Unknown
Monthly
Payment verification bypass in MasterStudy LMS WordPress Plugin before 3.7.40 permits unauthenticated attackers to fraudulently complete full-price course orders by submitting payment webhook notifications with only a token amount. The plugin neglects to validate the transaction amount, receiving account, currency, or payment status before updating order state to completed, granting unauthorized access to paid LMS content. A public proof-of-concept is available via WPScan, though EPSS remains low at 0.15% (4th percentile) and no CISA KEV listing has been confirmed.
SQL injection in WP Ultimate CSV Importer WordPress plugin (versions before 9.0) allows authenticated administrators to extract database contents by supplying crafted field values in CSV imports that are passed unsanitized into SQL statements. A publicly available proof-of-concept exists per the WPScan advisory, though the EPSS score of 0.16% (5th percentile) indicates minimal observed exploitation activity. No active exploitation has been confirmed by CISA KEV, and the administrative privilege requirement substantially narrows the realistic attack surface.
Stripe Payment Forms by WP Full Pay WordPress plugin before version 8.5.5 exposes an Insecure Direct Object Reference (IDOR) flaw in its customer-portal subscription cancellation endpoint, allowing an authenticated portal user to cancel subscriptions belonging to entirely different customers by substituting an arbitrary subscription ID in the cancellation request. Exploitation requires prior knowledge of the victim's Stripe subscription ID, which is high-entropy and not enumerable through the plugin itself, meaningfully constraining real-world exploitation despite a publicly available proof-of-concept. No active exploitation is confirmed - the vulnerability is absent from CISA KEV and carries a negligible EPSS score of 0.13% (3rd percentile), consistent with the practical access barrier imposed by the non-guessable subscription identifier.
Rank Math SEO WordPress plugin versions prior to 1.0.277 allows users holding the Editor role to modify site-wide administrator-reserved WordPress settings by invoking the plugin's automated SEO fix endpoint without proper capability verification. The root cause (CWE-863, Incorrect Authorization) is a missing capability check in the fix-handling code path - WordPress requires specific admin capabilities such as manage_options to alter core settings, but Rank Math does not enforce these checks before acting on the request. A publicly available proof-of-concept is documented via WPScan; the vulnerability is not in CISA KEV, and the EPSS score of 0.13% indicates very low observed exploitation activity at time of analysis.
Missing authorization enforcement in the Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 allows authenticated customers to escalate their own booking status without approval and tamper with other customers' statuses on shared appointments. The flaw (CWE-863) stems from the absence of a WordPress capability check before processing status-change requests, meaning any user with a booking can invoke the endpoint and set arbitrary statuses. No public exploitation has been confirmed by CISA KEV, but a publicly available proof-of-concept exists per WPScan.
Unauthenticated REST API access in the HEL Online Classroom WordPress plugin (through 1.0.3) allows any remote user to obtain a signed meeting join link for any classroom - including those protected by an access code - and join it with moderator privileges. All WordPress sites running this plugin through version 1.0.3 are affected regardless of classroom configuration. A publicly available exploit exists via WPScan, though EPSS (0.14%, 3rd percentile) indicates limited automated exploitation activity at time of analysis; no CISA KEV confirmation of active widespread exploitation is present.
Unauthenticated settings overwrite in the HEL Online Classroom WordPress plugin (versions through 1.0.3) allows any remote attacker to redirect all classroom sessions to attacker-controlled infrastructure and replace the shared secret used to sign those sessions. Because no authentication or authorization check exists on the settings-save endpoint, the entire plugin's operational trust model - both the backend URL and the signing secret - can be silently hijacked without any credentials. A publicly available exploit exists via WPScan, though EPSS sits at 0.18% (7th percentile), indicating no confirmed widespread exploitation at time of analysis.
PHP Object Injection in User Profile Builder WordPress plugin (versions 3.3.4 through before 4.0.1) allows authenticated administrators to inject arbitrary PHP objects by uploading a malicious configuration file through the plugin's import feature. Exploitation is gated by two non-trivial conditions: the affected free add-on must be explicitly enabled (it is disabled by default), and a suitable POP chain gadget must exist in another installed plugin or theme before code execution is achievable. A public POC exists per WPScan, but no public exploit identified at time of analysis maps to confirmed in-the-wild abuse - EPSS sits at just 0.23% (13th percentile), consistent with the high practical bar imposed by admin-level access and gadget dependencies.
Stored XSS in the User Profile Builder WordPress plugin (versions before 4.0.1) allows users with contributor-level WordPress roles to embed persistent JavaScript via an improperly escaped optional shortcode, executing in the browser of any user who views the affected content - including administrators. A publicly available exploit exists per WPScan intelligence, though EPSS remains at 0.15% (5th percentile) and the vulnerability is absent from CISA's KEV catalog. The non-default shortcode requirement meaningfully limits exposure to sites that have explicitly enabled the affected feature.
Catfolders Document Gallery Pro WordPress plugin before version 2.0.7 exposes private, unpublished folder contents to unauthenticated remote attackers through two compounding weaknesses: REST API routes that lack authorization checks, and a content-identifying token scheme that can be forged entirely client-side without prior authenticated access. Any network-accessible attacker can enumerate and download files from folders site administrators intentionally withheld from public publication. A publicly available proof-of-concept exists per WPScan, though EPSS places exploitation probability at 0.14% (3rd percentile), indicating limited observed opportunistic activity at time of analysis.
Broken order authorization in MStore API WordPress plugin (before 4.21.1) allows any authenticated user, including low-privilege Subscribers, to mark arbitrary orders as paid without actual payment being taken. The plugin's wallet payment handler neither verifies that the targeted order belongs to the requesting user nor deducts the wallet balance for most payment methods, enabling financial fraud against WooCommerce stores. A publicly available exploit exists per WPScan, though EPSS sits at 0.13% (3rd percentile), suggesting limited opportunistic exploitation to date.
MStore API WordPress plugin before 4.21.1 allows any authenticated user - including the lowest-privilege Subscriber role - to mark arbitrary WooCommerce orders as completed and paid without making any payment, constituting a business-logic fraud vulnerability. The root cause is a missing ownership authorization check (CWE-862) in a delivery status endpoint that accepts order IDs without verifying they belong to the requesting user. A publicly available exploit exists, though EPSS at 0.13% (3rd percentile) indicates limited automated mass exploitation to date; this vulnerability is not currently listed in the CISA KEV catalog.
Cross-Site Request Forgery in the Newsletters WordPress plugin (versions before 4.17) enables unauthenticated attackers to overwrite arbitrary plugin settings - including API credentials - by tricking a logged-in administrator into submitting a crafted request. The vulnerability arises from a complete absence of nonce verification and capability checks on the settings-save endpoint, meaning the plugin blindly applies every submitted parameter. A publicly available proof-of-concept exploit exists per WPScan, though EPSS sits at 0.10%, suggesting opportunistic mass exploitation has not yet materialized.
Predictable API key generation in the Newsletters WordPress plugin (versions before 4.17) enables unauthenticated network-accessible attackers who successfully derive the key to perform privileged API operations - including adding or deleting subscribers and sending bulk emails. Exploitation requires the plugin's optional API feature to be enabled. A publicly available proof-of-concept exists via WPScan, though EPSS stands at 0.10% (1st percentile), indicating minimal observed exploitation at time of analysis and no CISA KEV listing.
Missing object-level authorization in the User Registration & Membership WordPress plugin (before 5.2.5) allows any authenticated Subscriber-level user to cancel a pending email change belonging to any other account - including site administrators. The flaw stems from the plugin's email-change cancellation handler accepting a user identifier supplied by the requester without verifying account ownership, a classic IDOR pattern. A publicly available exploit exists per WPScan; however, SSVC assessment lists exploitation as none and the attack is not automatable, indicating opportunistic rather than widespread active abuse.
Arbitrary file write in the Breeze Cache WordPress plugin (all versions before 2.5.13) allows unauthenticated remote attackers to place files at any server filesystem location by supplying unsanitized path values in HTTP requests. The plugin uses attacker-controlled input directly to construct cache file paths, enabling traversal outside the intended cache directory. A publicly available proof-of-concept exists; while SSVC confirms no exploitation at time of analysis, the automatable attack vector and CWE-434 classification raise concern that the primitive could be chained to remote code execution if attacker-controlled content reaches a web-accessible directory.
Quiz and Survey Master (QSM) WordPress plugin versions before 11.2.4 expose quiz question banks, hints, and correct answer keys to any authenticated Contributor-level user via a REST API route lacking authorization checks. The flaw allows a low-privileged user to read quiz content owned by other users on the same WordPress installation, undermining academic integrity and confidentiality of proprietary quiz material. No confirmed active exploitation is recorded in CISA KEV, but a publicly available proof-of-concept is documented by WPScan, making opportunistic exploitation trivial for any authenticated site member.
Missing authorization in WCFM Marketplace WordPress plugin before 3.8.2 allows unauthenticated users to submit refund requests against any guest checkout order without verifying order ownership. The flaw (CWE-862) targets the refund request endpoint, which performs no ownership check for guest orders, enabling arbitrary financial disruption to marketplace vendors. A publicly available proof-of-concept exists; however, SSVC data confirms no active exploitation detected at time of analysis, and the patch is available in version 3.8.2.
Unauthenticated mass PII enumeration in the User Frontend WordPress plugin (versions 4.3.0 through 4.3.10) exposes the email address and phone number of every registered user - including site administrators - via an unrestricted user directory search endpoint. The flaw requires no authentication, no special configuration, and is automatable per SSVC, making bulk harvesting trivial for any remote attacker. A publicly available proof-of-concept exploit exists, reported by WPScan, though active exploitation has not been confirmed by CISA KEV at time of analysis.
Unauthenticated file upload in the Shared Files (before 1.7.67) and Shared Files Pro (before 1.7.70) WordPress plugins exposes an upload handler that performs no capability check and relies on a nonce embedded in every public page - making the nonce an ineffective authorization barrier. Any unauthenticated visitor can upload files within WordPress's allowed MIME type list to a publicly accessible server directory, and the server's absolute filesystem path is returned in the response, aiding reconnaissance. Publicly available exploit code exists (confirmed by WPScan); however, active exploitation has not been confirmed and the CVE is not listed in CISA KEV.
Arbitrary file deletion via path traversal in the Shared Files and Shared Files Pro WordPress plugins (versions before 1.7.67 and 1.7.68 respectively) enables unauthenticated attackers to trigger deletion of critical server files such as wp-config.php, causing denial of service and potential site takeover. The plugin's single-pass traversal filter is bypassable during frontend file submission, allowing a crafted path pointing outside the uploads directory to be stored; when an administrator later permanently deletes the corresponding file entry, the resolved arbitrary file is removed. A publicly available proof-of-concept exists, though SSVC assessment rates exploitation as none at time of analysis, likely reflecting the two-stage attack dependency on administrator action.
Simple Newsletter Plugin for WordPress (versions 4.0.0 through 4.3.2) fails to verify that a public requester matches the subscriber whose record is being fetched, exposing stored personal data and the authorization key that controls changes to that subscriber's record to any unauthenticated caller. A publicly available proof-of-concept documented by WPScan demonstrates the attack path, though EPSS at 0.18% (7th percentile) suggests exploitation has remained limited in observed telemetry. Vendor-released patch version 4.3.3 is available and should be applied immediately given the zero-complexity, unauthenticated exploit path.
SQL injection in the RegistrationMagic WordPress plugin (all versions before 6.0.9.4) permits authenticated administrators to inject arbitrary SQL through an unsanitized parameter. The CVSS Scope:Changed metric indicates the injected query can reach beyond the WordPress application boundary into the underlying database layer, enabling cross-schema data reads. A publicly available proof-of-concept exists via WPScan, though EPSS at 0.19% and SSVC exploitation status of 'none' indicate limited real-world abuse at time of analysis.
Insecure Direct Object Reference (IDOR) in the Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 allows any authenticated customer with a valid portal session to cancel, reactivate, or modify Stripe subscriptions belonging to other customers. The plugin's customer portal endpoints fail to verify that a subscription ID supplied in the request is actually owned by the authenticated session's bound customer, enabling horizontal privilege escalation across customer accounts. A publicly available proof-of-concept exists; exploitation probability is low per EPSS (0.16%, 5th percentile), but the business impact on affected merchants' subscription revenue could be significant despite the moderate CVSS score.
Stripe Payment Forms by WP Full Pay plugin for WordPress (all versions before 8.5.1) exposes customer subscription and billing data to unauthenticated network attackers due to a missing session-confirmation check in the customer portal workflow. The plugin returns sensitive financial records before verifying that a portal session has completed its confirmation step, enabling any unauthenticated user to read billing information belonging to a different customer. A publicly available exploit exists per WPScan intelligence, though EPSS sits at 0.18% (7th percentile), indicating limited observed exploitation despite the low-barrier attack path.
Path traversal in the Directorist WordPress plugin (versions 8.5 through before 8.9.3) allows subscriber-level authenticated users to relocate arbitrary server-readable image files into a publicly accessible directory and delete them from their original location. The flaw stems from unsanitized user-supplied image references passed directly to a file-move operation, exposing sensitive server files to unauthenticated public access after the move. Publicly available exploit code exists per WPScan reporting; however, EPSS sits at 0.19% (9th percentile), and the requirement for a subscriber-level account limits opportunistic mass exploitation.
Kirki WordPress Customizer Framework plugin before 6.0.14 exposes registered user email addresses, comment author emails, non-public page content, and site settings to unauthenticated remote attackers via missing capability checks on public AJAX action endpoints. Every WordPress site running any Kirki version prior to 6.0.14 is affected regardless of configuration. A publicly available proof-of-concept exists per WPScan reporting; exploitation probability is currently low (EPSS 0.18%, 7th percentile) and no active exploitation is confirmed in CISA KEV, though the data harvested enables downstream phishing and credential-stuffing campaigns.
Unauthenticated ownership bypass in the Return Refund and Exchange For WooCommerce plugin (versions before 4.6.4) exposes guest order workflows to arbitrary third-party manipulation. Any unauthenticated network attacker who can reference a guest order ID can read private order messages, impersonate the customer by posting messages or attachments, and cancel active return requests - undermining both customer privacy and merchant return-process integrity. A publicly available proof-of-concept exists; however, exploitation probability is very low per EPSS (0.17%, 6th percentile), and no active exploitation has been confirmed by CISA KEV.
Unauthenticated payment bypass in the Eventin WordPress plugin before 4.1.19 lets any visitor fraudulently obtain valid paid event tickets without completing payment. By abusing a guest checkout token, an attacker can transition their own unpaid order to 'completed', triggering ticket issuance without a charge being processed. A publicly available proof-of-concept exists, and SSVC flags the attack as automatable - enabling scaled ticket fraud against any WordPress site running the affected plugin.
Unauthenticated remote attackers can invoke AI queries against a site owner's configured provider account through the AI Engine WordPress plugin before version 3.7.2. The plugin exposes an administration-only feature protected solely by a token it distributes to anonymous visitors - rather than a proper WordPress capability check - enabling any network-accessible attacker to submit arbitrary AI prompts billed to the operator's account. A publicly available proof-of-concept exists via WPScan; however, the vulnerability is not currently listed in the CISA KEV catalog, and EPSS sits at 0.17% (6th percentile), suggesting limited confirmed mass exploitation at time of analysis.
Broken object-level authorization in the Project Manager WordPress plugin before 4.0.7 allows any authenticated user - including low-privilege subscribers - to read arbitrary users' activity histories, email addresses, and details of projects they have no legitimate access to via an unguarded REST API route. Affected versions span 2.2.0 through 4.0.6, with a patch released at 4.0.7. A publicly available proof-of-concept is documented by WPScan, though no confirmed active exploitation (CISA KEV) has been recorded and EPSS probability remains low at 0.16%.
Improper access control in the Project Manager WordPress plugin before 4.0.7 exposes several REST API routes without project-membership enforcement, allowing any low-privilege authenticated user - including subscribers - to read task content and user email addresses across projects they do not belong to, and to modify task boards of arbitrary projects. The flaw is a classic CWE-284 (Improper Access Control) exploitable with no special configuration, network-accessible, and requiring only a valid WordPress account. A publicly available exploit exists via WPScan, though EPSS at 0.16% (5th percentile) indicates limited observed exploitation; no public exploit identified at time of analysis confirms CISA KEV status, so active widespread exploitation cannot be confirmed.
Stored Cross-Site Scripting in the Royal Addons for Elementor WordPress plugin (all versions before 1.7.1066) permits any authenticated Contributor-role user to inject arbitrary JavaScript payloads via unsanitized widget settings that are rendered unescaped inside HTML attributes. When a higher-privileged user such as an administrator previews or views the crafted content, the payload executes in their browser session, enabling session hijacking, credential theft, or unauthorized administrative actions. A public proof-of-concept is available via WPScan; however, no public exploit identified at time of analysis maps to confirmed active exploitation, and EPSS sits at 0.18% (8th percentile).
Privilege escalation in the Forminator Forms WordPress plugin (all versions before 1.57.1) allows unauthenticated remote attackers to register new sites on WordPress multisite networks regardless of whether the network administrator has enabled site registration, granting the attacker administrator-level privileges over each newly created sub-site. This flaw is scoped exclusively to WordPress multisite deployments; standard single-site WordPress installations are completely unaffected regardless of plugin version. No active exploitation has been confirmed by CISA KEV, though WPScan has published a public proof-of-concept and a vendor patch is available at version 1.57.1.
SQL injection and unrestricted template file loading in the Tutor LMS WordPress plugin before version 4.0.6 exposes non-public course question-and-answer content to unauthenticated remote attackers. User-supplied values are incorporated directly into database query grammar without validation, and no restriction is enforced on which template file a request may load. Although a publicly available proof-of-concept exists and the flaw is fully automatable with no authentication barrier, the SQL injection is constrained by database engine behavior such that it does not yield arbitrary table extraction - impact is limited to disclosure of restricted course Q&A material. No confirmed active exploitation (CISA KEV) has been reported at time of analysis.
Payment amount manipulation in the Booking Package WordPress plugin (versions before 1.7.25) allows unauthenticated remote attackers to complete paid service bookings at an arbitrary fraction of the legitimate price. The plugin derives the charge amount from attacker-controlled HTTP request values rather than authoritative server-stored pricing, a classic business-logic trust boundary failure. A publicly available exploit exists per WPScan, though no CISA KEV listing was provided in input data, and EPSS at 0.18% (7th percentile) suggests limited observed mass exploitation to date.
Unauthenticated access to a missing-authorization REST endpoint in the Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before version 3.7.1 exposes the site's connected compliance-service API secret and account credentials to any visitor. Using the retrieved secret, an attacker can call the connected third-party compliance service API to sever the plugin's integration, causing GDPR, CCPA, and cookie policy documents to stop displaying on the affected WordPress site. A public exploit exists per WPScan, though CISA has not listed this in KEV and SSVC rates active exploitation as none at time of analysis.
Unauthorized reservation creation in the WPCafe WordPress plugin (all versions before 3.0.18) exposes the administrator moderation workflow to unauthenticated bypass through a missing authorization check in its REST API endpoint. The endpoint validates only a publicly available nonce - a control that provides no meaningful access restriction - allowing any remote user to submit reservations with an arbitrary approval status, including self-approving bookings that administrators would otherwise need to review and accept. A proof-of-concept exploit is publicly available via WPScan; however, EPSS stands at 0.19% (9th percentile), indicating that exploitation has remained limited despite trivially low attack prerequisites.
Unauthenticated queue-trigger exposure in the Booking for Appointments and Events Calendar WordPress plugin (versions before 2.4.7) permits any remote visitor to force the dispatch of the plugin's pending notification queue and integration callbacks. Because the queue-processing endpoint performs no authentication check (CWE-287), an attacker needs no credentials or session to invoke it. A publicly available proof-of-concept exists per the WPScan report, though EPSS at 0.23% indicates exploitation has not yet reached widespread automated activity, and the vulnerability is not listed in CISA KEV.
Broken object-level authorization in the Booking for Appointments and Events Calendar WordPress plugin (versions 9.0 through before 9.8) allows any authenticated employee account to overwrite a different employee's cabinet password, achieving full account takeover of the victim provider. The flaw exists because the plugin's password-update endpoint does not verify that the requesting employee owns the target provider account. A publicly available proof-of-concept exists; no active exploitation has been confirmed by CISA KEV at time of analysis.
Unauthenticated information disclosure in Royal Addons for Elementor (WordPress plugin) before version 1.7.1066 exposes names and IDs of non-public taxonomy terms to any remote caller. The plugin performs no capability or nonce verification before fulfilling taxonomy data requests, meaning access controls enforced by WordPress core are entirely bypassed at the plugin layer. A publicly available proof-of-concept exists per WPScan, and exploitation is assessed as automatable with partial technical impact by the SSVC framework.
Unauthenticated metadata tampering in Royal Addons for Elementor WordPress plugin before 1.7.1066 allows any remote visitor to overwrite like-count and visitor-tracking post meta on arbitrary posts, including private and draft posts, because the plugin's AJAX handler validates only a nonce - a value scrapeable from any public page - without performing any WordPress capability or post-ownership check. A publicly available proof-of-concept exists per WPScan. While exploitation is automatable and requires no credentials, the integrity impact is narrow, limited to engagement metadata rather than post content or authentication data.
Unauthenticated information disclosure in the Eventin WordPress plugin before 4.1.22 exposes private, draft, and pending posts - including the plaintext passwords and full content of password-protected posts - to any unauthenticated HTTP client via an unprotected REST API namespace. The flaw arises from missing authorization checks on post status and ownership within that namespace, meaning no credentials or privileges are required to enumerate and read content the site owner intended to restrict. A publicly available proof-of-concept exploit exists, and the attack is fully automatable per the SSVC framework, though CISA has not listed this in KEV and the EPSS score is low (0.18%), suggesting exploitation has not yet been widespread.
Stored shortcode injection in the ProfilePress WordPress plugin before 4.17.1 allows unauthenticated attackers to persist shortcodes in two unfiltered profile fields, which WordPress then executes when any visitor loads the public profile page. The impact is limited to information disclosure - exposing a targeted user's email address, login date, and registration date - but the attack requires no elevated privileges and no special configuration beyond default plugin deployment. A publicly available exploit exists per WPScan's disclosure; patch version 4.17.1 is confirmed available from the vendor.
Username denylist bypass in Limit Login Attempts Security (Limit Login Attempts Reloaded) before version 3.3.5 allows a WordPress user who has been explicitly blocked by an administrator to successfully authenticate by varying the case of their username or by supplying the account's associated email address instead. This is a logic flaw in the plugin's denylist enforcement, entirely defeating the access control that a site administrator intended to impose on specific accounts. A publicly available proof-of-concept is documented in the WPScan advisory; the low CVSS score of 3.7 with AC:H reflects that successful exploitation requires the attacker to already hold valid credentials for the denylisted account.
Passster WordPress plugin versions before 4.3.9 exposes globally password-protected post and page content to unauthenticated remote attackers via a flawed REST API path-matching bypass. The plugin's allowlist logic for public endpoints uses unanchored substring comparison against the full request URI rather than matching against the resolved WordPress route, meaning any attacker can craft a URI that embeds the whitelisted path segment anywhere within it to sidestep the protection gate entirely. A publicly available proof-of-concept exploit exists per WPScan, and the EPSS-relevant CVSS vector (PR:N, AC:L) confirms exploitation requires no authentication or special configuration beyond the plugin being installed with global password protection active.
Webhook authentication bypass in the Charitable WordPress donation plugin (versions before 1.8.12) allows unauthenticated remote attackers to forge Square payment webhook notifications, causing the plugin to record donations as successfully paid without any actual financial transaction occurring. The vulnerability exists in all default configurations where Square is the configured payment gateway, requiring no credentials or user interaction to exploit. A publicly available proof-of-concept exists per WPScan reporting, though this vulnerability has not been listed in CISA's Known Exploited Vulnerabilities catalog at time of analysis.
Payment gateway merchant account verification is entirely absent in the myCred WordPress plugin before version 3.2.5, enabling unauthenticated remote attackers to fraudulently inflate their in-site credit balances by routing payments to a gateway account they control instead of the site operator's. An attacker needs only to complete a payment of the expected amount through a supported gateway and trigger the resulting notification to the vulnerable site - no knowledge of or access to the site's merchant credentials is required. A publicly available exploit exists per WPScan reporting (EUVD-2026-63909), and a vendor-released patch in version 3.2.5 is confirmed available.
CSRF in the LitExtension WordPress migration plugin (≤1.2.5) allows an unauthenticated remote attacker to overwrite the store-migration connector's authentication token by tricking a logged-in administrator into clicking a crafted link. Token replacement gives the attacker control over the connector, potentially enabling unauthorized access to migrated store data or disruption of active migration workflows. A publicly available proof-of-concept exploit was published via WPScan; this vulnerability has not been added to the CISA KEV catalog at time of analysis.
Blind server-side request forgery in the Eventin WordPress plugin prior to version 4.1.21 allows contributor-level authenticated users to direct the WordPress server to issue arbitrary outbound HTTP requests by supplying unvalidated webhook URLs on events they do not own. Two distinct control failures compound the issue: webhook URL input is accepted without sanitization, and the plugin performs no event ownership check, meaning any contributor can abuse another user's event configuration. A publicly available proof-of-concept exists; no CISA KEV listing confirms active exploitation at time of analysis.
Unauthorized post data disclosure in the Duplicate Post WordPress plugin before 1.5.6 allows authenticated users holding a delegated role to read content, metadata, and passwords for posts they should not have access to - including other users' private and draft posts. The CVSS vector (PR:H/C:L) reflects a constrained impact limited to information disclosure within authenticated contexts, making this a meaningful risk in multi-user editorial WordPress environments but not in single-author deployments. A publicly available proof-of-concept exists per WPScan's advisory; no active exploitation has been confirmed via CISA KEV.
Duplicate Post WordPress plugin before 1.5.6 exposes password-protected post content to authenticated users who lack read authorization on those posts. The plugin's duplication feature fails to verify whether the requesting user has permission to read the source post, allowing any user with a delegated duplication role to republish another author's password-protected content as publicly readable. A publicly available proof-of-concept exists; no active exploitation has been confirmed (not in CISA KEV). A vendor patch is available at version 1.5.6.
SQL injection in the Media Library Assistant WordPress plugin before version 3.40 allows authenticated users with the Author role to read sensitive database contents by injecting arbitrary SQL via an unvalidated search parameter in a media-library query handler. The scope-changed CVSS vector (S:C) reflects that exploitation can reach data beyond the plugin's immediate database scope, and a publicly available proof-of-concept exists per WPScan's disclosure. No public exploit identified at time of analysis for active exploitation, though the POC lowers the bar for abuse against any WordPress installation running the unpatched plugin.
Financial ledger manipulation in the Dokan WooCommerce Multivendor Marketplace WordPress plugin (before 5.0.14) allows authenticated vendors to fraudulently clear commission debts by submitting arbitrary client-supplied payment amounts to the reverse-withdrawal endpoint without server-side balance validation. Any registered vendor on an affected marketplace can exploit this to zero out real outstanding commissions owed to the marketplace operator, constituting financial fraud against the site owner. A publicly available proof-of-concept exists; no active exploitation has been confirmed by CISA KEV, though the low attack complexity and accessible vendor registration on most marketplaces make this a meaningful business risk.
Unauthenticated information disclosure in Dokan WooCommerce Multivendor Marketplace plugin (versions before 5.0.14) allows any remote actor to retrieve per-vendor commission configuration from an unprotected store REST endpoint without credentials. The exposed data includes commission type and, where category-based commissions are configured, per-category and default commission rates - leaking potentially sensitive business financial details for every vendor on the marketplace. A publicly available proof-of-concept exists; however, active exploitation has not been confirmed via CISA KEV.
SQL injection in the Link Whisper Free WordPress plugin (all versions before 0.9.7) enables authenticated users holding the Editor role or above to execute arbitrary SQL queries against the underlying WordPress database, with potential scope change to data beyond the plugin's own tables. Reported by WPScan with a publicly available proof-of-concept, this raises the practical exploitability despite the elevated privilege requirement. No CISA KEV listing indicates active mass exploitation has not been confirmed at time of analysis; a vendor-released patch (0.9.7) is available.
Stored XSS in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin (versions before 1.3.9.9) allows administrator-level users to inject arbitrary JavaScript via an unsanitized plugin setting used as an HTML tag name in front-end output. Any visitor loading a page that renders the upload field will execute the injected script in their browser context. A publicly available exploit exists; the vulnerability is rated CVSS 3.5 due to the high-privilege requirement, though post-authentication stored XSS can still enable session hijacking or malicious redirects against site visitors.
Session fixation in the Welcart e-Commerce WordPress plugin (all versions before 2.12.1) allows an unauthenticated remote attacker to pre-set a shop member's session identifier via a user-supplied request parameter, then silently hijack the authenticated session once the victim logs in through an attacker-crafted request. Because the plugin neither generates a fresh session ID on authentication nor rejects externally supplied session tokens, the attacker's chosen token becomes the victim's authenticated session. A publicly available POC exists via WPScan, and no KEV listing is present, though the combination of no required attacker privileges and a low-complexity exploit path elevates practical risk for any live Welcart storefront.
Missing authorization on the Tamara Checkout WordPress plugin's public payment cancel/fail return URLs allows any unauthenticated remote attacker to cancel or fail arbitrary WooCommerce orders store-wide simply by enumerating sequential numeric order IDs. The plugin through version 1.9.9.20 performs no verification of the WooCommerce order key, a WordPress nonce, or any user capability before acting on the supplied ID, making mass order disruption trivial to automate. A publicly available exploit has been documented by WPScan; no KEV listing is present but the low-friction attack surface warrants prompt remediation.
Unauthenticated information disclosure in the NewPath WildApricotPress Add-on WordPress plugin (all versions through 1.0.0) exposes member-only contact fields - email addresses and phone numbers - to any anonymous internet visitor via a REST API route that omits access control enforcement. Site administrators who configure those fields as members-only visibility receive no protection because the REST endpoint bypasses the plugin's own privacy logic. A publicly available exploit exists per WPScan, and no vendor-released patch has been identified at time of analysis.
Arbitrary file upload via malformed archive in the Kirki WordPress customizer plugin (all versions before 6.2.3) allows users holding the Editor role to place executable and web-accessible files on the server, enabling Stored XSS against any visitor and Remote Code Execution on permissive server configurations. A publicly available proof-of-concept exists per WPScan, elevating practical risk beyond the CVSS 6.8 score. No confirmed active exploitation appears in CISA KEV at time of analysis, though SSVC rates technical impact as total.
Insufficient authorization on GutenKit REST API endpoints allows any WordPress user with Contributor-level access or above to read mailing-list audience metadata from marketing accounts connected to the site. Affected installations running GutenKit versions prior to 2.5.0 with an integrated email marketing platform (e.g., Mailchimp) are exposed to unauthorized data disclosure. A public proof-of-concept is available via WPScan, though SSVC confirms no active exploitation at time of analysis.
Stored Cross-Site Scripting in GutenKit WordPress plugin before 2.5.0 allows authenticated users holding the Author role - or any role with file upload capability - to upload maliciously crafted SVG files through plugin-enabled upload paths that lack sanitization, executing arbitrary JavaScript in the browsers of any user who subsequently opens the file, including site administrators. A publicly available proof-of-concept exists via WPScan, and the SSVC framework rates technical impact as 'total,' meaning successful targeting of an administrator session could yield full WordPress site compromise. The vendor has released a remediated version (2.5.0), and exploitation status is rated 'none' by SSVC at time of analysis despite the public exploit code.
Stored cross-site scripting in the Admin and Site Enhancements (ASE) WordPress plugin before 9.0.1 allows authenticated users with site-owner-granted upload access to embed malicious JavaScript inside SVG files uploaded through incompletely sanitized routes, which then executes silently in the browser of any user - including administrators - who subsequently opens or previews the file. The plugin fails to apply SVG sanitization uniformly across all upload-accepting endpoints, meaning at least one route bypasses the intended XSS filter. A publicly available proof-of-concept has been confirmed by WPScan (EUVD-2026-63203), though SSVC assessment and the absence of a CISA KEV entry indicate no active widespread exploitation at time of analysis.
Arbitrary PHP code execution in Royal Addons for Elementor WordPress plugin (all versions before 1.7.1066) is reachable by any user holding the manage_options capability, including non-super subsite administrators on WordPress Multisite who would not otherwise have code-execution rights. The plugin writes unsanitized custom widget markup directly to a server-side file that is subsequently executed as PHP, enabling full server-side code injection. A publicly available exploit exists per WPScan; no CISA KEV listing at time of analysis, though the attack scenario is realistic for any WordPress Multisite deployment with delegated administration.
Server-Side Request Forgery in the WooMS WordPress plugin through version 9.14 allows unauthenticated remote attackers to trigger outbound HTTP requests to arbitrary URLs from the server, with third-party integration credentials automatically appended to each request. The vulnerability is conditional on the data-sync feature being enabled. A publicly available exploit exists per WPScan reporting, and successful exploitation results in full disclosure of stored integration credentials, making the confidentiality impact high despite a moderate aggregate CVSS score.
Unauthenticated access to a phone-number lookup endpoint in ShopSmart Loyalty for WooCommerce (versions ≤1.0.0) exposes customer PII - name, email address, and loyalty account balance - to any caller who supplies a valid phone number. Rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), the plugin performs no ownership or identity check before returning profile data. A public exploit exists via WPScan; the SSVC framework flags the attack as automatable, enabling systematic bulk harvesting of customer records across affected WooCommerce stores.
Insufficient authorization in the Visualizer WordPress plugin before 4.0.7 permits any authenticated Contributor-level user to retrieve the full configuration of every chart on the site through a single API request, bypassing the plugin's own UI-level access controls. The exposed configuration data may include credentials for remote data sources - such as database connection strings or API keys - that chart owners have configured. A publicly available proof-of-concept is referenced by WPScan; no active exploitation has been confirmed by CISA KEV, though the low barrier to exploitation makes patching urgent for any site with untrusted contributor accounts.
Stored Cross-Site Scripting in the Masteriyo LMS WordPress plugin (all versions before 2.3.3) allows instructor-role users to inject persistent malicious scripts into quiz fields that execute in the browsers of any page visitor, including administrators. The vulnerability stems from the plugin granting instructors unfiltered HTML storage capability without sanitizing or escaping output, creating a privilege-escalation path from instructor to effective administrator compromise via session hijacking. A publicly available proof-of-concept exists per WPScan; EPSS is low at 0.16%, and the flaw is not listed in CISA KEV, though POC availability elevates practical risk for unpatched single-site deployments.
Improper payout validation in the Premium Packages WordPress plugin (all versions before 7.0.7) allows any authenticated user - including subscribers with zero sales history - to submit withdrawal requests for arbitrary monetary amounts. Because the plugin never cross-references the requested amount against the user's actual earned balance, a low-privilege attacker can fabricate a payout claim that an administrator may approve and disburse as real funds. A publicly available proof-of-concept exists; no confirmed active exploitation (CISA KEV) has been recorded, and EPSS probability stands at 0.14% (4th percentile), suggesting opportunistic rather than widespread targeting.
Missing authorization checks in the ECS WordPress plugin before 4.3.10 allow any contributor-level or higher user to read custom field values and post metadata from WordPress posts they do not own, including private and draft content. The plugin's dynamic repeater data source feature accepts user-supplied post identifiers without validating ownership or post publication status, exposing potentially sensitive metadata to lower-privileged authenticated users. A publicly available proof-of-concept exists via WPScan, though EPSS at 0.15% (5th percentile) indicates limited observed exploitation activity and no CISA KEV listing has been issued.
Manual Image Crop WordPress plugin before version 1.15 exposes an authenticated AJAX crop action with neither capability check nor nonce verification, permitting any subscriber-level user to overwrite another user's media attachment thumbnails and corrupt stored image metadata across the entire Media Library. The flaw is simultaneously a broken authorization control and a CSRF vector - two distinct exploitation paths in one action. A public exploit exists per WPScan's disclosure, though EPSS at 0.10% (1st percentile) and SSVC's 'not automatable' rating indicate very limited observed exploitation, and no active exploitation is confirmed by CISA KEV.
Stored cross-site scripting in the Divi WordPress theme (versions 5.0 through before 5.9.0) allows any contributor-role user to inject persistent JavaScript into the Social Media Follow module's link attributes, which executes in the browser of any higher-privileged user - including administrators - who subsequently views the affected post. A publicly available proof-of-concept exploit exists per WPScan, and the scope-changed CVSS vector (S:C) confirms the injected script runs in the victim's privileged session context rather than the attacker's. Vendor-released patch version 5.9.0 is available and should be applied immediately.
Broken authorization in the Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin (versions before 7.0.9) allows any authenticated WordPress user - including the lowest-privilege subscriber role - to disconnect the site's Ecwid store and take the entire storefront offline. The affected store-management action performs neither a capability check nor a nonce verification, meaning the only barrier to exploitation is a valid WordPress session. A public exploit exists per WPScan reporting, and the fix is confirmed available in version 7.0.9.
Email injection in the Estatik Real Estate Plugin for WordPress (versions before 4.3.4) allows unauthenticated remote users to send emails to arbitrary recipients with fully attacker-controlled subject, body, and Reply-To headers by abusing the plugin's unvalidated property request form recipient list. The site's own mail infrastructure is effectively weaponized as an open relay, enabling phishing and spam distribution from a trusted sending domain. A publicly available proof-of-concept is referenced in the WPScan advisory; active exploitation has not been confirmed by CISA KEV, though the low skill barrier introduced by the PoC elevates practical risk above what the CVSS 3.7 base score alone suggests.
Fraudulent order completion in the Quick Paypal Payments WordPress plugin (all versions through 5.7.50) enables any buyer to acquire full-price goods or services by paying an arbitrary small amount. The plugin's PayPal IPN handler validates only the order token when determining whether to mark an order as paid - ignoring the payment amount, receiver address, and payment status entirely - so any buyer who can initiate a checkout can trivially complete a full-value order for pennies. Publicly available exploit code exists, reported by WPScan, making immediate opportunistic exploitation straightforward for any motivated attacker targeting affected WordPress storefronts.
Price manipulation in the Payment Button for PayPal WordPress plugin (all versions through 1.2.3.44) enables unauthenticated remote visitors to complete real PayPal transactions at self-specified amounts, causing direct financial loss to the merchant. The plugin forwards whatever payment amount the browser submits to PayPal without any server-side comparison against the merchant-configured price, meaning a buyer can purchase any listed product or service for an arbitrarily low value - including fractions of a cent. A publicly available proof-of-concept exploit exists per WPScan intelligence, lowering the bar for opportunistic financial fraud against any affected storefront.
Unauthenticated shortcode injection in Kirki WordPress plugin (all versions before 6.2.1) allows any remote attacker to execute arbitrary registered WordPress shortcodes via unprotected front-end form submission REST routes. On a default WordPress install, exploitation leads to disclosure of the site administrator's email address and abuse of the victim domain as a mail relay to arbitrary recipients. A publicly available proof-of-concept exploit exists per WPScan, and a vendor patch has been released.
Payment fraud in the Payment Gateway for PayPal on WooCommerce WordPress plugin (all versions before 9.2.1) enables unauthenticated remote attackers to mark arbitrary WooCommerce orders as paid without completing actual payment. The plugin's PayPal return handler reads attacker-controlled URL parameters and completes orders regardless of whether server-side gateway verification passes or fails, with no amount comparison and no order-ownership validation. A publicly available proof-of-concept exploit exists per WPScan; while the official CVSS score is 5.3, the financial fraud impact on affected e-commerce stores is materially higher in practice.
Payment callback fraud in the Welcart e-Commerce WordPress plugin (versions before 2.11.33) allows any unauthenticated remote attacker to flip their own unpaid order to a settled/paid state by submitting a crafted HTTP request containing only an order number and a status flag - no signature, payment amount, or origin IP is validated. Merchants offering convenience-store or bank-transfer pay-later methods are directly exposed to financial fraud, enabling attackers to obtain goods or services without transferring funds. A publicly available proof-of-concept exists; no active exploitation has been confirmed by CISA KEV at time of analysis.
Authenticated customers on WooCommerce stores running Wallet System for WooCommerce before 2.7.10 can complete purchases for free by submitting arbitrarily inflated wallet deduction amounts during checkout that the plugin accepts without verifying against the customer's actual stored balance. This business logic flaw enables systematic payment fraud - any registered shopper can zero out an order total and receive goods or services without paying the merchant. A publicly available proof-of-concept exists per WPScan, making this trivially exploitable by any site visitor who can register an account, and patching should be treated as urgent.
Stored Cross-Site Scripting in the Royal Addons for Elementor WordPress plugin (all versions before 1.7.1065) allows authenticated users holding the Contributor role or higher to inject persistent malicious scripts by supplying an unsanitized value in a widget setting that is written directly into an HTML tag. When a higher-privileged user such as an administrator subsequently views the affected page, the injected script executes in their browser session. A publicly available proof-of-concept exists and EPSS is 15%, placing this above the median exploitation probability for medium-severity WordPress plugin flaws.
Unauthenticated information disclosure in the Order Sync with Zendesk for WooCommerce WordPress plugin (all versions before 2.2.3) exposes full customer order history and cumulative purchase totals to any remote attacker who supplies a target's email address. The plugin's REST API endpoint omits both a WordPress capability check and any ownership verification, meaning the access control layer is entirely absent - not misconfigured but simply missing. A publicly available proof-of-concept exists (reported by WPScan), and SSVC assesses the vulnerability as automatable, making bulk enumeration of customer purchase data a realistic threat; however, no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Missing authorization on two administrative AJAX endpoints in ProSolution WP Client WordPress plugin before 2.0.9 allows any low-privileged authenticated user - including subscribers - to trigger administrative data synchronization and erase the plugin's activity log. The security nonce protecting these endpoints is exposed in the public-facing frontend, effectively nullifying WordPress's built-in CSRF protection and reducing the attack bar to any account with login access. A public exploit exists via WPScan, though CISA KEV lists no active exploitation and SSVC rates technical impact as only partial.
Server-side request forgery in ProSolution WP Client WordPress plugin (all versions before 2.0.9) allows any authenticated user - including low-privileged subscribers - to force the hosting server to issue arbitrary HTTP requests to internal hosts and services, with full attacker control over request method, headers, and body. The vulnerability bypasses both WordPress capability checks and nonce verification entirely. Publicly available exploit code exists, though no CISA KEV listing confirms active in-the-wild exploitation at time of analysis.
Insufficient authorization in WP Photo Album Plus (all versions before 9.2.09.002) allows any authenticated WordPress user-including low-privilege Subscriber accounts-to upload files into photo albums owned by other users or administrators. The flaw is rooted in CWE-639 (Authorization Bypass Through User-Controlled Key): the plugin's front-end upload endpoint accepts a caller-supplied album identifier without verifying ownership, enabling cross-user content injection. A publicly available POC exists via WPScan; no active exploitation is confirmed in CISA KEV, and the attack surface is constrained by a non-default configuration prerequisite.
WPC Admin Columns WordPress plugin exposes arbitrary metadata to subscriber-level authenticated users through an AJAX endpoint that lacks any authorization check. Any account with the lowest default WordPress role - subscriber - can query user, post, and term metadata site-wide, including sensitive data belonging to administrator accounts. Publicly available exploit code documented by WPScan lowers the practical barrier to exploitation; patch version 2.3.4 is available and should be applied immediately.
Incorrect authorization in the Cookie Consent WordPress plugin (versions before 0.0.10) allows any authenticated user - including low-privilege roles such as subscribers - to overwrite the plugin's stored geolocation service license key via a REST API route that fails its intended administrator-only capability check and falls back to a weaker authentication-only gate. The practical consequence is silent disruption of geolocation-based consent banner targeting, which can undermine GDPR and regional cookie-consent compliance workflows. Publicly available exploit code exists (no confirmed CISA KEV listing), and an EPSS score of 17% indicates above-average real-world exploitation interest relative to this severity class.
User Access Manager WordPress plugin before version 2.3.15 exposes restricted content to unauthenticated attackers via the WordPress REST API, which the plugin fails to protect with its own access control logic. Any post, page, or custom post type configured to be visible only to specific user groups can be silently read through standard REST API endpoints without credentials. A publicly available proof-of-concept exists (WPScan), and with an EPSS of 15% and automatable exploitation, this is a realistic risk for any WordPress site using this plugin to gate premium or sensitive content.
Reflected Cross-Site Scripting in the WP Photo Album Plus WordPress plugin (all versions before 9.2.07.002) allows unauthenticated attackers to inject arbitrary JavaScript into a victim's browser by reflecting an unsanitized parameter directly into an inline script block on gallery pages. Exploitation requires social engineering - the victim must open a crafted link - but no attacker credentials are needed. A publicly available proof-of-concept exists, reported by WPScan, and EPSS places exploitation probability at 17%, a notably elevated figure for a reflected XSS in a plugin.
Payment verification bypass in MasterStudy LMS WordPress Plugin before 3.7.40 permits unauthenticated attackers to fraudulently complete full-price course orders by submitting payment webhook notifications with only a token amount. The plugin neglects to validate the transaction amount, receiving account, currency, or payment status before updating order state to completed, granting unauthorized access to paid LMS content. A public proof-of-concept is available via WPScan, though EPSS remains low at 0.15% (4th percentile) and no CISA KEV listing has been confirmed.
SQL injection in WP Ultimate CSV Importer WordPress plugin (versions before 9.0) allows authenticated administrators to extract database contents by supplying crafted field values in CSV imports that are passed unsanitized into SQL statements. A publicly available proof-of-concept exists per the WPScan advisory, though the EPSS score of 0.16% (5th percentile) indicates minimal observed exploitation activity. No active exploitation has been confirmed by CISA KEV, and the administrative privilege requirement substantially narrows the realistic attack surface.
Stripe Payment Forms by WP Full Pay WordPress plugin before version 8.5.5 exposes an Insecure Direct Object Reference (IDOR) flaw in its customer-portal subscription cancellation endpoint, allowing an authenticated portal user to cancel subscriptions belonging to entirely different customers by substituting an arbitrary subscription ID in the cancellation request. Exploitation requires prior knowledge of the victim's Stripe subscription ID, which is high-entropy and not enumerable through the plugin itself, meaningfully constraining real-world exploitation despite a publicly available proof-of-concept. No active exploitation is confirmed - the vulnerability is absent from CISA KEV and carries a negligible EPSS score of 0.13% (3rd percentile), consistent with the practical access barrier imposed by the non-guessable subscription identifier.
Rank Math SEO WordPress plugin versions prior to 1.0.277 allows users holding the Editor role to modify site-wide administrator-reserved WordPress settings by invoking the plugin's automated SEO fix endpoint without proper capability verification. The root cause (CWE-863, Incorrect Authorization) is a missing capability check in the fix-handling code path - WordPress requires specific admin capabilities such as manage_options to alter core settings, but Rank Math does not enforce these checks before acting on the request. A publicly available proof-of-concept is documented via WPScan; the vulnerability is not in CISA KEV, and the EPSS score of 0.13% indicates very low observed exploitation activity at time of analysis.
Missing authorization enforcement in the Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 allows authenticated customers to escalate their own booking status without approval and tamper with other customers' statuses on shared appointments. The flaw (CWE-863) stems from the absence of a WordPress capability check before processing status-change requests, meaning any user with a booking can invoke the endpoint and set arbitrary statuses. No public exploitation has been confirmed by CISA KEV, but a publicly available proof-of-concept exists per WPScan.
Unauthenticated REST API access in the HEL Online Classroom WordPress plugin (through 1.0.3) allows any remote user to obtain a signed meeting join link for any classroom - including those protected by an access code - and join it with moderator privileges. All WordPress sites running this plugin through version 1.0.3 are affected regardless of classroom configuration. A publicly available exploit exists via WPScan, though EPSS (0.14%, 3rd percentile) indicates limited automated exploitation activity at time of analysis; no CISA KEV confirmation of active widespread exploitation is present.
Unauthenticated settings overwrite in the HEL Online Classroom WordPress plugin (versions through 1.0.3) allows any remote attacker to redirect all classroom sessions to attacker-controlled infrastructure and replace the shared secret used to sign those sessions. Because no authentication or authorization check exists on the settings-save endpoint, the entire plugin's operational trust model - both the backend URL and the signing secret - can be silently hijacked without any credentials. A publicly available exploit exists via WPScan, though EPSS sits at 0.18% (7th percentile), indicating no confirmed widespread exploitation at time of analysis.
PHP Object Injection in User Profile Builder WordPress plugin (versions 3.3.4 through before 4.0.1) allows authenticated administrators to inject arbitrary PHP objects by uploading a malicious configuration file through the plugin's import feature. Exploitation is gated by two non-trivial conditions: the affected free add-on must be explicitly enabled (it is disabled by default), and a suitable POP chain gadget must exist in another installed plugin or theme before code execution is achievable. A public POC exists per WPScan, but no public exploit identified at time of analysis maps to confirmed in-the-wild abuse - EPSS sits at just 0.23% (13th percentile), consistent with the high practical bar imposed by admin-level access and gadget dependencies.
Stored XSS in the User Profile Builder WordPress plugin (versions before 4.0.1) allows users with contributor-level WordPress roles to embed persistent JavaScript via an improperly escaped optional shortcode, executing in the browser of any user who views the affected content - including administrators. A publicly available exploit exists per WPScan intelligence, though EPSS remains at 0.15% (5th percentile) and the vulnerability is absent from CISA's KEV catalog. The non-default shortcode requirement meaningfully limits exposure to sites that have explicitly enabled the affected feature.
Catfolders Document Gallery Pro WordPress plugin before version 2.0.7 exposes private, unpublished folder contents to unauthenticated remote attackers through two compounding weaknesses: REST API routes that lack authorization checks, and a content-identifying token scheme that can be forged entirely client-side without prior authenticated access. Any network-accessible attacker can enumerate and download files from folders site administrators intentionally withheld from public publication. A publicly available proof-of-concept exists per WPScan, though EPSS places exploitation probability at 0.14% (3rd percentile), indicating limited observed opportunistic activity at time of analysis.
Broken order authorization in MStore API WordPress plugin (before 4.21.1) allows any authenticated user, including low-privilege Subscribers, to mark arbitrary orders as paid without actual payment being taken. The plugin's wallet payment handler neither verifies that the targeted order belongs to the requesting user nor deducts the wallet balance for most payment methods, enabling financial fraud against WooCommerce stores. A publicly available exploit exists per WPScan, though EPSS sits at 0.13% (3rd percentile), suggesting limited opportunistic exploitation to date.
MStore API WordPress plugin before 4.21.1 allows any authenticated user - including the lowest-privilege Subscriber role - to mark arbitrary WooCommerce orders as completed and paid without making any payment, constituting a business-logic fraud vulnerability. The root cause is a missing ownership authorization check (CWE-862) in a delivery status endpoint that accepts order IDs without verifying they belong to the requesting user. A publicly available exploit exists, though EPSS at 0.13% (3rd percentile) indicates limited automated mass exploitation to date; this vulnerability is not currently listed in the CISA KEV catalog.
Cross-Site Request Forgery in the Newsletters WordPress plugin (versions before 4.17) enables unauthenticated attackers to overwrite arbitrary plugin settings - including API credentials - by tricking a logged-in administrator into submitting a crafted request. The vulnerability arises from a complete absence of nonce verification and capability checks on the settings-save endpoint, meaning the plugin blindly applies every submitted parameter. A publicly available proof-of-concept exploit exists per WPScan, though EPSS sits at 0.10%, suggesting opportunistic mass exploitation has not yet materialized.
Predictable API key generation in the Newsletters WordPress plugin (versions before 4.17) enables unauthenticated network-accessible attackers who successfully derive the key to perform privileged API operations - including adding or deleting subscribers and sending bulk emails. Exploitation requires the plugin's optional API feature to be enabled. A publicly available proof-of-concept exists via WPScan, though EPSS stands at 0.10% (1st percentile), indicating minimal observed exploitation at time of analysis and no CISA KEV listing.
Missing object-level authorization in the User Registration & Membership WordPress plugin (before 5.2.5) allows any authenticated Subscriber-level user to cancel a pending email change belonging to any other account - including site administrators. The flaw stems from the plugin's email-change cancellation handler accepting a user identifier supplied by the requester without verifying account ownership, a classic IDOR pattern. A publicly available exploit exists per WPScan; however, SSVC assessment lists exploitation as none and the attack is not automatable, indicating opportunistic rather than widespread active abuse.
Arbitrary file write in the Breeze Cache WordPress plugin (all versions before 2.5.13) allows unauthenticated remote attackers to place files at any server filesystem location by supplying unsanitized path values in HTTP requests. The plugin uses attacker-controlled input directly to construct cache file paths, enabling traversal outside the intended cache directory. A publicly available proof-of-concept exists; while SSVC confirms no exploitation at time of analysis, the automatable attack vector and CWE-434 classification raise concern that the primitive could be chained to remote code execution if attacker-controlled content reaches a web-accessible directory.
Quiz and Survey Master (QSM) WordPress plugin versions before 11.2.4 expose quiz question banks, hints, and correct answer keys to any authenticated Contributor-level user via a REST API route lacking authorization checks. The flaw allows a low-privileged user to read quiz content owned by other users on the same WordPress installation, undermining academic integrity and confidentiality of proprietary quiz material. No confirmed active exploitation is recorded in CISA KEV, but a publicly available proof-of-concept is documented by WPScan, making opportunistic exploitation trivial for any authenticated site member.
Missing authorization in WCFM Marketplace WordPress plugin before 3.8.2 allows unauthenticated users to submit refund requests against any guest checkout order without verifying order ownership. The flaw (CWE-862) targets the refund request endpoint, which performs no ownership check for guest orders, enabling arbitrary financial disruption to marketplace vendors. A publicly available proof-of-concept exists; however, SSVC data confirms no active exploitation detected at time of analysis, and the patch is available in version 3.8.2.
Unauthenticated mass PII enumeration in the User Frontend WordPress plugin (versions 4.3.0 through 4.3.10) exposes the email address and phone number of every registered user - including site administrators - via an unrestricted user directory search endpoint. The flaw requires no authentication, no special configuration, and is automatable per SSVC, making bulk harvesting trivial for any remote attacker. A publicly available proof-of-concept exploit exists, reported by WPScan, though active exploitation has not been confirmed by CISA KEV at time of analysis.
Unauthenticated file upload in the Shared Files (before 1.7.67) and Shared Files Pro (before 1.7.70) WordPress plugins exposes an upload handler that performs no capability check and relies on a nonce embedded in every public page - making the nonce an ineffective authorization barrier. Any unauthenticated visitor can upload files within WordPress's allowed MIME type list to a publicly accessible server directory, and the server's absolute filesystem path is returned in the response, aiding reconnaissance. Publicly available exploit code exists (confirmed by WPScan); however, active exploitation has not been confirmed and the CVE is not listed in CISA KEV.
Arbitrary file deletion via path traversal in the Shared Files and Shared Files Pro WordPress plugins (versions before 1.7.67 and 1.7.68 respectively) enables unauthenticated attackers to trigger deletion of critical server files such as wp-config.php, causing denial of service and potential site takeover. The plugin's single-pass traversal filter is bypassable during frontend file submission, allowing a crafted path pointing outside the uploads directory to be stored; when an administrator later permanently deletes the corresponding file entry, the resolved arbitrary file is removed. A publicly available proof-of-concept exists, though SSVC assessment rates exploitation as none at time of analysis, likely reflecting the two-stage attack dependency on administrator action.
Simple Newsletter Plugin for WordPress (versions 4.0.0 through 4.3.2) fails to verify that a public requester matches the subscriber whose record is being fetched, exposing stored personal data and the authorization key that controls changes to that subscriber's record to any unauthenticated caller. A publicly available proof-of-concept documented by WPScan demonstrates the attack path, though EPSS at 0.18% (7th percentile) suggests exploitation has remained limited in observed telemetry. Vendor-released patch version 4.3.3 is available and should be applied immediately given the zero-complexity, unauthenticated exploit path.
SQL injection in the RegistrationMagic WordPress plugin (all versions before 6.0.9.4) permits authenticated administrators to inject arbitrary SQL through an unsanitized parameter. The CVSS Scope:Changed metric indicates the injected query can reach beyond the WordPress application boundary into the underlying database layer, enabling cross-schema data reads. A publicly available proof-of-concept exists via WPScan, though EPSS at 0.19% and SSVC exploitation status of 'none' indicate limited real-world abuse at time of analysis.
Insecure Direct Object Reference (IDOR) in the Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 allows any authenticated customer with a valid portal session to cancel, reactivate, or modify Stripe subscriptions belonging to other customers. The plugin's customer portal endpoints fail to verify that a subscription ID supplied in the request is actually owned by the authenticated session's bound customer, enabling horizontal privilege escalation across customer accounts. A publicly available proof-of-concept exists; exploitation probability is low per EPSS (0.16%, 5th percentile), but the business impact on affected merchants' subscription revenue could be significant despite the moderate CVSS score.
Stripe Payment Forms by WP Full Pay plugin for WordPress (all versions before 8.5.1) exposes customer subscription and billing data to unauthenticated network attackers due to a missing session-confirmation check in the customer portal workflow. The plugin returns sensitive financial records before verifying that a portal session has completed its confirmation step, enabling any unauthenticated user to read billing information belonging to a different customer. A publicly available exploit exists per WPScan intelligence, though EPSS sits at 0.18% (7th percentile), indicating limited observed exploitation despite the low-barrier attack path.
Path traversal in the Directorist WordPress plugin (versions 8.5 through before 8.9.3) allows subscriber-level authenticated users to relocate arbitrary server-readable image files into a publicly accessible directory and delete them from their original location. The flaw stems from unsanitized user-supplied image references passed directly to a file-move operation, exposing sensitive server files to unauthenticated public access after the move. Publicly available exploit code exists per WPScan reporting; however, EPSS sits at 0.19% (9th percentile), and the requirement for a subscriber-level account limits opportunistic mass exploitation.
Kirki WordPress Customizer Framework plugin before 6.0.14 exposes registered user email addresses, comment author emails, non-public page content, and site settings to unauthenticated remote attackers via missing capability checks on public AJAX action endpoints. Every WordPress site running any Kirki version prior to 6.0.14 is affected regardless of configuration. A publicly available proof-of-concept exists per WPScan reporting; exploitation probability is currently low (EPSS 0.18%, 7th percentile) and no active exploitation is confirmed in CISA KEV, though the data harvested enables downstream phishing and credential-stuffing campaigns.
Unauthenticated ownership bypass in the Return Refund and Exchange For WooCommerce plugin (versions before 4.6.4) exposes guest order workflows to arbitrary third-party manipulation. Any unauthenticated network attacker who can reference a guest order ID can read private order messages, impersonate the customer by posting messages or attachments, and cancel active return requests - undermining both customer privacy and merchant return-process integrity. A publicly available proof-of-concept exists; however, exploitation probability is very low per EPSS (0.17%, 6th percentile), and no active exploitation has been confirmed by CISA KEV.
Unauthenticated payment bypass in the Eventin WordPress plugin before 4.1.19 lets any visitor fraudulently obtain valid paid event tickets without completing payment. By abusing a guest checkout token, an attacker can transition their own unpaid order to 'completed', triggering ticket issuance without a charge being processed. A publicly available proof-of-concept exists, and SSVC flags the attack as automatable - enabling scaled ticket fraud against any WordPress site running the affected plugin.
Unauthenticated remote attackers can invoke AI queries against a site owner's configured provider account through the AI Engine WordPress plugin before version 3.7.2. The plugin exposes an administration-only feature protected solely by a token it distributes to anonymous visitors - rather than a proper WordPress capability check - enabling any network-accessible attacker to submit arbitrary AI prompts billed to the operator's account. A publicly available proof-of-concept exists via WPScan; however, the vulnerability is not currently listed in the CISA KEV catalog, and EPSS sits at 0.17% (6th percentile), suggesting limited confirmed mass exploitation at time of analysis.
Broken object-level authorization in the Project Manager WordPress plugin before 4.0.7 allows any authenticated user - including low-privilege subscribers - to read arbitrary users' activity histories, email addresses, and details of projects they have no legitimate access to via an unguarded REST API route. Affected versions span 2.2.0 through 4.0.6, with a patch released at 4.0.7. A publicly available proof-of-concept is documented by WPScan, though no confirmed active exploitation (CISA KEV) has been recorded and EPSS probability remains low at 0.16%.
Improper access control in the Project Manager WordPress plugin before 4.0.7 exposes several REST API routes without project-membership enforcement, allowing any low-privilege authenticated user - including subscribers - to read task content and user email addresses across projects they do not belong to, and to modify task boards of arbitrary projects. The flaw is a classic CWE-284 (Improper Access Control) exploitable with no special configuration, network-accessible, and requiring only a valid WordPress account. A publicly available exploit exists via WPScan, though EPSS at 0.16% (5th percentile) indicates limited observed exploitation; no public exploit identified at time of analysis confirms CISA KEV status, so active widespread exploitation cannot be confirmed.
Stored Cross-Site Scripting in the Royal Addons for Elementor WordPress plugin (all versions before 1.7.1066) permits any authenticated Contributor-role user to inject arbitrary JavaScript payloads via unsanitized widget settings that are rendered unescaped inside HTML attributes. When a higher-privileged user such as an administrator previews or views the crafted content, the payload executes in their browser session, enabling session hijacking, credential theft, or unauthorized administrative actions. A public proof-of-concept is available via WPScan; however, no public exploit identified at time of analysis maps to confirmed active exploitation, and EPSS sits at 0.18% (8th percentile).
Privilege escalation in the Forminator Forms WordPress plugin (all versions before 1.57.1) allows unauthenticated remote attackers to register new sites on WordPress multisite networks regardless of whether the network administrator has enabled site registration, granting the attacker administrator-level privileges over each newly created sub-site. This flaw is scoped exclusively to WordPress multisite deployments; standard single-site WordPress installations are completely unaffected regardless of plugin version. No active exploitation has been confirmed by CISA KEV, though WPScan has published a public proof-of-concept and a vendor patch is available at version 1.57.1.
SQL injection and unrestricted template file loading in the Tutor LMS WordPress plugin before version 4.0.6 exposes non-public course question-and-answer content to unauthenticated remote attackers. User-supplied values are incorporated directly into database query grammar without validation, and no restriction is enforced on which template file a request may load. Although a publicly available proof-of-concept exists and the flaw is fully automatable with no authentication barrier, the SQL injection is constrained by database engine behavior such that it does not yield arbitrary table extraction - impact is limited to disclosure of restricted course Q&A material. No confirmed active exploitation (CISA KEV) has been reported at time of analysis.
Payment amount manipulation in the Booking Package WordPress plugin (versions before 1.7.25) allows unauthenticated remote attackers to complete paid service bookings at an arbitrary fraction of the legitimate price. The plugin derives the charge amount from attacker-controlled HTTP request values rather than authoritative server-stored pricing, a classic business-logic trust boundary failure. A publicly available exploit exists per WPScan, though no CISA KEV listing was provided in input data, and EPSS at 0.18% (7th percentile) suggests limited observed mass exploitation to date.
Unauthenticated access to a missing-authorization REST endpoint in the Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before version 3.7.1 exposes the site's connected compliance-service API secret and account credentials to any visitor. Using the retrieved secret, an attacker can call the connected third-party compliance service API to sever the plugin's integration, causing GDPR, CCPA, and cookie policy documents to stop displaying on the affected WordPress site. A public exploit exists per WPScan, though CISA has not listed this in KEV and SSVC rates active exploitation as none at time of analysis.
Unauthorized reservation creation in the WPCafe WordPress plugin (all versions before 3.0.18) exposes the administrator moderation workflow to unauthenticated bypass through a missing authorization check in its REST API endpoint. The endpoint validates only a publicly available nonce - a control that provides no meaningful access restriction - allowing any remote user to submit reservations with an arbitrary approval status, including self-approving bookings that administrators would otherwise need to review and accept. A proof-of-concept exploit is publicly available via WPScan; however, EPSS stands at 0.19% (9th percentile), indicating that exploitation has remained limited despite trivially low attack prerequisites.
Unauthenticated queue-trigger exposure in the Booking for Appointments and Events Calendar WordPress plugin (versions before 2.4.7) permits any remote visitor to force the dispatch of the plugin's pending notification queue and integration callbacks. Because the queue-processing endpoint performs no authentication check (CWE-287), an attacker needs no credentials or session to invoke it. A publicly available proof-of-concept exists per the WPScan report, though EPSS at 0.23% indicates exploitation has not yet reached widespread automated activity, and the vulnerability is not listed in CISA KEV.
Broken object-level authorization in the Booking for Appointments and Events Calendar WordPress plugin (versions 9.0 through before 9.8) allows any authenticated employee account to overwrite a different employee's cabinet password, achieving full account takeover of the victim provider. The flaw exists because the plugin's password-update endpoint does not verify that the requesting employee owns the target provider account. A publicly available proof-of-concept exists; no active exploitation has been confirmed by CISA KEV at time of analysis.
Unauthenticated information disclosure in Royal Addons for Elementor (WordPress plugin) before version 1.7.1066 exposes names and IDs of non-public taxonomy terms to any remote caller. The plugin performs no capability or nonce verification before fulfilling taxonomy data requests, meaning access controls enforced by WordPress core are entirely bypassed at the plugin layer. A publicly available proof-of-concept exists per WPScan, and exploitation is assessed as automatable with partial technical impact by the SSVC framework.
Unauthenticated metadata tampering in Royal Addons for Elementor WordPress plugin before 1.7.1066 allows any remote visitor to overwrite like-count and visitor-tracking post meta on arbitrary posts, including private and draft posts, because the plugin's AJAX handler validates only a nonce - a value scrapeable from any public page - without performing any WordPress capability or post-ownership check. A publicly available proof-of-concept exists per WPScan. While exploitation is automatable and requires no credentials, the integrity impact is narrow, limited to engagement metadata rather than post content or authentication data.
Unauthenticated information disclosure in the Eventin WordPress plugin before 4.1.22 exposes private, draft, and pending posts - including the plaintext passwords and full content of password-protected posts - to any unauthenticated HTTP client via an unprotected REST API namespace. The flaw arises from missing authorization checks on post status and ownership within that namespace, meaning no credentials or privileges are required to enumerate and read content the site owner intended to restrict. A publicly available proof-of-concept exploit exists, and the attack is fully automatable per the SSVC framework, though CISA has not listed this in KEV and the EPSS score is low (0.18%), suggesting exploitation has not yet been widespread.
Stored shortcode injection in the ProfilePress WordPress plugin before 4.17.1 allows unauthenticated attackers to persist shortcodes in two unfiltered profile fields, which WordPress then executes when any visitor loads the public profile page. The impact is limited to information disclosure - exposing a targeted user's email address, login date, and registration date - but the attack requires no elevated privileges and no special configuration beyond default plugin deployment. A publicly available exploit exists per WPScan's disclosure; patch version 4.17.1 is confirmed available from the vendor.
Username denylist bypass in Limit Login Attempts Security (Limit Login Attempts Reloaded) before version 3.3.5 allows a WordPress user who has been explicitly blocked by an administrator to successfully authenticate by varying the case of their username or by supplying the account's associated email address instead. This is a logic flaw in the plugin's denylist enforcement, entirely defeating the access control that a site administrator intended to impose on specific accounts. A publicly available proof-of-concept is documented in the WPScan advisory; the low CVSS score of 3.7 with AC:H reflects that successful exploitation requires the attacker to already hold valid credentials for the denylisted account.
Passster WordPress plugin versions before 4.3.9 exposes globally password-protected post and page content to unauthenticated remote attackers via a flawed REST API path-matching bypass. The plugin's allowlist logic for public endpoints uses unanchored substring comparison against the full request URI rather than matching against the resolved WordPress route, meaning any attacker can craft a URI that embeds the whitelisted path segment anywhere within it to sidestep the protection gate entirely. A publicly available proof-of-concept exploit exists per WPScan, and the EPSS-relevant CVSS vector (PR:N, AC:L) confirms exploitation requires no authentication or special configuration beyond the plugin being installed with global password protection active.
Webhook authentication bypass in the Charitable WordPress donation plugin (versions before 1.8.12) allows unauthenticated remote attackers to forge Square payment webhook notifications, causing the plugin to record donations as successfully paid without any actual financial transaction occurring. The vulnerability exists in all default configurations where Square is the configured payment gateway, requiring no credentials or user interaction to exploit. A publicly available proof-of-concept exists per WPScan reporting, though this vulnerability has not been listed in CISA's Known Exploited Vulnerabilities catalog at time of analysis.
Payment gateway merchant account verification is entirely absent in the myCred WordPress plugin before version 3.2.5, enabling unauthenticated remote attackers to fraudulently inflate their in-site credit balances by routing payments to a gateway account they control instead of the site operator's. An attacker needs only to complete a payment of the expected amount through a supported gateway and trigger the resulting notification to the vulnerable site - no knowledge of or access to the site's merchant credentials is required. A publicly available exploit exists per WPScan reporting (EUVD-2026-63909), and a vendor-released patch in version 3.2.5 is confirmed available.
CSRF in the LitExtension WordPress migration plugin (≤1.2.5) allows an unauthenticated remote attacker to overwrite the store-migration connector's authentication token by tricking a logged-in administrator into clicking a crafted link. Token replacement gives the attacker control over the connector, potentially enabling unauthorized access to migrated store data or disruption of active migration workflows. A publicly available proof-of-concept exploit was published via WPScan; this vulnerability has not been added to the CISA KEV catalog at time of analysis.
Blind server-side request forgery in the Eventin WordPress plugin prior to version 4.1.21 allows contributor-level authenticated users to direct the WordPress server to issue arbitrary outbound HTTP requests by supplying unvalidated webhook URLs on events they do not own. Two distinct control failures compound the issue: webhook URL input is accepted without sanitization, and the plugin performs no event ownership check, meaning any contributor can abuse another user's event configuration. A publicly available proof-of-concept exists; no CISA KEV listing confirms active exploitation at time of analysis.
Unauthorized post data disclosure in the Duplicate Post WordPress plugin before 1.5.6 allows authenticated users holding a delegated role to read content, metadata, and passwords for posts they should not have access to - including other users' private and draft posts. The CVSS vector (PR:H/C:L) reflects a constrained impact limited to information disclosure within authenticated contexts, making this a meaningful risk in multi-user editorial WordPress environments but not in single-author deployments. A publicly available proof-of-concept exists per WPScan's advisory; no active exploitation has been confirmed via CISA KEV.
Duplicate Post WordPress plugin before 1.5.6 exposes password-protected post content to authenticated users who lack read authorization on those posts. The plugin's duplication feature fails to verify whether the requesting user has permission to read the source post, allowing any user with a delegated duplication role to republish another author's password-protected content as publicly readable. A publicly available proof-of-concept exists; no active exploitation has been confirmed (not in CISA KEV). A vendor patch is available at version 1.5.6.
SQL injection in the Media Library Assistant WordPress plugin before version 3.40 allows authenticated users with the Author role to read sensitive database contents by injecting arbitrary SQL via an unvalidated search parameter in a media-library query handler. The scope-changed CVSS vector (S:C) reflects that exploitation can reach data beyond the plugin's immediate database scope, and a publicly available proof-of-concept exists per WPScan's disclosure. No public exploit identified at time of analysis for active exploitation, though the POC lowers the bar for abuse against any WordPress installation running the unpatched plugin.
Financial ledger manipulation in the Dokan WooCommerce Multivendor Marketplace WordPress plugin (before 5.0.14) allows authenticated vendors to fraudulently clear commission debts by submitting arbitrary client-supplied payment amounts to the reverse-withdrawal endpoint without server-side balance validation. Any registered vendor on an affected marketplace can exploit this to zero out real outstanding commissions owed to the marketplace operator, constituting financial fraud against the site owner. A publicly available proof-of-concept exists; no active exploitation has been confirmed by CISA KEV, though the low attack complexity and accessible vendor registration on most marketplaces make this a meaningful business risk.
Unauthenticated information disclosure in Dokan WooCommerce Multivendor Marketplace plugin (versions before 5.0.14) allows any remote actor to retrieve per-vendor commission configuration from an unprotected store REST endpoint without credentials. The exposed data includes commission type and, where category-based commissions are configured, per-category and default commission rates - leaking potentially sensitive business financial details for every vendor on the marketplace. A publicly available proof-of-concept exists; however, active exploitation has not been confirmed via CISA KEV.
SQL injection in the Link Whisper Free WordPress plugin (all versions before 0.9.7) enables authenticated users holding the Editor role or above to execute arbitrary SQL queries against the underlying WordPress database, with potential scope change to data beyond the plugin's own tables. Reported by WPScan with a publicly available proof-of-concept, this raises the practical exploitability despite the elevated privilege requirement. No CISA KEV listing indicates active mass exploitation has not been confirmed at time of analysis; a vendor-released patch (0.9.7) is available.
Stored XSS in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin (versions before 1.3.9.9) allows administrator-level users to inject arbitrary JavaScript via an unsanitized plugin setting used as an HTML tag name in front-end output. Any visitor loading a page that renders the upload field will execute the injected script in their browser context. A publicly available exploit exists; the vulnerability is rated CVSS 3.5 due to the high-privilege requirement, though post-authentication stored XSS can still enable session hijacking or malicious redirects against site visitors.
Session fixation in the Welcart e-Commerce WordPress plugin (all versions before 2.12.1) allows an unauthenticated remote attacker to pre-set a shop member's session identifier via a user-supplied request parameter, then silently hijack the authenticated session once the victim logs in through an attacker-crafted request. Because the plugin neither generates a fresh session ID on authentication nor rejects externally supplied session tokens, the attacker's chosen token becomes the victim's authenticated session. A publicly available POC exists via WPScan, and no KEV listing is present, though the combination of no required attacker privileges and a low-complexity exploit path elevates practical risk for any live Welcart storefront.
Missing authorization on the Tamara Checkout WordPress plugin's public payment cancel/fail return URLs allows any unauthenticated remote attacker to cancel or fail arbitrary WooCommerce orders store-wide simply by enumerating sequential numeric order IDs. The plugin through version 1.9.9.20 performs no verification of the WooCommerce order key, a WordPress nonce, or any user capability before acting on the supplied ID, making mass order disruption trivial to automate. A publicly available exploit has been documented by WPScan; no KEV listing is present but the low-friction attack surface warrants prompt remediation.
Unauthenticated information disclosure in the NewPath WildApricotPress Add-on WordPress plugin (all versions through 1.0.0) exposes member-only contact fields - email addresses and phone numbers - to any anonymous internet visitor via a REST API route that omits access control enforcement. Site administrators who configure those fields as members-only visibility receive no protection because the REST endpoint bypasses the plugin's own privacy logic. A publicly available exploit exists per WPScan, and no vendor-released patch has been identified at time of analysis.
Arbitrary file upload via malformed archive in the Kirki WordPress customizer plugin (all versions before 6.2.3) allows users holding the Editor role to place executable and web-accessible files on the server, enabling Stored XSS against any visitor and Remote Code Execution on permissive server configurations. A publicly available proof-of-concept exists per WPScan, elevating practical risk beyond the CVSS 6.8 score. No confirmed active exploitation appears in CISA KEV at time of analysis, though SSVC rates technical impact as total.
Insufficient authorization on GutenKit REST API endpoints allows any WordPress user with Contributor-level access or above to read mailing-list audience metadata from marketing accounts connected to the site. Affected installations running GutenKit versions prior to 2.5.0 with an integrated email marketing platform (e.g., Mailchimp) are exposed to unauthorized data disclosure. A public proof-of-concept is available via WPScan, though SSVC confirms no active exploitation at time of analysis.
Stored Cross-Site Scripting in GutenKit WordPress plugin before 2.5.0 allows authenticated users holding the Author role - or any role with file upload capability - to upload maliciously crafted SVG files through plugin-enabled upload paths that lack sanitization, executing arbitrary JavaScript in the browsers of any user who subsequently opens the file, including site administrators. A publicly available proof-of-concept exists via WPScan, and the SSVC framework rates technical impact as 'total,' meaning successful targeting of an administrator session could yield full WordPress site compromise. The vendor has released a remediated version (2.5.0), and exploitation status is rated 'none' by SSVC at time of analysis despite the public exploit code.
Stored cross-site scripting in the Admin and Site Enhancements (ASE) WordPress plugin before 9.0.1 allows authenticated users with site-owner-granted upload access to embed malicious JavaScript inside SVG files uploaded through incompletely sanitized routes, which then executes silently in the browser of any user - including administrators - who subsequently opens or previews the file. The plugin fails to apply SVG sanitization uniformly across all upload-accepting endpoints, meaning at least one route bypasses the intended XSS filter. A publicly available proof-of-concept has been confirmed by WPScan (EUVD-2026-63203), though SSVC assessment and the absence of a CISA KEV entry indicate no active widespread exploitation at time of analysis.
Arbitrary PHP code execution in Royal Addons for Elementor WordPress plugin (all versions before 1.7.1066) is reachable by any user holding the manage_options capability, including non-super subsite administrators on WordPress Multisite who would not otherwise have code-execution rights. The plugin writes unsanitized custom widget markup directly to a server-side file that is subsequently executed as PHP, enabling full server-side code injection. A publicly available exploit exists per WPScan; no CISA KEV listing at time of analysis, though the attack scenario is realistic for any WordPress Multisite deployment with delegated administration.
Server-Side Request Forgery in the WooMS WordPress plugin through version 9.14 allows unauthenticated remote attackers to trigger outbound HTTP requests to arbitrary URLs from the server, with third-party integration credentials automatically appended to each request. The vulnerability is conditional on the data-sync feature being enabled. A publicly available exploit exists per WPScan reporting, and successful exploitation results in full disclosure of stored integration credentials, making the confidentiality impact high despite a moderate aggregate CVSS score.
Unauthenticated access to a phone-number lookup endpoint in ShopSmart Loyalty for WooCommerce (versions ≤1.0.0) exposes customer PII - name, email address, and loyalty account balance - to any caller who supplies a valid phone number. Rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), the plugin performs no ownership or identity check before returning profile data. A public exploit exists via WPScan; the SSVC framework flags the attack as automatable, enabling systematic bulk harvesting of customer records across affected WooCommerce stores.
Insufficient authorization in the Visualizer WordPress plugin before 4.0.7 permits any authenticated Contributor-level user to retrieve the full configuration of every chart on the site through a single API request, bypassing the plugin's own UI-level access controls. The exposed configuration data may include credentials for remote data sources - such as database connection strings or API keys - that chart owners have configured. A publicly available proof-of-concept is referenced by WPScan; no active exploitation has been confirmed by CISA KEV, though the low barrier to exploitation makes patching urgent for any site with untrusted contributor accounts.
Stored Cross-Site Scripting in the Masteriyo LMS WordPress plugin (all versions before 2.3.3) allows instructor-role users to inject persistent malicious scripts into quiz fields that execute in the browsers of any page visitor, including administrators. The vulnerability stems from the plugin granting instructors unfiltered HTML storage capability without sanitizing or escaping output, creating a privilege-escalation path from instructor to effective administrator compromise via session hijacking. A publicly available proof-of-concept exists per WPScan; EPSS is low at 0.16%, and the flaw is not listed in CISA KEV, though POC availability elevates practical risk for unpatched single-site deployments.
Improper payout validation in the Premium Packages WordPress plugin (all versions before 7.0.7) allows any authenticated user - including subscribers with zero sales history - to submit withdrawal requests for arbitrary monetary amounts. Because the plugin never cross-references the requested amount against the user's actual earned balance, a low-privilege attacker can fabricate a payout claim that an administrator may approve and disburse as real funds. A publicly available proof-of-concept exists; no confirmed active exploitation (CISA KEV) has been recorded, and EPSS probability stands at 0.14% (4th percentile), suggesting opportunistic rather than widespread targeting.
Missing authorization checks in the ECS WordPress plugin before 4.3.10 allow any contributor-level or higher user to read custom field values and post metadata from WordPress posts they do not own, including private and draft content. The plugin's dynamic repeater data source feature accepts user-supplied post identifiers without validating ownership or post publication status, exposing potentially sensitive metadata to lower-privileged authenticated users. A publicly available proof-of-concept exists via WPScan, though EPSS at 0.15% (5th percentile) indicates limited observed exploitation activity and no CISA KEV listing has been issued.
Manual Image Crop WordPress plugin before version 1.15 exposes an authenticated AJAX crop action with neither capability check nor nonce verification, permitting any subscriber-level user to overwrite another user's media attachment thumbnails and corrupt stored image metadata across the entire Media Library. The flaw is simultaneously a broken authorization control and a CSRF vector - two distinct exploitation paths in one action. A public exploit exists per WPScan's disclosure, though EPSS at 0.10% (1st percentile) and SSVC's 'not automatable' rating indicate very limited observed exploitation, and no active exploitation is confirmed by CISA KEV.
Stored cross-site scripting in the Divi WordPress theme (versions 5.0 through before 5.9.0) allows any contributor-role user to inject persistent JavaScript into the Social Media Follow module's link attributes, which executes in the browser of any higher-privileged user - including administrators - who subsequently views the affected post. A publicly available proof-of-concept exploit exists per WPScan, and the scope-changed CVSS vector (S:C) confirms the injected script runs in the victim's privileged session context rather than the attacker's. Vendor-released patch version 5.9.0 is available and should be applied immediately.
Broken authorization in the Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin (versions before 7.0.9) allows any authenticated WordPress user - including the lowest-privilege subscriber role - to disconnect the site's Ecwid store and take the entire storefront offline. The affected store-management action performs neither a capability check nor a nonce verification, meaning the only barrier to exploitation is a valid WordPress session. A public exploit exists per WPScan reporting, and the fix is confirmed available in version 7.0.9.
Email injection in the Estatik Real Estate Plugin for WordPress (versions before 4.3.4) allows unauthenticated remote users to send emails to arbitrary recipients with fully attacker-controlled subject, body, and Reply-To headers by abusing the plugin's unvalidated property request form recipient list. The site's own mail infrastructure is effectively weaponized as an open relay, enabling phishing and spam distribution from a trusted sending domain. A publicly available proof-of-concept is referenced in the WPScan advisory; active exploitation has not been confirmed by CISA KEV, though the low skill barrier introduced by the PoC elevates practical risk above what the CVSS 3.7 base score alone suggests.
Fraudulent order completion in the Quick Paypal Payments WordPress plugin (all versions through 5.7.50) enables any buyer to acquire full-price goods or services by paying an arbitrary small amount. The plugin's PayPal IPN handler validates only the order token when determining whether to mark an order as paid - ignoring the payment amount, receiver address, and payment status entirely - so any buyer who can initiate a checkout can trivially complete a full-value order for pennies. Publicly available exploit code exists, reported by WPScan, making immediate opportunistic exploitation straightforward for any motivated attacker targeting affected WordPress storefronts.
Price manipulation in the Payment Button for PayPal WordPress plugin (all versions through 1.2.3.44) enables unauthenticated remote visitors to complete real PayPal transactions at self-specified amounts, causing direct financial loss to the merchant. The plugin forwards whatever payment amount the browser submits to PayPal without any server-side comparison against the merchant-configured price, meaning a buyer can purchase any listed product or service for an arbitrarily low value - including fractions of a cent. A publicly available proof-of-concept exploit exists per WPScan intelligence, lowering the bar for opportunistic financial fraud against any affected storefront.
Unauthenticated shortcode injection in Kirki WordPress plugin (all versions before 6.2.1) allows any remote attacker to execute arbitrary registered WordPress shortcodes via unprotected front-end form submission REST routes. On a default WordPress install, exploitation leads to disclosure of the site administrator's email address and abuse of the victim domain as a mail relay to arbitrary recipients. A publicly available proof-of-concept exploit exists per WPScan, and a vendor patch has been released.
Payment fraud in the Payment Gateway for PayPal on WooCommerce WordPress plugin (all versions before 9.2.1) enables unauthenticated remote attackers to mark arbitrary WooCommerce orders as paid without completing actual payment. The plugin's PayPal return handler reads attacker-controlled URL parameters and completes orders regardless of whether server-side gateway verification passes or fails, with no amount comparison and no order-ownership validation. A publicly available proof-of-concept exploit exists per WPScan; while the official CVSS score is 5.3, the financial fraud impact on affected e-commerce stores is materially higher in practice.
Payment callback fraud in the Welcart e-Commerce WordPress plugin (versions before 2.11.33) allows any unauthenticated remote attacker to flip their own unpaid order to a settled/paid state by submitting a crafted HTTP request containing only an order number and a status flag - no signature, payment amount, or origin IP is validated. Merchants offering convenience-store or bank-transfer pay-later methods are directly exposed to financial fraud, enabling attackers to obtain goods or services without transferring funds. A publicly available proof-of-concept exists; no active exploitation has been confirmed by CISA KEV at time of analysis.
Authenticated customers on WooCommerce stores running Wallet System for WooCommerce before 2.7.10 can complete purchases for free by submitting arbitrarily inflated wallet deduction amounts during checkout that the plugin accepts without verifying against the customer's actual stored balance. This business logic flaw enables systematic payment fraud - any registered shopper can zero out an order total and receive goods or services without paying the merchant. A publicly available proof-of-concept exists per WPScan, making this trivially exploitable by any site visitor who can register an account, and patching should be treated as urgent.
Stored Cross-Site Scripting in the Royal Addons for Elementor WordPress plugin (all versions before 1.7.1065) allows authenticated users holding the Contributor role or higher to inject persistent malicious scripts by supplying an unsanitized value in a widget setting that is written directly into an HTML tag. When a higher-privileged user such as an administrator subsequently views the affected page, the injected script executes in their browser session. A publicly available proof-of-concept exists and EPSS is 15%, placing this above the median exploitation probability for medium-severity WordPress plugin flaws.
Unauthenticated information disclosure in the Order Sync with Zendesk for WooCommerce WordPress plugin (all versions before 2.2.3) exposes full customer order history and cumulative purchase totals to any remote attacker who supplies a target's email address. The plugin's REST API endpoint omits both a WordPress capability check and any ownership verification, meaning the access control layer is entirely absent - not misconfigured but simply missing. A publicly available proof-of-concept exists (reported by WPScan), and SSVC assesses the vulnerability as automatable, making bulk enumeration of customer purchase data a realistic threat; however, no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Missing authorization on two administrative AJAX endpoints in ProSolution WP Client WordPress plugin before 2.0.9 allows any low-privileged authenticated user - including subscribers - to trigger administrative data synchronization and erase the plugin's activity log. The security nonce protecting these endpoints is exposed in the public-facing frontend, effectively nullifying WordPress's built-in CSRF protection and reducing the attack bar to any account with login access. A public exploit exists via WPScan, though CISA KEV lists no active exploitation and SSVC rates technical impact as only partial.
Server-side request forgery in ProSolution WP Client WordPress plugin (all versions before 2.0.9) allows any authenticated user - including low-privileged subscribers - to force the hosting server to issue arbitrary HTTP requests to internal hosts and services, with full attacker control over request method, headers, and body. The vulnerability bypasses both WordPress capability checks and nonce verification entirely. Publicly available exploit code exists, though no CISA KEV listing confirms active in-the-wild exploitation at time of analysis.
Insufficient authorization in WP Photo Album Plus (all versions before 9.2.09.002) allows any authenticated WordPress user-including low-privilege Subscriber accounts-to upload files into photo albums owned by other users or administrators. The flaw is rooted in CWE-639 (Authorization Bypass Through User-Controlled Key): the plugin's front-end upload endpoint accepts a caller-supplied album identifier without verifying ownership, enabling cross-user content injection. A publicly available POC exists via WPScan; no active exploitation is confirmed in CISA KEV, and the attack surface is constrained by a non-default configuration prerequisite.
WPC Admin Columns WordPress plugin exposes arbitrary metadata to subscriber-level authenticated users through an AJAX endpoint that lacks any authorization check. Any account with the lowest default WordPress role - subscriber - can query user, post, and term metadata site-wide, including sensitive data belonging to administrator accounts. Publicly available exploit code documented by WPScan lowers the practical barrier to exploitation; patch version 2.3.4 is available and should be applied immediately.
Incorrect authorization in the Cookie Consent WordPress plugin (versions before 0.0.10) allows any authenticated user - including low-privilege roles such as subscribers - to overwrite the plugin's stored geolocation service license key via a REST API route that fails its intended administrator-only capability check and falls back to a weaker authentication-only gate. The practical consequence is silent disruption of geolocation-based consent banner targeting, which can undermine GDPR and regional cookie-consent compliance workflows. Publicly available exploit code exists (no confirmed CISA KEV listing), and an EPSS score of 17% indicates above-average real-world exploitation interest relative to this severity class.
User Access Manager WordPress plugin before version 2.3.15 exposes restricted content to unauthenticated attackers via the WordPress REST API, which the plugin fails to protect with its own access control logic. Any post, page, or custom post type configured to be visible only to specific user groups can be silently read through standard REST API endpoints without credentials. A publicly available proof-of-concept exists (WPScan), and with an EPSS of 15% and automatable exploitation, this is a realistic risk for any WordPress site using this plugin to gate premium or sensitive content.
Reflected Cross-Site Scripting in the WP Photo Album Plus WordPress plugin (all versions before 9.2.07.002) allows unauthenticated attackers to inject arbitrary JavaScript into a victim's browser by reflecting an unsanitized parameter directly into an inline script block on gallery pages. Exploitation requires social engineering - the victim must open a crafted link - but no attacker credentials are needed. A publicly available proof-of-concept exists, reported by WPScan, and EPSS places exploitation probability at 17%, a notably elevated figure for a reflected XSS in a plugin.