Unknown
Monthly
Authenticated remote code execution in the FileOrganizer WordPress plugin before 1.2.0 lets users granted file-manager access upload arbitrary PHP files because several file-management operations skip file-type validation. Publicly available exploit code exists, and the flaw is an incomplete fix of CVE-2024-7985, which only hardened the upload operation while leaving other file-management endpoints unvalidated. With CVSS 3.1 base 8.8 (PR:L) and a working PoC, any low-privileged account with file-manager rights - extendable to sub-administrator roles via the premium add-on - can achieve full site compromise.
Stored/reflected cross-site scripting in the Simple Membership WordPress plugin before 4.7.5 lets unauthenticated attackers execute arbitrary JavaScript in a logged-in administrator's browser by abusing the Stripe webhook handler. When no Stripe signing secret is configured, the plugin fails to verify webhook authenticity and then renders an attacker-controlled value unescaped inside an admin notice. Publicly available exploit code exists (WPScan), though EPSS remains low at 0.18% and no active exploitation is reported (not in CISA KEV).
Stored cross-site scripting in the Ultimate Member WordPress plugin before 2.12.0 lets authenticated Subscriber-level users inject persistent JavaScript through custom textarea profile fields, which executes in the browser of any visitor - including administrators - who views the poisoned profile. Publicly available exploit code exists (WPScan), though EPSS is low (0.17%) and SSVC records no observed exploitation, so this is a real but not yet actively-exploited privilege-escalation-capable XSS.
Account takeover in the AllCoach WordPress plugin before 1.0.2 lets remote attackers overwrite the password of any existing account - including administrators - by re-submitting that account's email address to the public account-registration endpoint, which fails to check whether the email is already tied to a user before writing a new password. Publicly available exploit code exists and a vendor patch (1.0.2) has been released, but there is no public exploit identified as actively exploited in the wild; EPSS is low (0.14%, 4th percentile) and CISA SSVC rates exploitation as 'none' despite a 'total' technical impact. The provided CVSS vector lists PR:L, which conflicts with the description's explicit 'unauthenticated attackers' claim and should be verified.
Two-factor authentication bypass in the WebAuthn Provider for Two Factor WordPress plugin (all versions before 2.5.6) lets an attacker who already possesses a valid user's password defeat the WebAuthn second factor by submitting a malformed authentication response that the plugin fails to validate. This neutralizes the plugin's core protection, effectively reducing account security back to single-factor (password-only). Publicly available exploit code exists (reported by WPScan); there is no public exploit identified as being used in active attacks and the issue is not listed in CISA KEV.
Privilege escalation in the Advanced Form Integration - Connect Forms to 200+ Apps WordPress plugin before 2.1.1 allows unauthenticated visitors to provision a full administrator account through a public form. Because the plugin fails to restrict which WordPress role it assigns during user creation, any site that maps the user-role field to a public form input via an active integration exposes site takeover to anonymous submitters. Publicly available exploit code exists (reported by WPScan), though this is not listed in CISA KEV and requires a specific non-default integration configuration, so real-world exposure is narrower than the 8.1 CVSS suggests.
Unauthenticated information disclosure in the Product Configurator for WooCommerce WordPress plugin (versions before 1.7.3) exposes sensitive product data through a public AJAX action that skips authorization and post-status checks. By supplying only a product ID, remote unauthenticated users can read titles, prices, weights, stock status, and configurator option pricing/SKUs of private and draft products, bypassing WordPress post-visibility controls. Publicly available exploit code exists (reported by WPScan), though there is no indication of active exploitation.
Broken access control in the Royal MCP WordPress plugin before 1.4.26 lets any authenticated low-privileged user (e.g. Subscriber) invoke privileged MCP tools that skip capability checks after token authentication, exposing private content, full user/role enumeration, and create/modify/delete operations on other users' content. Reported by WPScan with a publicly available exploit and a vendor patch in 1.4.26; the CVSS 8.1 vector (PR:L) confirms authenticated but not administrative access is required. There is no public exploit identified as actively exploited - status is POC only, not CISA KEV.
Unauthenticated SQL injection in the WP Support Plus Responsive Ticket System WordPress plugin (all versions through 9.1.2) lets remote attackers inject arbitrary SQL by abusing user-supplied array keys that are passed into a query without sanitization. Any unauthenticated visitor can extract sensitive database contents such as WordPress user records and password hashes. Publicly available exploit code exists, though EPSS rates exploitation probability low (0.18%, 7th percentile) and it is not on CISA KEV.
Stored cross-site scripting in the WP Support Plus Responsive Ticket System WordPress plugin (all versions through 9.1.2) lets unauthenticated attackers upload files containing malicious JavaScript - such as HTML or SVG payloads - to a publicly accessible location, where the script executes in the browsers of site users and administrators who view it. The flaw stems from missing validation of uploaded file types/content. Publicly available exploit code exists (reported by WPScan), though it is not listed in CISA KEV and no EPSS score was provided.
Stored Cross-Site Scripting in the APCu Manager WordPress plugin before 4.5.0 lets unauthenticated attackers seed a malicious APCu object-cache key (for example via a crafted transient name) that later executes arbitrary JavaScript in the browser of any administrator who opens the plugin's admin-area page. Publicly available exploit code exists (reported by WPScan) and a vendor patch is available, but there is no public exploit identified as being actively used; EPSS is low at 0.16% (5th percentile), consistent with the SSVC exploitation status of none.
SQL injection in the SALESmanago & Leadoo WordPress plugin before 3.11.3 allows low-privileged authenticated users to inject arbitrary SQL through an unsanitised parameter passed to a vulnerable AJAX action. Because the action enforces no authorisation check, even subscriber-level accounts can reach it, and the CVSS scope-changed, high-confidentiality rating (7.7) reflects the ability to read data across the WordPress database. Publicly available exploit code exists (WPScan), though EPSS is low (0.16%) and SSVC classifies exploitation as proof-of-concept only, not active.
Information disclosure in the YMC Filter WordPress plugin before 3.11.3 lets unauthenticated remote attackers read the titles and content of private, draft, and other non-public posts by abusing a REST API endpoint that lacks proper authorization and fails to validate a user-supplied query parameter. WPScan reported the flaw, a public exploit exists, and a vendor patch is available; the CVSS 3.1 score is 7.5 reflecting high confidentiality impact with no integrity or availability effect.
Order shipping-destination tampering in the InPost PL WooCommerce plugin (versions before 1.9.1) lets unauthenticated remote attackers silently change the parcel-locker delivery point of any order still in 'pending' or 'processing' status, because the plugin never verifies the request comes from the legitimate buyer. Publicly available exploit code exists and a vendor patch has been released, though this is not listed in CISA KEV (no public exploit identified as actively exploited at time of analysis beyond the published POC). With CVSS 7.5 and an integrity-only impact, the practical risk is shipment redirection / parcel theft rather than data disclosure.
Stored cross-site scripting in the Email Address Encoder WordPress plugin (free, before 1.0.25) and its Email Encoder Premium counterpart (before 0.3.12) lets unauthenticated visitors inject persistent JavaScript through the plugin's flawed email-replacement handling. Publicly available exploit code exists (disclosed by WPScan) and a vendor patch is available, but it is not in CISA KEV, so there is no public exploit identified as actively used in the wild. Successful exploitation executes attacker script in the browser of any user who later renders the affected page, typically an authenticated administrator.
Sensitive information disclosure in the premium Cornerstone page builder (bundled with the X theme) versions 3.0.0 through 7.8.7 allows any authenticated WordPress user to extract raw password hashes and other private user metadata. The CSS-preview request handler fails to enforce capability checks while exposing its required nonce on every wp-admin page, and publicly available exploit code exists per WPScan, though no active exploitation has been reported.
Authenticated information disclosure in the premium Cornerstone page builder (bundled with the X WordPress theme) before version 7.8.9 allows any logged-in user to enumerate other users' metadata via an unprotected REST API route. Disclosed data includes roles, session token previews, and stored billing/shipping fields, enabling account targeting and potential session abuse. Publicly available exploit code exists per WPScan, though there is no public exploit identified as actively used in the wild and the issue is not listed in CISA KEV.
PHP Object Injection in the Post Duplicator WordPress plugin before 3.0.15 lets authenticated users with Contributor-level access or higher inject arbitrary serialized PHP objects by abusing the plugin's post-duplication routine, which copies attacker-controlled custom meta-data without the WordPress meta API's double-serialization safeguard. Successful exploitation can lead to property-oriented programming attacks and, with a suitable gadget chain present, full compromise of the site. Publicly available exploit code exists (WPScan), though the flaw is not listed in CISA KEV and carries a low EPSS score (0.15%, 5th percentile).
Supply-chain compromise of three commercial WordPress plugins - Smart Post Show Pro (before 4.0.2), Real Testimonials Pro (before 3.2.5), and Product Slider for WooCommerce Pro (before 3.5.3) - shipped malicious code via the vendor's compromised update server, letting remote unauthenticated attackers deploy a second-stage payload that harvests credentials and other sensitive data and takes full control of affected sites. Publicly available exploit code exists and a patch is available from the vendor, but there is no public exploit identified as being used for active exploitation and the flaw is not in CISA KEV. EPSS is low (0.20%, 10th percentile), consistent with the malicious builds having been pulled once discovered rather than being mass-exploited in the wild.
Unauthenticated file disclosure in the Frontend File Manager Plugin for WordPress (all versions through 23.6) exposes every user-uploaded file to anonymous download via identifier enumeration. The plugin's file download handler fails to properly enforce WordPress nonce validation, stripping the only access control gate between unauthenticated HTTP requests and user-uploaded content. A public proof-of-concept is available via WPScan, and SSVC assessment confirms the attack is automatable - any script that iterates numeric file identifiers can bulk-harvest uploaded documents, images, or sensitive attachments without credentials. Not currently listed in CISA KEV.
Reflected cross-site scripting in the Simple Basic Contact Form WordPress plugin (all versions through 20250114) allows unauthenticated remote attackers to execute arbitrary JavaScript in a visitor's browser when the victim follows a crafted link or submits a cross-site forged form that triggers a validation error. Publicly available exploit details have been published by WPScan, though the issue is not listed in CISA KEV and no EPSS data is provided in the input.
SQL injection in the Infility Global WordPress plugin before 2.15.19 allows authenticated users with Subscriber-level access or higher to inject arbitrary SQL via unsanitized parameters. Publicly available exploit code exists (WPScan), and a vendor patch has been released, raising the practical risk on sites that allow open user registration. No CISA KEV listing at time of analysis.
Privilege escalation in the Vitepos WordPress point-of-sale plugin before 3.4.2 lets an authenticated user holding a custom Vitepos role assign themselves the administrator role through an insufficiently restricted user-creation REST API endpoint, resulting in full site takeover. WPScan reports publicly available exploit code exists, though the flaw is not listed in CISA KEV and SSVC records no observed exploitation. With a modest EPSS of 0.24% (14th percentile) but a 'total' technical impact, this is a credentialed-but-realistic escalation path rather than a mass-exploited internet threat.
Stored cross-site scripting in the Transbank Webpay WordPress plugin before 1.14.0 lets unauthenticated visitors inject malicious script into plugin log entries that execute in the browser of any administrator who later views the logs. Because injection requires no authentication and the payload runs in a privileged admin session, it can be used to hijack the WordPress backend; publicly available exploit code exists and a public write-up chains the flaw toward remote code execution. EPSS is low (0.16%, 6th percentile) and CISA SSVC records no observed exploitation, so real-world targeting appears limited despite the high CVSS of 7.1.
Reflected Cross-Site Scripting in the Ultimate WooCommerce Auction Pro WordPress plugin (all versions through 2.4.5) allows remote attackers to inject arbitrary JavaScript into a page by tricking a logged-in high-privilege user, such as an administrator, into clicking a crafted link. The flaw stems from an unsanitized, unescaped request parameter reflected back into the response, and publicly available exploit code exists (reported by WPScan), though EPSS probability is low (0.15%, 4th percentile) and there is no evidence of active exploitation.
Reflected cross-site scripting in the Taskbuilder WordPress plugin before 5.0.8 lets an unauthenticated attacker inject arbitrary JavaScript by tricking a logged-in user into visiting a crafted URL. The plugin echoes an unsanitised URL parameter directly into inline JavaScript on any frontend page that renders one of its shortcodes, so the payload executes in the victim's authenticated browser session. Publicly available exploit code exists (WPScan), though EPSS remains low (0.18%) and the flaw is not in CISA KEV.
Reflected Cross-Site Scripting in the weMail WordPress plugin (versions before 2.1.3) lets unauthenticated attackers inject arbitrary JavaScript by luring any logged-in user to a crafted URL, because a user-supplied parameter is reflected unescaped into an HTML attribute on an AJAX endpoint that lacks nonce protection. Successful exploitation runs script in the victim's authenticated browser session - including administrators - enabling session/account takeover of the WordPress site. Publicly available exploit code exists (WPScan), though EPSS is low (0.21%) and there is no evidence of active exploitation.
Privilege escalation to full administrator in the WP Maps Pro WordPress plugin before 6.1.1 allows remote unauthenticated attackers to create a rogue admin account and obtain an interactive login. The plugin exposes an unauthenticated AJAX handler that trusts a nonce publicly rendered on any front-end page loading its map script, so the nonce provides no real authorization. Publicly available exploit code exists and a vendor patch is available; despite the 9.8 CVSS the EPSS probability is low (0.13%, 3rd percentile) and CISA SSVC records no observed exploitation.
Unauthenticated arbitrary file upload in the Schema & Structured Data for WP & AMP WordPress plugin before version 1.60 allows remote attackers to upload any file type accepted by WordPress's media library through frontend AJAX handlers intended for images and videos only. The plugin fails to perform user capability checks and does not validate uploaded file content against the endpoint's declared media type. Publicly available exploit code exists via WPScan, increasing the urgency for immediate patching despite no confirmed in-the-wild exploitation.
Stored cross-site scripting in the Anti-Spam by CleanTalk Spam Protection WordPress plugin before 6.79 allows unauthenticated remote attackers to inject arbitrary JavaScript into approved comments via a custom shortcode in the email-encoding feature, with execution occurring when any visitor or administrator views the affected post. Publicly available exploit code exists per WPScan, increasing exposure for the plugin's large WordPress installation base, though it requires user interaction (UI:R) to trigger the payload. The high CVSS score of 8.8 reflects the potential for administrator account compromise leading to full site takeover.
Unauthenticated SQL injection in the XStore WordPress theme before 9.7.3 allows remote attackers to inject arbitrary SQL queries through an AJAX action that fails to sanitise and escape a user-supplied parameter. Publicly available exploit code exists per WPScan, and the changed scope (S:C) with high confidentiality impact indicates an attacker can extract sensitive data across security boundaries - including WordPress user records, password hashes, and configuration secrets - without any credentials or user interaction.
Two-factor authentication bypass in the Really Simple Security WordPress plugin before 9.5.10.1 allows attackers who already possess a valid username and password to hijack a fully authenticated WordPress session without completing the email OTP challenge. Two REST endpoints in the plugin's 2FA flow fail to enforce the second-factor challenge, effectively neutralizing the MFA protection the plugin is marketed to provide. Publicly available exploit code exists (WPScan), and a vendor patch has been released.
Unauthenticated refund abuse in the Eupago Gateway for WooCommerce WordPress plugin before 4.7.2 lets remote attackers trigger refunds on arbitrary WooCommerce orders using the merchant's own payment gateway credentials, and for certain payment methods divert the refunded funds to an attacker-controlled bank account. The CVSS 8.6 score reflects the network-reachable, no-auth, no-interaction attack path against a financial workflow; publicly available exploit code exists per WPScan, though there is no public exploit identified at time of analysis confirming active exploitation in CISA KEV.
Reflected cross-site scripting in the Ajax Load More WordPress plugin (all versions before 7.8.4) allows remote attackers to execute arbitrary JavaScript in a victim's browser by reflecting an unsanitized, unescaped request parameter back into the page. The attack targets high-privilege users such as administrators, who must be lured into clicking a crafted link; publicly available exploit code exists, though EPSS estimates exploitation probability at only 0.03% (8th percentile) and there is no public exploit identified as being used in active campaigns.
Local File Inclusion in the WP Maps WordPress plugin before 4.9.3 allows authenticated users to read arbitrary files by injecting path traversal sequences into an unsanitized parameter used to build a file path. Publicly available exploit code exists (reported by WPScan), though EPSS is low (0.03%, 8th percentile) and the flaw is not automatable per SSVC. A vendor patch is available in version 4.9.3.
SQL injection in the WP Photo Album Plus WordPress plugin before 9.1.11.001 allows unauthenticated attackers to inject arbitrary SQL through an improperly sanitized parameter, exposing backend database contents such as user credentials and hashed passwords. The CVSS vector (PR:N, S:C, C:H) indicates no authentication is required and that a successful attack reaches data beyond the plugin's own scope. Publicly available exploit code exists (reported by WPScan) and a vendor patch is available, though the EPSS score is very low at 0.04% (14th percentile).
Unauthenticated stored cross-site scripting affects the Autoptimize (before 3.1.15), Clearfy Cache (before 2.4.2), and Speed Optimizer (before 7.7.9) WordPress plugins, which share a common HTML-minification routine. Because the placeholder hash used to protect content during minification is predictable, an unauthenticated attacker who can get their input processed by the minifier can anticipate the placeholder format and inject arbitrary HTML attributes into the final rendered output. Publicly available exploit code exists (WPScan), a vendor patch is available, and EPSS is low (0.03%), but the impact is total per CISA SSVC; there is no public exploit identified as being used in active attacks.
Unauthenticated attackers can exploit SQL injection in OttoKit: All-in-One Automation Platform WordPress plugin versions before 1.1.23 due to improper input sanitization in SQL statement construction. The vulnerability allows remote attackers to extract sensitive data and modify database contents without authentication, though integrity impact is limited. Publicly available exploit code exists, and a patch has been released by the vendor.
SQL injection in Product Filter for WooCommerce by WBW plugin versions below 3.1.3 allows unauthenticated remote attackers to extract sensitive database contents including user credentials, customer data, and order information. The vulnerability requires no authentication (CVSS PR:N) and has low attack complexity with publicly available exploit code. EPSS data not available, but the combination of unauthenticated access, public POC, and WordPress's large attack surface creates substantial real-world risk for unpatched WooCommerce installations.
Improper access control in the ActivityPub WordPress plugin before 8.0.2 exposes draft, scheduled, and pending posts to unauthenticated remote users, resulting in confidentiality breach. This information disclosure vulnerability (CVSS 7.5) allows network-based attackers to access unpublished content without authentication or user interaction. Publicly available exploit code exists, though no confirmed active exploitation (not in CISA KEV). EPSS score of 0.02% (6th percentile) suggests low current exploitation probability despite POC availability, but SSVC framework marks it as automatable with partial technical impact.
Remote code execution in Spam Protect for Contact Form 7 WordPress plugin before version 1.2.10 allows authenticated users with editor-level privileges to achieve arbitrary code execution by crafting malicious headers that are logged to a PHP file. The vulnerability is publicly exploitable with proof-of-concept code available, making it a critical risk for WordPress installations using affected plugin versions.
Unauthenticated attackers can book time slots in the Appointment Hour Booking WordPress plugin (before 1.5.95) that have already reached their configured capacity, because each appointment in a multi-appointment booking submission is not validated against the capacity limit of its own slot. The plugin assigns a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N, integrity-only impact), meaning any anonymous visitor can submit a crafted booking form and overwrite or occupy fully booked slots, denying legitimate customers their reservations. Publicly available exploit code exists per WPScan, but the issue is not listed in CISA KEV and EPSS-style mass exploitation signals are absent, so this is best treated as a business-logic abuse and booking-integrity risk rather than a code-execution emergency.
Unauthenticated visitors can mark unpaid Eventin orders of any value as paid by replaying a single genuine low-value payment transaction, because the plugin only checks that the gateway reports success and never validates the amount, currency, or which order the transaction belongs to. The flaw affects WordPress sites running the Eventin event-management plugin before version 4.1.24, and exploit detail is publicly available via the WPScan advisory. There is no indication in the supplied data that this is being actively exploited (no CISA KEV listing), and EPSS data was not provided.
Unauthenticated visitors can inject arbitrary WordPress shortcodes, including attacker-chosen attributes, into Formidable Forms versions before 6.35 because a request-derived value is substituted into a form's custom HTML and then passed through the shortcode parser server-side. Any page rendering an affected form will execute the injected shortcode, which can expose data or alter site behaviour depending on which shortcodes are installed on the target. Publicly available exploit code exists per WPScan, but CISA KEV does not list this issue and the CVSS score is moderate (4.8, AV:N/AC:H/PR:N/UI:N/C:L/I:L/A:N), reflecting configuration-dependent preconditions and limited impact.
HTML injection in the Royal Elementor Addons WordPress plugin before version 1.7.1067 lets unauthenticated visitors inject arbitrary HTML into the administrator notification emails generated by the plugin's form widget. Because form submissions are not sanitized before being embedded in the email body, an attacker can place crafted markup, malicious links, or spoofed content in mail that lands in the site administrator's inbox. Publicly available exploit code exists, and exploitation hinges on the administrator opening the notification email (CVSS UI:R), giving a base score of 6.1; no CISA KEV listing or EPSS score was supplied with the source data.
Payment bypass in the Quads Ads Manager for Google AdSense WordPress plugin (versions before 3.0.5) allows any low-privilege authenticated user capable of placing an advertising order to obtain paid ad placements at no cost. The plugin fails to verify transaction completion with the configured payment gateway before updating an order's status to paid, representing a fundamental business logic failure in the purchase flow. A publicly available proof-of-concept exploit has been published by WPScan, and the vendor has released a fix in version 3.0.5.
Unauthenticated information disclosure in the Bookit - Booking & Appointment Calendar WordPress plugin (versions before 2.6.0.1) exposes appointment records belonging to other customers via the availability-check endpoint. Any unauthenticated visitor can query this endpoint and receive free-text booking comments, personal contact information, and appointment details that belong to other registered users. A publicly available proof-of-concept exploit exists (documented by WPScan), lowering the skill barrier for abuse. No active exploitation has been confirmed in CISA KEV.
Horizontal privilege escalation in rtMedia for WordPress, BuddyPress and bbPress plugin before version 4.7.12 allows any authenticated subscriber-level user to alter the privacy settings of other users' activities and attached media. The plugin's privacy-change endpoint validates only a WordPress nonce that is shared across all logged-in users, performing no ownership verification against the requesting account. A publicly available exploit for this flaw has been disclosed via WPScan, enabling unauthorized exposure of private media or suppression of public content across a community site's user base.
Privilege escalation in the Simple Membership WordPress plugin before 4.7.8 allows authenticated members to obtain higher-tier memberships without paying the correct price. The plugin's PayPal IPN (Instant Payment Notification) handler accepts the membership level asserted in the payment notification without verifying it matches the level configured for the specific payment button that was purchased, enabling a low-cost membership purchase to be fraudulently upgraded to any higher tier. A publicly available exploit exists, and vendor patch 4.7.8 resolves the issue.
Unauthenticated information disclosure in the User Registration & Membership WordPress plugin (versions 5.0 through 5.2.7) exposes arbitrary users' email addresses, profile fields, roles, and membership order details to any visitor. The plugin's membership confirmation page performs no ownership verification - an attacker who supplies another user's identifier in the request receives that user's data if the site operator has configured user smart tags on the page's message template. No public exploit confirmed in CISA KEV, though a publicly available proof-of-concept is documented by WPScan.
Open redirect in the User Registration & Membership WordPress plugin before 5.2.8 permits unauthenticated attackers to craft post-login redirect URLs pointing to arbitrary external domains, enabling phishing campaigns targeting site visitors. The plugin fails to validate the destination parameter before executing the redirect, meaning any visitor who follows a specially crafted login link is silently forwarded to an attacker-controlled page after authenticating. A publicly available proof-of-concept exists per WPScan, and a vendor patch was released in version 5.2.8.
Unauthenticated information disclosure in the 'Contact Form to Chat Apps | Click to Chat to Order' WordPress plugin before 2.15.8 exposes all submitted form entries to any anonymous HTTP client. The plugin registers a public WordPress AJAX action that performs no capability check, nonce verification, or session validation - three standard WordPress authorization layers - allowing any remote actor to dump contact form submissions. A publicly available proof-of-concept exploit exists, reported by WPScan, making opportunistic mass scanning trivial.
REST API authorization bypass in BackWPup WordPress plugin (versions 5.2.2 through 5.7.4) allows users holding a plugin-defined limited role to invoke privileged backup management endpoints - creating jobs, specifying attacker-controlled destinations, and triggering execution to exfiltrate a complete database backup. WPScan reported the flaw and has published exploit code; vendor-released fix is available in version 5.7.5. No CISA KEV listing exists, but the public POC and high-value database credential exposure make this a genuine remediation priority for sites that have provisioned BackWPup limited roles to potentially untrusted users.
Unauthenticated order-management access in WPCafe WordPress plugin before 3.0.18 stems from REST API permission callbacks that return an incorrect PHP type on failure, causing WordPress's REST dispatcher to grant rather than deny access. Remote unauthenticated attackers can enumerate guest order information (names, addresses, items) and manipulate any order's status or move orders to trash without logging in. A publicly available exploit reported by WPScan exists; the vendor has released a patch in version 3.0.18.
Broken object-level authorization in the Visualizer WordPress plugin before 4.0.6 allows any authenticated user holding at least the Contributor role to publish, rename, and overwrite posts and pages belonging to other users - including private drafts they would normally have no access to. The flaw stems from chart-building AJAX/REST actions that do not verify post ownership before acting on the supplied post identifier. A publicly available proof-of-concept exploit exists, confirmed by WPScan research; no active exploitation (CISA KEV) has been reported.
TLS private key disclosure in the SSL Zen WordPress plugin (all versions before 4.7.40) allows any authenticated user - including Subscribers, the lowest-privilege WordPress role - to download the site's TLS private key, certificate files, and diagnostic logs. The plugin's certificate-file download handler fires early in the WordPress admin request lifecycle without performing WordPress capability checks or nonce verification, bypassing the standard authorization layer entirely. A public exploit is available via WPScan; vendor-released patch 4.7.40 resolves the issue.
Stored XSS in the Featured Image with URL WordPress plugin before 1.0.6 allows any authenticated user holding at least a Contributor role to inject malicious JavaScript via an unsanitized image attribute value, which then executes in the browser of every subsequent viewer - including Editors and Administrators. A publicly available proof-of-concept is documented by WPScan. Vendor-released patch version 1.0.6 is available, and no active exploitation has been confirmed in the CISA KEV catalog.
Broken object-level authorization in the Visualizer WordPress plugin before 4.0.6 allows any authenticated Contributor-level user to permanently delete charts created by other users, including administrators, by exploiting a missing per-chart ownership check on deletion requests. The plugin validates only a site-wide capability (confirming the user can edit content generally) but never verifies whether the requesting user owns the specific chart being deleted - a classic BOLA/IDOR pattern under CWE-862. A publicly available proof-of-concept from WPScan demonstrates trivial exploitation with any valid Contributor account. No public exploitation (KEV) status is confirmed at time of analysis.
Stored XSS in the AI Builder WordPress plugin (versions 2.4.1 through <2.7.8) allows any authenticated contributor-level user to inject persistent JavaScript via an unsanitized custom JS field, which executes in the browser of every subsequent viewer - including editors and administrators who review the post. This creates a reliable privilege-escalation path from contributor to full WordPress site administrator via session token theft or forced admin-action execution. Publicly available exploit code exists per WPScan, and a vendor-released patch is available in version 2.7.8.
Missing authorization on the wishlist rename endpoint in YITH WooCommerce Wishlist (WordPress plugin before 4.18.1) permits any unauthenticated network attacker to rename any customer wishlist sitewide by supplying a target wishlist identifier. The flaw is rooted in CWE-639 - the plugin never verifies that the requesting user owns or has permission over the wishlist identified by a user-controlled key. A publicly available proof-of-concept exists via WPScan; no active exploitation (KEV) has been confirmed. CVSS rates impact at 5.3 (I:L) as only wishlist names - not data, credentials, or site availability - are affected.
Order metadata tampering in the Advanced Customized Prompts WordPress plugin (all versions through 1.0.1) allows any authenticated subscriber to overwrite WooCommerce order item metadata for orders belonging to other customers. The plugin performs no capability, ownership, or nonce verification before applying user-supplied metadata updates to an arbitrary order ID, making every order's custom fields writable by any registered user. WPScan has published a proof-of-concept, reducing the technical bar for exploitation on any WooCommerce store running this plugin.
Stored cross-site scripting in the Advanced Customized Prompts WordPress plugin (≤1.0.1) allows any authenticated subscriber-level user to inject persistent JavaScript into product popup configurations, which then executes in the browsers of all visitors viewing the affected product. The plugin performs no capability check, ownership verification, or nonce validation before persisting popup data, and fails to escape stored values on output - a dual failure enabling both unauthorized write and reflected-on-read XSS. A publicly available proof-of-concept exists via WPScan; no vendor-released patch has been identified at time of analysis.
Unauthenticated information disclosure in the Teddy Bear Customize Addon WordPress plugin through version 1.0.5 exposes WooCommerce order metadata and customer-uploaded file attachment URLs to any network attacker without credentials. The plugin's data-return endpoints implement no authorization or ownership checks whatsoever, enabling an attacker to enumerate and retrieve private order records and attachment links belonging to arbitrary customers. Publicly available exploit code exists via WPScan; the same plugin also carries a separate RCE vulnerability (CVE-2026-14560), making immediate removal or patching urgent.
Stored cross-site scripting in the Translate WordPress with GTranslate plugin before 3.0.10 allows authenticated administrators to inject persistent JavaScript into front-end markup rendered to all site visitors. The plugin's bundled front-end scripts consume an unvalidated settings value and construct DOM markup from it without escaping, meaning a malicious or compromised admin can embed scripts that execute in every visitor's browser session. No public exploit has been reported as actively exploited in the wild; however, a proof-of-concept is publicly available via WPScan.
Stored cross-site scripting in the CoolClock WordPress plugin before 4.3.8 allows contributor-level and higher authenticated users to inject arbitrary JavaScript via an unsanitized skin configuration value, which is rendered unescaped within an HTML attribute and executes in any visitor's browser upon page load. A publicly available proof-of-concept exploit has been published by WPScan. The vulnerability enables session hijacking, credential theft, or unauthorized actions within the WordPress admin panel when an administrator views affected content.
Stored cross-site scripting in the CoolClock WordPress plugin (before 4.3.8) allows contributor-level users to inject arbitrary JavaScript through an unsanitized custom skin setting that is echoed verbatim into an inline script block. When a higher-privileged user such as an administrator views the affected post or page, the payload executes in their browser, enabling session hijacking or full site takeover. A publicly available proof-of-concept exploit has been published by WPScan, and a vendor-released patch is available in version 4.3.8.
Missing capability checks in the Notiqoo WordPress plugin (before 1.4.14) expose multiple AJAX endpoints to any authenticated contributor-level user, allowing arbitrary WordPress option writes. Because the option name is constructed directly from user-supplied input with no validation or authorization gate, a contributor can overwrite any site option - including disabling the Notiqoo plugin itself or corrupting the admin email/user-role mappings to lock every administrator out of the WordPress dashboard. A publicly available proof-of-concept exploit exists per WPScan, and the SSVC framework classifies technical impact as partial with no confirmed active exploitation at time of analysis.
Payment bypass in the WP Express Checkout WordPress plugin (versions before 2.5.0) allows unauthenticated users to forge completed order records without submitting actual payment. The plugin fails to perform server-side validation against the payment processor to confirm a transaction was successfully completed, trusting client-supplied signals instead. Any visitor to an affected WordPress store can obtain goods or services for free, making this a high-impact business-logic flaw despite its moderate CVSS score. A publicly available exploit exists via WPScan, and no public exploitation (KEV) has been confirmed at time of analysis.
Shortcode injection in the Hustle WordPress plugin (versions prior to 7.8.14.2) allows unauthenticated remote attackers to execute any shortcode registered on the target site by embedding nested shortcode syntax in form submission field values. The plugin substitutes submitted values into its post-submission success message, and while a guard exists to prevent shortcode execution, it can be defeated through shortcode nesting - causing WordPress to process and execute arbitrary registered shortcodes in the response. A publicly available proof-of-concept exploit exists, and a vendor patch is available in version 7.8.14.2.
Unauthenticated shortcode injection in the CleanTalk WordPress anti-spam plugin before 6.87 allows any site visitor to trigger arbitrary shortcodes registered on the target WordPress site to execute server-side, with output persisted and rendered to every subsequent visitor of the affected page. Because shortcode execution scope depends entirely on which shortcodes third-party plugins have registered, actual impact can range from minor data leakage to server-side code execution if code-execution shortcodes are present. A publicly available exploit exists, and the vendor has released a patch in version 6.87.
Shortcode injection in the Ninja Forms WordPress plugin (versions 3.14.10 through 3.15.1) allows unauthenticated network attackers to execute any shortcode registered on the target site by embedding shortcode syntax into form request fields the plugin later processes. The plugin fails to strip or escape shortcode markers before passing user-controlled values through WordPress's shortcode execution pipeline, meaning the server interprets and runs injected tags. A publicly available exploit exists per WPScan's advisory; real-world impact scales with the shortcodes registered on the site - ranging from benign output to sensitive data exposure or unintended privileged actions.
Shortcode injection in the Redirection for Contact Form 7 WordPress plugin (versions 2.2.7 through 3.2.10) enables unauthenticated remote attackers to execute arbitrary registered WordPress shortcodes server-side and capture their output. The plugin substitutes raw form submission values into its action settings and then evaluates those settings through WordPress's do_shortcode() pipeline without sanitizing or stripping user-supplied shortcode syntax first. A public proof-of-concept is available via WPScan; vendor-released patch version 3.2.11 addresses the issue.
Email header injection in JetFormBuilder WordPress plugin before 3.6.5.2 allows unauthenticated attackers to manipulate outgoing email headers by submitting CRLF sequences in form address fields. Exploitation enables adding hidden recipients via BCC, spoofing the sender address, and abusing the victim site's trusted email reputation as a phishing or spam relay. A publicly available exploit entry is documented by WPScan, though exploitation requires a non-default configuration in which the plugin is explicitly set to source message address headers from user-submitted form fields.
Shortcode injection in JetFormBuilder WordPress plugin before 3.6.5.2 allows unauthenticated remote attackers to execute any shortcode registered on the target WordPress site. The flaw stems from a misordered sanitization pipeline: user-supplied input in a request parameter is HTML-escaped before it is passed to WordPress's shortcode expansion function rather than after, meaning shortcode syntax survives the escape pass intact and is then evaluated server-side. A publicly available proof-of-concept exploit exists via WPScan, making this immediately actionable for attackers against unpatched installs.
Unauthorized role self-assignment in the B2BKing WooCommerce plugin before version 5.2.40 allows unauthenticated registrants to claim restricted B2B customer group memberships without admin approval by supplying arbitrary role parameters not bounded by server-side validation. The plugin fails to verify that a role submitted during account registration is actually one offered on the public registration form, enabling any user to bypass the manual account-approval workflow and gain access to wholesale pricing tiers or restricted catalogs. A publicly available proof-of-concept exists via WPScan, though no confirmed active exploitation has been identified in CISA KEV at time of analysis.
Stored cross-site scripting in the Bold Page Builder WordPress plugin (all versions before 5.9.9) permits any user holding the Contributor role or higher to embed arbitrary JavaScript inside an HTML attribute via an unsanitized shortcode parameter. A publicly available exploit exists per WPScan (EUVD-2026-72064). When a higher-privileged user such as an administrator views a page containing the injected payload, the script executes in their browser, enabling session hijacking, nonce theft, or full administrative takeover of the WordPress installation.
Unauthenticated account registration bypass in SureCart WordPress plugin before 4.7.0 allows remote attackers to create WordPress user accounts and obtain authenticated sessions even when the site administrator has explicitly disabled user registration. The plugin fails to consult WordPress's native `users_can_register` site option before processing account creation through its own checkout/registration flow. A publicly available proof-of-concept exists per WPScan, and a vendor patch is available in version 4.7.0. No confirmed active exploitation (CISA KEV) at time of analysis.
Real Estate Papi WordPress theme (≤1.0.5) exposes an AJAX endpoint that lacks both capability checks and CSRF validation, enabling any authenticated subscriber to silently force-install a fixed set of companion plugins from the WordPress.org repository. Because CSRF protection is also absent, an attacker can craft a cross-site request that fires in an active administrator session, causing those plugins to be activated as well - an escalation beyond what subscriber-level access alone would permit. WPScan published a proof-of-concept; SSVC rates exploitation as none with partial technical impact, indicating no confirmed in-the-wild abuse at time of analysis.
SQL injection in the Video Player for YouTube WordPress plugin (versions before 2.1.0) allows authenticated users holding the Contributor role or higher to inject arbitrary SQL commands via unsanitized input, enabling them to read any data stored in the underlying WordPress database. The scope change reflected in the CVSS vector (S:C) indicates that exploitation extends reads beyond the plugin's own tables to potentially include WordPress user credentials, secrets, and configuration data held elsewhere in the database. A public PoC exists via WPScan, but EPSS sits at 0.16% and CISA has not added this to KEV, indicating low observed exploitation activity.
Missing authorization on the EmbedPress WordPress plugin's review-loading action (versions 4.6.0-4.6.3) permits unauthenticated remote attackers to abuse the site's stored third-party API credentials - triggering repeated billable API calls against the site owner's account - while simultaneously injecting an unbounded number of attacker-controlled rows into the WordPress database. A publicly available PoC exploit was documented by WPScan. Although EPSS probability is low (0.14%), SSVC rates the attack as automatable, making mass targeting of vulnerable WordPress deployments feasible with minimal tooling.
Stored cross-site scripting in the Joli Table Of Contents WordPress plugin (versions before 3.0.3) permits any user holding the Author role or higher to inject arbitrary HTML attributes and JavaScript via an unsanitized shortcode attribute, with the payload executing in the browser of any visitor - including administrators - who views the post. Because Authors in WordPress are explicitly barred from posting unfiltered HTML, this constitutes a privilege-boundary violation that can be leveraged to hijack administrator sessions or trigger privileged actions covertly. A public exploit is documented by WPScan; EPSS stands at 0.15% (5th percentile), indicating limited automated targeting, and no CISA KEV listing exists.
Stored XSS in CatFolders Document Gallery & PDF Library WordPress plugin before version 2.0.7 allows any user holding an Author account or higher to inject persistent malicious scripts via an unsanitized block attribute that is directly interpolated as an HTML tag name in gallery rendering output. Any visitor who views a post containing the crafted gallery block will execute the attacker's payload in their browser without additional interaction. No active exploitation has been confirmed in CISA KEV, but a publicly available proof-of-concept exists per WPScan disclosure, reducing the technical barrier for any authenticated attacker.
Insufficient authorization on the EmbedPress WordPress plugin's Google Reviews REST API endpoint allows any authenticated Contributor-role user to overwrite the site-wide reviews store in versions 4.6.0 through 4.6.3. An attacker with a Contributor account can delete administrator-configured review entries and inject fabricated ones that render publicly across the entire WordPress site, enabling reputation manipulation or social engineering. A publicly available exploit exists per WPScan; however, SSVC marks exploitation as none and EPSS sits at 0.13% (3rd percentile), reflecting the prerequisite of a legitimate account.
Information disclosure in the EmbedPress WordPress plugin (versions 4.6.0 through 4.6.3) allows any authenticated contributor-level user or above to retrieve the site administrator's email address via an improperly restricted Google Reviews REST API endpoint. WordPress core deliberately withholds administrator email from the contributor role as a privacy control; this plugin bypass defeats that restriction without requiring administrative privileges. A publicly available proof-of-concept has been published by WPScan, though EPSS at 0.14% and SSVC exploitation status of 'none' indicate no observed active exploitation at time of analysis.
Missing authorization on Eventin's event-management REST routes allows low-privilege WordPress contributors to perform integrity-impacting actions outside their permitted scope. Affected installations running Eventin before 4.1.22 expose endpoints that let contributor-role users redirect the site's public front page to an arbitrary event they do not own, and create, edit, or delete global event and speaker taxonomy terms site-wide. A publicly available exploit is documented by WPScan, though SSVC exploitation status is none and EPSS is 0.13%, indicating no confirmed active abuse at time of analysis.
Stored XSS in VikWidgetsLoader WordPress plugin before 1.12.0 allows Contributor-role users to permanently embed arbitrary JavaScript into posts by supplying a malicious block attribute that is output unsanitized inside an inline script tag. When an administrator reviews the pending submission, the payload executes in their browser, enabling full session hijacking and site takeover without any further attacker interaction. A publicly available exploit exists (via WPScan), though EPSS is low (0.15%, 5th percentile) and SSVC records no confirmed exploitation at this time.
Local file inclusion in Eventin WordPress plugin before 4.1.21 enables authenticated contributors and higher-privileged users to include and execute arbitrary PHP files on the web server. The plugin fails to validate a user-supplied template path parameter before passing it to a PHP file-inclusion routine, allowing path traversal to any locally accessible PHP file. A publicly available proof-of-concept has been published by WPScan; vendor patch 4.1.21 is available and should be applied immediately.
Stored cross-site scripting in King Addons for Elementor WordPress plugin before version 51.1.77 allows any Contributor-level (or higher) user to inject persistent JavaScript into a widget display-style setting that is written unescaped into an HTML attribute at render time. The payload fires in every visitor's browser upon page load - including logged-in administrators - enabling session hijacking, credential theft, or silent execution of privileged site actions. A publicly available proof-of-concept was disclosed via WPScan; no active exploitation is confirmed in the CISA KEV catalog at time of analysis.
The Events Calendar WordPress plugin before 6.17.3.1 exposes unpublished site content - drafts, pending posts, and private records from all users - through its public REST API archive endpoints to any contributor-level authenticated user. The plugin fails to enforce WordPress's standard post-status visibility controls on its custom REST routes, allowing a low-privilege account holder to enumerate and read the full body of every non-public record site-wide, bypassing intended access controls. A public proof-of-concept is documented via WPScan, and a vendor patch (6.17.3.1) is available.
Insufficient per-object authorization in the Kirki WordPress plugin before 6.3.0 allows users with administrator-granted content-level page builder access to alter the state of collaboration comments left by any user, including on pages those users cannot themselves open. The root cause is CWE-639 (Authorization Through User-Controlled Key / IDOR): the comment-state endpoint accepts a user-supplied comment identifier without verifying whether the requesting user holds authorization over that specific comment object. Despite a publicly available PoC from WPScan, EPSS sits at 0.13% (3rd percentile) and the vulnerability is not in the CISA KEV catalog, indicating negligible opportunistic exploitation risk.
Authenticated remote code execution in the FileOrganizer WordPress plugin before 1.2.0 lets users granted file-manager access upload arbitrary PHP files because several file-management operations skip file-type validation. Publicly available exploit code exists, and the flaw is an incomplete fix of CVE-2024-7985, which only hardened the upload operation while leaving other file-management endpoints unvalidated. With CVSS 3.1 base 8.8 (PR:L) and a working PoC, any low-privileged account with file-manager rights - extendable to sub-administrator roles via the premium add-on - can achieve full site compromise.
Stored/reflected cross-site scripting in the Simple Membership WordPress plugin before 4.7.5 lets unauthenticated attackers execute arbitrary JavaScript in a logged-in administrator's browser by abusing the Stripe webhook handler. When no Stripe signing secret is configured, the plugin fails to verify webhook authenticity and then renders an attacker-controlled value unescaped inside an admin notice. Publicly available exploit code exists (WPScan), though EPSS remains low at 0.18% and no active exploitation is reported (not in CISA KEV).
Stored cross-site scripting in the Ultimate Member WordPress plugin before 2.12.0 lets authenticated Subscriber-level users inject persistent JavaScript through custom textarea profile fields, which executes in the browser of any visitor - including administrators - who views the poisoned profile. Publicly available exploit code exists (WPScan), though EPSS is low (0.17%) and SSVC records no observed exploitation, so this is a real but not yet actively-exploited privilege-escalation-capable XSS.
Account takeover in the AllCoach WordPress plugin before 1.0.2 lets remote attackers overwrite the password of any existing account - including administrators - by re-submitting that account's email address to the public account-registration endpoint, which fails to check whether the email is already tied to a user before writing a new password. Publicly available exploit code exists and a vendor patch (1.0.2) has been released, but there is no public exploit identified as actively exploited in the wild; EPSS is low (0.14%, 4th percentile) and CISA SSVC rates exploitation as 'none' despite a 'total' technical impact. The provided CVSS vector lists PR:L, which conflicts with the description's explicit 'unauthenticated attackers' claim and should be verified.
Two-factor authentication bypass in the WebAuthn Provider for Two Factor WordPress plugin (all versions before 2.5.6) lets an attacker who already possesses a valid user's password defeat the WebAuthn second factor by submitting a malformed authentication response that the plugin fails to validate. This neutralizes the plugin's core protection, effectively reducing account security back to single-factor (password-only). Publicly available exploit code exists (reported by WPScan); there is no public exploit identified as being used in active attacks and the issue is not listed in CISA KEV.
Privilege escalation in the Advanced Form Integration - Connect Forms to 200+ Apps WordPress plugin before 2.1.1 allows unauthenticated visitors to provision a full administrator account through a public form. Because the plugin fails to restrict which WordPress role it assigns during user creation, any site that maps the user-role field to a public form input via an active integration exposes site takeover to anonymous submitters. Publicly available exploit code exists (reported by WPScan), though this is not listed in CISA KEV and requires a specific non-default integration configuration, so real-world exposure is narrower than the 8.1 CVSS suggests.
Unauthenticated information disclosure in the Product Configurator for WooCommerce WordPress plugin (versions before 1.7.3) exposes sensitive product data through a public AJAX action that skips authorization and post-status checks. By supplying only a product ID, remote unauthenticated users can read titles, prices, weights, stock status, and configurator option pricing/SKUs of private and draft products, bypassing WordPress post-visibility controls. Publicly available exploit code exists (reported by WPScan), though there is no indication of active exploitation.
Broken access control in the Royal MCP WordPress plugin before 1.4.26 lets any authenticated low-privileged user (e.g. Subscriber) invoke privileged MCP tools that skip capability checks after token authentication, exposing private content, full user/role enumeration, and create/modify/delete operations on other users' content. Reported by WPScan with a publicly available exploit and a vendor patch in 1.4.26; the CVSS 8.1 vector (PR:L) confirms authenticated but not administrative access is required. There is no public exploit identified as actively exploited - status is POC only, not CISA KEV.
Unauthenticated SQL injection in the WP Support Plus Responsive Ticket System WordPress plugin (all versions through 9.1.2) lets remote attackers inject arbitrary SQL by abusing user-supplied array keys that are passed into a query without sanitization. Any unauthenticated visitor can extract sensitive database contents such as WordPress user records and password hashes. Publicly available exploit code exists, though EPSS rates exploitation probability low (0.18%, 7th percentile) and it is not on CISA KEV.
Stored cross-site scripting in the WP Support Plus Responsive Ticket System WordPress plugin (all versions through 9.1.2) lets unauthenticated attackers upload files containing malicious JavaScript - such as HTML or SVG payloads - to a publicly accessible location, where the script executes in the browsers of site users and administrators who view it. The flaw stems from missing validation of uploaded file types/content. Publicly available exploit code exists (reported by WPScan), though it is not listed in CISA KEV and no EPSS score was provided.
Stored Cross-Site Scripting in the APCu Manager WordPress plugin before 4.5.0 lets unauthenticated attackers seed a malicious APCu object-cache key (for example via a crafted transient name) that later executes arbitrary JavaScript in the browser of any administrator who opens the plugin's admin-area page. Publicly available exploit code exists (reported by WPScan) and a vendor patch is available, but there is no public exploit identified as being actively used; EPSS is low at 0.16% (5th percentile), consistent with the SSVC exploitation status of none.
SQL injection in the SALESmanago & Leadoo WordPress plugin before 3.11.3 allows low-privileged authenticated users to inject arbitrary SQL through an unsanitised parameter passed to a vulnerable AJAX action. Because the action enforces no authorisation check, even subscriber-level accounts can reach it, and the CVSS scope-changed, high-confidentiality rating (7.7) reflects the ability to read data across the WordPress database. Publicly available exploit code exists (WPScan), though EPSS is low (0.16%) and SSVC classifies exploitation as proof-of-concept only, not active.
Information disclosure in the YMC Filter WordPress plugin before 3.11.3 lets unauthenticated remote attackers read the titles and content of private, draft, and other non-public posts by abusing a REST API endpoint that lacks proper authorization and fails to validate a user-supplied query parameter. WPScan reported the flaw, a public exploit exists, and a vendor patch is available; the CVSS 3.1 score is 7.5 reflecting high confidentiality impact with no integrity or availability effect.
Order shipping-destination tampering in the InPost PL WooCommerce plugin (versions before 1.9.1) lets unauthenticated remote attackers silently change the parcel-locker delivery point of any order still in 'pending' or 'processing' status, because the plugin never verifies the request comes from the legitimate buyer. Publicly available exploit code exists and a vendor patch has been released, though this is not listed in CISA KEV (no public exploit identified as actively exploited at time of analysis beyond the published POC). With CVSS 7.5 and an integrity-only impact, the practical risk is shipment redirection / parcel theft rather than data disclosure.
Stored cross-site scripting in the Email Address Encoder WordPress plugin (free, before 1.0.25) and its Email Encoder Premium counterpart (before 0.3.12) lets unauthenticated visitors inject persistent JavaScript through the plugin's flawed email-replacement handling. Publicly available exploit code exists (disclosed by WPScan) and a vendor patch is available, but it is not in CISA KEV, so there is no public exploit identified as actively used in the wild. Successful exploitation executes attacker script in the browser of any user who later renders the affected page, typically an authenticated administrator.
Sensitive information disclosure in the premium Cornerstone page builder (bundled with the X theme) versions 3.0.0 through 7.8.7 allows any authenticated WordPress user to extract raw password hashes and other private user metadata. The CSS-preview request handler fails to enforce capability checks while exposing its required nonce on every wp-admin page, and publicly available exploit code exists per WPScan, though no active exploitation has been reported.
Authenticated information disclosure in the premium Cornerstone page builder (bundled with the X WordPress theme) before version 7.8.9 allows any logged-in user to enumerate other users' metadata via an unprotected REST API route. Disclosed data includes roles, session token previews, and stored billing/shipping fields, enabling account targeting and potential session abuse. Publicly available exploit code exists per WPScan, though there is no public exploit identified as actively used in the wild and the issue is not listed in CISA KEV.
PHP Object Injection in the Post Duplicator WordPress plugin before 3.0.15 lets authenticated users with Contributor-level access or higher inject arbitrary serialized PHP objects by abusing the plugin's post-duplication routine, which copies attacker-controlled custom meta-data without the WordPress meta API's double-serialization safeguard. Successful exploitation can lead to property-oriented programming attacks and, with a suitable gadget chain present, full compromise of the site. Publicly available exploit code exists (WPScan), though the flaw is not listed in CISA KEV and carries a low EPSS score (0.15%, 5th percentile).
Supply-chain compromise of three commercial WordPress plugins - Smart Post Show Pro (before 4.0.2), Real Testimonials Pro (before 3.2.5), and Product Slider for WooCommerce Pro (before 3.5.3) - shipped malicious code via the vendor's compromised update server, letting remote unauthenticated attackers deploy a second-stage payload that harvests credentials and other sensitive data and takes full control of affected sites. Publicly available exploit code exists and a patch is available from the vendor, but there is no public exploit identified as being used for active exploitation and the flaw is not in CISA KEV. EPSS is low (0.20%, 10th percentile), consistent with the malicious builds having been pulled once discovered rather than being mass-exploited in the wild.
Unauthenticated file disclosure in the Frontend File Manager Plugin for WordPress (all versions through 23.6) exposes every user-uploaded file to anonymous download via identifier enumeration. The plugin's file download handler fails to properly enforce WordPress nonce validation, stripping the only access control gate between unauthenticated HTTP requests and user-uploaded content. A public proof-of-concept is available via WPScan, and SSVC assessment confirms the attack is automatable - any script that iterates numeric file identifiers can bulk-harvest uploaded documents, images, or sensitive attachments without credentials. Not currently listed in CISA KEV.
Reflected cross-site scripting in the Simple Basic Contact Form WordPress plugin (all versions through 20250114) allows unauthenticated remote attackers to execute arbitrary JavaScript in a visitor's browser when the victim follows a crafted link or submits a cross-site forged form that triggers a validation error. Publicly available exploit details have been published by WPScan, though the issue is not listed in CISA KEV and no EPSS data is provided in the input.
SQL injection in the Infility Global WordPress plugin before 2.15.19 allows authenticated users with Subscriber-level access or higher to inject arbitrary SQL via unsanitized parameters. Publicly available exploit code exists (WPScan), and a vendor patch has been released, raising the practical risk on sites that allow open user registration. No CISA KEV listing at time of analysis.
Privilege escalation in the Vitepos WordPress point-of-sale plugin before 3.4.2 lets an authenticated user holding a custom Vitepos role assign themselves the administrator role through an insufficiently restricted user-creation REST API endpoint, resulting in full site takeover. WPScan reports publicly available exploit code exists, though the flaw is not listed in CISA KEV and SSVC records no observed exploitation. With a modest EPSS of 0.24% (14th percentile) but a 'total' technical impact, this is a credentialed-but-realistic escalation path rather than a mass-exploited internet threat.
Stored cross-site scripting in the Transbank Webpay WordPress plugin before 1.14.0 lets unauthenticated visitors inject malicious script into plugin log entries that execute in the browser of any administrator who later views the logs. Because injection requires no authentication and the payload runs in a privileged admin session, it can be used to hijack the WordPress backend; publicly available exploit code exists and a public write-up chains the flaw toward remote code execution. EPSS is low (0.16%, 6th percentile) and CISA SSVC records no observed exploitation, so real-world targeting appears limited despite the high CVSS of 7.1.
Reflected Cross-Site Scripting in the Ultimate WooCommerce Auction Pro WordPress plugin (all versions through 2.4.5) allows remote attackers to inject arbitrary JavaScript into a page by tricking a logged-in high-privilege user, such as an administrator, into clicking a crafted link. The flaw stems from an unsanitized, unescaped request parameter reflected back into the response, and publicly available exploit code exists (reported by WPScan), though EPSS probability is low (0.15%, 4th percentile) and there is no evidence of active exploitation.
Reflected cross-site scripting in the Taskbuilder WordPress plugin before 5.0.8 lets an unauthenticated attacker inject arbitrary JavaScript by tricking a logged-in user into visiting a crafted URL. The plugin echoes an unsanitised URL parameter directly into inline JavaScript on any frontend page that renders one of its shortcodes, so the payload executes in the victim's authenticated browser session. Publicly available exploit code exists (WPScan), though EPSS remains low (0.18%) and the flaw is not in CISA KEV.
Reflected Cross-Site Scripting in the weMail WordPress plugin (versions before 2.1.3) lets unauthenticated attackers inject arbitrary JavaScript by luring any logged-in user to a crafted URL, because a user-supplied parameter is reflected unescaped into an HTML attribute on an AJAX endpoint that lacks nonce protection. Successful exploitation runs script in the victim's authenticated browser session - including administrators - enabling session/account takeover of the WordPress site. Publicly available exploit code exists (WPScan), though EPSS is low (0.21%) and there is no evidence of active exploitation.
Privilege escalation to full administrator in the WP Maps Pro WordPress plugin before 6.1.1 allows remote unauthenticated attackers to create a rogue admin account and obtain an interactive login. The plugin exposes an unauthenticated AJAX handler that trusts a nonce publicly rendered on any front-end page loading its map script, so the nonce provides no real authorization. Publicly available exploit code exists and a vendor patch is available; despite the 9.8 CVSS the EPSS probability is low (0.13%, 3rd percentile) and CISA SSVC records no observed exploitation.
Unauthenticated arbitrary file upload in the Schema & Structured Data for WP & AMP WordPress plugin before version 1.60 allows remote attackers to upload any file type accepted by WordPress's media library through frontend AJAX handlers intended for images and videos only. The plugin fails to perform user capability checks and does not validate uploaded file content against the endpoint's declared media type. Publicly available exploit code exists via WPScan, increasing the urgency for immediate patching despite no confirmed in-the-wild exploitation.
Stored cross-site scripting in the Anti-Spam by CleanTalk Spam Protection WordPress plugin before 6.79 allows unauthenticated remote attackers to inject arbitrary JavaScript into approved comments via a custom shortcode in the email-encoding feature, with execution occurring when any visitor or administrator views the affected post. Publicly available exploit code exists per WPScan, increasing exposure for the plugin's large WordPress installation base, though it requires user interaction (UI:R) to trigger the payload. The high CVSS score of 8.8 reflects the potential for administrator account compromise leading to full site takeover.
Unauthenticated SQL injection in the XStore WordPress theme before 9.7.3 allows remote attackers to inject arbitrary SQL queries through an AJAX action that fails to sanitise and escape a user-supplied parameter. Publicly available exploit code exists per WPScan, and the changed scope (S:C) with high confidentiality impact indicates an attacker can extract sensitive data across security boundaries - including WordPress user records, password hashes, and configuration secrets - without any credentials or user interaction.
Two-factor authentication bypass in the Really Simple Security WordPress plugin before 9.5.10.1 allows attackers who already possess a valid username and password to hijack a fully authenticated WordPress session without completing the email OTP challenge. Two REST endpoints in the plugin's 2FA flow fail to enforce the second-factor challenge, effectively neutralizing the MFA protection the plugin is marketed to provide. Publicly available exploit code exists (WPScan), and a vendor patch has been released.
Unauthenticated refund abuse in the Eupago Gateway for WooCommerce WordPress plugin before 4.7.2 lets remote attackers trigger refunds on arbitrary WooCommerce orders using the merchant's own payment gateway credentials, and for certain payment methods divert the refunded funds to an attacker-controlled bank account. The CVSS 8.6 score reflects the network-reachable, no-auth, no-interaction attack path against a financial workflow; publicly available exploit code exists per WPScan, though there is no public exploit identified at time of analysis confirming active exploitation in CISA KEV.
Reflected cross-site scripting in the Ajax Load More WordPress plugin (all versions before 7.8.4) allows remote attackers to execute arbitrary JavaScript in a victim's browser by reflecting an unsanitized, unescaped request parameter back into the page. The attack targets high-privilege users such as administrators, who must be lured into clicking a crafted link; publicly available exploit code exists, though EPSS estimates exploitation probability at only 0.03% (8th percentile) and there is no public exploit identified as being used in active campaigns.
Local File Inclusion in the WP Maps WordPress plugin before 4.9.3 allows authenticated users to read arbitrary files by injecting path traversal sequences into an unsanitized parameter used to build a file path. Publicly available exploit code exists (reported by WPScan), though EPSS is low (0.03%, 8th percentile) and the flaw is not automatable per SSVC. A vendor patch is available in version 4.9.3.
SQL injection in the WP Photo Album Plus WordPress plugin before 9.1.11.001 allows unauthenticated attackers to inject arbitrary SQL through an improperly sanitized parameter, exposing backend database contents such as user credentials and hashed passwords. The CVSS vector (PR:N, S:C, C:H) indicates no authentication is required and that a successful attack reaches data beyond the plugin's own scope. Publicly available exploit code exists (reported by WPScan) and a vendor patch is available, though the EPSS score is very low at 0.04% (14th percentile).
Unauthenticated stored cross-site scripting affects the Autoptimize (before 3.1.15), Clearfy Cache (before 2.4.2), and Speed Optimizer (before 7.7.9) WordPress plugins, which share a common HTML-minification routine. Because the placeholder hash used to protect content during minification is predictable, an unauthenticated attacker who can get their input processed by the minifier can anticipate the placeholder format and inject arbitrary HTML attributes into the final rendered output. Publicly available exploit code exists (WPScan), a vendor patch is available, and EPSS is low (0.03%), but the impact is total per CISA SSVC; there is no public exploit identified as being used in active attacks.
Unauthenticated attackers can exploit SQL injection in OttoKit: All-in-One Automation Platform WordPress plugin versions before 1.1.23 due to improper input sanitization in SQL statement construction. The vulnerability allows remote attackers to extract sensitive data and modify database contents without authentication, though integrity impact is limited. Publicly available exploit code exists, and a patch has been released by the vendor.
SQL injection in Product Filter for WooCommerce by WBW plugin versions below 3.1.3 allows unauthenticated remote attackers to extract sensitive database contents including user credentials, customer data, and order information. The vulnerability requires no authentication (CVSS PR:N) and has low attack complexity with publicly available exploit code. EPSS data not available, but the combination of unauthenticated access, public POC, and WordPress's large attack surface creates substantial real-world risk for unpatched WooCommerce installations.
Improper access control in the ActivityPub WordPress plugin before 8.0.2 exposes draft, scheduled, and pending posts to unauthenticated remote users, resulting in confidentiality breach. This information disclosure vulnerability (CVSS 7.5) allows network-based attackers to access unpublished content without authentication or user interaction. Publicly available exploit code exists, though no confirmed active exploitation (not in CISA KEV). EPSS score of 0.02% (6th percentile) suggests low current exploitation probability despite POC availability, but SSVC framework marks it as automatable with partial technical impact.
Remote code execution in Spam Protect for Contact Form 7 WordPress plugin before version 1.2.10 allows authenticated users with editor-level privileges to achieve arbitrary code execution by crafting malicious headers that are logged to a PHP file. The vulnerability is publicly exploitable with proof-of-concept code available, making it a critical risk for WordPress installations using affected plugin versions.
Unauthenticated attackers can book time slots in the Appointment Hour Booking WordPress plugin (before 1.5.95) that have already reached their configured capacity, because each appointment in a multi-appointment booking submission is not validated against the capacity limit of its own slot. The plugin assigns a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N, integrity-only impact), meaning any anonymous visitor can submit a crafted booking form and overwrite or occupy fully booked slots, denying legitimate customers their reservations. Publicly available exploit code exists per WPScan, but the issue is not listed in CISA KEV and EPSS-style mass exploitation signals are absent, so this is best treated as a business-logic abuse and booking-integrity risk rather than a code-execution emergency.
Unauthenticated visitors can mark unpaid Eventin orders of any value as paid by replaying a single genuine low-value payment transaction, because the plugin only checks that the gateway reports success and never validates the amount, currency, or which order the transaction belongs to. The flaw affects WordPress sites running the Eventin event-management plugin before version 4.1.24, and exploit detail is publicly available via the WPScan advisory. There is no indication in the supplied data that this is being actively exploited (no CISA KEV listing), and EPSS data was not provided.
Unauthenticated visitors can inject arbitrary WordPress shortcodes, including attacker-chosen attributes, into Formidable Forms versions before 6.35 because a request-derived value is substituted into a form's custom HTML and then passed through the shortcode parser server-side. Any page rendering an affected form will execute the injected shortcode, which can expose data or alter site behaviour depending on which shortcodes are installed on the target. Publicly available exploit code exists per WPScan, but CISA KEV does not list this issue and the CVSS score is moderate (4.8, AV:N/AC:H/PR:N/UI:N/C:L/I:L/A:N), reflecting configuration-dependent preconditions and limited impact.
HTML injection in the Royal Elementor Addons WordPress plugin before version 1.7.1067 lets unauthenticated visitors inject arbitrary HTML into the administrator notification emails generated by the plugin's form widget. Because form submissions are not sanitized before being embedded in the email body, an attacker can place crafted markup, malicious links, or spoofed content in mail that lands in the site administrator's inbox. Publicly available exploit code exists, and exploitation hinges on the administrator opening the notification email (CVSS UI:R), giving a base score of 6.1; no CISA KEV listing or EPSS score was supplied with the source data.
Payment bypass in the Quads Ads Manager for Google AdSense WordPress plugin (versions before 3.0.5) allows any low-privilege authenticated user capable of placing an advertising order to obtain paid ad placements at no cost. The plugin fails to verify transaction completion with the configured payment gateway before updating an order's status to paid, representing a fundamental business logic failure in the purchase flow. A publicly available proof-of-concept exploit has been published by WPScan, and the vendor has released a fix in version 3.0.5.
Unauthenticated information disclosure in the Bookit - Booking & Appointment Calendar WordPress plugin (versions before 2.6.0.1) exposes appointment records belonging to other customers via the availability-check endpoint. Any unauthenticated visitor can query this endpoint and receive free-text booking comments, personal contact information, and appointment details that belong to other registered users. A publicly available proof-of-concept exploit exists (documented by WPScan), lowering the skill barrier for abuse. No active exploitation has been confirmed in CISA KEV.
Horizontal privilege escalation in rtMedia for WordPress, BuddyPress and bbPress plugin before version 4.7.12 allows any authenticated subscriber-level user to alter the privacy settings of other users' activities and attached media. The plugin's privacy-change endpoint validates only a WordPress nonce that is shared across all logged-in users, performing no ownership verification against the requesting account. A publicly available exploit for this flaw has been disclosed via WPScan, enabling unauthorized exposure of private media or suppression of public content across a community site's user base.
Privilege escalation in the Simple Membership WordPress plugin before 4.7.8 allows authenticated members to obtain higher-tier memberships without paying the correct price. The plugin's PayPal IPN (Instant Payment Notification) handler accepts the membership level asserted in the payment notification without verifying it matches the level configured for the specific payment button that was purchased, enabling a low-cost membership purchase to be fraudulently upgraded to any higher tier. A publicly available exploit exists, and vendor patch 4.7.8 resolves the issue.
Unauthenticated information disclosure in the User Registration & Membership WordPress plugin (versions 5.0 through 5.2.7) exposes arbitrary users' email addresses, profile fields, roles, and membership order details to any visitor. The plugin's membership confirmation page performs no ownership verification - an attacker who supplies another user's identifier in the request receives that user's data if the site operator has configured user smart tags on the page's message template. No public exploit confirmed in CISA KEV, though a publicly available proof-of-concept is documented by WPScan.
Open redirect in the User Registration & Membership WordPress plugin before 5.2.8 permits unauthenticated attackers to craft post-login redirect URLs pointing to arbitrary external domains, enabling phishing campaigns targeting site visitors. The plugin fails to validate the destination parameter before executing the redirect, meaning any visitor who follows a specially crafted login link is silently forwarded to an attacker-controlled page after authenticating. A publicly available proof-of-concept exists per WPScan, and a vendor patch was released in version 5.2.8.
Unauthenticated information disclosure in the 'Contact Form to Chat Apps | Click to Chat to Order' WordPress plugin before 2.15.8 exposes all submitted form entries to any anonymous HTTP client. The plugin registers a public WordPress AJAX action that performs no capability check, nonce verification, or session validation - three standard WordPress authorization layers - allowing any remote actor to dump contact form submissions. A publicly available proof-of-concept exploit exists, reported by WPScan, making opportunistic mass scanning trivial.
REST API authorization bypass in BackWPup WordPress plugin (versions 5.2.2 through 5.7.4) allows users holding a plugin-defined limited role to invoke privileged backup management endpoints - creating jobs, specifying attacker-controlled destinations, and triggering execution to exfiltrate a complete database backup. WPScan reported the flaw and has published exploit code; vendor-released fix is available in version 5.7.5. No CISA KEV listing exists, but the public POC and high-value database credential exposure make this a genuine remediation priority for sites that have provisioned BackWPup limited roles to potentially untrusted users.
Unauthenticated order-management access in WPCafe WordPress plugin before 3.0.18 stems from REST API permission callbacks that return an incorrect PHP type on failure, causing WordPress's REST dispatcher to grant rather than deny access. Remote unauthenticated attackers can enumerate guest order information (names, addresses, items) and manipulate any order's status or move orders to trash without logging in. A publicly available exploit reported by WPScan exists; the vendor has released a patch in version 3.0.18.
Broken object-level authorization in the Visualizer WordPress plugin before 4.0.6 allows any authenticated user holding at least the Contributor role to publish, rename, and overwrite posts and pages belonging to other users - including private drafts they would normally have no access to. The flaw stems from chart-building AJAX/REST actions that do not verify post ownership before acting on the supplied post identifier. A publicly available proof-of-concept exploit exists, confirmed by WPScan research; no active exploitation (CISA KEV) has been reported.
TLS private key disclosure in the SSL Zen WordPress plugin (all versions before 4.7.40) allows any authenticated user - including Subscribers, the lowest-privilege WordPress role - to download the site's TLS private key, certificate files, and diagnostic logs. The plugin's certificate-file download handler fires early in the WordPress admin request lifecycle without performing WordPress capability checks or nonce verification, bypassing the standard authorization layer entirely. A public exploit is available via WPScan; vendor-released patch 4.7.40 resolves the issue.
Stored XSS in the Featured Image with URL WordPress plugin before 1.0.6 allows any authenticated user holding at least a Contributor role to inject malicious JavaScript via an unsanitized image attribute value, which then executes in the browser of every subsequent viewer - including Editors and Administrators. A publicly available proof-of-concept is documented by WPScan. Vendor-released patch version 1.0.6 is available, and no active exploitation has been confirmed in the CISA KEV catalog.
Broken object-level authorization in the Visualizer WordPress plugin before 4.0.6 allows any authenticated Contributor-level user to permanently delete charts created by other users, including administrators, by exploiting a missing per-chart ownership check on deletion requests. The plugin validates only a site-wide capability (confirming the user can edit content generally) but never verifies whether the requesting user owns the specific chart being deleted - a classic BOLA/IDOR pattern under CWE-862. A publicly available proof-of-concept from WPScan demonstrates trivial exploitation with any valid Contributor account. No public exploitation (KEV) status is confirmed at time of analysis.
Stored XSS in the AI Builder WordPress plugin (versions 2.4.1 through <2.7.8) allows any authenticated contributor-level user to inject persistent JavaScript via an unsanitized custom JS field, which executes in the browser of every subsequent viewer - including editors and administrators who review the post. This creates a reliable privilege-escalation path from contributor to full WordPress site administrator via session token theft or forced admin-action execution. Publicly available exploit code exists per WPScan, and a vendor-released patch is available in version 2.7.8.
Missing authorization on the wishlist rename endpoint in YITH WooCommerce Wishlist (WordPress plugin before 4.18.1) permits any unauthenticated network attacker to rename any customer wishlist sitewide by supplying a target wishlist identifier. The flaw is rooted in CWE-639 - the plugin never verifies that the requesting user owns or has permission over the wishlist identified by a user-controlled key. A publicly available proof-of-concept exists via WPScan; no active exploitation (KEV) has been confirmed. CVSS rates impact at 5.3 (I:L) as only wishlist names - not data, credentials, or site availability - are affected.
Order metadata tampering in the Advanced Customized Prompts WordPress plugin (all versions through 1.0.1) allows any authenticated subscriber to overwrite WooCommerce order item metadata for orders belonging to other customers. The plugin performs no capability, ownership, or nonce verification before applying user-supplied metadata updates to an arbitrary order ID, making every order's custom fields writable by any registered user. WPScan has published a proof-of-concept, reducing the technical bar for exploitation on any WooCommerce store running this plugin.
Stored cross-site scripting in the Advanced Customized Prompts WordPress plugin (≤1.0.1) allows any authenticated subscriber-level user to inject persistent JavaScript into product popup configurations, which then executes in the browsers of all visitors viewing the affected product. The plugin performs no capability check, ownership verification, or nonce validation before persisting popup data, and fails to escape stored values on output - a dual failure enabling both unauthorized write and reflected-on-read XSS. A publicly available proof-of-concept exists via WPScan; no vendor-released patch has been identified at time of analysis.
Unauthenticated information disclosure in the Teddy Bear Customize Addon WordPress plugin through version 1.0.5 exposes WooCommerce order metadata and customer-uploaded file attachment URLs to any network attacker without credentials. The plugin's data-return endpoints implement no authorization or ownership checks whatsoever, enabling an attacker to enumerate and retrieve private order records and attachment links belonging to arbitrary customers. Publicly available exploit code exists via WPScan; the same plugin also carries a separate RCE vulnerability (CVE-2026-14560), making immediate removal or patching urgent.
Stored cross-site scripting in the Translate WordPress with GTranslate plugin before 3.0.10 allows authenticated administrators to inject persistent JavaScript into front-end markup rendered to all site visitors. The plugin's bundled front-end scripts consume an unvalidated settings value and construct DOM markup from it without escaping, meaning a malicious or compromised admin can embed scripts that execute in every visitor's browser session. No public exploit has been reported as actively exploited in the wild; however, a proof-of-concept is publicly available via WPScan.
Stored cross-site scripting in the CoolClock WordPress plugin before 4.3.8 allows contributor-level and higher authenticated users to inject arbitrary JavaScript via an unsanitized skin configuration value, which is rendered unescaped within an HTML attribute and executes in any visitor's browser upon page load. A publicly available proof-of-concept exploit has been published by WPScan. The vulnerability enables session hijacking, credential theft, or unauthorized actions within the WordPress admin panel when an administrator views affected content.
Stored cross-site scripting in the CoolClock WordPress plugin (before 4.3.8) allows contributor-level users to inject arbitrary JavaScript through an unsanitized custom skin setting that is echoed verbatim into an inline script block. When a higher-privileged user such as an administrator views the affected post or page, the payload executes in their browser, enabling session hijacking or full site takeover. A publicly available proof-of-concept exploit has been published by WPScan, and a vendor-released patch is available in version 4.3.8.
Missing capability checks in the Notiqoo WordPress plugin (before 1.4.14) expose multiple AJAX endpoints to any authenticated contributor-level user, allowing arbitrary WordPress option writes. Because the option name is constructed directly from user-supplied input with no validation or authorization gate, a contributor can overwrite any site option - including disabling the Notiqoo plugin itself or corrupting the admin email/user-role mappings to lock every administrator out of the WordPress dashboard. A publicly available proof-of-concept exploit exists per WPScan, and the SSVC framework classifies technical impact as partial with no confirmed active exploitation at time of analysis.
Payment bypass in the WP Express Checkout WordPress plugin (versions before 2.5.0) allows unauthenticated users to forge completed order records without submitting actual payment. The plugin fails to perform server-side validation against the payment processor to confirm a transaction was successfully completed, trusting client-supplied signals instead. Any visitor to an affected WordPress store can obtain goods or services for free, making this a high-impact business-logic flaw despite its moderate CVSS score. A publicly available exploit exists via WPScan, and no public exploitation (KEV) has been confirmed at time of analysis.
Shortcode injection in the Hustle WordPress plugin (versions prior to 7.8.14.2) allows unauthenticated remote attackers to execute any shortcode registered on the target site by embedding nested shortcode syntax in form submission field values. The plugin substitutes submitted values into its post-submission success message, and while a guard exists to prevent shortcode execution, it can be defeated through shortcode nesting - causing WordPress to process and execute arbitrary registered shortcodes in the response. A publicly available proof-of-concept exploit exists, and a vendor patch is available in version 7.8.14.2.
Unauthenticated shortcode injection in the CleanTalk WordPress anti-spam plugin before 6.87 allows any site visitor to trigger arbitrary shortcodes registered on the target WordPress site to execute server-side, with output persisted and rendered to every subsequent visitor of the affected page. Because shortcode execution scope depends entirely on which shortcodes third-party plugins have registered, actual impact can range from minor data leakage to server-side code execution if code-execution shortcodes are present. A publicly available exploit exists, and the vendor has released a patch in version 6.87.
Shortcode injection in the Ninja Forms WordPress plugin (versions 3.14.10 through 3.15.1) allows unauthenticated network attackers to execute any shortcode registered on the target site by embedding shortcode syntax into form request fields the plugin later processes. The plugin fails to strip or escape shortcode markers before passing user-controlled values through WordPress's shortcode execution pipeline, meaning the server interprets and runs injected tags. A publicly available exploit exists per WPScan's advisory; real-world impact scales with the shortcodes registered on the site - ranging from benign output to sensitive data exposure or unintended privileged actions.
Shortcode injection in the Redirection for Contact Form 7 WordPress plugin (versions 2.2.7 through 3.2.10) enables unauthenticated remote attackers to execute arbitrary registered WordPress shortcodes server-side and capture their output. The plugin substitutes raw form submission values into its action settings and then evaluates those settings through WordPress's do_shortcode() pipeline without sanitizing or stripping user-supplied shortcode syntax first. A public proof-of-concept is available via WPScan; vendor-released patch version 3.2.11 addresses the issue.
Email header injection in JetFormBuilder WordPress plugin before 3.6.5.2 allows unauthenticated attackers to manipulate outgoing email headers by submitting CRLF sequences in form address fields. Exploitation enables adding hidden recipients via BCC, spoofing the sender address, and abusing the victim site's trusted email reputation as a phishing or spam relay. A publicly available exploit entry is documented by WPScan, though exploitation requires a non-default configuration in which the plugin is explicitly set to source message address headers from user-submitted form fields.
Shortcode injection in JetFormBuilder WordPress plugin before 3.6.5.2 allows unauthenticated remote attackers to execute any shortcode registered on the target WordPress site. The flaw stems from a misordered sanitization pipeline: user-supplied input in a request parameter is HTML-escaped before it is passed to WordPress's shortcode expansion function rather than after, meaning shortcode syntax survives the escape pass intact and is then evaluated server-side. A publicly available proof-of-concept exploit exists via WPScan, making this immediately actionable for attackers against unpatched installs.
Unauthorized role self-assignment in the B2BKing WooCommerce plugin before version 5.2.40 allows unauthenticated registrants to claim restricted B2B customer group memberships without admin approval by supplying arbitrary role parameters not bounded by server-side validation. The plugin fails to verify that a role submitted during account registration is actually one offered on the public registration form, enabling any user to bypass the manual account-approval workflow and gain access to wholesale pricing tiers or restricted catalogs. A publicly available proof-of-concept exists via WPScan, though no confirmed active exploitation has been identified in CISA KEV at time of analysis.
Stored cross-site scripting in the Bold Page Builder WordPress plugin (all versions before 5.9.9) permits any user holding the Contributor role or higher to embed arbitrary JavaScript inside an HTML attribute via an unsanitized shortcode parameter. A publicly available exploit exists per WPScan (EUVD-2026-72064). When a higher-privileged user such as an administrator views a page containing the injected payload, the script executes in their browser, enabling session hijacking, nonce theft, or full administrative takeover of the WordPress installation.
Unauthenticated account registration bypass in SureCart WordPress plugin before 4.7.0 allows remote attackers to create WordPress user accounts and obtain authenticated sessions even when the site administrator has explicitly disabled user registration. The plugin fails to consult WordPress's native `users_can_register` site option before processing account creation through its own checkout/registration flow. A publicly available proof-of-concept exists per WPScan, and a vendor patch is available in version 4.7.0. No confirmed active exploitation (CISA KEV) at time of analysis.
Real Estate Papi WordPress theme (≤1.0.5) exposes an AJAX endpoint that lacks both capability checks and CSRF validation, enabling any authenticated subscriber to silently force-install a fixed set of companion plugins from the WordPress.org repository. Because CSRF protection is also absent, an attacker can craft a cross-site request that fires in an active administrator session, causing those plugins to be activated as well - an escalation beyond what subscriber-level access alone would permit. WPScan published a proof-of-concept; SSVC rates exploitation as none with partial technical impact, indicating no confirmed in-the-wild abuse at time of analysis.
SQL injection in the Video Player for YouTube WordPress plugin (versions before 2.1.0) allows authenticated users holding the Contributor role or higher to inject arbitrary SQL commands via unsanitized input, enabling them to read any data stored in the underlying WordPress database. The scope change reflected in the CVSS vector (S:C) indicates that exploitation extends reads beyond the plugin's own tables to potentially include WordPress user credentials, secrets, and configuration data held elsewhere in the database. A public PoC exists via WPScan, but EPSS sits at 0.16% and CISA has not added this to KEV, indicating low observed exploitation activity.
Missing authorization on the EmbedPress WordPress plugin's review-loading action (versions 4.6.0-4.6.3) permits unauthenticated remote attackers to abuse the site's stored third-party API credentials - triggering repeated billable API calls against the site owner's account - while simultaneously injecting an unbounded number of attacker-controlled rows into the WordPress database. A publicly available PoC exploit was documented by WPScan. Although EPSS probability is low (0.14%), SSVC rates the attack as automatable, making mass targeting of vulnerable WordPress deployments feasible with minimal tooling.
Stored cross-site scripting in the Joli Table Of Contents WordPress plugin (versions before 3.0.3) permits any user holding the Author role or higher to inject arbitrary HTML attributes and JavaScript via an unsanitized shortcode attribute, with the payload executing in the browser of any visitor - including administrators - who views the post. Because Authors in WordPress are explicitly barred from posting unfiltered HTML, this constitutes a privilege-boundary violation that can be leveraged to hijack administrator sessions or trigger privileged actions covertly. A public exploit is documented by WPScan; EPSS stands at 0.15% (5th percentile), indicating limited automated targeting, and no CISA KEV listing exists.
Stored XSS in CatFolders Document Gallery & PDF Library WordPress plugin before version 2.0.7 allows any user holding an Author account or higher to inject persistent malicious scripts via an unsanitized block attribute that is directly interpolated as an HTML tag name in gallery rendering output. Any visitor who views a post containing the crafted gallery block will execute the attacker's payload in their browser without additional interaction. No active exploitation has been confirmed in CISA KEV, but a publicly available proof-of-concept exists per WPScan disclosure, reducing the technical barrier for any authenticated attacker.
Insufficient authorization on the EmbedPress WordPress plugin's Google Reviews REST API endpoint allows any authenticated Contributor-role user to overwrite the site-wide reviews store in versions 4.6.0 through 4.6.3. An attacker with a Contributor account can delete administrator-configured review entries and inject fabricated ones that render publicly across the entire WordPress site, enabling reputation manipulation or social engineering. A publicly available exploit exists per WPScan; however, SSVC marks exploitation as none and EPSS sits at 0.13% (3rd percentile), reflecting the prerequisite of a legitimate account.
Information disclosure in the EmbedPress WordPress plugin (versions 4.6.0 through 4.6.3) allows any authenticated contributor-level user or above to retrieve the site administrator's email address via an improperly restricted Google Reviews REST API endpoint. WordPress core deliberately withholds administrator email from the contributor role as a privacy control; this plugin bypass defeats that restriction without requiring administrative privileges. A publicly available proof-of-concept has been published by WPScan, though EPSS at 0.14% and SSVC exploitation status of 'none' indicate no observed active exploitation at time of analysis.
Missing authorization on Eventin's event-management REST routes allows low-privilege WordPress contributors to perform integrity-impacting actions outside their permitted scope. Affected installations running Eventin before 4.1.22 expose endpoints that let contributor-role users redirect the site's public front page to an arbitrary event they do not own, and create, edit, or delete global event and speaker taxonomy terms site-wide. A publicly available exploit is documented by WPScan, though SSVC exploitation status is none and EPSS is 0.13%, indicating no confirmed active abuse at time of analysis.
Stored XSS in VikWidgetsLoader WordPress plugin before 1.12.0 allows Contributor-role users to permanently embed arbitrary JavaScript into posts by supplying a malicious block attribute that is output unsanitized inside an inline script tag. When an administrator reviews the pending submission, the payload executes in their browser, enabling full session hijacking and site takeover without any further attacker interaction. A publicly available exploit exists (via WPScan), though EPSS is low (0.15%, 5th percentile) and SSVC records no confirmed exploitation at this time.
Local file inclusion in Eventin WordPress plugin before 4.1.21 enables authenticated contributors and higher-privileged users to include and execute arbitrary PHP files on the web server. The plugin fails to validate a user-supplied template path parameter before passing it to a PHP file-inclusion routine, allowing path traversal to any locally accessible PHP file. A publicly available proof-of-concept has been published by WPScan; vendor patch 4.1.21 is available and should be applied immediately.
Stored cross-site scripting in King Addons for Elementor WordPress plugin before version 51.1.77 allows any Contributor-level (or higher) user to inject persistent JavaScript into a widget display-style setting that is written unescaped into an HTML attribute at render time. The payload fires in every visitor's browser upon page load - including logged-in administrators - enabling session hijacking, credential theft, or silent execution of privileged site actions. A publicly available proof-of-concept was disclosed via WPScan; no active exploitation is confirmed in the CISA KEV catalog at time of analysis.
The Events Calendar WordPress plugin before 6.17.3.1 exposes unpublished site content - drafts, pending posts, and private records from all users - through its public REST API archive endpoints to any contributor-level authenticated user. The plugin fails to enforce WordPress's standard post-status visibility controls on its custom REST routes, allowing a low-privilege account holder to enumerate and read the full body of every non-public record site-wide, bypassing intended access controls. A public proof-of-concept is documented via WPScan, and a vendor patch (6.17.3.1) is available.
Insufficient per-object authorization in the Kirki WordPress plugin before 6.3.0 allows users with administrator-granted content-level page builder access to alter the state of collaboration comments left by any user, including on pages those users cannot themselves open. The root cause is CWE-639 (Authorization Through User-Controlled Key / IDOR): the comment-state endpoint accepts a user-supplied comment identifier without verifying whether the requesting user holds authorization over that specific comment object. Despite a publicly available PoC from WPScan, EPSS sits at 0.13% (3rd percentile) and the vulnerability is not in the CISA KEV catalog, indicating negligible opportunistic exploitation risk.