Unknown
Monthly
SQL injection in the Kirki WordPress plugin (versions 6.0.0 through <6.3.0) enables authenticated users with editor-level access or above to append arbitrary SQL to an unescaped identifier, exfiltrating the full WordPress database including hashed credentials for all user accounts. The scope change (S:C) in the CVSS vector reflects that credential exposure extends impact beyond the attacker's own session to all other platform users. A publicly available proof-of-concept is documented by WPScan, and the vendor has released a remediated version (6.3.0).
Stored cross-site scripting in Bold Page Builder WordPress plugin (all versions before 5.9.8) allows authenticated Contributor-level users to inject persistent arbitrary JavaScript through unsanitized shortcode attribute values, which then execute in the browsers of any visitor rendering the affected page. A publicly available proof-of-concept exists via WPScan, and the vendor has released a patched version (5.9.8). Despite a low EPSS score (0.15%, 5th percentile), the public PoC and low privilege bar make this a realistic attack vector against sites with open contributor registration.
Stored cross-site scripting in the Bold Page Builder WordPress plugin before 5.9.8 allows authenticated users holding the Contributor role or higher to inject arbitrary JavaScript via a crafted link URL that bypasses the plugin's client-side filter. When a victim user subsequently clicks the malicious link rendered in the page builder output, the injected script executes in their browser session. A publicly available proof-of-concept exists per WPScan, though EPSS remains very low (0.15%), indicating limited observed exploitation despite public disclosure.
Stored cross-site scripting in the Greenshift WordPress plugin (all versions before 13.2.0) allows any user with Contributor-level access or higher to inject arbitrary JavaScript via an improperly escaped block animation attribute rendered into an HTML attribute context. When a higher-privileged user such as an administrator views the affected content, the injected script executes in their browser session, enabling session hijacking or unauthorized administrative actions. A publicly available proof-of-concept exists per WPScan reporting, making exploitation accessible to low-skilled threat actors despite the low EPSS score of 0.15%.
Server-side request forgery in the Greenshift WordPress plugin before 13.2.0 allows contributor-level (and higher) authenticated users to direct the server to fetch arbitrary external or internal URLs and read the response. The flaw stems from missing URL validation before server-side HTTP requests are dispatched, enabling internal network reconnaissance, port scanning, or cloud instance metadata credential theft in hosted environments. A publicly available exploit exists and was reported by WPScan; EPSS stands at 0.13% (3rd percentile), suggesting no widespread automated exploitation at time of analysis despite the public PoC.
Stored Cross-Site Scripting in the Masteriyo LMS WordPress plugin before version 3.4.0 allows any user holding the course-author role to inject unsanitized JavaScript into course settings fields, where it silently executes in the browser of every subsequent visitor - including logged-in administrators. Because the injected payload runs within the victim's full session context, a successful attack against a site administrator can result in complete WordPress site takeover through credential theft, rogue plugin installation, or arbitrary content modification. A publicly available proof-of-concept has been published by WPScan; no active exploitation is confirmed by CISA KEV, and the EPSS score of 0.15% (5th percentile) reflects limited observed exploitation probability at time of analysis.
Order-integrity bypass in the Accept Stripe Payments WordPress plugin before 2.1.4 allows unauthenticated customers who complete a genuine Stripe payment to receive fulfillment for a different product than the one they purchased. The plugin validates only that the payment amount is at least the referenced product's price at checkout completion, without verifying that the fulfilled product matches the product for which payment was originally captured. A public proof-of-concept is available via WPScan; no active exploitation is confirmed in CISA KEV, and the EPSS score (0.15%, 4th percentile) indicates low automated exploitation likelihood.
Open redirect in the Accept Stripe Payments WordPress plugin before version 2.1.4 enables unauthenticated attackers to craft URLs that silently redirect site visitors to arbitrary external destinations, creating a phishing vector against users who trust the legitimate domain. The vulnerability stems from unvalidated user-supplied redirect parameters in the plugin's payment flow. A publicly available proof-of-concept exists per WPScan, though the EPSS score of 0.16% (5th percentile) indicates minimal observed automated exploitation at time of analysis.
Unauthenticated information disclosure in the My Private Site WordPress plugin (all versions before 4.2.3) exposes post content, post URLs, and comments to anonymous visitors, directly defeating the plugin's stated purpose of enforcing mandatory login across a WordPress site. The plugin fails to apply its privacy gate to certain front-end read surfaces, meaning requests to those endpoints bypass the authentication requirement entirely. A publicly available proof-of-concept exists; the vendor has released a corrective patch in version 4.2.3.
Unauthorized post-content disclosure in the Smart Post WordPress plugin before 4.0.8 allows any contributor-level authenticated user to duplicate any private or password-protected post into a personal draft, exposing the full content and metadata regardless of the original post's visibility or ownership restrictions. The flaw is rooted in the plugin's post-duplication feature entirely omitting checks on post type, status, and ownership before creating the copy. A public PoC is available via WPScan; no active exploitation has been confirmed by CISA KEV and the EPSS score sits at the 4th percentile.
Unauthenticated information disclosure in the Smart Post WordPress plugin (versions prior to 4.0.8) exposes both the content of password-protected posts and the passwords themselves via an unprotected AJAX endpoint. Any unauthenticated remote user can query the endpoint to bypass WordPress's native post-password protection mechanism entirely, retrieving guarded content without knowing the password - and also harvesting the password itself for reuse. A public exploit is documented by WPScan; a vendor patch (4.0.8) has been released.
HTML injection via unsanitized email notifications in JetFormBuilder WordPress plugin (versions before 3.6.5.2) allows unauthenticated form submitters to embed arbitrary HTML-and conditionally JavaScript-into notification emails delivered to administrators and other configured recipients. The scope change is real: a public form submission influences the admin's email client environment rather than the WordPress server itself, with JavaScript execution gated on the recipient's mail client rendering capability. A publicly available proof-of-concept exists via WPScan, though EPSS at 0.18% (8th percentile) reflects no widespread active exploitation; the vulnerability is not in CISA KEV.
Search Atlas SEO WordPress plugin before 2.6.24 allows any subscriber-level authenticated user to overwrite or permanently delete the site's stored Google service-account credentials by invoking a settings-update handler that performs no nonce verification or capability check. Any registered user on an affected WordPress site can trigger this handler via a crafted HTTP request, disrupting Google Search Console, Analytics, or other Google API integrations that depend on those credentials. A publicly available exploit is documented by WPScan; EPSS remains at 0.14% and CISA KEV status is absent, indicating no observed active exploitation at time of analysis.
Stored Cross-Site Scripting in the Joli Table Of Contents WordPress plugin (versions up to and including 2.8.0) allows authenticated administrator-level users to inject persistent malicious scripts into admin settings pages that execute in the browsers of other administrators who view those pages. The vulnerability bypasses WordPress's unfiltered_html capability restriction, making it particularly relevant in WordPress multisite deployments where that capability is intentionally withheld from site administrators. A vendor-released patch (2.8.1) is available, and a public proof-of-concept has been published by WPScan.
Path traversal in the JCH Optimize WordPress plugin (versions before 5.0.1) permits authenticated administrators - including sub-site administrators on WordPress multisite installations - to enumerate directories and file names outside the web root via an unsanitized path parameter in the plugin's administrative image-browsing feature. A public proof-of-concept is available through WPScan, though SSVC confirms no active exploitation and EPSS sits at the 5th percentile. Real-world impact is confined to confidentiality of filesystem structure: attackers can map server directory layouts and file names but cannot read file contents or modify data.
Client-side price manipulation in the E-cab Taxi Booking Manager for WooCommerce WordPress plugin (before 2.0.5) allows unauthenticated attackers to submit taxi booking orders at an arbitrary price, including zero, by supplying fabricated trip-distance and base-price values that the server accepts without validation. The plugin trusts the pricing parameters delivered in the booking request rather than computing cost authoritatively on the backend, constituting a classic business-logic bypass. A publicly available exploit exists per WPScan; no public exploitation tracking (KEV) is recorded, but the trivial exploitation requirements make this a meaningful financial risk for any operator running the affected plugin.
Unauthenticated information disclosure in the Xpro Addons - 140+ Widgets for Elementor WordPress plugin (versions before 1.7.8) exposes non-public WooCommerce product data - including titles, prices, SKUs, descriptions, and stock levels - to any visitor without authentication. The plugin renders product summaries via a widget endpoint without performing any post-status or capability check, meaning products in draft, pending, private, or scheduled states are fully retrievable by arbitrary external requesters. A publicly available exploit has been documented by WPScan, though no active exploitation has been confirmed by CISA KEV.
Missing post-ownership authorization in Directorist WordPress plugin before 8.9 allows any authenticated subscriber-level user to overwrite image metadata on posts belonging to other users. The plugin fails to verify that the uploading user owns the target post before writing file references to its metadata, enabling cross-user content tampering limited to image attachment references. No public exploit confirmed via CISA KEV, but WPScan has published a proof-of-concept, and a vendor patch is available at version 8.9.
Arbitrary file deletion in WPvivid - Backup, Migration & Staging WordPress plugin before 0.9.134 allows authenticated administrators to supply unsanitized path values to the plugin's file deletion routine, enabling deletion of files anywhere on the server filesystem including outside the web root. Exploitation requires WordPress administrator credentials but no other conditions, and a publicly available proof-of-concept has been published by WPScan. Patch version 0.9.134 is available from the vendor.
Arbitrary file-write via path traversal in WPvivid - Backup, Migration & Staging WordPress plugin before 0.9.134 allows authenticated administrators to place files of permitted types at any writable server path, including locations outside the WordPress installation root. The vulnerability stems from unsanitized user-supplied filenames used directly in write-path construction (CWE-22), with scope change (S:C) confirmed by the vendor CVSS vector. A publicly available proof-of-concept exists, and a patched release (0.9.134) has been issued; no active exploitation (CISA KEV) has been reported at time of analysis.
SQL injection in WPLP Cookie Consent WordPress plugin (versions 3.0.0 through before 4.4.2) allows authenticated administrators to execute arbitrary SQL queries via an unvalidated pagination parameter passed directly into a database query without sanitization. The vendor CVSS includes a scope-change flag (S:C), indicating the injection may permit cross-schema database reads beyond the plugin's own tables. A publicly available proof-of-concept exists via WPScan, though exploitation is gated behind WordPress administrator credentials.
Unauthenticated path traversal file deletion in the Frontend Admin by DynamiApps WordPress plugin before 3.29.13 allows remote attackers to delete index.php and .htaccess files from the WordPress root directory, rendering the site entirely inoperable. The flaw stems from insufficient validation of a user-controllable directory path parameter prior to file deletion operations, exploitable without any authentication credentials. A publicly available proof-of-concept exists; exploitation is constrained by a non-default form configuration requirement, reflected in the CVSS AC:H scoring.
Improper access control in Ninja Forms WordPress plugin (versions 3.14.0 through 3.15.1) allows any user holding a plugin-specific capability to exploit overly permissive REST API endpoints well beyond their intended scope. An attacker authenticated with that capability can read all stored form submissions and plugin settings, overwrite the plugin's configuration, and create or modify arbitrary WordPress posts and pages - operations ordinarily reserved for site administrators. A publicly available proof-of-concept exists per the WPScan advisory, though exploitation depends on a non-default administrative delegation step; no CISA KEV listing has been identified.
Unauthenticated email relay abuse in WPFunnels WordPress plugin versions 3.1.0 through 3.12.x allows any remote visitor to send emails from the affected site to arbitrary recipients with arbitrary subjects. The opt-in submission handler accepts notification recipients and email subject lines directly from HTTP request parameters without performing authorization checks or WordPress nonce validation, turning the site's trusted mail infrastructure into an open relay. A publicly available exploit exists via WPScan; vendor-released patch 3.13.0 closes the gap.
Unauthenticated log file exposure in WPFunnels WordPress plugin (versions 2.6.0 through <3.13.0) enables any remote visitor to retrieve customer order details and opt-in form submission data by directly requesting a predictable log file URL within the public uploads directory. The flaw affects e-commerce funnel operators who may store customer PII - names, emails, purchase data - in these logs, with potential GDPR/privacy regulatory consequences beyond the C:L CVSS rating suggests. A publicly available proof-of-concept exists; no public exploit or CISA KEV listing indicates active mass exploitation at time of analysis.
Price manipulation in WPFunnels WordPress plugin before 3.13.0 allows unauthenticated attackers to apply a configured order bump discount to any purchasable WooCommerce product rather than only the specific product the discount was intended for, causing the fraudulently reduced price to carry through to the completed order total. The vulnerability stems from absent server-side validation of the product-to-discount pairing during order bump processing, classified as CWE-639 (Authorization Bypass Through User-Controlled Key). A publicly available exploit exists via WPScan, and a vendor-released patch is available in version 3.13.0.
Arbitrary file read in the Pods WordPress plugin before 3.3.9.2 allows users holding the Author role or higher to exfiltrate any file accessible to the web server process, including sensitive files outside the web root such as wp-config.php or system credentials. The flaw stems from the plugin's display callback resolver accepting unrestricted PHP callable targets without allowlisting. A publicly available proof-of-concept exists per WPScan, and a vendor patch is available. The attack surface is limited to installations operating in restricted display-callback mode, which is the automatic default for WordPress sites whose initial Pods installation predated version 3.1.
Unauthenticated information disclosure in the Content Views WordPress plugin before 4.5.1.2 allows any remote visitor to read the title and full body of non-public posts - including drafts, pending, private, and scheduled posts - when a site administrator has configured a view to include them. The root cause is a missing authorization check: the plugin never verifies whether the requesting user holds the WordPress capability required to read posts in restricted statuses before serving them in view responses. A publicly available proof-of-concept exists via WPScan; the vendor has released a patched version (4.5.1.2).
Unauthorized WordPress account creation in WPFunnels (versions 3.6.3 through before 3.13.0) allows unauthenticated remote attackers to register user accounts on sites where WordPress registration is explicitly disabled. The plugin trusts a client-supplied boolean in the opt-in form submission request rather than querying the server-side registration setting, making the site-level restriction trivially bypassable. This is an incomplete patch for CVE-2025-12353 - the fix applied in 3.6.3 closed only one of three registration code paths, leaving sites that updated to 3.6.3 through 3.12.x still vulnerable and falsely believing they were protected.
HTTP Header Injection in the Ajaxify Comments WordPress plugin (before version 3.2) allows unauthenticated remote attackers to inject arbitrary HTTP response headers via unsanitized user-supplied input that is echoed into server responses. The plugin fails to neutralize CRLF sequences, enabling response splitting that could facilitate session fixation, cache poisoning, or cross-site scripting via crafted HTTP responses. A publicly available exploit has been documented by WPScan; no active exploitation (CISA KEV) has been confirmed at time of analysis.
Unauthenticated information disclosure in the Wp Edit Password Protected WordPress plugin (before 1.3.5) exposes password-protected page and post content via the WordPress REST API. The plugin enforces content protection on standard page views but fails to apply the same restriction to REST API endpoints, allowing any remote unauthenticated requester to retrieve the full content of pages the site owner intended to keep gated behind a password. A publicly available proof-of-concept is documented by WPScan; no active exploitation has been confirmed in CISA KEV. The CVSS score of 5.3 reflects the limited scope - confidentiality only, no integrity or availability impact.
Global protection bypass in the Passster WordPress plugin (versions before 4.2.26) allows unauthenticated remote attackers to access password-protected content by submitting crafted URLs that circumvent the plugin's site-wide protection checks. Because Passster's entire purpose is content gating, this vulnerability entirely nullifies the plugin's security guarantee for affected sites. A publicly available PoC exists, reported by WPScan, making automated scanning and exploitation straightforward.
Unauthenticated information disclosure in the Passster WordPress plugin (versions before 4.2.24) allows remote attackers to retrieve the values of password-protected content via an improperly handled AJAX action. Because Passster's sole function is gating content behind passwords, this flaw entirely negates its intended protection guarantee. A public exploit is available via WPScan, and the zero-prerequisite attack vector makes this trivially exploitable against any affected installation.
Unauthenticated information disclosure in the Notification Bar for WordPress plugin (through v1.1.8) allows any remote attacker to retrieve the full subscriber email list via an exposed CSV export script that performs no authentication or capability check. A publicly available proof-of-concept published by WPScan confirms trivial exploitation requiring only a single HTTP request. The vulnerability is not currently in CISA KEV, but the zero-friction exploitation path creates meaningful privacy and regulatory exposure (GDPR, CAN-SPAM) for any WordPress site running this plugin.
Stored Cross-Site Scripting in Xpro Addons for WordPress (before 1.7.4) allows any user holding the Contributor role or higher to inject malicious JavaScript through insufficiently escaped widget settings, which are then rendered unsanitized within HTML attributes on the front end. When a privileged user such as an administrator views a page containing the compromised widget, the attacker's payload executes in their browser session. A publicly available exploit has been documented by WPScan; no CISA KEV listing is present, but the low barrier to exploitation (any registered Contributor) makes this a meaningful risk on multi-author or membership WordPress sites.
Payment verification bypass in WP Express Checkout WordPress plugin before 2.4.9 allows unauthenticated remote attackers to forge completed orders without submitting actual payment. The plugin fails to perform server-side confirmation that a payment transaction was successfully processed before transitioning an order to 'paid' status, enabling fraudulent order completion. A publicly available exploit exists per WPScan, making active abuse by financially motivated actors a realistic near-term risk for any e-commerce site running an affected version.
Stored Cross-Site Scripting in the All in One SEO WordPress plugin before version 5.0.0.1 enables users holding the contributor role or above to inject persistent malicious scripts into post content that execute in the browser of any higher-privileged user who subsequently edits that post. The attack effectively allows a low-trust contributor to hijack administrator sessions, enabling full site compromise. A publicly available proof-of-concept from WPScan exists, and the plugin's broad deployment across millions of WordPress installations amplifies aggregate exposure.
Shortcode injection in the Brave WordPress plugin before 0.8.8 allows unauthenticated remote attackers to execute arbitrary WordPress shortcodes server-side by passing crafted values through URL parameters designed for pre-filling form fields. The exploitable shortcodes and their consequences depend entirely on which shortcodes are registered on the target installation - ranging from information disclosure to, in worst-case scenarios involving code-execution shortcodes, elevated impact. A publicly available proof-of-concept exists per WPScan; no active exploitation (KEV) has been confirmed. The CVSS score of 4.8 with AC:H reflects that real-world impact is highly site-dependent.
Cross-site request forgery in the Simple Membership MailChimp Integration WordPress plugin (versions before 1.9.8) allows a network-positioned attacker to replace the site's configured MailChimp API key with one under attacker control by tricking a logged-in administrator into loading a crafted page. Once the API key is substituted, all subsequent member registration data - including name, email address, and membership level - is silently forwarded to the attacker's MailChimp account until the change is detected. A publicly available exploit exists and a vendor patch (1.9.8) is available; no active exploitation has been confirmed in CISA KEV.
Route normalization bypass in the Restrict User Access WordPress plugin (all versions before 2.8.1) lets unauthenticated remote attackers read content the plugin is configured to restrict and enumerate WordPress user accounts. The plugin compares raw incoming REST API route strings against its protection rules without first canonicalizing the path, so a subtly non-canonical request (extra slash, encoded character, etc.) matches no rule and is passed through unrestricted. A publicly available PoC is documented by WPScan; the vulnerability is not in CISA KEV at time of analysis.
Payment bypass in the RegistrationMagic WordPress plugin before 6.0.9.9 allows unauthenticated users to register for paid forms without completing payment and immediately receive an activated account holding whatever role the form is configured to grant. The plugin fails to validate a client-supplied quantity multiplier when computing the total registration price server-side, enabling an attacker to force the calculated total to zero or an arbitrary value. A publicly available proof-of-concept exploit exists per WPScan, and no authentication is required. No public exploit identified at time of analysis for active exploitation, but the low attack complexity combined with public PoC makes this a realistic threat for any site monetizing registrations via this plugin.
Price validation bypass in the RegistrationMagic WordPress plugin before 6.0.9.9 allows unauthenticated users to complete paid registrations without payment and receive fully activated accounts. The plugin fails to verify the total registration price server-side, meaning client-submitted price values are accepted without cross-checking against the configured amount. A publicly available proof-of-concept exploit exists, and no CISA KEV listing has been recorded at time of analysis.
Unauthenticated attackers can bypass WordPress nonce validation in the HIPAA FORMS plugin (all versions before 3.2.0) by including a hardcoded parameter in any AJAX request, which causes the server to skip its nonce check entirely. Because the plugin handles HIPAA-regulated healthcare intake forms, this exposes protected AJAX endpoints to unauthorized read and write operations without any credentials. A public exploit is available via WPScan, and no exploitation complexity is required beyond knowledge of the hardcoded value.
CSS injection in GutenKit WordPress plugin (versions before 2.5.1) allows any authenticated user holding the Contributor role or above to embed arbitrary stylesheets into posts served to all site visitors and anonymous users. The plugin fails to validate or escape style settings before interpolating them into CSS output on the front end, enabling defacement, interface redressing, and forced loading of external resources. JavaScript execution is explicitly ruled out at the Contributor privilege tier, capping the attack surface below full cross-site scripting. A publicly available exploit has been disclosed by WPScan.
Unauthenticated post creation and publication is possible in the User Frontend WordPress plugin before 4.3.11 due to a server-side enforcement gap in its subscription-gating logic. The plugin validates subscription status only at form-render time, not during form submission processing, so an attacker who bypasses the rendered form and submits directly to the backend endpoint can create - and depending on form configuration, immediately publish - posts that should be restricted to paying subscribers. A publicly available proof-of-concept exists and was disclosed through WPScan. No public exploit in CISA KEV at time of analysis.
Broken object-level authorization in the Timetics WordPress plugin through version 1.0.61 allows authenticated users holding the plugin's custom staff role to modify, disable, or take over appointments belonging to other staff members via the REST API. The endpoint accepts appointment identifiers without validating ownership, enabling lateral privilege abuse among staff peers. A public WPScan PoC confirms exploitability, though real-world impact is bounded by the PR:H prerequisite of a pre-existing staff account.
Control-character (newline) injection in Yoast SEO Premium before 27.6.1 allows an authenticated WordPress Author to write arbitrary Apache directives into the site's root .htaccess file via unsanitized redirect origins in file-based redirect mode. On Apache servers that process PHP directives, the injected auto_prepend_file directive can be chained with a polyglot image upload (available to Author-role users) to achieve full Remote Code Execution as the web server process. A public exploit is available via WPScan, making real-world exploitation feasible wherever the three required conditions align.
Stored Cross-Site Scripting in Icegram Express WordPress plugin versions before 5.8.6 allows administrator-level users to inject malicious scripts into HTML attributes via the list description setting. When another user subsequently loads the affected page, the injected payload executes in their browser, enabling session hijacking, credential capture, or unauthorized actions on their behalf. A publicly available proof-of-concept exploit has been confirmed by WPScan, though real-world impact is substantially constrained by the high-privilege prerequisite required to plant the payload.
SQL injection in the WPvivid Backup, Migration & Staging WordPress plugin (all versions before 0.9.133) allows authenticated WordPress administrators to inject arbitrary SQL through an unsanitized list of identifiers passed directly to database queries. The CVSS scope change (S:C) indicates injected queries may reach beyond the plugin's own data, potentially touching other schemas on the shared MySQL host. A publicly available proof-of-concept has been disclosed via WPScan, though SSVC reports no confirmed active exploitation; vendor-released patch 0.9.133 is available.
Privilege escalation in the Theme My Login WordPress plugin (versions before 7.2.0) allows low-privileged users to silently bypass the network's site-creation restrictions on multisite WordPress installations, gaining administrator-level control over a newly created site. Subscriber-level authenticated users - and on some networks, unauthenticated users - can invoke the site-signup flow to create sites even when the network's registration setting prohibits it. A publicly available proof-of-concept exploit exists, raising the urgency for patching. The vendor has released a fix in version 7.2.0.
Cross-site request forgery vulnerabilities in JetStyleManager for Gutenberg WordPress plugin (all versions before 1.3.9) allow an unauthenticated attacker to delete or modify custom widget skins by tricking a logged-in Contributor-level (or higher) user into visiting a crafted page or clicking a malicious link. The missing CSRF token (nonce) validation on affected AJAX endpoints means the victim's authenticated browser session is silently weaponized against their own site. A publicly available exploit exists via WPScan and vendor-released patch version 1.3.9 resolves the issue.
Insecure Direct Object Reference in the WC Vendors WordPress plugin before 2.7.2.1 allows any authenticated user holding the vendor role to tamper with product variations owned by other vendors and to overwrite the status and title of arbitrary WordPress posts. The root cause is that the plugin never validates whether a user-supplied object ID actually belongs to the requesting vendor before persisting changes. A publicly available proof-of-concept exploit exists; the issue is not currently listed in CISA KEV.
Missing order-ownership verification in WC Vendors WordPress plugin before 2.7.2.1 allows any authenticated vendor to manipulate shipment records belonging to other vendors. An attacker with a valid vendor account can submit a front-end shipment status update referencing any order ID regardless of ownership, causing the order to be falsely marked as shipped, an order note to be injected under the victim vendor's identity, and the customer to receive a fraudulent dispatch notification. A publicly available proof-of-concept exists via WPScan; no active exploitation is confirmed in CISA KEV.
CSRF protection is absent on front-end order shipment status actions in the WC Vendors WordPress plugin before version 2.7.2.1, allowing network-based attackers to manipulate a logged-in vendor's order shipment state by inducing them to visit a crafted page. The vulnerability requires no attacker authentication and no special deployment configuration beyond active vendor use of the plugin's front-end dashboard. A publicly available exploit exists via WPScan, though no CISA KEV listing was identified, and the practical impact is bounded to order status modification rather than data breach or site takeover.
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin before 3.7.46 exposes learning statistics for any registered user without authorization. The plugin's student statistics endpoint performs no access control check, allowing any remote attacker to retrieve course counts, accumulated points, certificates, quiz totals, and assignment totals for arbitrary user accounts. A publicly available exploit exists per WPScan, and the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required.
Cross-instructor content tampering in MasterStudy LMS WordPress Plugin before 3.7.46 allows authenticated instructor-role users to delete or modify curriculum sections and materials belonging to courses owned by other instructors. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the plugin performs operations on curriculum objects without confirming the requesting instructor owns the parent course. A publicly available proof-of-concept exists via WPScan; no active exploitation (CISA KEV) has been recorded, and the CVSS score of 3.8 reflects the restricted impact scope.
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin before 3.7.46 exposes the titles and IDs of an author's unpublished courses - including draft, pending, and private posts - through an unprotected REST API endpoint. The affected route performs no access control check and applies no publication-status filter, meaning any unauthenticated network request can enumerate course content that site owners intended to keep hidden. A publicly available proof-of-concept exists per the WPScan advisory; no active exploitation has been confirmed in CISA KEV at time of analysis.
Instructors in MasterStudy LMS WordPress Plugin versions before 3.7.46 can read quiz questions, correct answers, and explanations belonging to other instructors by supplying arbitrary question identifiers in plugin requests. The root cause is CWE-639 (IDOR - Authorization Through User-Controlled Key): the plugin exposes question IDs without verifying that the requesting instructor owns them. A public proof-of-concept is available via WPScan, and a vendor patch has been released at version 3.7.46.
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin (all versions before 3.7.46) exposes per-student course enrollment and learning progress data to any remote attacker without credentials. The plugin fails to perform an authorization check before returning student-specific data, allowing enumeration of any registered user's enrolled courses and progress metrics. A publicly available exploit exists via WPScan; no active exploitation (KEV) has been confirmed, and the CVSS 5.3 score accurately reflects limited confidentiality impact.
Broken object-level authorization in MasterStudy LMS WordPress Plugin before 3.7.46 exposes course sales records of any instructor to any authenticated WordPress user. The plugin's order line-item retrieval endpoint accepts a user-supplied identifier without verifying that the requesting user is the record owner, enabling subscriber-level accounts to enumerate and read other instructors' transaction histories. A publicly available exploit exists per WPScan, and the fix is present in version 3.7.46.
Email content injection in the CatalogX WordPress plugin before 6.1.3 allows unauthenticated attackers to permanently plant unsanitized content into product enquiry notification emails delivered to site administrators. The injected payload is stored server-side upon submission of a product enquiry and is included verbatim in the administrator notification email each time any subsequent visitor triggers a new enquiry. A publicly available proof-of-concept exists; no public exploit confirmed as actively exploited per CISA KEV.
FormLayer WordPress plugin before version 1.0.9 discloses full form configuration data to unauthenticated users through its public submission handler, which performs no authorization check before returning stored settings. Notification recipient email addresses, confirmation redirect targets, and third-party integration credentials are exposed for all forms - including unpublished drafts invisible to end users. A public exploit exists via WPScan, and a vendor patch is available at version 1.0.9.
Rank Math SEO WordPress plugin before version 1.0.277 allows authenticated users holding at minimum an Author role to overwrite arbitrary post and user metadata across the entire WordPress installation, including metadata belonging to higher-privileged accounts such as Editors and Administrators. The flaw is an IDOR (CWE-639): the metadata update endpoint accepts a user-controlled row reference without verifying that the targeted record belongs to an object the requesting user is authorized to modify. A publicly available proof-of-concept exploit exists, confirmed by WPScan; no active exploitation in CISA KEV is noted at time of analysis.
Privilege escalation in the Rank Math SEO WordPress plugin (versions before 1.0.277) lets any authenticated Author-role user modify SEO metadata on taxonomy terms they have no editorial rights over, and overwrite post titles belonging to other users. The root cause is a missing capability check in the bulk metadata update handler, compounded by unsafe object identifier reuse across object types (taxonomy terms and posts), which allows the same request to reach unintended target objects. A public exploit is documented by WPScan and a vendor patch (v1.0.277) has been released.
Insecure direct object reference (IDOR) in Rank Math SEO WordPress plugin before 1.0.277 allows authenticated users with the Author role or above to read the title, body, and SEO metadata of other users' non-public posts (drafts, private, pending) without authorization. The plugin fails to verify that the requesting user has permission to access the specific post ID supplied in the request. A publicly available exploit exists per WPScan, and a vendor patch (1.0.277) has been released. No active exploitation confirmed in CISA KEV at time of analysis.
Rank Math SEO WordPress plugin before version 1.0.277 allows any authenticated user with at least the Author role to modify SEO indexing metadata on WordPress content, taxonomy terms, and user profiles they do not own, due to a missing object-ownership check. This enables authors to suppress other users' content from the site's XML sitemap and search engine index, causing targeted de-indexing attacks in multi-author environments. A publicly available proof-of-concept exploit exists, and a vendor-released patch (1.0.277) is available.
Unauthenticated schema disclosure in the Rank Math SEO WordPress plugin (versions 1.0.48 through 1.0.276) allows any anonymous visitor to read the structured schema markup and associated post content of posts the site owner has restricted - including drafts, pending review, private, scheduled, and password-protected posts. The plugin renders JSON-LD schema on the front end without verifying whether the requesting user is authorized to view the underlying post, effectively leaking embargoed or confidential content. A publicly available exploit is documented by WPScan; vendor patch version 1.0.277 is available. No active exploitation confirmed in CISA KEV at time of analysis.
Rank Math SEO WordPress plugin versions before 1.0.277.1 exposes the full content of password-protected posts to unauthenticated users via publicly generated SEO metadata. The plugin fails to enforce WordPress's native post-password gate before extracting post content for use in meta tags and structured data, making protected content readable by anyone who can access the SEO output. A publicly available proof-of-concept is documented by WPScan; a vendor patch (1.0.277.1) is available.
Insufficient access control in GamiPress (WordPress plugin before 7.9.9.6) allows any authenticated Subscriber-level user to abuse the video watch-tracking endpoint to award configured gamification points, achievements, and ranks to any WordPress user on the site - including administrators - and to accrue them without limit. The flaw maps to CWE-639 (Authorization Bypass Through User-Controlled Key), where the endpoint accepts a user-controlled target identifier without verifying the requester's authorization to grant rewards to that target. A publicly available proof-of-concept is documented by WPScan, and a vendor patch is available.
Unauthenticated information disclosure in the MultiVendorX WordPress plugin (versions prior to 5.0.15) exposes sensitive marketplace data through an improperly secured REST API listing route. Any unauthenticated remote attacker can query the endpoint to retrieve vendor contact information, payout details, pending payout amounts, and administrative notes attached to store applications. A publicly available exploit code exists via WPScan, and a vendor patch has been released in version 5.0.15.
Stored Cross-Site Scripting in the Social Media Share Buttons & Social Sharing Icons WordPress plugin (versions before 3.0.1) allows users with the Contributor role or higher to inject persistent JavaScript payloads via unescaped post titles rendered inside inline event handlers on share buttons. Payload execution is deferred to site visitors who interact with those buttons - enabling session theft or full site compromise if an administrator triggers it. A publicly available proof-of-concept from WPScan exists; no active exploitation confirmed in CISA KEV at time of analysis.
SQL injection in the Comments WordPress plugin before 7.6.66 allows unauthenticated remote attackers to read restricted comment content by injecting SQL grammar into an unvalidated query parameter. Affected content includes comments awaiting moderation, spam and trash comments, and comments attached to private or draft posts. The impact is scoped to comment disclosure rather than full database extraction, as the injection manipulates query structure rather than enabling arbitrary SELECT statements. No public exploit identified at time of analysis is contradicted by WPScan confirming publicly available exploit code exists.
Unauthenticated information disclosure in the Ultimate Member WordPress plugin (all versions before 2.13.0) exposes the content of comments still awaiting moderation and activity from private user profiles to any anonymous visitor. The plugin's profile activity endpoint fails to verify both comment approval status and profile privacy settings before returning data, meaning moderated/private content is served as if it were public. A publicly available proof-of-concept exists; no active exploitation has been confirmed via CISA KEV.
Plaintext password disclosure in the Gutentor WordPress page builder plugin (before 4.0.6) allows any authenticated subscriber-level user to retrieve the passwords of password-protected posts via a misconfigured REST API endpoint. The endpoint fails to enforce WordPress's built-in content-access context restrictions, meaning the security model of password-protected posts is completely bypassed for any site user who can authenticate. A publicly available exploit exists per WPScan, and a patched release (4.0.6) is available from the vendor.
Unauthenticated information disclosure in the Solace Extra WordPress plugin before 1.7.0 exposes the full content of non-published Site Builder parts - drafts, pending posts, private pages, and trashed items - to any anonymous visitor via an unprotected AJAX action. The plugin registers an AJAX handler that performs no capability check and no post-status validation, bypassing WordPress's normal access controls entirely. A public proof-of-concept is available through WPScan; the vendor has released version 1.7.0 to close the gap.
Unauthenticated IDOR (CWE-639) in the MotoPress Appointment Booking WordPress plugin before version 2.4.8 enables any remote attacker to permanently delete arbitrary users' reservations by supplying a known booking identifier to an unprotected deletion endpoint. This CVE documents an incomplete fix of CVE-2026-9180 - the vulnerable deletion path remains reachable on sites using payment confirmation workflows, confirmed through version 2.4.7. A publicly available proof-of-concept was disclosed by WPScan, and the vendor has released a corrective patch in version 2.4.8.
Missing authorization in the Booking for Appointments and Events Calendar WordPress plugin (versions before 2.4.9) allows unauthenticated remote attackers to trigger the post-booking action chain - including email notifications and third-party integration callbacks - for any booking by guessing or enumerating its numeric identifier. The plugin fails to validate either session authentication or a nonce/request token before executing post-booking hooks, meaning an attacker can impersonate the completion of any booking without ever making a real reservation. A publicly available proof-of-concept exploit exists per WPScan, though no KEV listing confirms active mass exploitation.
Stored cross-site scripting in the Ultimate Before After Image Slider & Gallery WordPress plugin before version 4.7.19 enables any authenticated user holding the Author role or higher to plant a malicious JavaScript payload within a slider's before-label field. Because the plugin's bundled client-side script re-injects that label value into the DOM without sanitization, the payload executes automatically in the browser of every visitor - including administrators - who views the affected slider. A publicly available proof-of-concept was published by WPScan; vendor-released patch version 4.7.19 is available, and no active exploitation has been confirmed in the CISA KEV catalog.
Stored cross-site scripting in the Ultimate Before After Image Slider & Gallery WordPress plugin (all versions before 4.7.19) allows users holding the Author role or above to embed a persistent browser payload in a slider's after-label field, which executes in every visitor's browser - including site administrators - when the slider is rendered. The plugin's bundled client-side script re-injects the stored label value directly into the DOM without HTML encoding. A publicly available exploit exists per WPScan, making this a practical privilege-escalation path on any WordPress site granting Author access to untrusted users.
Unauthenticated REST endpoint access in the KiviCare WordPress plugin (before 4.5.5) exposes both a clinic's full patient roster and, critically, the configured payment gateway secret key to any unauthenticated remote attacker. The vulnerability stems from missing authorization checks on specific REST API routes, requiring no credentials or user interaction to exploit. A publicly available proof-of-concept is documented by WPScan, materially lowering the bar for exploitation across any WordPress site running an unpatched version of this clinic management plugin.
Shortcode injection in MW WP Form WordPress plugin (versions before 5.1.5) allows unauthenticated remote attackers to execute any WordPress shortcode registered on the target site. The plugin fails to neutralize shortcode syntax in user-submitted form values before passing those values through WordPress's shortcode processing engine. A publicly available proof-of-concept exists (via WPScan), though exploitation is gated by a non-default site configuration requirement, which suppresses real-world risk despite the network-accessible attack vector.
Web cache poisoning in WP Fastest Cache WordPress plugin before 1.5.1 enables unauthenticated attackers to inject content into the site-wide page cache by exploiting its failure to include tracking-related query parameters in cache key construction. Because the plugin caches responses to URLs containing these parameters under the canonical clean-URL key, an attacker-controlled page render is stored and subsequently served to every visitor of the legitimate URL. A publicly available proof-of-concept exploit exists; no active exploitation confirmed in CISA KEV at time of analysis.
Missing authorization in the 爱采集数据采集和发布插件 WordPress plugin (all versions through 1.0.0) exposes internal handler methods to unauthenticated HTTP requests with no capability or nonce verification, allowing any remote attacker to create WordPress user accounts and taxonomy terms. A publicly available exploit has been documented by WPScan, significantly lowering the barrier to opportunistic exploitation across WordPress installations running this plugin. No KEV listing confirms active widespread exploitation at time of analysis, but the trivial attack complexity and public exploit code make targeted abuse realistic.
Improper privilege management in the Really Simple Security WordPress plugin before 9.8.0 permits a subsite administrator on a WordPress multisite network to install an arbitrary plugin from a user-supplied URL, placing attacker-controlled PHP code into the network-shared plugin directory normally reserved for network (super) administrators. Successful exploitation achieves remote code execution with full confidentiality, integrity, and availability impact across the entire multisite network. A public proof-of-concept is available via WPScan, though EPSS remains low (0.15%) consistent with the high-privilege, non-default-configuration prerequisites; no confirmed active exploitation (CISA KEV) is recorded at time of analysis.
Stored XSS in the MW WP Form WordPress plugin (all versions before 5.1.6) lets authenticated users holding the Editor role or above inject persistent malicious JavaScript into form settings, which then executes in the browser of any administrator who views the affected dashboard page. A publicly available proof-of-concept has been published by WPScan, though EPSS sits at 0.15% (5th percentile), indicating low measured exploitation probability at this time. No confirmed active exploitation has been reported and the vulnerability is not listed in the CISA KEV catalog.
Arbitrary file write via path traversal in the WPvivid - Backup, Migration & Staging WordPress plugin (versions before 0.9.133) allows high-privilege WordPress administrators to extract backup archives with traversal sequences that write files outside the designated restore directory. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.17% (7th percentile) and CISA KEV lists no active exploitation at time of analysis. Successful exploitation can lead to remote code execution by placing malicious PHP files in web-accessible directories.
Stored cross-site scripting in the SOGO Add Script to Individual Pages Header Footer WordPress plugin (through version 3.9) enables any contributor-level WordPress user to inject arbitrary JavaScript into per-post header and footer script fields without sanitization or capability gating. The payload executes in an administrator's browser when reviewing the pending post, enabling session hijacking and full site takeover, and persists for all site visitors once the post is published. A publicly available proof-of-concept exists per WPScan, though EPSS remains at 0.15% (5th percentile) and there is no CISA KEV listing, indicating limited opportunistic exploitation to date.
Unauthorized deletion of arbitrary membership plans is possible in the Frontend Admin by DynamiApps WordPress plugin (all versions before 3.29.11) due to a missing capability check on an AJAX endpoint accessible to any logged-in user. Any subscriber-level WordPress account holder can send a crafted AJAX request to invoke the unprotected action and permanently remove membership plans without administrative authorization. A publicly available proof-of-concept exists per WPScan, though the EPSS score of 0.13% (3rd percentile) indicates very limited observed exploitation activity at time of analysis, and the vulnerability is not listed in CISA KEV.
Open redirect in MasterStudy LMS WordPress Plugin before version 3.7.43 enables unauthenticated attackers to supply an unvalidated redirect parameter during user registration, silently forwarding newly registered users to arbitrary external URLs. This creates a reliable phishing vector: an attacker crafts a registration link pointing to a spoofed login page, and the plugin delivers the victim there immediately post-registration without warning. A publicly available proof-of-concept exists per WPScan, though the EPSS score of 0.14% (3rd percentile) indicates exploitation has not yet become widespread or automated.
MasterStudy LMS WordPress Plugin versions before 3.7.42 expose order billing records - including customer names, email addresses, phone numbers, and postal addresses - to any authenticated user holding the instructor role, via insecure direct object reference on order IDs. An instructor can iterate through order IDs in the plugin's order-detail endpoint to retrieve billing information belonging to arbitrary other users without any administrative interaction. A publicly available proof-of-concept exists per WPScan, though no confirmed active exploitation has been observed and the EPSS probability remains extremely low at 0.13%.
SQL injection in the Kirki WordPress plugin (versions 6.0.0 through <6.3.0) enables authenticated users with editor-level access or above to append arbitrary SQL to an unescaped identifier, exfiltrating the full WordPress database including hashed credentials for all user accounts. The scope change (S:C) in the CVSS vector reflects that credential exposure extends impact beyond the attacker's own session to all other platform users. A publicly available proof-of-concept is documented by WPScan, and the vendor has released a remediated version (6.3.0).
Stored cross-site scripting in Bold Page Builder WordPress plugin (all versions before 5.9.8) allows authenticated Contributor-level users to inject persistent arbitrary JavaScript through unsanitized shortcode attribute values, which then execute in the browsers of any visitor rendering the affected page. A publicly available proof-of-concept exists via WPScan, and the vendor has released a patched version (5.9.8). Despite a low EPSS score (0.15%, 5th percentile), the public PoC and low privilege bar make this a realistic attack vector against sites with open contributor registration.
Stored cross-site scripting in the Bold Page Builder WordPress plugin before 5.9.8 allows authenticated users holding the Contributor role or higher to inject arbitrary JavaScript via a crafted link URL that bypasses the plugin's client-side filter. When a victim user subsequently clicks the malicious link rendered in the page builder output, the injected script executes in their browser session. A publicly available proof-of-concept exists per WPScan, though EPSS remains very low (0.15%), indicating limited observed exploitation despite public disclosure.
Stored cross-site scripting in the Greenshift WordPress plugin (all versions before 13.2.0) allows any user with Contributor-level access or higher to inject arbitrary JavaScript via an improperly escaped block animation attribute rendered into an HTML attribute context. When a higher-privileged user such as an administrator views the affected content, the injected script executes in their browser session, enabling session hijacking or unauthorized administrative actions. A publicly available proof-of-concept exists per WPScan reporting, making exploitation accessible to low-skilled threat actors despite the low EPSS score of 0.15%.
Server-side request forgery in the Greenshift WordPress plugin before 13.2.0 allows contributor-level (and higher) authenticated users to direct the server to fetch arbitrary external or internal URLs and read the response. The flaw stems from missing URL validation before server-side HTTP requests are dispatched, enabling internal network reconnaissance, port scanning, or cloud instance metadata credential theft in hosted environments. A publicly available exploit exists and was reported by WPScan; EPSS stands at 0.13% (3rd percentile), suggesting no widespread automated exploitation at time of analysis despite the public PoC.
Stored Cross-Site Scripting in the Masteriyo LMS WordPress plugin before version 3.4.0 allows any user holding the course-author role to inject unsanitized JavaScript into course settings fields, where it silently executes in the browser of every subsequent visitor - including logged-in administrators. Because the injected payload runs within the victim's full session context, a successful attack against a site administrator can result in complete WordPress site takeover through credential theft, rogue plugin installation, or arbitrary content modification. A publicly available proof-of-concept has been published by WPScan; no active exploitation is confirmed by CISA KEV, and the EPSS score of 0.15% (5th percentile) reflects limited observed exploitation probability at time of analysis.
Order-integrity bypass in the Accept Stripe Payments WordPress plugin before 2.1.4 allows unauthenticated customers who complete a genuine Stripe payment to receive fulfillment for a different product than the one they purchased. The plugin validates only that the payment amount is at least the referenced product's price at checkout completion, without verifying that the fulfilled product matches the product for which payment was originally captured. A public proof-of-concept is available via WPScan; no active exploitation is confirmed in CISA KEV, and the EPSS score (0.15%, 4th percentile) indicates low automated exploitation likelihood.
Open redirect in the Accept Stripe Payments WordPress plugin before version 2.1.4 enables unauthenticated attackers to craft URLs that silently redirect site visitors to arbitrary external destinations, creating a phishing vector against users who trust the legitimate domain. The vulnerability stems from unvalidated user-supplied redirect parameters in the plugin's payment flow. A publicly available proof-of-concept exists per WPScan, though the EPSS score of 0.16% (5th percentile) indicates minimal observed automated exploitation at time of analysis.
Unauthenticated information disclosure in the My Private Site WordPress plugin (all versions before 4.2.3) exposes post content, post URLs, and comments to anonymous visitors, directly defeating the plugin's stated purpose of enforcing mandatory login across a WordPress site. The plugin fails to apply its privacy gate to certain front-end read surfaces, meaning requests to those endpoints bypass the authentication requirement entirely. A publicly available proof-of-concept exists; the vendor has released a corrective patch in version 4.2.3.
Unauthorized post-content disclosure in the Smart Post WordPress plugin before 4.0.8 allows any contributor-level authenticated user to duplicate any private or password-protected post into a personal draft, exposing the full content and metadata regardless of the original post's visibility or ownership restrictions. The flaw is rooted in the plugin's post-duplication feature entirely omitting checks on post type, status, and ownership before creating the copy. A public PoC is available via WPScan; no active exploitation has been confirmed by CISA KEV and the EPSS score sits at the 4th percentile.
Unauthenticated information disclosure in the Smart Post WordPress plugin (versions prior to 4.0.8) exposes both the content of password-protected posts and the passwords themselves via an unprotected AJAX endpoint. Any unauthenticated remote user can query the endpoint to bypass WordPress's native post-password protection mechanism entirely, retrieving guarded content without knowing the password - and also harvesting the password itself for reuse. A public exploit is documented by WPScan; a vendor patch (4.0.8) has been released.
HTML injection via unsanitized email notifications in JetFormBuilder WordPress plugin (versions before 3.6.5.2) allows unauthenticated form submitters to embed arbitrary HTML-and conditionally JavaScript-into notification emails delivered to administrators and other configured recipients. The scope change is real: a public form submission influences the admin's email client environment rather than the WordPress server itself, with JavaScript execution gated on the recipient's mail client rendering capability. A publicly available proof-of-concept exists via WPScan, though EPSS at 0.18% (8th percentile) reflects no widespread active exploitation; the vulnerability is not in CISA KEV.
Search Atlas SEO WordPress plugin before 2.6.24 allows any subscriber-level authenticated user to overwrite or permanently delete the site's stored Google service-account credentials by invoking a settings-update handler that performs no nonce verification or capability check. Any registered user on an affected WordPress site can trigger this handler via a crafted HTTP request, disrupting Google Search Console, Analytics, or other Google API integrations that depend on those credentials. A publicly available exploit is documented by WPScan; EPSS remains at 0.14% and CISA KEV status is absent, indicating no observed active exploitation at time of analysis.
Stored Cross-Site Scripting in the Joli Table Of Contents WordPress plugin (versions up to and including 2.8.0) allows authenticated administrator-level users to inject persistent malicious scripts into admin settings pages that execute in the browsers of other administrators who view those pages. The vulnerability bypasses WordPress's unfiltered_html capability restriction, making it particularly relevant in WordPress multisite deployments where that capability is intentionally withheld from site administrators. A vendor-released patch (2.8.1) is available, and a public proof-of-concept has been published by WPScan.
Path traversal in the JCH Optimize WordPress plugin (versions before 5.0.1) permits authenticated administrators - including sub-site administrators on WordPress multisite installations - to enumerate directories and file names outside the web root via an unsanitized path parameter in the plugin's administrative image-browsing feature. A public proof-of-concept is available through WPScan, though SSVC confirms no active exploitation and EPSS sits at the 5th percentile. Real-world impact is confined to confidentiality of filesystem structure: attackers can map server directory layouts and file names but cannot read file contents or modify data.
Client-side price manipulation in the E-cab Taxi Booking Manager for WooCommerce WordPress plugin (before 2.0.5) allows unauthenticated attackers to submit taxi booking orders at an arbitrary price, including zero, by supplying fabricated trip-distance and base-price values that the server accepts without validation. The plugin trusts the pricing parameters delivered in the booking request rather than computing cost authoritatively on the backend, constituting a classic business-logic bypass. A publicly available exploit exists per WPScan; no public exploitation tracking (KEV) is recorded, but the trivial exploitation requirements make this a meaningful financial risk for any operator running the affected plugin.
Unauthenticated information disclosure in the Xpro Addons - 140+ Widgets for Elementor WordPress plugin (versions before 1.7.8) exposes non-public WooCommerce product data - including titles, prices, SKUs, descriptions, and stock levels - to any visitor without authentication. The plugin renders product summaries via a widget endpoint without performing any post-status or capability check, meaning products in draft, pending, private, or scheduled states are fully retrievable by arbitrary external requesters. A publicly available exploit has been documented by WPScan, though no active exploitation has been confirmed by CISA KEV.
Missing post-ownership authorization in Directorist WordPress plugin before 8.9 allows any authenticated subscriber-level user to overwrite image metadata on posts belonging to other users. The plugin fails to verify that the uploading user owns the target post before writing file references to its metadata, enabling cross-user content tampering limited to image attachment references. No public exploit confirmed via CISA KEV, but WPScan has published a proof-of-concept, and a vendor patch is available at version 8.9.
Arbitrary file deletion in WPvivid - Backup, Migration & Staging WordPress plugin before 0.9.134 allows authenticated administrators to supply unsanitized path values to the plugin's file deletion routine, enabling deletion of files anywhere on the server filesystem including outside the web root. Exploitation requires WordPress administrator credentials but no other conditions, and a publicly available proof-of-concept has been published by WPScan. Patch version 0.9.134 is available from the vendor.
Arbitrary file-write via path traversal in WPvivid - Backup, Migration & Staging WordPress plugin before 0.9.134 allows authenticated administrators to place files of permitted types at any writable server path, including locations outside the WordPress installation root. The vulnerability stems from unsanitized user-supplied filenames used directly in write-path construction (CWE-22), with scope change (S:C) confirmed by the vendor CVSS vector. A publicly available proof-of-concept exists, and a patched release (0.9.134) has been issued; no active exploitation (CISA KEV) has been reported at time of analysis.
SQL injection in WPLP Cookie Consent WordPress plugin (versions 3.0.0 through before 4.4.2) allows authenticated administrators to execute arbitrary SQL queries via an unvalidated pagination parameter passed directly into a database query without sanitization. The vendor CVSS includes a scope-change flag (S:C), indicating the injection may permit cross-schema database reads beyond the plugin's own tables. A publicly available proof-of-concept exists via WPScan, though exploitation is gated behind WordPress administrator credentials.
Unauthenticated path traversal file deletion in the Frontend Admin by DynamiApps WordPress plugin before 3.29.13 allows remote attackers to delete index.php and .htaccess files from the WordPress root directory, rendering the site entirely inoperable. The flaw stems from insufficient validation of a user-controllable directory path parameter prior to file deletion operations, exploitable without any authentication credentials. A publicly available proof-of-concept exists; exploitation is constrained by a non-default form configuration requirement, reflected in the CVSS AC:H scoring.
Improper access control in Ninja Forms WordPress plugin (versions 3.14.0 through 3.15.1) allows any user holding a plugin-specific capability to exploit overly permissive REST API endpoints well beyond their intended scope. An attacker authenticated with that capability can read all stored form submissions and plugin settings, overwrite the plugin's configuration, and create or modify arbitrary WordPress posts and pages - operations ordinarily reserved for site administrators. A publicly available proof-of-concept exists per the WPScan advisory, though exploitation depends on a non-default administrative delegation step; no CISA KEV listing has been identified.
Unauthenticated email relay abuse in WPFunnels WordPress plugin versions 3.1.0 through 3.12.x allows any remote visitor to send emails from the affected site to arbitrary recipients with arbitrary subjects. The opt-in submission handler accepts notification recipients and email subject lines directly from HTTP request parameters without performing authorization checks or WordPress nonce validation, turning the site's trusted mail infrastructure into an open relay. A publicly available exploit exists via WPScan; vendor-released patch 3.13.0 closes the gap.
Unauthenticated log file exposure in WPFunnels WordPress plugin (versions 2.6.0 through <3.13.0) enables any remote visitor to retrieve customer order details and opt-in form submission data by directly requesting a predictable log file URL within the public uploads directory. The flaw affects e-commerce funnel operators who may store customer PII - names, emails, purchase data - in these logs, with potential GDPR/privacy regulatory consequences beyond the C:L CVSS rating suggests. A publicly available proof-of-concept exists; no public exploit or CISA KEV listing indicates active mass exploitation at time of analysis.
Price manipulation in WPFunnels WordPress plugin before 3.13.0 allows unauthenticated attackers to apply a configured order bump discount to any purchasable WooCommerce product rather than only the specific product the discount was intended for, causing the fraudulently reduced price to carry through to the completed order total. The vulnerability stems from absent server-side validation of the product-to-discount pairing during order bump processing, classified as CWE-639 (Authorization Bypass Through User-Controlled Key). A publicly available exploit exists via WPScan, and a vendor-released patch is available in version 3.13.0.
Arbitrary file read in the Pods WordPress plugin before 3.3.9.2 allows users holding the Author role or higher to exfiltrate any file accessible to the web server process, including sensitive files outside the web root such as wp-config.php or system credentials. The flaw stems from the plugin's display callback resolver accepting unrestricted PHP callable targets without allowlisting. A publicly available proof-of-concept exists per WPScan, and a vendor patch is available. The attack surface is limited to installations operating in restricted display-callback mode, which is the automatic default for WordPress sites whose initial Pods installation predated version 3.1.
Unauthenticated information disclosure in the Content Views WordPress plugin before 4.5.1.2 allows any remote visitor to read the title and full body of non-public posts - including drafts, pending, private, and scheduled posts - when a site administrator has configured a view to include them. The root cause is a missing authorization check: the plugin never verifies whether the requesting user holds the WordPress capability required to read posts in restricted statuses before serving them in view responses. A publicly available proof-of-concept exists via WPScan; the vendor has released a patched version (4.5.1.2).
Unauthorized WordPress account creation in WPFunnels (versions 3.6.3 through before 3.13.0) allows unauthenticated remote attackers to register user accounts on sites where WordPress registration is explicitly disabled. The plugin trusts a client-supplied boolean in the opt-in form submission request rather than querying the server-side registration setting, making the site-level restriction trivially bypassable. This is an incomplete patch for CVE-2025-12353 - the fix applied in 3.6.3 closed only one of three registration code paths, leaving sites that updated to 3.6.3 through 3.12.x still vulnerable and falsely believing they were protected.
HTTP Header Injection in the Ajaxify Comments WordPress plugin (before version 3.2) allows unauthenticated remote attackers to inject arbitrary HTTP response headers via unsanitized user-supplied input that is echoed into server responses. The plugin fails to neutralize CRLF sequences, enabling response splitting that could facilitate session fixation, cache poisoning, or cross-site scripting via crafted HTTP responses. A publicly available exploit has been documented by WPScan; no active exploitation (CISA KEV) has been confirmed at time of analysis.
Unauthenticated information disclosure in the Wp Edit Password Protected WordPress plugin (before 1.3.5) exposes password-protected page and post content via the WordPress REST API. The plugin enforces content protection on standard page views but fails to apply the same restriction to REST API endpoints, allowing any remote unauthenticated requester to retrieve the full content of pages the site owner intended to keep gated behind a password. A publicly available proof-of-concept is documented by WPScan; no active exploitation has been confirmed in CISA KEV. The CVSS score of 5.3 reflects the limited scope - confidentiality only, no integrity or availability impact.
Global protection bypass in the Passster WordPress plugin (versions before 4.2.26) allows unauthenticated remote attackers to access password-protected content by submitting crafted URLs that circumvent the plugin's site-wide protection checks. Because Passster's entire purpose is content gating, this vulnerability entirely nullifies the plugin's security guarantee for affected sites. A publicly available PoC exists, reported by WPScan, making automated scanning and exploitation straightforward.
Unauthenticated information disclosure in the Passster WordPress plugin (versions before 4.2.24) allows remote attackers to retrieve the values of password-protected content via an improperly handled AJAX action. Because Passster's sole function is gating content behind passwords, this flaw entirely negates its intended protection guarantee. A public exploit is available via WPScan, and the zero-prerequisite attack vector makes this trivially exploitable against any affected installation.
Unauthenticated information disclosure in the Notification Bar for WordPress plugin (through v1.1.8) allows any remote attacker to retrieve the full subscriber email list via an exposed CSV export script that performs no authentication or capability check. A publicly available proof-of-concept published by WPScan confirms trivial exploitation requiring only a single HTTP request. The vulnerability is not currently in CISA KEV, but the zero-friction exploitation path creates meaningful privacy and regulatory exposure (GDPR, CAN-SPAM) for any WordPress site running this plugin.
Stored Cross-Site Scripting in Xpro Addons for WordPress (before 1.7.4) allows any user holding the Contributor role or higher to inject malicious JavaScript through insufficiently escaped widget settings, which are then rendered unsanitized within HTML attributes on the front end. When a privileged user such as an administrator views a page containing the compromised widget, the attacker's payload executes in their browser session. A publicly available exploit has been documented by WPScan; no CISA KEV listing is present, but the low barrier to exploitation (any registered Contributor) makes this a meaningful risk on multi-author or membership WordPress sites.
Payment verification bypass in WP Express Checkout WordPress plugin before 2.4.9 allows unauthenticated remote attackers to forge completed orders without submitting actual payment. The plugin fails to perform server-side confirmation that a payment transaction was successfully processed before transitioning an order to 'paid' status, enabling fraudulent order completion. A publicly available exploit exists per WPScan, making active abuse by financially motivated actors a realistic near-term risk for any e-commerce site running an affected version.
Stored Cross-Site Scripting in the All in One SEO WordPress plugin before version 5.0.0.1 enables users holding the contributor role or above to inject persistent malicious scripts into post content that execute in the browser of any higher-privileged user who subsequently edits that post. The attack effectively allows a low-trust contributor to hijack administrator sessions, enabling full site compromise. A publicly available proof-of-concept from WPScan exists, and the plugin's broad deployment across millions of WordPress installations amplifies aggregate exposure.
Shortcode injection in the Brave WordPress plugin before 0.8.8 allows unauthenticated remote attackers to execute arbitrary WordPress shortcodes server-side by passing crafted values through URL parameters designed for pre-filling form fields. The exploitable shortcodes and their consequences depend entirely on which shortcodes are registered on the target installation - ranging from information disclosure to, in worst-case scenarios involving code-execution shortcodes, elevated impact. A publicly available proof-of-concept exists per WPScan; no active exploitation (KEV) has been confirmed. The CVSS score of 4.8 with AC:H reflects that real-world impact is highly site-dependent.
Cross-site request forgery in the Simple Membership MailChimp Integration WordPress plugin (versions before 1.9.8) allows a network-positioned attacker to replace the site's configured MailChimp API key with one under attacker control by tricking a logged-in administrator into loading a crafted page. Once the API key is substituted, all subsequent member registration data - including name, email address, and membership level - is silently forwarded to the attacker's MailChimp account until the change is detected. A publicly available exploit exists and a vendor patch (1.9.8) is available; no active exploitation has been confirmed in CISA KEV.
Route normalization bypass in the Restrict User Access WordPress plugin (all versions before 2.8.1) lets unauthenticated remote attackers read content the plugin is configured to restrict and enumerate WordPress user accounts. The plugin compares raw incoming REST API route strings against its protection rules without first canonicalizing the path, so a subtly non-canonical request (extra slash, encoded character, etc.) matches no rule and is passed through unrestricted. A publicly available PoC is documented by WPScan; the vulnerability is not in CISA KEV at time of analysis.
Payment bypass in the RegistrationMagic WordPress plugin before 6.0.9.9 allows unauthenticated users to register for paid forms without completing payment and immediately receive an activated account holding whatever role the form is configured to grant. The plugin fails to validate a client-supplied quantity multiplier when computing the total registration price server-side, enabling an attacker to force the calculated total to zero or an arbitrary value. A publicly available proof-of-concept exploit exists per WPScan, and no authentication is required. No public exploit identified at time of analysis for active exploitation, but the low attack complexity combined with public PoC makes this a realistic threat for any site monetizing registrations via this plugin.
Price validation bypass in the RegistrationMagic WordPress plugin before 6.0.9.9 allows unauthenticated users to complete paid registrations without payment and receive fully activated accounts. The plugin fails to verify the total registration price server-side, meaning client-submitted price values are accepted without cross-checking against the configured amount. A publicly available proof-of-concept exploit exists, and no CISA KEV listing has been recorded at time of analysis.
Unauthenticated attackers can bypass WordPress nonce validation in the HIPAA FORMS plugin (all versions before 3.2.0) by including a hardcoded parameter in any AJAX request, which causes the server to skip its nonce check entirely. Because the plugin handles HIPAA-regulated healthcare intake forms, this exposes protected AJAX endpoints to unauthorized read and write operations without any credentials. A public exploit is available via WPScan, and no exploitation complexity is required beyond knowledge of the hardcoded value.
CSS injection in GutenKit WordPress plugin (versions before 2.5.1) allows any authenticated user holding the Contributor role or above to embed arbitrary stylesheets into posts served to all site visitors and anonymous users. The plugin fails to validate or escape style settings before interpolating them into CSS output on the front end, enabling defacement, interface redressing, and forced loading of external resources. JavaScript execution is explicitly ruled out at the Contributor privilege tier, capping the attack surface below full cross-site scripting. A publicly available exploit has been disclosed by WPScan.
Unauthenticated post creation and publication is possible in the User Frontend WordPress plugin before 4.3.11 due to a server-side enforcement gap in its subscription-gating logic. The plugin validates subscription status only at form-render time, not during form submission processing, so an attacker who bypasses the rendered form and submits directly to the backend endpoint can create - and depending on form configuration, immediately publish - posts that should be restricted to paying subscribers. A publicly available proof-of-concept exists and was disclosed through WPScan. No public exploit in CISA KEV at time of analysis.
Broken object-level authorization in the Timetics WordPress plugin through version 1.0.61 allows authenticated users holding the plugin's custom staff role to modify, disable, or take over appointments belonging to other staff members via the REST API. The endpoint accepts appointment identifiers without validating ownership, enabling lateral privilege abuse among staff peers. A public WPScan PoC confirms exploitability, though real-world impact is bounded by the PR:H prerequisite of a pre-existing staff account.
Control-character (newline) injection in Yoast SEO Premium before 27.6.1 allows an authenticated WordPress Author to write arbitrary Apache directives into the site's root .htaccess file via unsanitized redirect origins in file-based redirect mode. On Apache servers that process PHP directives, the injected auto_prepend_file directive can be chained with a polyglot image upload (available to Author-role users) to achieve full Remote Code Execution as the web server process. A public exploit is available via WPScan, making real-world exploitation feasible wherever the three required conditions align.
Stored Cross-Site Scripting in Icegram Express WordPress plugin versions before 5.8.6 allows administrator-level users to inject malicious scripts into HTML attributes via the list description setting. When another user subsequently loads the affected page, the injected payload executes in their browser, enabling session hijacking, credential capture, or unauthorized actions on their behalf. A publicly available proof-of-concept exploit has been confirmed by WPScan, though real-world impact is substantially constrained by the high-privilege prerequisite required to plant the payload.
SQL injection in the WPvivid Backup, Migration & Staging WordPress plugin (all versions before 0.9.133) allows authenticated WordPress administrators to inject arbitrary SQL through an unsanitized list of identifiers passed directly to database queries. The CVSS scope change (S:C) indicates injected queries may reach beyond the plugin's own data, potentially touching other schemas on the shared MySQL host. A publicly available proof-of-concept has been disclosed via WPScan, though SSVC reports no confirmed active exploitation; vendor-released patch 0.9.133 is available.
Privilege escalation in the Theme My Login WordPress plugin (versions before 7.2.0) allows low-privileged users to silently bypass the network's site-creation restrictions on multisite WordPress installations, gaining administrator-level control over a newly created site. Subscriber-level authenticated users - and on some networks, unauthenticated users - can invoke the site-signup flow to create sites even when the network's registration setting prohibits it. A publicly available proof-of-concept exploit exists, raising the urgency for patching. The vendor has released a fix in version 7.2.0.
Cross-site request forgery vulnerabilities in JetStyleManager for Gutenberg WordPress plugin (all versions before 1.3.9) allow an unauthenticated attacker to delete or modify custom widget skins by tricking a logged-in Contributor-level (or higher) user into visiting a crafted page or clicking a malicious link. The missing CSRF token (nonce) validation on affected AJAX endpoints means the victim's authenticated browser session is silently weaponized against their own site. A publicly available exploit exists via WPScan and vendor-released patch version 1.3.9 resolves the issue.
Insecure Direct Object Reference in the WC Vendors WordPress plugin before 2.7.2.1 allows any authenticated user holding the vendor role to tamper with product variations owned by other vendors and to overwrite the status and title of arbitrary WordPress posts. The root cause is that the plugin never validates whether a user-supplied object ID actually belongs to the requesting vendor before persisting changes. A publicly available proof-of-concept exploit exists; the issue is not currently listed in CISA KEV.
Missing order-ownership verification in WC Vendors WordPress plugin before 2.7.2.1 allows any authenticated vendor to manipulate shipment records belonging to other vendors. An attacker with a valid vendor account can submit a front-end shipment status update referencing any order ID regardless of ownership, causing the order to be falsely marked as shipped, an order note to be injected under the victim vendor's identity, and the customer to receive a fraudulent dispatch notification. A publicly available proof-of-concept exists via WPScan; no active exploitation is confirmed in CISA KEV.
CSRF protection is absent on front-end order shipment status actions in the WC Vendors WordPress plugin before version 2.7.2.1, allowing network-based attackers to manipulate a logged-in vendor's order shipment state by inducing them to visit a crafted page. The vulnerability requires no attacker authentication and no special deployment configuration beyond active vendor use of the plugin's front-end dashboard. A publicly available exploit exists via WPScan, though no CISA KEV listing was identified, and the practical impact is bounded to order status modification rather than data breach or site takeover.
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin before 3.7.46 exposes learning statistics for any registered user without authorization. The plugin's student statistics endpoint performs no access control check, allowing any remote attacker to retrieve course counts, accumulated points, certificates, quiz totals, and assignment totals for arbitrary user accounts. A publicly available exploit exists per WPScan, and the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required.
Cross-instructor content tampering in MasterStudy LMS WordPress Plugin before 3.7.46 allows authenticated instructor-role users to delete or modify curriculum sections and materials belonging to courses owned by other instructors. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the plugin performs operations on curriculum objects without confirming the requesting instructor owns the parent course. A publicly available proof-of-concept exists via WPScan; no active exploitation (CISA KEV) has been recorded, and the CVSS score of 3.8 reflects the restricted impact scope.
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin before 3.7.46 exposes the titles and IDs of an author's unpublished courses - including draft, pending, and private posts - through an unprotected REST API endpoint. The affected route performs no access control check and applies no publication-status filter, meaning any unauthenticated network request can enumerate course content that site owners intended to keep hidden. A publicly available proof-of-concept exists per the WPScan advisory; no active exploitation has been confirmed in CISA KEV at time of analysis.
Instructors in MasterStudy LMS WordPress Plugin versions before 3.7.46 can read quiz questions, correct answers, and explanations belonging to other instructors by supplying arbitrary question identifiers in plugin requests. The root cause is CWE-639 (IDOR - Authorization Through User-Controlled Key): the plugin exposes question IDs without verifying that the requesting instructor owns them. A public proof-of-concept is available via WPScan, and a vendor patch has been released at version 3.7.46.
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin (all versions before 3.7.46) exposes per-student course enrollment and learning progress data to any remote attacker without credentials. The plugin fails to perform an authorization check before returning student-specific data, allowing enumeration of any registered user's enrolled courses and progress metrics. A publicly available exploit exists via WPScan; no active exploitation (KEV) has been confirmed, and the CVSS 5.3 score accurately reflects limited confidentiality impact.
Broken object-level authorization in MasterStudy LMS WordPress Plugin before 3.7.46 exposes course sales records of any instructor to any authenticated WordPress user. The plugin's order line-item retrieval endpoint accepts a user-supplied identifier without verifying that the requesting user is the record owner, enabling subscriber-level accounts to enumerate and read other instructors' transaction histories. A publicly available exploit exists per WPScan, and the fix is present in version 3.7.46.
Email content injection in the CatalogX WordPress plugin before 6.1.3 allows unauthenticated attackers to permanently plant unsanitized content into product enquiry notification emails delivered to site administrators. The injected payload is stored server-side upon submission of a product enquiry and is included verbatim in the administrator notification email each time any subsequent visitor triggers a new enquiry. A publicly available proof-of-concept exists; no public exploit confirmed as actively exploited per CISA KEV.
FormLayer WordPress plugin before version 1.0.9 discloses full form configuration data to unauthenticated users through its public submission handler, which performs no authorization check before returning stored settings. Notification recipient email addresses, confirmation redirect targets, and third-party integration credentials are exposed for all forms - including unpublished drafts invisible to end users. A public exploit exists via WPScan, and a vendor patch is available at version 1.0.9.
Rank Math SEO WordPress plugin before version 1.0.277 allows authenticated users holding at minimum an Author role to overwrite arbitrary post and user metadata across the entire WordPress installation, including metadata belonging to higher-privileged accounts such as Editors and Administrators. The flaw is an IDOR (CWE-639): the metadata update endpoint accepts a user-controlled row reference without verifying that the targeted record belongs to an object the requesting user is authorized to modify. A publicly available proof-of-concept exploit exists, confirmed by WPScan; no active exploitation in CISA KEV is noted at time of analysis.
Privilege escalation in the Rank Math SEO WordPress plugin (versions before 1.0.277) lets any authenticated Author-role user modify SEO metadata on taxonomy terms they have no editorial rights over, and overwrite post titles belonging to other users. The root cause is a missing capability check in the bulk metadata update handler, compounded by unsafe object identifier reuse across object types (taxonomy terms and posts), which allows the same request to reach unintended target objects. A public exploit is documented by WPScan and a vendor patch (v1.0.277) has been released.
Insecure direct object reference (IDOR) in Rank Math SEO WordPress plugin before 1.0.277 allows authenticated users with the Author role or above to read the title, body, and SEO metadata of other users' non-public posts (drafts, private, pending) without authorization. The plugin fails to verify that the requesting user has permission to access the specific post ID supplied in the request. A publicly available exploit exists per WPScan, and a vendor patch (1.0.277) has been released. No active exploitation confirmed in CISA KEV at time of analysis.
Rank Math SEO WordPress plugin before version 1.0.277 allows any authenticated user with at least the Author role to modify SEO indexing metadata on WordPress content, taxonomy terms, and user profiles they do not own, due to a missing object-ownership check. This enables authors to suppress other users' content from the site's XML sitemap and search engine index, causing targeted de-indexing attacks in multi-author environments. A publicly available proof-of-concept exploit exists, and a vendor-released patch (1.0.277) is available.
Unauthenticated schema disclosure in the Rank Math SEO WordPress plugin (versions 1.0.48 through 1.0.276) allows any anonymous visitor to read the structured schema markup and associated post content of posts the site owner has restricted - including drafts, pending review, private, scheduled, and password-protected posts. The plugin renders JSON-LD schema on the front end without verifying whether the requesting user is authorized to view the underlying post, effectively leaking embargoed or confidential content. A publicly available exploit is documented by WPScan; vendor patch version 1.0.277 is available. No active exploitation confirmed in CISA KEV at time of analysis.
Rank Math SEO WordPress plugin versions before 1.0.277.1 exposes the full content of password-protected posts to unauthenticated users via publicly generated SEO metadata. The plugin fails to enforce WordPress's native post-password gate before extracting post content for use in meta tags and structured data, making protected content readable by anyone who can access the SEO output. A publicly available proof-of-concept is documented by WPScan; a vendor patch (1.0.277.1) is available.
Insufficient access control in GamiPress (WordPress plugin before 7.9.9.6) allows any authenticated Subscriber-level user to abuse the video watch-tracking endpoint to award configured gamification points, achievements, and ranks to any WordPress user on the site - including administrators - and to accrue them without limit. The flaw maps to CWE-639 (Authorization Bypass Through User-Controlled Key), where the endpoint accepts a user-controlled target identifier without verifying the requester's authorization to grant rewards to that target. A publicly available proof-of-concept is documented by WPScan, and a vendor patch is available.
Unauthenticated information disclosure in the MultiVendorX WordPress plugin (versions prior to 5.0.15) exposes sensitive marketplace data through an improperly secured REST API listing route. Any unauthenticated remote attacker can query the endpoint to retrieve vendor contact information, payout details, pending payout amounts, and administrative notes attached to store applications. A publicly available exploit code exists via WPScan, and a vendor patch has been released in version 5.0.15.
Stored Cross-Site Scripting in the Social Media Share Buttons & Social Sharing Icons WordPress plugin (versions before 3.0.1) allows users with the Contributor role or higher to inject persistent JavaScript payloads via unescaped post titles rendered inside inline event handlers on share buttons. Payload execution is deferred to site visitors who interact with those buttons - enabling session theft or full site compromise if an administrator triggers it. A publicly available proof-of-concept from WPScan exists; no active exploitation confirmed in CISA KEV at time of analysis.
SQL injection in the Comments WordPress plugin before 7.6.66 allows unauthenticated remote attackers to read restricted comment content by injecting SQL grammar into an unvalidated query parameter. Affected content includes comments awaiting moderation, spam and trash comments, and comments attached to private or draft posts. The impact is scoped to comment disclosure rather than full database extraction, as the injection manipulates query structure rather than enabling arbitrary SELECT statements. No public exploit identified at time of analysis is contradicted by WPScan confirming publicly available exploit code exists.
Unauthenticated information disclosure in the Ultimate Member WordPress plugin (all versions before 2.13.0) exposes the content of comments still awaiting moderation and activity from private user profiles to any anonymous visitor. The plugin's profile activity endpoint fails to verify both comment approval status and profile privacy settings before returning data, meaning moderated/private content is served as if it were public. A publicly available proof-of-concept exists; no active exploitation has been confirmed via CISA KEV.
Plaintext password disclosure in the Gutentor WordPress page builder plugin (before 4.0.6) allows any authenticated subscriber-level user to retrieve the passwords of password-protected posts via a misconfigured REST API endpoint. The endpoint fails to enforce WordPress's built-in content-access context restrictions, meaning the security model of password-protected posts is completely bypassed for any site user who can authenticate. A publicly available exploit exists per WPScan, and a patched release (4.0.6) is available from the vendor.
Unauthenticated information disclosure in the Solace Extra WordPress plugin before 1.7.0 exposes the full content of non-published Site Builder parts - drafts, pending posts, private pages, and trashed items - to any anonymous visitor via an unprotected AJAX action. The plugin registers an AJAX handler that performs no capability check and no post-status validation, bypassing WordPress's normal access controls entirely. A public proof-of-concept is available through WPScan; the vendor has released version 1.7.0 to close the gap.
Unauthenticated IDOR (CWE-639) in the MotoPress Appointment Booking WordPress plugin before version 2.4.8 enables any remote attacker to permanently delete arbitrary users' reservations by supplying a known booking identifier to an unprotected deletion endpoint. This CVE documents an incomplete fix of CVE-2026-9180 - the vulnerable deletion path remains reachable on sites using payment confirmation workflows, confirmed through version 2.4.7. A publicly available proof-of-concept was disclosed by WPScan, and the vendor has released a corrective patch in version 2.4.8.
Missing authorization in the Booking for Appointments and Events Calendar WordPress plugin (versions before 2.4.9) allows unauthenticated remote attackers to trigger the post-booking action chain - including email notifications and third-party integration callbacks - for any booking by guessing or enumerating its numeric identifier. The plugin fails to validate either session authentication or a nonce/request token before executing post-booking hooks, meaning an attacker can impersonate the completion of any booking without ever making a real reservation. A publicly available proof-of-concept exploit exists per WPScan, though no KEV listing confirms active mass exploitation.
Stored cross-site scripting in the Ultimate Before After Image Slider & Gallery WordPress plugin before version 4.7.19 enables any authenticated user holding the Author role or higher to plant a malicious JavaScript payload within a slider's before-label field. Because the plugin's bundled client-side script re-injects that label value into the DOM without sanitization, the payload executes automatically in the browser of every visitor - including administrators - who views the affected slider. A publicly available proof-of-concept was published by WPScan; vendor-released patch version 4.7.19 is available, and no active exploitation has been confirmed in the CISA KEV catalog.
Stored cross-site scripting in the Ultimate Before After Image Slider & Gallery WordPress plugin (all versions before 4.7.19) allows users holding the Author role or above to embed a persistent browser payload in a slider's after-label field, which executes in every visitor's browser - including site administrators - when the slider is rendered. The plugin's bundled client-side script re-injects the stored label value directly into the DOM without HTML encoding. A publicly available exploit exists per WPScan, making this a practical privilege-escalation path on any WordPress site granting Author access to untrusted users.
Unauthenticated REST endpoint access in the KiviCare WordPress plugin (before 4.5.5) exposes both a clinic's full patient roster and, critically, the configured payment gateway secret key to any unauthenticated remote attacker. The vulnerability stems from missing authorization checks on specific REST API routes, requiring no credentials or user interaction to exploit. A publicly available proof-of-concept is documented by WPScan, materially lowering the bar for exploitation across any WordPress site running an unpatched version of this clinic management plugin.
Shortcode injection in MW WP Form WordPress plugin (versions before 5.1.5) allows unauthenticated remote attackers to execute any WordPress shortcode registered on the target site. The plugin fails to neutralize shortcode syntax in user-submitted form values before passing those values through WordPress's shortcode processing engine. A publicly available proof-of-concept exists (via WPScan), though exploitation is gated by a non-default site configuration requirement, which suppresses real-world risk despite the network-accessible attack vector.
Web cache poisoning in WP Fastest Cache WordPress plugin before 1.5.1 enables unauthenticated attackers to inject content into the site-wide page cache by exploiting its failure to include tracking-related query parameters in cache key construction. Because the plugin caches responses to URLs containing these parameters under the canonical clean-URL key, an attacker-controlled page render is stored and subsequently served to every visitor of the legitimate URL. A publicly available proof-of-concept exploit exists; no active exploitation confirmed in CISA KEV at time of analysis.
Missing authorization in the 爱采集数据采集和发布插件 WordPress plugin (all versions through 1.0.0) exposes internal handler methods to unauthenticated HTTP requests with no capability or nonce verification, allowing any remote attacker to create WordPress user accounts and taxonomy terms. A publicly available exploit has been documented by WPScan, significantly lowering the barrier to opportunistic exploitation across WordPress installations running this plugin. No KEV listing confirms active widespread exploitation at time of analysis, but the trivial attack complexity and public exploit code make targeted abuse realistic.
Improper privilege management in the Really Simple Security WordPress plugin before 9.8.0 permits a subsite administrator on a WordPress multisite network to install an arbitrary plugin from a user-supplied URL, placing attacker-controlled PHP code into the network-shared plugin directory normally reserved for network (super) administrators. Successful exploitation achieves remote code execution with full confidentiality, integrity, and availability impact across the entire multisite network. A public proof-of-concept is available via WPScan, though EPSS remains low (0.15%) consistent with the high-privilege, non-default-configuration prerequisites; no confirmed active exploitation (CISA KEV) is recorded at time of analysis.
Stored XSS in the MW WP Form WordPress plugin (all versions before 5.1.6) lets authenticated users holding the Editor role or above inject persistent malicious JavaScript into form settings, which then executes in the browser of any administrator who views the affected dashboard page. A publicly available proof-of-concept has been published by WPScan, though EPSS sits at 0.15% (5th percentile), indicating low measured exploitation probability at this time. No confirmed active exploitation has been reported and the vulnerability is not listed in the CISA KEV catalog.
Arbitrary file write via path traversal in the WPvivid - Backup, Migration & Staging WordPress plugin (versions before 0.9.133) allows high-privilege WordPress administrators to extract backup archives with traversal sequences that write files outside the designated restore directory. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.17% (7th percentile) and CISA KEV lists no active exploitation at time of analysis. Successful exploitation can lead to remote code execution by placing malicious PHP files in web-accessible directories.
Stored cross-site scripting in the SOGO Add Script to Individual Pages Header Footer WordPress plugin (through version 3.9) enables any contributor-level WordPress user to inject arbitrary JavaScript into per-post header and footer script fields without sanitization or capability gating. The payload executes in an administrator's browser when reviewing the pending post, enabling session hijacking and full site takeover, and persists for all site visitors once the post is published. A publicly available proof-of-concept exists per WPScan, though EPSS remains at 0.15% (5th percentile) and there is no CISA KEV listing, indicating limited opportunistic exploitation to date.
Unauthorized deletion of arbitrary membership plans is possible in the Frontend Admin by DynamiApps WordPress plugin (all versions before 3.29.11) due to a missing capability check on an AJAX endpoint accessible to any logged-in user. Any subscriber-level WordPress account holder can send a crafted AJAX request to invoke the unprotected action and permanently remove membership plans without administrative authorization. A publicly available proof-of-concept exists per WPScan, though the EPSS score of 0.13% (3rd percentile) indicates very limited observed exploitation activity at time of analysis, and the vulnerability is not listed in CISA KEV.
Open redirect in MasterStudy LMS WordPress Plugin before version 3.7.43 enables unauthenticated attackers to supply an unvalidated redirect parameter during user registration, silently forwarding newly registered users to arbitrary external URLs. This creates a reliable phishing vector: an attacker crafts a registration link pointing to a spoofed login page, and the plugin delivers the victim there immediately post-registration without warning. A publicly available proof-of-concept exists per WPScan, though the EPSS score of 0.14% (3rd percentile) indicates exploitation has not yet become widespread or automated.
MasterStudy LMS WordPress Plugin versions before 3.7.42 expose order billing records - including customer names, email addresses, phone numbers, and postal addresses - to any authenticated user holding the instructor role, via insecure direct object reference on order IDs. An instructor can iterate through order IDs in the plugin's order-detail endpoint to retrieve billing information belonging to arbitrary other users without any administrative interaction. A publicly available proof-of-concept exists per WPScan, though no confirmed active exploitation has been observed and the EPSS probability remains extremely low at 0.13%.