full remote code execution on the underlying web server is achievable upon requesting the uploaded file. A publicly available proof-of-concept exists per WPScan; no active exploitation has been confirmed (not in CISA KEV), and EPSS sits at 0.14% (4th percentile), indicating this remains a targeted rather than widespread threat despite total technical impact.
Session hijacking in the User Profile Builder WordPress plugin (versions before 3.16.4) allows unauthenticated attackers to obtain an authenticated session for any arbitrary existing user - including site administrators - by exploiting improper account binding in the post-registration auto-login flow. Exploitation is constrained to sites running a supported but non-default plugin configuration, which explains the AC:H in the CVSS vector and the SSVC 'Automatable: no' designation despite total technical impact. A publicly available proof-of-concept exists per WPScan, though EPSS of 0.14% (4th percentile) and SSVC 'Exploitation: none' indicate no confirmed widespread exploitation at time of analysis.
Local File Inclusion via path traversal in the HUSKY WordPress plugin (versions before 1.4.1) allows authenticated shop managers to cause arbitrary local PHP files to be included and executed on every subsequent front-end request, including those made by unauthenticated visitors. The attack is staged: a privileged user (shop manager) poisons a stored plugin setting with a directory traversal sequence, after which the web server silently executes the targeted local file on every page load without further attacker interaction. A publicly available proof-of-concept exists; EPSS is low at 0.50% (40th percentile), suggesting exploitation has not yet reached broad automated scanning, though the POC lowers the bar significantly for targeted attacks against WooCommerce stores.
Account takeover in the Login & Register Forms WordPress plugin (versions before 3.2.5) enables unauthenticated attackers to brute-force password-reset verification codes by bypassing the plugin's rate-limit control. The rate limiter and code storage are both keyed on a client-supplied value, meaning an attacker can arbitrarily reset their attempt counter and exhaust the verification code space, resulting in full compromise of any account - including site administrators - on affected WordPress installations. A publicly available proof-of-concept exploit exists; no CISA KEV confirmation has been issued, but the admin-takeover impact makes this a high-priority patch for any site running the affected configuration.
Password reset link host poisoning in DynamicKit for Elementor WordPress plugin (versions before 1.0.3) enables unauthenticated attackers to redirect victims' password reset emails to an attacker-controlled domain, carrying a valid reset key issued by the legitimate WordPress site. When the victim clicks the link, the attacker captures the reset token and achieves full account takeover. A publicly available exploit exists via WPScan, though EPSS sits at just 0.14% (4th percentile), indicating limited observed exploitation despite the severity rating and POC availability.
Password reset authentication bypass in the Chat On Desk Order Notifications WordPress plugin (versions before 1.0.9) allows unauthenticated remote attackers to take over arbitrary user accounts, including administrators, by submitting a new password without completing OTP verification. Exploitation is conditional on the SMS one-time-password reset feature being active on the target site. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.14% (4th percentile) and SSVC rates exploitation status as 'none,' suggesting currently limited attacker uptake despite disclosed exploit code. No confirmed active exploitation (CISA KEV) at time of analysis.
Administrator account takeover in the ShopMonitor.io WordPress plugin before 1.2.0 allows unauthenticated attackers to hijack outgoing emails. The plugin's email-rerouting test mode is gated only by a trusted-source check that can be satisfied with client-supplied request headers, so an attacker can redirect the WordPress administrator password-reset email to an address they control and seize the admin account. Rated CVSS 9.8 with publicly available exploit code; EPSS is low (0.14%, 4th percentile), and it is not listed in CISA KEV - no public exploit identified as actively used at time of analysis, though POC exists.
Stored cross-site scripting in the Frontend Admin by DynamiApps WordPress plugin (all versions before 3.29.9) allows unauthenticated visitors to permanently inject executable script content into site storage by exploiting a double-encoding sanitization bypass. The flaw arises because the plugin re-decodes HTML entities after sanitization, resurrecting neutralized tags; the live payload is then rendered without escaping on front-end display surfaces and fires in the browser of any authenticated user — including site administrators — who later views the affected page. A publicly available proof-of-concept exists; while no active exploitation is confirmed in CISA KEV, the unauthenticated attack surface and admin-session-hijacking potential make this a meaningful priority for WordPress operators running this plugin.
Two-factor authentication is completely bypassable in the miniOrange 2FA WordPress plugin before version 6.2.6, enabling an attacker who already holds a victim's password to authenticate as that user - including site administrators - by supplying a self-referential OTP value the plugin incorrectly validates against an attacker-controlled parameter rather than the user's stored secret. All WordPress installations running the affected plugin versions are exposed to full account takeover with no prior plugin privileges required. A publicly available proof-of-concept exists per WPScan; however, EPSS probability stands at 0.19% (9th percentile) and SSVC exploitation status is classified as 'none,' indicating no confirmed mass exploitation at time of analysis.
Remote code execution in the ElementsKit Elementor Addons WordPress plugin before 3.10.01 allows an authenticated administrator to inject arbitrary PHP code into server-side execution by crafting a malicious custom widget definition. The plugin writes this definition verbatim into a generated PHP file and subsequently executes it without sanitization. The critical escalation scenario occurs on WordPress multisite networks, where a subsite Administrator - ordinarily barred from file or code editing - can exploit this flaw to achieve host-level code execution, bypassing the privilege boundaries the network enforces. A publicly available exploit exists; no confirmed active exploitation (CISA KEV) at time of analysis.
SQL injection in the Kirki WordPress plugin before version 6.0.13 enables unauthenticated remote attackers to read arbitrary data from the underlying WordPress database by injecting malicious SQL through an unsanitized request parameter. The CVSS vector scores this 8.6 with a scope change reflecting potential access to the database tier beyond the web application boundary, with high confidentiality impact but no integrity or availability impact - consistent with a read-only injection primitive. A public proof-of-concept exploit exists per WPScan, though the EPSS score of 0.18% (7th percentile) indicates low observed exploitation probability relative to the theoretical severity, and the vulnerability has not been added to the CISA KEV catalog.
PHP Object Injection in the Kirki WordPress plugin before 6.0.13 enables a two-stage attack where unauthenticated users store malicious serialized PHP objects, which are then deserialized when an administrator reviews the stored data in the WordPress admin panel. With a suitable gadget chain present on the site - from another installed plugin or an outdated WordPress core - this can escalate to full remote code execution on the hosting server. A publicly available proof-of-concept exists per WPScan, though EPSS remains low (0.22%, 13th percentile) and CISA has not listed this in KEV, suggesting no confirmed widespread in-the-wild exploitation at time of analysis.
Privilege escalation to WordPress administrator in Ultimate Member plugin before 2.12.1 permits unauthenticated registrants to self-assign a site-defined role carrying full administrator capabilities, resulting in complete site takeover. The plugin omits administrator-level roles from its registration form role-filter and ships with its post-registration elevation safeguard disabled by default, creating a two-layered failure that exposes affected sites when a custom admin-capable role exists alongside a role-selection field on a live registration form. A publicly available proof-of-concept is confirmed via WPScan; no public exploit identified at time of analysis as actively exploited (not in CISA KEV), and EPSS sits at 0.14%, reflecting the dependency on specific site configuration.
SQL injection in the Product Feed Manager For WooCommerce WordPress plugin (versions prior to 7.6.1) allows authenticated users holding a Contributor role or higher to execute arbitrary SQL statements against the WordPress database by crafting malicious product-feed custom filter rules. High CVSS impact metrics (C:H, I:H) reflect the potential for full database read and write access, including extraction of user credentials, WooCommerce order records, and site configuration data. A publicly available exploit exists per WPScan, though the EPSS score of 0.16% (5th percentile) suggests active mass exploitation has not materialized; the vulnerability is not listed in CISA KEV at time of analysis.
Unauthenticated information disclosure in the Geeky Bot WordPress plugin (all versions before 1.2.8) permits any remote, unauthenticated user to retrieve chat-history session metadata - including WordPress usernames, user IDs, and timestamps - by invoking an unprotected AJAX endpoint. Reported by WPScan with a publicly available proof-of-concept, this flaw provides attackers with a ready-made user enumeration primitive against any publicly reachable WordPress site running the affected plugin. CISA KEV listing is absent and EPSS sits at 0.14% (4th percentile), indicating limited current mass-exploitation, but the POC lowers the barrier for targeted attacks significantly.
Unauthenticated file upload and arbitrary ticket attachment in JS Help Desk WordPress plugin (all versions before 3.1.4) stems from a complete absence of authorization, nonce validation, and ownership checks on the plugin's front-end request dispatcher. Any unauthenticated remote attacker can upload files - constrained to the plugin's inert allowed extensions - and attach those files to any user's support ticket without possessing an account. A publicly available proof-of-concept exists per WPScan reporting; however, EPSS remains very low (0.14%, 4th percentile) and the vulnerability is not listed in CISA KEV, indicating limited observed exploitation despite POC availability.
Payment verification bypass in the FlxWoo WordPress plugin before 3.1.1 allows unauthenticated attackers to complete WooCommerce orders without paying, because the plugin marks orders as paid without confirming the checkout session was actually settled with the payment processor. Publicly available exploit code exists, and a vendor patch is released; no active exploitation is confirmed in CISA KEV. The flaw enables fraudulent free acquisition of goods or services from any store running the plugin.
Sensitive information disclosure in the Demi WordPress plugin before 0.0.7 lets unauthenticated attackers retrieve full-site backup archives that the plugin writes to a publicly reachable path under a predictable filename with no access control. Because these archives contain the complete site database - including WordPress user password hashes - an attacker can crack or replay credentials to escalate toward administrative takeover. A public exploit exists (WPScan) and a fixed release (0.0.7) is available; EPSS was not supplied but the CVSS is 7.5 (High) and it is not on CISA KEV.
GiveWP WordPress plugin before 4.16.3 exposes sensitive donor privacy data through an unauthenticated REST API endpoint that returns recurring-donation records without access controls. Any unauthenticated remote party can enumerate donor names and subscription details for donors who explicitly chose to give anonymously, directly violating donor privacy expectations. A publicly available exploit exists per WPScan reporting, though EPSS sits at the 5th percentile, suggesting limited opportunistic exploitation at time of analysis. No active exploitation is confirmed via CISA KEV.
Stored cross-site scripting via CSRF in the tourmaster WordPress plugin (all versions before 5.4.8) allows an unauthenticated remote attacker to permanently inject arbitrary JavaScript into the WordPress admin area by tricking a logged-in administrator into triggering a request that stores a malicious custom-filter label. A publicly available proof-of-concept exists per WPScan, though EPSS (0.12%, 3rd percentile) and SSVC (exploitation: none, non-automatable) collectively indicate no confirmed widespread active exploitation at time of analysis. No KEV listing was identified.
SQL injection in the Online Scheduling and Appointment Booking System WordPress plugin before version 27.8 lets unauthenticated attackers extract sensitive database contents, including WordPress user password hashes, through the plugin's public-facing booking request handler. The flaw stems from a user-supplied parameter being neither sanitized nor properly type-cast before use in a SQL query, and is reachable pre-authentication over the network. Publicly available exploit code exists (reported by WPScan), a vendor patch is available, and the EPSS score is low (0.20%) despite the high CVSS of 8.6.
Broken authorization in the Eventin WordPress plugin before 4.1.16 lets unauthenticated visitors create orders and supply their own order status, marking those orders as paid without ever completing payment. Because the order-creation endpoint neither authorizes the requester nor validates the payment state, remote attackers can forge fully-paid transactions, undermining ticket/event revenue integrity. Publicly available exploit code exists (reported by WPScan), though EPSS remains low at 0.15% and it is not listed in CISA KEV.
Unauthenticated option overwrite in the WP Travel Engine WordPress plugin before 6.8.2 lets any anonymous visitor tamper with a site-wide plugin setting because an AJAX action lacks a capability check and the nonce that gates it is served to logged-out users. Attackers do not need credentials; publicly available exploit code exists, though EPSS remains low (0.15%, 4th percentile) and the flaw is not on CISA KEV. Impact is integrity-only, with no direct data disclosure or denial of service.
Full account takeover in the Customer Switching WordPress plugin before 2.1.3 allows a low-privileged user, while an operator is actively switched into their account, to be resolved as that operator and switch into any permitted account including an administrator. Publicly available exploit code exists (reported by WPScan), though EPSS remains low at 0.14% (4th percentile) and it is not in CISA KEV; no public exploit identified as actively used at time of analysis.
Privilege escalation in the ProfileGrid WordPress plugin before 5.9.9.8 lets unauthenticated visitors self-register into any group through the front-end registration form, inheriting that group's configured WordPress role - up to Administrator where such a group exists. Publicly available exploit code exists (published by WPScan) and a vendor patch is available, though EPSS remains low at 0.15% (4th percentile), indicating limited observed exploitation attempts to date.
PHP object injection in the Remote API WordPress plugin (all versions through 0.2) lets unauthenticated attackers deserialize attacker-supplied input, and when a suitable gadget chain is available it escalates to remote code execution on the host. The flaw stems from the plugin processing serialized user input before any authentication check. Publicly available exploit code exists (WPScan), though EPSS remains low (0.25%, 17th percentile) and it is not listed in CISA KEV.
Account takeover in the miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 lets unauthenticated attackers hijack any account, including administrators. The optional email-verification one-time code is not bound to the account it was issued for, so an attacker requests a code for an email they control and replays it against a victim's email to obtain a valid session. Publicly available exploit code exists (WPScan) and a vendor patch is available, though EPSS remains low at 0.14%.
Stored Cross-Site Scripting in the WOLF WordPress plugin before 1.1.0 lets an unauthenticated attacker persist malicious script into a post by exploiting a CSRF-exposed AJAX action lacking nonce and capability checks. Because a logged-in administrator must be tricked into triggering the request (UI:R), exploitation is CSRF-driven rather than direct, but a successful attack injects attacker-controlled JavaScript that executes in the context of anyone viewing the affected post. Publicly available exploit code exists (reported by WPScan), though the EPSS score is very low (0.12%, 2nd percentile) and it is not on the CISA KEV list.
Two-factor authentication bypass in the UsersWP WordPress plugin before 1.2.67 lets an attacker who already possesses a victim's username and password skip the second authentication factor and fully log in as that user. The two-factor login handler fails to validate the selected authentication provider (CWE-287), so the 2FA step can be circumvented. Publicly available exploit code exists and a vendor patch is released, but there is no public exploit identified as actively exploited in the wild.
Unauthenticated remote code execution in the Streamit WordPress theme (versions up to and including 4.5.0) stems from a missing-authorization AJAX endpoint that invokes an attacker-supplied PHP function with attacker-supplied arguments, letting unauthenticated attackers create administrator accounts and run arbitrary code. Reported by WPScan and tracked as EUVD-2026-50115, it carries a CVSS 9.8 and publicly available exploit code exists, though there is no public exploit identified as being used in active attacks at time of analysis.
Arbitrary file disclosure and SSRF in the WP Media Folder Addon WordPress plugin (all versions through 4.1.6) let unauthenticated remote attackers read local files and coerce server-side requests via two AJAX handlers that fail to validate a user-supplied path parameter, but only on sites where a cloud-storage connection is configured. This is an incomplete-fix regression of CVE-2026-9690, which hardened only one cloud-storage handler and left the others exploitable. Publicly available exploit code exists (reported by WPScan); there is no public exploit identified as being used in active attacks and it is not listed in CISA KEV.
Unauthorized post creation and arbitrary post/page overwrite in the Tablesome Table WordPress plugin before version 1.1.31 due to missing authentication, capability, and nonce checks in an AJAX action. Unauthenticated attackers can create new published posts or overwrite any existing published content. Public exploit code exists, but no active exploitation has been confirmed; EPSS predicts very low exploitation probability (0.18%).
We need to generate a JSON object with the specified fields, synthesizing all provided data about CVE-2026-14870. First, parse the input: CVE ID: CVE-2026-14870 Description: The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. CVSS Score: 7.1 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L CWE: CWE-79 EPSS: 0.15% (percentile 5%) POC/Exploit: Publicly available Patch: Available from vendor Reported by: WPScan CPE: cpe:2.3:a:unknown:database_for_contact_form_7,_wpforms,_elementor_forms:*:*:*:*:*:*:*:* Tags: XSS, WordPress, Database For Contact Form 7 Wpforms Elementor Forms SSVC: Exploitation: poc, Automatable: no, Technical Impact: partial ENISA EUVD ID: EUVD-2026-49701 Affected versions (EUVD): ["Database for Contact Form 7, WPforms, Elementor forms 0 <1.5.3"] References: [cveorg] (exploit) https://wpscan.com/vulnerability/d574b78c-df04-4dab-bd33-e3a22ff51918/ [euvd] (advisory) https://nvd.nist.gov/vuln/detail/CVE-2026-14870 Now, construct each field as a paragraph string. product_name: The plugin name is "Database for Contact Form 7, WPforms, Elementor forms". So product_name: "Database for Contact Form 7, WPforms, Elementor forms" – but that's long, but permissible as a product name. The task says "1-3 words ONLY." That's problematic because the product name is longer. I need to pick a short name. The plugin's main purpose: it's a database plugin for those form plugins. Maybe "WordPress Forms Database" or "Database for CF7, WPforms, Elementor Forms"? But I must keep it 1-3 words. The plugin name as per WPScan: "Database for Contact Form 7, WPforms, Elementor forms". I could shorten to "Database for Contact Form 7, WPforms, Elementor forms plugin"? No, that's too long. The instruction says: "product_name": "1-3 wor
Account takeover in TrueBooker WordPress plugin before 1.2.4 enables unauthenticated attackers to reset any user’s password via a front-end handler lacking ownership validation, compromising the entire site. Public proof-of-concept exploit code is available, though EPSS exploitation probability remains low (0.14%) and no CISA KEV listing confirms active exploitation.
BookingPress Appointment Booking Pro WordPress plugin before version 5.7.3 exposes all REST API routes in a specific namespace without requiring authentication, enabling any remote attacker to read sensitive customer booking information and modify other users' bookings. Public exploit code is available, making exploitation straightforward.
Remote code execution in FacturaONE for WooCommerce plugin before version 5.37 allows unauthenticated attackers to write arbitrary files to a web-accessible directory and achieve code execution, because a request handler relies on an empty default cryptographic key and lacks authentication. Public exploit code is available.
Download Manager WordPress plugin before 3.3.62 fails to bind temporary download tokens to user sessions, creating long-lived, reusable bearer tokens. An attacker who obtains a leaked token can repeatedly bypass authentication and download role- or password-protected files without authorization. Public proof-of-concept exploit code exists, though no active exploitation has been reported in the wild.
Reflected Cross-Site Scripting (XSS) in MPG WordPress plugin before 4.1.8 allows unauthenticated attackers to inject scripts into a victim's browser by tricking them into visiting a crafted URL. Successful exploitation can lead to session hijacking or defacement. Public exploit code exists, but no active exploitation has been confirmed by CISA KEV.
Unauthenticated arbitrary file upload leading to remote code execution exists in Realtyna Organic IDX plugin + WPL Real Estate for WordPress versions before 5.3.0. The file upload API, enabled by default, authenticates using hardcoded credentials identical across all installations and lacks file type validation, allowing attackers to upload and execute PHP files. Publicly available exploit code increases the likelihood of exploitation.
Authentication bypass in the 微信二维码登陆 WordPress plugin through 1.3 allows unauthenticated attackers to log in as any existing user, including administrators, by forging webhook requests and intercepting leaked login codes. A publicly available proof-of-concept exists, the attack is fully automatable, and the technical impact is total, making this a critical priority for any site using the plugin.
Unauthenticated arbitrary user session termination (force-logout) in the Masteriyo LMS WordPress plugin before version 2.3.1 allows remote attackers to log out any site user, including administrators, via an insecure AJAX action. Publicly available exploit code exists, but no active exploitation has been confirmed by CISA KEV. The high CVSS score from NVD likely overstates impact, as the flaw only disrupts sessions without exposing data.
An unauthenticated user registering on a WordPress site with the Custom Fields Account Registration for WooCommerce plugin before version 1.4 can exploit improperly protected custom fields to overwrite the user capabilities meta key, granting themselves the administrator role. This occurs on sites using a non-default database table prefix where a correspondingly named field has been configured. Publicly available exploit code exists, but active exploitation has not been confirmed by CISA KEV.
Unauthorized order completion in Clover Payment Gateway for WooCommerce prior to 1.3.6 allows unauthenticated attackers to mark any WooCommerce order as paid by replaying a previously approved payment reference, such as one from their own minimal purchase. Public proof-of-concept code exists, and while not listed in CISA's Known Exploited Vulnerabilities, the vulnerability is automatable with partial technical impact according to SSVC analysis.
Unauthorized role assignment in MemberGlut WordPress plugin versions below 1.1.5 allows unauthenticated attackers to register accounts with arbitrary roles, including administrator, leading to complete site takeover. Publicly available exploit code exists. CVSS 9.8 indicates critical severity with low complexity and no required privileges.
MainWP Child plugin before 6.1.2 on WordPress allows unauthenticated attackers to hijack any account, including administrators, by sending a crafted site-registration request when password authentication is disabled for the targeted account. A publicly available exploit exists, but no active exploitation has been confirmed by CISA KEV.
Unauthorized REST endpoint in WowOptin Popup Maker for WordPress (versions <1.4.38) allows unauthenticated attackers to disable all site opt-in forms and insert arbitrary template-based rows into the database. Public exploit code is available, though no active exploitation is reported. EPSS indicates a very low likelihood of widespread attack.
Account takeover in CAFEHAUS API plugin for WordPress allows unauthenticated attackers to arbitrarily reset any user password via a missing authorization endpoint. Versions up to 1.0.0 are affected, enabling complete site compromise by setting an administrator password and logging in. While a public proof-of-concept exists, no widespread exploitation has been confirmed by KEVCISA.
Unauthenticated SQL injection in the 'Project Management, Bug and Issue Tracking Plugin' for WordPress before version 5.1.0 enables remote attackers to extract or modify database contents via the standard front-end issue tracker. Exploit code is publicly available, and the vulnerability has a high CVSS score of 9.1, though EPSS probability remains low at 0.14%.
Unauthenticated privilege escalation in Paid Membership Plugin for WordPress before 4.16.18 allows an attacker to register an account with an elevated role such as Editor or Author, bypassing the configured restriction because the registration handler's role acceptance logic differs from the UI parser. The lack of a nonce on the public handler enables exploitation without user interaction. A public proof-of-concept exists, but no active exploitation has been reported via CISA KEV, and the EPSS score is low at 0.13%.
Two-factor authentication bypass in the Security Ninja Premium WordPress plugin (all versions before 5.290) lets a remote attacker who already knows a valid account password log in without supplying the one-time code, defeating enforced 2FA for any user including administrators. One of the plugin's two 2FA code paths never validates the second factor, so the protection can be silently skipped. Publicly available exploit code exists (published by WPScan) and a vendor patch is available; EPSS is low at 0.25% (17th percentile), indicating no evidence of widespread automated exploitation despite the POC.
Broken access control in the Praison AI SEO WordPress plugin before 5.0.7 lets unauthenticated attackers reach several REST API routes that lack authorization checks, allowing them to alter the permalink of any published post and to read the plugin's stored configuration data. WPScan reported the issue and publicly available exploit code exists, though EPSS remains low at 0.19% and it is not on CISA KEV. Exposure of configuration data (potentially including AI-service API keys and SEO settings) plus silent permalink tampering can break site links and SEO ranking with no login required.
Arbitrary database read in the Events Manager WordPress plugin before 7.3.7 lets unauthenticated bookers inject a malicious serialized PHP object through a booking-registration field on sites running No-User-Account Booking Mode. When the stored booking is later loaded, the object is deserialized without a class allow-list, triggering a gadget chain that reaches an unparameterised SQL query and exposes sensitive data such as user password hashes and secret keys. Publicly available exploit code exists (WPScan) and SSVC rates exploitation as PoC and automatable, though it is not listed in CISA KEV.
Stored cross-site scripting in the Product Addons and Product Options With Custom Fields WordPress plugin (all versions before 1.6.15) lets an unauthenticated attacker abuse an unrestricted file-upload endpoint to plant a malicious SVG that is stored and served inline; its embedded script then runs in the browser session of any user who opens it, including administrators, enabling account takeover. Publicly available exploit code exists and WPScan disclosed the issue, but no public exploit has been identified as used in active attacks. The CVSS 8.8 rating reflects the high impact of hijacking a privileged WordPress session despite the requirement that a victim open the crafted file.
SQL injection in the bpost Shipping Platform WordPress plugin (versions before 3.2.3) lets unauthenticated attackers inject SQL via an unsanitized parameter processed during WooCommerce order submission, enabling time-based blind extraction of database contents. Any WooCommerce store using this Belgian-postal shipping integration is exposed at checkout without authentication or user interaction. Publicly available exploit code exists (WPScan) and a vendor patch is available, though there is no public exploit identified as being actively used in the wild (not in CISA KEV).
Stored cross-site scripting in the Free Theme Builder for Elementor WordPress plugin before 1.6.7 lets unauthenticated attackers inject malicious script through contact form field values, which are stored unsanitized and later rendered in the admin dashboard's form-submissions view. The payload executes in the browser of any logged-in administrator who reviews submissions, enabling session hijacking or actions in the admin's context. Publicly available exploit code exists (WPScan), but there is no evidence of active exploitation and EPSS probability is low (0.17%).
Reflected cross-site scripting in the WordPress plugin 'Tag Groups is the Advanced Way to Display Your Taxonomy Terms' before version 2.2.0 allows unauthenticated attackers to run arbitrary JavaScript in the browser of a logged-in Editor (or higher) who clicks a crafted link, because one AJAX parameter is reflected unescaped into an HTML-typed response. Publicly available exploit code exists (published by WPScan), but the flaw is not listed in CISA KEV and carries a low EPSS score (0.17%, 7th percentile), indicating no evidence of widespread active exploitation. Successful exploitation can hijack an editorial session, letting the attacker act with the victim's WordPress capabilities.
Server-Side Request Forgery in the Kirki WordPress plugin before 6.0.12 allows unauthenticated attackers to coerce the server into issuing HTTP requests to arbitrary attacker-chosen hosts because a user-supplied URL is fetched server-side without validation. This is reachable remotely with no authentication or user interaction (CVSS 9.1), publicly available exploit code exists, and a vendor patch has shipped, but there is no public exploit identified as being used in active attacks (not in CISA KEV). Reported by WPScan (EUVD-2026-45889), the flaw is dangerous on WordPress sites hosted in cloud or internal-network environments where the request can pivot to metadata or intranet services.
Authentication bypass via OTP brute-force in the 'Social Login, Passkeys, Magic Link & Email OTP' WordPress plugin before 1.4.1 lets an unauthenticated attacker who knows a registered email address guess the passwordless one-time-password and log in as that user, including an administrator, resulting in full site takeover. The plugin fails to enforce rate limiting or a working lockout on OTP verification and stores the short numeric codes in plaintext, so codes can be exhausted rapidly. Publicly available exploit code exists (reported by WPScan) and a vendor patch is available, though EPSS remains low at 0.14%.
Reflected Cross-Site Scripting in the LearnPress WordPress plugin before 4.4.1 lets a remote attacker execute arbitrary JavaScript in the browser of a logged-in instructor or administrator who opens a crafted link, because a search parameter is reflected into an HTML attribute without escaping. Publicly available exploit code exists (published by WPScan), but there is no public exploit identified as being used in active attacks; EPSS is low at 0.15% (5th percentile). A vendor patch is available in version 4.4.1.
Stored cross-site scripting in the SlimStat Analytics WordPress plugin before 5.5.0 lets unauthenticated visitors inject a persistent payload through a geolocation value that fires when an administrator opens the analytics reports, enabling admin-session compromise. The flaw is only reachable when the plugin is configured to use the Cloudflare geolocation provider. Publicly available exploit code exists (reported by WPScan) and a vendor patch is available; no public exploit identified as actively exploited and it is not in CISA KEV.
Unauthenticated SQL injection in the Modern Event Calendar Pro and Modern Events Calendar Lite WordPress plugins (all versions before 7.34.0) lets remote attackers extract sensitive database contents by injecting into an unsanitized request parameter used within a SQL statement, reachable through an AJAX action open to unauthenticated users. Publicly available exploit code exists (reported by WPScan), and a vendor patch is available; the CVSS 8.6 rating reflects a scope-changed, high-confidentiality impact with no authentication or user interaction required. No EPSS score or CISA KEV listing was provided, so there is no public exploit identified as being actively exploited at time of analysis.
Stored cross-site scripting in the Unlimited Elements For Elementor WordPress plugin (all versions before 2.0.11) lets an unauthenticated attacker plant a malicious Google review on a targeted business's Google listing that, once fetched via the Serp API and rendered unescaped in the Google Reviews widget, executes JavaScript in the browser of every visitor — including logged-in administrators — of any page showing that Place ID's reviews. Publicly available exploit code exists and the vendor has shipped a fix, but there is no public exploit identified as being used in active attacks. The injection is delivered through third-party review content rather than a direct request to the WordPress site, making it a supply-chain-style stored XSS.
Privilege escalation and full site takeover affects the AI Copilot WordPress plugin before 1.5.4, which fails to bind OAuth access tokens to a specific WordPress user and treats any valid token as an administrator session. An unauthenticated attacker who completes the plugin's public OAuth flow can invoke privileged MCP (Model Context Protocol) tools as an administrator, creating new users and escalating roles. Publicly available exploit code exists and the flaw carries a CVSS 9.8; no active exploitation has been confirmed (not in CISA KEV).
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.3 lets unauthenticated visitors self-assign an arbitrary published membership tier during public registration, gaining that tier's user role - including administrator where such a tier exists. The plugin never validates that the tier submitted in the registration form is one the form actually offers, so an attacker simply tampers with the submitted tier value. Publicly available exploit code exists (reported by WPScan), though active exploitation has not been confirmed.
Payment authentication bypass in the PhonePe Payment Solutions WordPress/WooCommerce plugin before 3.1.0 lets unauthenticated attackers forge payment-success callbacks and mark unpaid orders as paid. Because sites set up through the current onboarding flow have an empty callback-validation secret, the expected signature collapses to an unkeyed hash of the request body that anyone can reproduce. Publicly available exploit code exists (reported by WPScan), though EPSS is low (0.14%) and there is no public exploit identified as being used in the wild.
Reflected Cross-Site Scripting in the FunnelKit WordPress plugin before 3.15.0.6 lets unauthenticated attackers inject arbitrary JavaScript into a page-builder AJAX response, which executes in the browser of a logged-in user who opens an attacker-crafted link. The flaw is only reachable when the Divi builder integration is active, and publicly available exploit code exists though there is no public exploit identified as actively exploited at time of analysis. EPSS was not provided and the vulnerability is not on CISA KEV, so widespread exploitation is unconfirmed.
Authentication bypass in the Abandoned Cart Lite for WooCommerce WordPress plugin before 6.8.2 allows unauthenticated attackers to forge cart-recovery links that log them in as arbitrary users when the automatic-login feature is enabled. Because recovery tokens are neither integrity-protected nor bound to the requesting account, an attacker can craft a link that authenticates them as a victim, yielding full account takeover (SSVC technical impact: total). Publicly available exploit code exists (WPScan), though it is not listed in CISA KEV and EPSS is low (0.14%).
Privilege escalation in the Redux Framework WordPress plugin before 4.5.13 allows authenticated Subscriber-level users to become Administrators by writing arbitrary user meta keys through the plugin's custom profile fields, on sites where the Users extension (user-profile feature) is enabled. Because the plugin does not restrict which user meta keys are written when saving custom profile fields, an attacker can inject the wp_capabilities meta to grant themselves the administrator role. Publicly available exploit code exists (published by WPScan), though EPSS remains low at 0.14% and there is no evidence of active exploitation.
Authentication bypass in the Happy Coders OTP Login for WooCommerce WordPress plugin (versions 1.5 through 2.7) lets unauthenticated remote attackers log in as any existing user, including administrators, and create arbitrary accounts. The plugin authenticates a user from a supplied identifier without confirming that the one-time password was ever validated. Publicly available exploit code exists (WPScan) and a vendor patch (2.8) is available; EPSS remains low at 0.15% despite the maximal 9.8 CVSS score.
UNION-based SQL injection in the Quotes Llama WordPress plugin (all versions before 3.1.6) lets unauthenticated remote attackers inject arbitrary SQL through an unsanitized request parameter and read any data from the WordPress database, including user password hashes. Publicly available exploit code exists and a vendor patch has been released; the flaw carries a high EPSS-relevant profile because it is remotely reachable with no authentication or user interaction. This is no public exploit identified as actively exploited (not in CISA KEV), but working PoC availability makes opportunistic mass-scanning likely.
Authentication bypass in the Shibboleth WordPress plugin before 2.5.4 lets remote unauthenticated attackers forge identity headers and log in when the HTTP header identity mode is enabled without an anti-spoofing key. Because the plugin fails open rather than closed, any request carrying identity headers is trusted as an authenticated session, and with automatic account creation plus the default administrator role mapping an attacker can provision and sign in as a brand-new administrator. Rated CVSS 8.1 (CWE-287); publicly available exploit code exists (WPScan), but it is not listed in CISA KEV.
Unauthenticated PHP object injection in the Newsletters WordPress plugin before 4.15 lets remote attackers deserialize attacker-controlled data submitted through a public-facing form, then leverage a property-oriented gadget chain bundled inside the plugin itself to write arbitrary files and achieve remote code execution on the host. Publicly available exploit code exists (published via WPScan), though there is no public exploit identified as being used in active attacks and the flaw is not listed in CISA KEV. The self-contained gadget chain removes the usual dependency on third-party gadgets, making reliable exploitation notably more achievable than typical POI bugs.
Arbitrary file write in the AI Engine WordPress plugin before 3.5.5 lets authenticated editor-level users abuse an unsanitized, user-supplied filename during a file-download-and-save operation to plant attacker-controlled bytes anywhere the web server user can write via path traversal. Because writing a PHP payload into the webroot typically yields remote code execution, this crosses from a content-management flaw into full site compromise. Publicly available exploit code exists and a vendor patch has shipped, though the issue is not listed in CISA KEV.
Arbitrary file deletion in the Word Count and Social Shares WordPress plugin (versions through 1.0) lets any authenticated low-privilege user, including a Subscriber, delete any file the web server can reach because the plugin neither validates the supplied file path nor enforces authorization or CSRF protection. Deleting critical files such as wp-config.php can trigger WordPress's setup/installation flow and enable a full site takeover. Publicly available exploit code exists (reported by WPScan); there is no public exploit identified as actively used, and the issue is not on the CISA KEV list.
SQL injection in the Library Management System WordPress plugin before 3.5.8 lets unauthenticated attackers inject arbitrary SQL through an unsanitized request parameter and read data straight from the WordPress database, including user password hashes. Publicly available exploit code exists and the flaw was reported by WPScan, though the EPSS probability is low (0.18%, 7th percentile) and it is not on CISA KEV. The vendor has shipped a fixed release (3.5.8), making patching the clear priority for affected sites.
Broken authorization in the Tutor LMS WordPress plugin (before 3.9.13) lets authenticated subscriber-level users bypass paid/private-course access controls when the Droip or Kirki page-builder integration is active. Because these integration handlers omit the enrollment, purchase, and private-course capability checks enforced in the core course handler, low-privileged accounts can self-enroll in paid or private courses, read otherwise-restricted content, and mark arbitrary courses complete. Reported by WPScan with publicly available exploit detail and a vendor patch released; no active exploitation is currently listed in CISA KEV.
Payment-verification bypass in the User Registration & Membership WordPress plugin before 5.2.2 lets unauthenticated attackers forge a payment-provider webhook to mark a subscription as paid, activating premium memberships without any real transaction. WPScan reports publicly available exploit code, though there is no public exploit identified as being used in active attacks (not in CISA KEV). The core weakness is that inbound webhook notifications are trusted and acted upon without authenticating their origin or signature.
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.2 lets any authenticated low-privileged user (e.g. a subscriber) alter another account's WordPress role and membership tier. The membership-upgrade action performs no authorization check and trusts a caller-supplied user identifier instead of the current session, so an attacker can target an arbitrary account - including their own - to gain higher roles up to administrator. Publicly available exploit code exists and a vendor patch is available, but this is not listed in CISA KEV.
Content destruction and covert data exfiltration in the EscortWP WordPress theme (all builds through 3.6.2) stem from a deliberately obfuscated, vendor-authored backdoor rather than an accidental coding flaw. Any unauthenticated remote attacker who knows the hard-coded per-build key can permanently delete every piece of the site's content, while the theme silently beacons the site URL, administrator email, and license key to a third-party server. Publicly available exploit code exists (reported by WPScan), though EPSS probability is low (0.14%, 4th percentile) and it is not on CISA KEV.
Information disclosure in the Everest Forms WordPress plugin before 3.5.0 allows unauthenticated remote attackers to download other users' form submissions. The plugin generates temporary CSV files during email-notification processing but fails to reliably delete them, leaving them publicly accessible in the wp-content uploads directory under predictable, enumerable filenames. Publicly available exploit code exists and the flaw is automatable per CISA SSVC, though EPSS remains low at 0.14%; not listed in CISA KEV.
PHP object injection in the Appointment Booking Calendar and Scheduling Plugin for WordPress (all versions through 1.1.28) lets unauthenticated attackers pass attacker-controlled data into a PHP deserialization call, and where a suitable gadget chain exists on the site this can be escalated to remote code execution. Reported by WPScan with publicly available exploit detail, though EPSS is low (0.23%, 13th percentile) and CISA SSVC records no observed exploitation, so this is a proof-of-concept-grade risk rather than confirmed active exploitation. Impact is total (confidentiality, integrity, availability) when a gadget chain is present, but the high attack complexity reflects that dependency.
OS command injection in a family of popular WordPress file-manager plugins - FileOrganizer (before 1.1.9), Advanced File Manager (before 5.4.12), File Manager Pro (before 2.1.1), and File Manager (before 8.0.4) - lets authenticated users inject arbitrary shell commands through an unescaped parameter passed to the ImageMagick convert CLI during image operations. Reported by WPScan, publicly available exploit code exists, though EPSS is modest at 0.52% (40th percentile) and CISA SSVC records exploitation as 'none'. Exploitation is real but gated: the server must fall back to the ImageMagick convert binary because neither the PHP imagick nor GD extension is installed.
Unauthenticated API abuse in the AI ChatBot for WooCommerce WordPress plugin (all versions before 4.8.4) permits any remote visitor to trigger a backend AJAX action with no authorization check or nonce validation, causing the plugin to forward requests to the site owner's stored third-party AI API credentials - generating charges billed directly to the owner's account. A publicly available exploit exists per WPScan, though EPSS sits at 0.15% (5th percentile), indicating limited current automated exploitation; this CVE is not listed in the CISA KEV catalog. When the plugin's optional knowledge-base indexing feature is enabled, the same unprotected endpoint additionally exposes indexed site content to unauthenticated retrieval, introducing a confidentiality dimension alongside the financial abuse risk.
Authentication bypass in the SMS Alert WordPress plugin before 3.9.8 allows unauthenticated remote attackers to log in as any registered user - including site administrators - by exploiting broken OTP session binding. The plugin marks a session as 'mobile verified' after an attacker validates an OTP to their own phone, then naively trusts a separately supplied, attacker-controlled phone number to resolve and authenticate the target account. A public proof-of-concept is available via WPScan; while EPSS remains low at 0.15% (5th percentile), the combination of administrative account takeover potential and available exploit code makes this a high-priority patch for affected WordPress deployments.
Missing capability check on a WordPress AJAX action in Five Star Restaurant Reservations before 2.7.23 permits any user holding the plugin's lowest booking-management role to reset the site's configured booking notification rules - a setting they are explicitly barred from accessing through the UI. Notably, the provided CVSS vector (PR:N, C:H) conflicts materially with the description, which requires an authenticated role and describes an integrity-only impact; defenders should not rely on the published score at face value. A publicly available exploit exists via WPScan, though EPSS at 0.13% (3rd percentile) indicates no meaningful opportunistic exploitation has been observed.
Unauthenticated SQL injection in AcyMailing WordPress plugin (versions before 10.11.1) allows remote attackers to read sensitive data from the underlying database and perform limited data modification without any credentials. Reported by WPScan and assigned CVSS 8.2, the flaw is network-exploitable with no user interaction required. A publicly available proof-of-concept exists; however, EPSS sits at 0.19% (8th percentile), indicating minimal observed exploitation activity at time of analysis despite the public PoC, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated information disclosure in the Mapster WP Maps WordPress plugin (all versions before 1.24.0) exposes the full title and body content of any post - including drafts, private, pending, and trashed posts - through an unprotected public REST API endpoint. Any remote attacker with network access to the WordPress site can enumerate and read content that site owners explicitly withheld from publication, bypassing WordPress's native post-status and capability access controls. A publicly available proof-of-concept exists per WPScan reporting; however, the EPSS score of 0.14% (4th percentile) indicates exploitation has not yet become widespread, and the vulnerability is not listed in the CISA KEV catalog.
Reflected XSS in the Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin (all versions before 5.0.0) enables unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by exploiting an AJAX endpoint that lacks both nonce validation and capability checks. A publicly available exploit exists per WPScan, lowering the bar for abuse, though EPSS sits at just 0.17% (7th percentile) and CISA has not added this to KEV - suggesting opportunistic rather than widespread active exploitation. The scope-changed CVSS vector (S:C) reflects that a successful attack breaks out of the plugin context into the victim's browser session, enabling session hijacking or credential theft against authenticated WordPress users.
SQL injection in the Participants Database WordPress plugin before 2.7.8.4 lets remote unauthenticated attackers inject arbitrary SQL through an improperly sanitized user-supplied parameter, exposing and tampering with the WordPress database. Publicly available exploit code exists (disclosed by WPScan), though EPSS remains low at 0.18% and the flaw is not on CISA KEV. The high 9.1 CVSS reflects full read/write database compromise without authentication.
Unrestricted PHP file upload in the Theme Demo Import WordPress plugin (≤1.1.3) enables administrator-level users - including non-super-admin site admins on multisite installs - to bypass WordPress's native file-type validation and upload executable PHP files to the server's uploads directory, resulting in full remote code execution. A publicly available proof-of-concept exists per WPScan reporting, though EPSS sits at 0.14% (4th percentile), suggesting exploitation remains uncommon. No confirmed active exploitation in CISA KEV; however, SSVC rates technical impact as total.
Unrestricted PHP file upload in Everest Toolkit (WordPress plugin ≤1.2.3) enables authenticated Administrators - including non-super-admin site administrators on multisite networks - to place executable PHP web shells in the wp-content/uploads directory via the demo-content import feature. Full remote code execution on the underlying web server is achievable upon requesting the uploaded file. A publicly available proof-of-concept exists per WPScan; no active exploitation has been confirmed (not in CISA KEV), and EPSS sits at 0.14% (4th percentile), indicating this remains a targeted rather than widespread threat despite total technical impact.
Session hijacking in the User Profile Builder WordPress plugin (versions before 3.16.4) allows unauthenticated attackers to obtain an authenticated session for any arbitrary existing user - including site administrators - by exploiting improper account binding in the post-registration auto-login flow. Exploitation is constrained to sites running a supported but non-default plugin configuration, which explains the AC:H in the CVSS vector and the SSVC 'Automatable: no' designation despite total technical impact. A publicly available proof-of-concept exists per WPScan, though EPSS of 0.14% (4th percentile) and SSVC 'Exploitation: none' indicate no confirmed widespread exploitation at time of analysis.
Local File Inclusion via path traversal in the HUSKY WordPress plugin (versions before 1.4.1) allows authenticated shop managers to cause arbitrary local PHP files to be included and executed on every subsequent front-end request, including those made by unauthenticated visitors. The attack is staged: a privileged user (shop manager) poisons a stored plugin setting with a directory traversal sequence, after which the web server silently executes the targeted local file on every page load without further attacker interaction. A publicly available proof-of-concept exists; EPSS is low at 0.50% (40th percentile), suggesting exploitation has not yet reached broad automated scanning, though the POC lowers the bar significantly for targeted attacks against WooCommerce stores.
Account takeover in the Login & Register Forms WordPress plugin (versions before 3.2.5) enables unauthenticated attackers to brute-force password-reset verification codes by bypassing the plugin's rate-limit control. The rate limiter and code storage are both keyed on a client-supplied value, meaning an attacker can arbitrarily reset their attempt counter and exhaust the verification code space, resulting in full compromise of any account - including site administrators - on affected WordPress installations. A publicly available proof-of-concept exploit exists; no CISA KEV confirmation has been issued, but the admin-takeover impact makes this a high-priority patch for any site running the affected configuration.
Password reset link host poisoning in DynamicKit for Elementor WordPress plugin (versions before 1.0.3) enables unauthenticated attackers to redirect victims' password reset emails to an attacker-controlled domain, carrying a valid reset key issued by the legitimate WordPress site. When the victim clicks the link, the attacker captures the reset token and achieves full account takeover. A publicly available exploit exists via WPScan, though EPSS sits at just 0.14% (4th percentile), indicating limited observed exploitation despite the severity rating and POC availability.
Password reset authentication bypass in the Chat On Desk Order Notifications WordPress plugin (versions before 1.0.9) allows unauthenticated remote attackers to take over arbitrary user accounts, including administrators, by submitting a new password without completing OTP verification. Exploitation is conditional on the SMS one-time-password reset feature being active on the target site. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.14% (4th percentile) and SSVC rates exploitation status as 'none,' suggesting currently limited attacker uptake despite disclosed exploit code. No confirmed active exploitation (CISA KEV) at time of analysis.
Administrator account takeover in the ShopMonitor.io WordPress plugin before 1.2.0 allows unauthenticated attackers to hijack outgoing emails. The plugin's email-rerouting test mode is gated only by a trusted-source check that can be satisfied with client-supplied request headers, so an attacker can redirect the WordPress administrator password-reset email to an address they control and seize the admin account. Rated CVSS 9.8 with publicly available exploit code; EPSS is low (0.14%, 4th percentile), and it is not listed in CISA KEV - no public exploit identified as actively used at time of analysis, though POC exists.
Stored cross-site scripting in the Frontend Admin by DynamiApps WordPress plugin (all versions before 3.29.9) allows unauthenticated visitors to permanently inject executable script content into site storage by exploiting a double-encoding sanitization bypass. The flaw arises because the plugin re-decodes HTML entities after sanitization, resurrecting neutralized tags; the live payload is then rendered without escaping on front-end display surfaces and fires in the browser of any authenticated user — including site administrators — who later views the affected page. A publicly available proof-of-concept exists; while no active exploitation is confirmed in CISA KEV, the unauthenticated attack surface and admin-session-hijacking potential make this a meaningful priority for WordPress operators running this plugin.
Two-factor authentication is completely bypassable in the miniOrange 2FA WordPress plugin before version 6.2.6, enabling an attacker who already holds a victim's password to authenticate as that user - including site administrators - by supplying a self-referential OTP value the plugin incorrectly validates against an attacker-controlled parameter rather than the user's stored secret. All WordPress installations running the affected plugin versions are exposed to full account takeover with no prior plugin privileges required. A publicly available proof-of-concept exists per WPScan; however, EPSS probability stands at 0.19% (9th percentile) and SSVC exploitation status is classified as 'none,' indicating no confirmed mass exploitation at time of analysis.
Remote code execution in the ElementsKit Elementor Addons WordPress plugin before 3.10.01 allows an authenticated administrator to inject arbitrary PHP code into server-side execution by crafting a malicious custom widget definition. The plugin writes this definition verbatim into a generated PHP file and subsequently executes it without sanitization. The critical escalation scenario occurs on WordPress multisite networks, where a subsite Administrator - ordinarily barred from file or code editing - can exploit this flaw to achieve host-level code execution, bypassing the privilege boundaries the network enforces. A publicly available exploit exists; no confirmed active exploitation (CISA KEV) at time of analysis.
SQL injection in the Kirki WordPress plugin before version 6.0.13 enables unauthenticated remote attackers to read arbitrary data from the underlying WordPress database by injecting malicious SQL through an unsanitized request parameter. The CVSS vector scores this 8.6 with a scope change reflecting potential access to the database tier beyond the web application boundary, with high confidentiality impact but no integrity or availability impact - consistent with a read-only injection primitive. A public proof-of-concept exploit exists per WPScan, though the EPSS score of 0.18% (7th percentile) indicates low observed exploitation probability relative to the theoretical severity, and the vulnerability has not been added to the CISA KEV catalog.
PHP Object Injection in the Kirki WordPress plugin before 6.0.13 enables a two-stage attack where unauthenticated users store malicious serialized PHP objects, which are then deserialized when an administrator reviews the stored data in the WordPress admin panel. With a suitable gadget chain present on the site - from another installed plugin or an outdated WordPress core - this can escalate to full remote code execution on the hosting server. A publicly available proof-of-concept exists per WPScan, though EPSS remains low (0.22%, 13th percentile) and CISA has not listed this in KEV, suggesting no confirmed widespread in-the-wild exploitation at time of analysis.
Privilege escalation to WordPress administrator in Ultimate Member plugin before 2.12.1 permits unauthenticated registrants to self-assign a site-defined role carrying full administrator capabilities, resulting in complete site takeover. The plugin omits administrator-level roles from its registration form role-filter and ships with its post-registration elevation safeguard disabled by default, creating a two-layered failure that exposes affected sites when a custom admin-capable role exists alongside a role-selection field on a live registration form. A publicly available proof-of-concept is confirmed via WPScan; no public exploit identified at time of analysis as actively exploited (not in CISA KEV), and EPSS sits at 0.14%, reflecting the dependency on specific site configuration.
SQL injection in the Product Feed Manager For WooCommerce WordPress plugin (versions prior to 7.6.1) allows authenticated users holding a Contributor role or higher to execute arbitrary SQL statements against the WordPress database by crafting malicious product-feed custom filter rules. High CVSS impact metrics (C:H, I:H) reflect the potential for full database read and write access, including extraction of user credentials, WooCommerce order records, and site configuration data. A publicly available exploit exists per WPScan, though the EPSS score of 0.16% (5th percentile) suggests active mass exploitation has not materialized; the vulnerability is not listed in CISA KEV at time of analysis.
Unauthenticated information disclosure in the Geeky Bot WordPress plugin (all versions before 1.2.8) permits any remote, unauthenticated user to retrieve chat-history session metadata - including WordPress usernames, user IDs, and timestamps - by invoking an unprotected AJAX endpoint. Reported by WPScan with a publicly available proof-of-concept, this flaw provides attackers with a ready-made user enumeration primitive against any publicly reachable WordPress site running the affected plugin. CISA KEV listing is absent and EPSS sits at 0.14% (4th percentile), indicating limited current mass-exploitation, but the POC lowers the barrier for targeted attacks significantly.
Unauthenticated file upload and arbitrary ticket attachment in JS Help Desk WordPress plugin (all versions before 3.1.4) stems from a complete absence of authorization, nonce validation, and ownership checks on the plugin's front-end request dispatcher. Any unauthenticated remote attacker can upload files - constrained to the plugin's inert allowed extensions - and attach those files to any user's support ticket without possessing an account. A publicly available proof-of-concept exists per WPScan reporting; however, EPSS remains very low (0.14%, 4th percentile) and the vulnerability is not listed in CISA KEV, indicating limited observed exploitation despite POC availability.
Payment verification bypass in the FlxWoo WordPress plugin before 3.1.1 allows unauthenticated attackers to complete WooCommerce orders without paying, because the plugin marks orders as paid without confirming the checkout session was actually settled with the payment processor. Publicly available exploit code exists, and a vendor patch is released; no active exploitation is confirmed in CISA KEV. The flaw enables fraudulent free acquisition of goods or services from any store running the plugin.
Sensitive information disclosure in the Demi WordPress plugin before 0.0.7 lets unauthenticated attackers retrieve full-site backup archives that the plugin writes to a publicly reachable path under a predictable filename with no access control. Because these archives contain the complete site database - including WordPress user password hashes - an attacker can crack or replay credentials to escalate toward administrative takeover. A public exploit exists (WPScan) and a fixed release (0.0.7) is available; EPSS was not supplied but the CVSS is 7.5 (High) and it is not on CISA KEV.
GiveWP WordPress plugin before 4.16.3 exposes sensitive donor privacy data through an unauthenticated REST API endpoint that returns recurring-donation records without access controls. Any unauthenticated remote party can enumerate donor names and subscription details for donors who explicitly chose to give anonymously, directly violating donor privacy expectations. A publicly available exploit exists per WPScan reporting, though EPSS sits at the 5th percentile, suggesting limited opportunistic exploitation at time of analysis. No active exploitation is confirmed via CISA KEV.
Stored cross-site scripting via CSRF in the tourmaster WordPress plugin (all versions before 5.4.8) allows an unauthenticated remote attacker to permanently inject arbitrary JavaScript into the WordPress admin area by tricking a logged-in administrator into triggering a request that stores a malicious custom-filter label. A publicly available proof-of-concept exists per WPScan, though EPSS (0.12%, 3rd percentile) and SSVC (exploitation: none, non-automatable) collectively indicate no confirmed widespread active exploitation at time of analysis. No KEV listing was identified.
SQL injection in the Online Scheduling and Appointment Booking System WordPress plugin before version 27.8 lets unauthenticated attackers extract sensitive database contents, including WordPress user password hashes, through the plugin's public-facing booking request handler. The flaw stems from a user-supplied parameter being neither sanitized nor properly type-cast before use in a SQL query, and is reachable pre-authentication over the network. Publicly available exploit code exists (reported by WPScan), a vendor patch is available, and the EPSS score is low (0.20%) despite the high CVSS of 8.6.
Broken authorization in the Eventin WordPress plugin before 4.1.16 lets unauthenticated visitors create orders and supply their own order status, marking those orders as paid without ever completing payment. Because the order-creation endpoint neither authorizes the requester nor validates the payment state, remote attackers can forge fully-paid transactions, undermining ticket/event revenue integrity. Publicly available exploit code exists (reported by WPScan), though EPSS remains low at 0.15% and it is not listed in CISA KEV.
Unauthenticated option overwrite in the WP Travel Engine WordPress plugin before 6.8.2 lets any anonymous visitor tamper with a site-wide plugin setting because an AJAX action lacks a capability check and the nonce that gates it is served to logged-out users. Attackers do not need credentials; publicly available exploit code exists, though EPSS remains low (0.15%, 4th percentile) and the flaw is not on CISA KEV. Impact is integrity-only, with no direct data disclosure or denial of service.
Full account takeover in the Customer Switching WordPress plugin before 2.1.3 allows a low-privileged user, while an operator is actively switched into their account, to be resolved as that operator and switch into any permitted account including an administrator. Publicly available exploit code exists (reported by WPScan), though EPSS remains low at 0.14% (4th percentile) and it is not in CISA KEV; no public exploit identified as actively used at time of analysis.
Privilege escalation in the ProfileGrid WordPress plugin before 5.9.9.8 lets unauthenticated visitors self-register into any group through the front-end registration form, inheriting that group's configured WordPress role - up to Administrator where such a group exists. Publicly available exploit code exists (published by WPScan) and a vendor patch is available, though EPSS remains low at 0.15% (4th percentile), indicating limited observed exploitation attempts to date.
PHP object injection in the Remote API WordPress plugin (all versions through 0.2) lets unauthenticated attackers deserialize attacker-supplied input, and when a suitable gadget chain is available it escalates to remote code execution on the host. The flaw stems from the plugin processing serialized user input before any authentication check. Publicly available exploit code exists (WPScan), though EPSS remains low (0.25%, 17th percentile) and it is not listed in CISA KEV.
Account takeover in the miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 lets unauthenticated attackers hijack any account, including administrators. The optional email-verification one-time code is not bound to the account it was issued for, so an attacker requests a code for an email they control and replays it against a victim's email to obtain a valid session. Publicly available exploit code exists (WPScan) and a vendor patch is available, though EPSS remains low at 0.14%.
Stored Cross-Site Scripting in the WOLF WordPress plugin before 1.1.0 lets an unauthenticated attacker persist malicious script into a post by exploiting a CSRF-exposed AJAX action lacking nonce and capability checks. Because a logged-in administrator must be tricked into triggering the request (UI:R), exploitation is CSRF-driven rather than direct, but a successful attack injects attacker-controlled JavaScript that executes in the context of anyone viewing the affected post. Publicly available exploit code exists (reported by WPScan), though the EPSS score is very low (0.12%, 2nd percentile) and it is not on the CISA KEV list.
Two-factor authentication bypass in the UsersWP WordPress plugin before 1.2.67 lets an attacker who already possesses a victim's username and password skip the second authentication factor and fully log in as that user. The two-factor login handler fails to validate the selected authentication provider (CWE-287), so the 2FA step can be circumvented. Publicly available exploit code exists and a vendor patch is released, but there is no public exploit identified as actively exploited in the wild.
Unauthenticated remote code execution in the Streamit WordPress theme (versions up to and including 4.5.0) stems from a missing-authorization AJAX endpoint that invokes an attacker-supplied PHP function with attacker-supplied arguments, letting unauthenticated attackers create administrator accounts and run arbitrary code. Reported by WPScan and tracked as EUVD-2026-50115, it carries a CVSS 9.8 and publicly available exploit code exists, though there is no public exploit identified as being used in active attacks at time of analysis.
Arbitrary file disclosure and SSRF in the WP Media Folder Addon WordPress plugin (all versions through 4.1.6) let unauthenticated remote attackers read local files and coerce server-side requests via two AJAX handlers that fail to validate a user-supplied path parameter, but only on sites where a cloud-storage connection is configured. This is an incomplete-fix regression of CVE-2026-9690, which hardened only one cloud-storage handler and left the others exploitable. Publicly available exploit code exists (reported by WPScan); there is no public exploit identified as being used in active attacks and it is not listed in CISA KEV.
Unauthorized post creation and arbitrary post/page overwrite in the Tablesome Table WordPress plugin before version 1.1.31 due to missing authentication, capability, and nonce checks in an AJAX action. Unauthenticated attackers can create new published posts or overwrite any existing published content. Public exploit code exists, but no active exploitation has been confirmed; EPSS predicts very low exploitation probability (0.18%).
We need to generate a JSON object with the specified fields, synthesizing all provided data about CVE-2026-14870. First, parse the input: CVE ID: CVE-2026-14870 Description: The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. CVSS Score: 7.1 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L CWE: CWE-79 EPSS: 0.15% (percentile 5%) POC/Exploit: Publicly available Patch: Available from vendor Reported by: WPScan CPE: cpe:2.3:a:unknown:database_for_contact_form_7,_wpforms,_elementor_forms:*:*:*:*:*:*:*:* Tags: XSS, WordPress, Database For Contact Form 7 Wpforms Elementor Forms SSVC: Exploitation: poc, Automatable: no, Technical Impact: partial ENISA EUVD ID: EUVD-2026-49701 Affected versions (EUVD): ["Database for Contact Form 7, WPforms, Elementor forms 0 <1.5.3"] References: [cveorg] (exploit) https://wpscan.com/vulnerability/d574b78c-df04-4dab-bd33-e3a22ff51918/ [euvd] (advisory) https://nvd.nist.gov/vuln/detail/CVE-2026-14870 Now, construct each field as a paragraph string. product_name: The plugin name is "Database for Contact Form 7, WPforms, Elementor forms". So product_name: "Database for Contact Form 7, WPforms, Elementor forms" – but that's long, but permissible as a product name. The task says "1-3 words ONLY." That's problematic because the product name is longer. I need to pick a short name. The plugin's main purpose: it's a database plugin for those form plugins. Maybe "WordPress Forms Database" or "Database for CF7, WPforms, Elementor Forms"? But I must keep it 1-3 words. The plugin name as per WPScan: "Database for Contact Form 7, WPforms, Elementor forms". I could shorten to "Database for Contact Form 7, WPforms, Elementor forms plugin"? No, that's too long. The instruction says: "product_name": "1-3 wor
Account takeover in TrueBooker WordPress plugin before 1.2.4 enables unauthenticated attackers to reset any user’s password via a front-end handler lacking ownership validation, compromising the entire site. Public proof-of-concept exploit code is available, though EPSS exploitation probability remains low (0.14%) and no CISA KEV listing confirms active exploitation.
BookingPress Appointment Booking Pro WordPress plugin before version 5.7.3 exposes all REST API routes in a specific namespace without requiring authentication, enabling any remote attacker to read sensitive customer booking information and modify other users' bookings. Public exploit code is available, making exploitation straightforward.
Remote code execution in FacturaONE for WooCommerce plugin before version 5.37 allows unauthenticated attackers to write arbitrary files to a web-accessible directory and achieve code execution, because a request handler relies on an empty default cryptographic key and lacks authentication. Public exploit code is available.
Download Manager WordPress plugin before 3.3.62 fails to bind temporary download tokens to user sessions, creating long-lived, reusable bearer tokens. An attacker who obtains a leaked token can repeatedly bypass authentication and download role- or password-protected files without authorization. Public proof-of-concept exploit code exists, though no active exploitation has been reported in the wild.
Reflected Cross-Site Scripting (XSS) in MPG WordPress plugin before 4.1.8 allows unauthenticated attackers to inject scripts into a victim's browser by tricking them into visiting a crafted URL. Successful exploitation can lead to session hijacking or defacement. Public exploit code exists, but no active exploitation has been confirmed by CISA KEV.
Unauthenticated arbitrary file upload leading to remote code execution exists in Realtyna Organic IDX plugin + WPL Real Estate for WordPress versions before 5.3.0. The file upload API, enabled by default, authenticates using hardcoded credentials identical across all installations and lacks file type validation, allowing attackers to upload and execute PHP files. Publicly available exploit code increases the likelihood of exploitation.
Authentication bypass in the 微信二维码登陆 WordPress plugin through 1.3 allows unauthenticated attackers to log in as any existing user, including administrators, by forging webhook requests and intercepting leaked login codes. A publicly available proof-of-concept exists, the attack is fully automatable, and the technical impact is total, making this a critical priority for any site using the plugin.
Unauthenticated arbitrary user session termination (force-logout) in the Masteriyo LMS WordPress plugin before version 2.3.1 allows remote attackers to log out any site user, including administrators, via an insecure AJAX action. Publicly available exploit code exists, but no active exploitation has been confirmed by CISA KEV. The high CVSS score from NVD likely overstates impact, as the flaw only disrupts sessions without exposing data.
An unauthenticated user registering on a WordPress site with the Custom Fields Account Registration for WooCommerce plugin before version 1.4 can exploit improperly protected custom fields to overwrite the user capabilities meta key, granting themselves the administrator role. This occurs on sites using a non-default database table prefix where a correspondingly named field has been configured. Publicly available exploit code exists, but active exploitation has not been confirmed by CISA KEV.
Unauthorized order completion in Clover Payment Gateway for WooCommerce prior to 1.3.6 allows unauthenticated attackers to mark any WooCommerce order as paid by replaying a previously approved payment reference, such as one from their own minimal purchase. Public proof-of-concept code exists, and while not listed in CISA's Known Exploited Vulnerabilities, the vulnerability is automatable with partial technical impact according to SSVC analysis.
Unauthorized role assignment in MemberGlut WordPress plugin versions below 1.1.5 allows unauthenticated attackers to register accounts with arbitrary roles, including administrator, leading to complete site takeover. Publicly available exploit code exists. CVSS 9.8 indicates critical severity with low complexity and no required privileges.
MainWP Child plugin before 6.1.2 on WordPress allows unauthenticated attackers to hijack any account, including administrators, by sending a crafted site-registration request when password authentication is disabled for the targeted account. A publicly available exploit exists, but no active exploitation has been confirmed by CISA KEV.
Unauthorized REST endpoint in WowOptin Popup Maker for WordPress (versions <1.4.38) allows unauthenticated attackers to disable all site opt-in forms and insert arbitrary template-based rows into the database. Public exploit code is available, though no active exploitation is reported. EPSS indicates a very low likelihood of widespread attack.
Account takeover in CAFEHAUS API plugin for WordPress allows unauthenticated attackers to arbitrarily reset any user password via a missing authorization endpoint. Versions up to 1.0.0 are affected, enabling complete site compromise by setting an administrator password and logging in. While a public proof-of-concept exists, no widespread exploitation has been confirmed by KEVCISA.
Unauthenticated SQL injection in the 'Project Management, Bug and Issue Tracking Plugin' for WordPress before version 5.1.0 enables remote attackers to extract or modify database contents via the standard front-end issue tracker. Exploit code is publicly available, and the vulnerability has a high CVSS score of 9.1, though EPSS probability remains low at 0.14%.
Unauthenticated privilege escalation in Paid Membership Plugin for WordPress before 4.16.18 allows an attacker to register an account with an elevated role such as Editor or Author, bypassing the configured restriction because the registration handler's role acceptance logic differs from the UI parser. The lack of a nonce on the public handler enables exploitation without user interaction. A public proof-of-concept exists, but no active exploitation has been reported via CISA KEV, and the EPSS score is low at 0.13%.
Two-factor authentication bypass in the Security Ninja Premium WordPress plugin (all versions before 5.290) lets a remote attacker who already knows a valid account password log in without supplying the one-time code, defeating enforced 2FA for any user including administrators. One of the plugin's two 2FA code paths never validates the second factor, so the protection can be silently skipped. Publicly available exploit code exists (published by WPScan) and a vendor patch is available; EPSS is low at 0.25% (17th percentile), indicating no evidence of widespread automated exploitation despite the POC.
Broken access control in the Praison AI SEO WordPress plugin before 5.0.7 lets unauthenticated attackers reach several REST API routes that lack authorization checks, allowing them to alter the permalink of any published post and to read the plugin's stored configuration data. WPScan reported the issue and publicly available exploit code exists, though EPSS remains low at 0.19% and it is not on CISA KEV. Exposure of configuration data (potentially including AI-service API keys and SEO settings) plus silent permalink tampering can break site links and SEO ranking with no login required.
Arbitrary database read in the Events Manager WordPress plugin before 7.3.7 lets unauthenticated bookers inject a malicious serialized PHP object through a booking-registration field on sites running No-User-Account Booking Mode. When the stored booking is later loaded, the object is deserialized without a class allow-list, triggering a gadget chain that reaches an unparameterised SQL query and exposes sensitive data such as user password hashes and secret keys. Publicly available exploit code exists (WPScan) and SSVC rates exploitation as PoC and automatable, though it is not listed in CISA KEV.
Stored cross-site scripting in the Product Addons and Product Options With Custom Fields WordPress plugin (all versions before 1.6.15) lets an unauthenticated attacker abuse an unrestricted file-upload endpoint to plant a malicious SVG that is stored and served inline; its embedded script then runs in the browser session of any user who opens it, including administrators, enabling account takeover. Publicly available exploit code exists and WPScan disclosed the issue, but no public exploit has been identified as used in active attacks. The CVSS 8.8 rating reflects the high impact of hijacking a privileged WordPress session despite the requirement that a victim open the crafted file.
SQL injection in the bpost Shipping Platform WordPress plugin (versions before 3.2.3) lets unauthenticated attackers inject SQL via an unsanitized parameter processed during WooCommerce order submission, enabling time-based blind extraction of database contents. Any WooCommerce store using this Belgian-postal shipping integration is exposed at checkout without authentication or user interaction. Publicly available exploit code exists (WPScan) and a vendor patch is available, though there is no public exploit identified as being actively used in the wild (not in CISA KEV).
Stored cross-site scripting in the Free Theme Builder for Elementor WordPress plugin before 1.6.7 lets unauthenticated attackers inject malicious script through contact form field values, which are stored unsanitized and later rendered in the admin dashboard's form-submissions view. The payload executes in the browser of any logged-in administrator who reviews submissions, enabling session hijacking or actions in the admin's context. Publicly available exploit code exists (WPScan), but there is no evidence of active exploitation and EPSS probability is low (0.17%).
Reflected cross-site scripting in the WordPress plugin 'Tag Groups is the Advanced Way to Display Your Taxonomy Terms' before version 2.2.0 allows unauthenticated attackers to run arbitrary JavaScript in the browser of a logged-in Editor (or higher) who clicks a crafted link, because one AJAX parameter is reflected unescaped into an HTML-typed response. Publicly available exploit code exists (published by WPScan), but the flaw is not listed in CISA KEV and carries a low EPSS score (0.17%, 7th percentile), indicating no evidence of widespread active exploitation. Successful exploitation can hijack an editorial session, letting the attacker act with the victim's WordPress capabilities.
Server-Side Request Forgery in the Kirki WordPress plugin before 6.0.12 allows unauthenticated attackers to coerce the server into issuing HTTP requests to arbitrary attacker-chosen hosts because a user-supplied URL is fetched server-side without validation. This is reachable remotely with no authentication or user interaction (CVSS 9.1), publicly available exploit code exists, and a vendor patch has shipped, but there is no public exploit identified as being used in active attacks (not in CISA KEV). Reported by WPScan (EUVD-2026-45889), the flaw is dangerous on WordPress sites hosted in cloud or internal-network environments where the request can pivot to metadata or intranet services.
Authentication bypass via OTP brute-force in the 'Social Login, Passkeys, Magic Link & Email OTP' WordPress plugin before 1.4.1 lets an unauthenticated attacker who knows a registered email address guess the passwordless one-time-password and log in as that user, including an administrator, resulting in full site takeover. The plugin fails to enforce rate limiting or a working lockout on OTP verification and stores the short numeric codes in plaintext, so codes can be exhausted rapidly. Publicly available exploit code exists (reported by WPScan) and a vendor patch is available, though EPSS remains low at 0.14%.
Reflected Cross-Site Scripting in the LearnPress WordPress plugin before 4.4.1 lets a remote attacker execute arbitrary JavaScript in the browser of a logged-in instructor or administrator who opens a crafted link, because a search parameter is reflected into an HTML attribute without escaping. Publicly available exploit code exists (published by WPScan), but there is no public exploit identified as being used in active attacks; EPSS is low at 0.15% (5th percentile). A vendor patch is available in version 4.4.1.
Stored cross-site scripting in the SlimStat Analytics WordPress plugin before 5.5.0 lets unauthenticated visitors inject a persistent payload through a geolocation value that fires when an administrator opens the analytics reports, enabling admin-session compromise. The flaw is only reachable when the plugin is configured to use the Cloudflare geolocation provider. Publicly available exploit code exists (reported by WPScan) and a vendor patch is available; no public exploit identified as actively exploited and it is not in CISA KEV.
Unauthenticated SQL injection in the Modern Event Calendar Pro and Modern Events Calendar Lite WordPress plugins (all versions before 7.34.0) lets remote attackers extract sensitive database contents by injecting into an unsanitized request parameter used within a SQL statement, reachable through an AJAX action open to unauthenticated users. Publicly available exploit code exists (reported by WPScan), and a vendor patch is available; the CVSS 8.6 rating reflects a scope-changed, high-confidentiality impact with no authentication or user interaction required. No EPSS score or CISA KEV listing was provided, so there is no public exploit identified as being actively exploited at time of analysis.
Stored cross-site scripting in the Unlimited Elements For Elementor WordPress plugin (all versions before 2.0.11) lets an unauthenticated attacker plant a malicious Google review on a targeted business's Google listing that, once fetched via the Serp API and rendered unescaped in the Google Reviews widget, executes JavaScript in the browser of every visitor — including logged-in administrators — of any page showing that Place ID's reviews. Publicly available exploit code exists and the vendor has shipped a fix, but there is no public exploit identified as being used in active attacks. The injection is delivered through third-party review content rather than a direct request to the WordPress site, making it a supply-chain-style stored XSS.
Privilege escalation and full site takeover affects the AI Copilot WordPress plugin before 1.5.4, which fails to bind OAuth access tokens to a specific WordPress user and treats any valid token as an administrator session. An unauthenticated attacker who completes the plugin's public OAuth flow can invoke privileged MCP (Model Context Protocol) tools as an administrator, creating new users and escalating roles. Publicly available exploit code exists and the flaw carries a CVSS 9.8; no active exploitation has been confirmed (not in CISA KEV).
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.3 lets unauthenticated visitors self-assign an arbitrary published membership tier during public registration, gaining that tier's user role - including administrator where such a tier exists. The plugin never validates that the tier submitted in the registration form is one the form actually offers, so an attacker simply tampers with the submitted tier value. Publicly available exploit code exists (reported by WPScan), though active exploitation has not been confirmed.
Payment authentication bypass in the PhonePe Payment Solutions WordPress/WooCommerce plugin before 3.1.0 lets unauthenticated attackers forge payment-success callbacks and mark unpaid orders as paid. Because sites set up through the current onboarding flow have an empty callback-validation secret, the expected signature collapses to an unkeyed hash of the request body that anyone can reproduce. Publicly available exploit code exists (reported by WPScan), though EPSS is low (0.14%) and there is no public exploit identified as being used in the wild.
Reflected Cross-Site Scripting in the FunnelKit WordPress plugin before 3.15.0.6 lets unauthenticated attackers inject arbitrary JavaScript into a page-builder AJAX response, which executes in the browser of a logged-in user who opens an attacker-crafted link. The flaw is only reachable when the Divi builder integration is active, and publicly available exploit code exists though there is no public exploit identified as actively exploited at time of analysis. EPSS was not provided and the vulnerability is not on CISA KEV, so widespread exploitation is unconfirmed.
Authentication bypass in the Abandoned Cart Lite for WooCommerce WordPress plugin before 6.8.2 allows unauthenticated attackers to forge cart-recovery links that log them in as arbitrary users when the automatic-login feature is enabled. Because recovery tokens are neither integrity-protected nor bound to the requesting account, an attacker can craft a link that authenticates them as a victim, yielding full account takeover (SSVC technical impact: total). Publicly available exploit code exists (WPScan), though it is not listed in CISA KEV and EPSS is low (0.14%).
Privilege escalation in the Redux Framework WordPress plugin before 4.5.13 allows authenticated Subscriber-level users to become Administrators by writing arbitrary user meta keys through the plugin's custom profile fields, on sites where the Users extension (user-profile feature) is enabled. Because the plugin does not restrict which user meta keys are written when saving custom profile fields, an attacker can inject the wp_capabilities meta to grant themselves the administrator role. Publicly available exploit code exists (published by WPScan), though EPSS remains low at 0.14% and there is no evidence of active exploitation.
Authentication bypass in the Happy Coders OTP Login for WooCommerce WordPress plugin (versions 1.5 through 2.7) lets unauthenticated remote attackers log in as any existing user, including administrators, and create arbitrary accounts. The plugin authenticates a user from a supplied identifier without confirming that the one-time password was ever validated. Publicly available exploit code exists (WPScan) and a vendor patch (2.8) is available; EPSS remains low at 0.15% despite the maximal 9.8 CVSS score.
UNION-based SQL injection in the Quotes Llama WordPress plugin (all versions before 3.1.6) lets unauthenticated remote attackers inject arbitrary SQL through an unsanitized request parameter and read any data from the WordPress database, including user password hashes. Publicly available exploit code exists and a vendor patch has been released; the flaw carries a high EPSS-relevant profile because it is remotely reachable with no authentication or user interaction. This is no public exploit identified as actively exploited (not in CISA KEV), but working PoC availability makes opportunistic mass-scanning likely.
Authentication bypass in the Shibboleth WordPress plugin before 2.5.4 lets remote unauthenticated attackers forge identity headers and log in when the HTTP header identity mode is enabled without an anti-spoofing key. Because the plugin fails open rather than closed, any request carrying identity headers is trusted as an authenticated session, and with automatic account creation plus the default administrator role mapping an attacker can provision and sign in as a brand-new administrator. Rated CVSS 8.1 (CWE-287); publicly available exploit code exists (WPScan), but it is not listed in CISA KEV.
Unauthenticated PHP object injection in the Newsletters WordPress plugin before 4.15 lets remote attackers deserialize attacker-controlled data submitted through a public-facing form, then leverage a property-oriented gadget chain bundled inside the plugin itself to write arbitrary files and achieve remote code execution on the host. Publicly available exploit code exists (published via WPScan), though there is no public exploit identified as being used in active attacks and the flaw is not listed in CISA KEV. The self-contained gadget chain removes the usual dependency on third-party gadgets, making reliable exploitation notably more achievable than typical POI bugs.
Arbitrary file write in the AI Engine WordPress plugin before 3.5.5 lets authenticated editor-level users abuse an unsanitized, user-supplied filename during a file-download-and-save operation to plant attacker-controlled bytes anywhere the web server user can write via path traversal. Because writing a PHP payload into the webroot typically yields remote code execution, this crosses from a content-management flaw into full site compromise. Publicly available exploit code exists and a vendor patch has shipped, though the issue is not listed in CISA KEV.
Arbitrary file deletion in the Word Count and Social Shares WordPress plugin (versions through 1.0) lets any authenticated low-privilege user, including a Subscriber, delete any file the web server can reach because the plugin neither validates the supplied file path nor enforces authorization or CSRF protection. Deleting critical files such as wp-config.php can trigger WordPress's setup/installation flow and enable a full site takeover. Publicly available exploit code exists (reported by WPScan); there is no public exploit identified as actively used, and the issue is not on the CISA KEV list.
SQL injection in the Library Management System WordPress plugin before 3.5.8 lets unauthenticated attackers inject arbitrary SQL through an unsanitized request parameter and read data straight from the WordPress database, including user password hashes. Publicly available exploit code exists and the flaw was reported by WPScan, though the EPSS probability is low (0.18%, 7th percentile) and it is not on CISA KEV. The vendor has shipped a fixed release (3.5.8), making patching the clear priority for affected sites.
Broken authorization in the Tutor LMS WordPress plugin (before 3.9.13) lets authenticated subscriber-level users bypass paid/private-course access controls when the Droip or Kirki page-builder integration is active. Because these integration handlers omit the enrollment, purchase, and private-course capability checks enforced in the core course handler, low-privileged accounts can self-enroll in paid or private courses, read otherwise-restricted content, and mark arbitrary courses complete. Reported by WPScan with publicly available exploit detail and a vendor patch released; no active exploitation is currently listed in CISA KEV.
Payment-verification bypass in the User Registration & Membership WordPress plugin before 5.2.2 lets unauthenticated attackers forge a payment-provider webhook to mark a subscription as paid, activating premium memberships without any real transaction. WPScan reports publicly available exploit code, though there is no public exploit identified as being used in active attacks (not in CISA KEV). The core weakness is that inbound webhook notifications are trusted and acted upon without authenticating their origin or signature.
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.2 lets any authenticated low-privileged user (e.g. a subscriber) alter another account's WordPress role and membership tier. The membership-upgrade action performs no authorization check and trusts a caller-supplied user identifier instead of the current session, so an attacker can target an arbitrary account - including their own - to gain higher roles up to administrator. Publicly available exploit code exists and a vendor patch is available, but this is not listed in CISA KEV.
Content destruction and covert data exfiltration in the EscortWP WordPress theme (all builds through 3.6.2) stem from a deliberately obfuscated, vendor-authored backdoor rather than an accidental coding flaw. Any unauthenticated remote attacker who knows the hard-coded per-build key can permanently delete every piece of the site's content, while the theme silently beacons the site URL, administrator email, and license key to a third-party server. Publicly available exploit code exists (reported by WPScan), though EPSS probability is low (0.14%, 4th percentile) and it is not on CISA KEV.
Information disclosure in the Everest Forms WordPress plugin before 3.5.0 allows unauthenticated remote attackers to download other users' form submissions. The plugin generates temporary CSV files during email-notification processing but fails to reliably delete them, leaving them publicly accessible in the wp-content uploads directory under predictable, enumerable filenames. Publicly available exploit code exists and the flaw is automatable per CISA SSVC, though EPSS remains low at 0.14%; not listed in CISA KEV.
PHP object injection in the Appointment Booking Calendar and Scheduling Plugin for WordPress (all versions through 1.1.28) lets unauthenticated attackers pass attacker-controlled data into a PHP deserialization call, and where a suitable gadget chain exists on the site this can be escalated to remote code execution. Reported by WPScan with publicly available exploit detail, though EPSS is low (0.23%, 13th percentile) and CISA SSVC records no observed exploitation, so this is a proof-of-concept-grade risk rather than confirmed active exploitation. Impact is total (confidentiality, integrity, availability) when a gadget chain is present, but the high attack complexity reflects that dependency.
OS command injection in a family of popular WordPress file-manager plugins - FileOrganizer (before 1.1.9), Advanced File Manager (before 5.4.12), File Manager Pro (before 2.1.1), and File Manager (before 8.0.4) - lets authenticated users inject arbitrary shell commands through an unescaped parameter passed to the ImageMagick convert CLI during image operations. Reported by WPScan, publicly available exploit code exists, though EPSS is modest at 0.52% (40th percentile) and CISA SSVC records exploitation as 'none'. Exploitation is real but gated: the server must fall back to the ImageMagick convert binary because neither the PHP imagick nor GD extension is installed.