Unknown
Monthly
Unauthenticated IDOR in WP Travel Engine WordPress plugin before 6.8.5 exposes all customer booking records and stored billing information to any unauthenticated attacker who supplies a valid booking identifier to an unprotected cart action. The root cause is a complete absence of authorization and ownership checks - the plugin accepts a caller-supplied booking ID and processes it without verifying the requestor's identity or entitlement. Beyond disclosure, attackers can overwrite any customer's booking record with their own data, enabling fraud, booking manipulation, or data corruption at travel agencies. A publicly available proof-of-concept exists, and at 15% EPSS this vulnerability is elevated for its CVSS 5.3 rating - warranting prompt attention.
Stored cross-site scripting in the Welcart e-Commerce WordPress plugin (all versions before 2.11.34) allows any authenticated user holding the Author role or above to permanently inject malicious JavaScript into product pages, executing in every subsequent visitor's browser. A publicly available proof-of-concept exploit exists and the EPSS score of 16% reflects above-average exploitation probability for a medium-severity plugin flaw. The vendor has released a fix in version 2.11.34, and patching is the primary recommended action.
Broken authorization in the Cookie Consent WordPress plugin before 0.0.10 allows any authenticated user - including a subscriber - to invoke administrator-intended REST API endpoints that control consent settings. Affected sites on the vendor's paid plan face an additional confidentiality exposure: the same misconfigured routes permit low-privileged users to read stored visitor consent logs, data that may carry GDPR compliance significance. A publicly available exploit exists, and an EPSS of 18% signals meaningful near-term exploitation probability despite the moderate CVSS score.
Stored XSS in the Patterns Kit WordPress plugin (versions through 1.0.3) enables any Contributor-level user to inject a JavaScript payload into an unescaped link attribute, which a client-side script inserts directly into the DOM. Victim browsers execute the payload when a user views the content and clicks the affected element, with the CVSS scope change (S:C) confirming the attack crosses from the WordPress application into the victim browser context. No vendor-released patch has been identified at time of analysis; a public proof-of-concept is available and the 16% EPSS score indicates above-average real-world exploitation probability for this severity class.
WP Crowdfunding WordPress plugin before version 2.2.1 allows any subscriber-level authenticated user to create crowdfunding campaign posts by exploiting a missing capability check in an AJAX action endpoint. The plugin fails to verify whether the requesting user holds the campaign-submission permission, allowing low-privilege WordPress roles to perform actions reserved for higher-privileged users. A publicly available exploit exists via WPScan, and an elevated EPSS of 14% signals meaningful real-world exploitation interest despite no CISA KEV listing.
Insecure Direct Object Reference in WP Crowdfunding (WordPress plugin, all versions before 2.2.1) allows any authenticated user with Subscriber-level access to read personal data from arbitrary WooCommerce orders and enumerate the store's complete order history. The flaw stems from missing order ownership verification, meaning low-privilege accounts - freely obtainable on sites with open registration - can harvest customer PII at scale. A publicly available exploit documented by WPScan exists, and the 14% EPSS score indicates meaningful real-world exploitation interest beyond what the mid-range CVSS score alone suggests.
Broken object-level authorization in the WP Crowdfunding WordPress plugin before 2.2.1 allows any authenticated user - including low-privilege Subscribers - to modify the update history of campaigns they do not own and trigger notification emails to that campaign's backers. The vulnerability stems from missing ownership verification on campaign update endpoints, enabling horizontal privilege escalation across all campaigns on the affected site. A publicly available proof-of-concept exists (reported by WPScan), and the EPSS score of 14% is notably elevated relative to most WordPress plugin flaws, warranting prompt patching on sites hosting active crowdfunding campaigns.
Insecure Direct Object Reference (IDOR) in KiviCare WordPress plugin before 4.5.2 allows any authenticated patient-level user to retrieve bills, invoices, and appointment records belonging to other patients without authorization. The plugin fails to verify record ownership server-side, meaning a low-privilege patient account is sufficient to enumerate and access sensitive healthcare and financial records of arbitrary other patients. A publicly available proof-of-concept exists via WPScan, and the EPSS score of 14% indicates meaningful near-term exploitation probability.
Eventin WordPress plugin versions from 4.1.9 through 4.1.19 exposes customer order records - including personal information - to any contributor-level or higher WordPress user via an Insecure Direct Object Reference (IDOR) flaw. Authenticated users can enumerate order identifiers sequentially to read arbitrary customers' purchase data without authorization. A public proof-of-concept is available via WPScan, and an EPSS score of 14% places this notably above the median for WordPress plugin vulnerabilities, indicating active interest from threat actors even without a CISA KEV listing.
Eventin WordPress plugin versions before 4.1.20 exposes stored customer records - including names and email addresses - to any authenticated WordPress user holding contributor-level access or higher, due to missing server-side capability checks on customer data retrieval. A publicly available proof-of-concept exploit exists per the WPScan advisory, and an EPSS score of 15% places exploitation probability well above the median for medium-severity CVEs. The vendor-released patch (version 4.1.20) resolves the access control gap; no active exploitation is confirmed in the CISA KEV catalog at time of analysis.
Unauthorized access to paid course content in LearnPress WordPress plugin (all versions before 4.4.4) allows any authenticated user - including low-privilege subscribers - to retrieve lesson material from courses they have not purchased or enrolled in. The flaw resides in the plugin's AI-assistant feature, which processes lesson content requests without first verifying the requesting user's enrollment status, exposing an authorization bypass at the content-serving layer. With a publicly available proof-of-concept from WPScan and a 15% EPSS score, this is a realistic and low-barrier threat to any WordPress e-learning deployment running an affected version.
Duplicate Post WordPress plugin before version 1.5.5 contains an IDOR flaw (CWE-639) in its bulk copy and delete operations that enables authenticated users with plugin-level access to permanently delete arbitrary posts across the entire site, including content owned by other users. The missing per-object authorization check means that any WordPress user role an administrator has configured to use the plugin can bypass ownership boundaries and destroy content they did not create. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.13% (3rd percentile) and absence from CISA KEV indicate no confirmed widespread exploitation at time of analysis.
Server-Side Request Forgery in the All-in-One Video Gallery WordPress plugin (all versions prior to 4.9.2) allows low-privileged WordPress users to weaponize the server as an HTTP proxy by abusing the public ?vdl=<post_id> download handler, which fetches and streams back the URL stored in a post's mp4 metadata field without destination validation. Attackers who can set that meta value can redirect server-side requests to internal network resources, cloud instance metadata endpoints, or RFC-1918 address space, with the full HTTP response returned to the attacker. No confirmed active exploitation (CISA KEV) at time of analysis, but a publicly available proof-of-concept exploit reported by WPScan exists; EPSS is low at 0.13% (3rd percentile), suggesting exploitation remains targeted rather than widespread.
Sensitive information exposure in the Advanced Classifieds & Directory Pro WordPress plugin (versions through 3.4.2) allows unauthenticated remote attackers to retrieve custom field listing data via the publicly accessible AJAX action `acadp_public_custom_fields_listings`, bypassing WordPress authentication entirely. A publicly available proof-of-concept has been published by WPScan, though EPSS places exploitation probability at the 1st percentile, suggesting limited observed exploitation to date. No CISA KEV listing exists, and a vendor-released patch is available in version 3.4.3.
Insecure Direct Object Reference (IDOR) in the FoodBoxBooker WordPress plugin before 1.0.8 allows any authenticated user - including those with only Subscriber-level access - to overwrite the profile details of any other account on the site, including administrator accounts. The plugin fails to verify that the account being modified belongs to the requesting user, enabling horizontal and vertical privilege abuse without any special configuration. A publicly available proof-of-concept exists; exploitation is not confirmed in CISA KEV but the low barrier to entry makes this a practical account-takeover risk on any affected WordPress site.
Stored cross-site scripting in the s2Member WordPress plugin (all versions before 260805) allows contributors to inject arbitrary JavaScript into post content via unescaped shortcode attributes rendered inside an inline script block. Any site visitor who opens the affected post will execute the attacker's script in their browser. A publicly available proof-of-concept exploit exists, reported by WPScan, though EPSS sits at the 5th percentile suggesting opportunistic rather than widespread active exploitation at time of analysis.
SQL injection in the vitepos WordPress plugin before version 3.6.0 enables authenticated administrators to exfiltrate database contents via a crafted REST API report request. The vulnerability stems from an unsanitized identifier taken directly from the request body and concatenated into a SQL query, a textbook CWE-89 flaw. A publicly available exploit proof-of-concept exists per WPScan, though no active exploitation is confirmed in CISA KEV and the EPSS score of 0.16% reflects the high authentication bar.
Broken Object Level Authorization in the Booking for Appointments and Events Calendar WordPress plugin (versions 9.0 through 9.6) permits any authenticated employee (provider) to read and modify the stored personal data of arbitrary customers by incrementing sequential record identifiers in the Employee Panel. The plugin fails to verify that the requesting employee has a legitimate relationship with the customer being accessed, enabling horizontal privilege escalation across all customer records. A publicly available exploit exists per WPScan, though EPSS of 0.13% (3rd percentile) suggests exploitation has remained uncommon; no CISA KEV listing has been confirmed at time of analysis.
OAuth token hijacking in the Salon Booking System WordPress plugin (through 10.30.33) allows unauthenticated remote attackers to overwrite the site's stored Google Calendar connection credentials with attacker-controlled OAuth tokens, fully hijacking the calendar integration. Exploitation requires the target site to have independently configured a Google OAuth client for the calendar sync feature, limiting the exposed population. No public exploit has reached CISA KEV status, but a publicly available proof-of-concept was published by WPScan, and EPSS remains low at 0.14% (3rd percentile), consistent with a niche plugin requiring a non-default configuration. The primary consequence is persistent integrity and availability disruption of the booking-calendar workflow, with a secondary confidentiality risk if future appointment data is synced to the attacker's Google account.
Unauthenticated price manipulation in the Salon Booking System WordPress plugin (through 10.30.33) allows any remote visitor to tamper with the stored total of arbitrary bookings by invoking unprotected booking-modification AJAX endpoints. The plugin neither restricts access to these actions nor verifies that the requesting user owns the targeted booking, creating a CWE-862 missing-authorization flaw. No public exploitation in CISA KEV has been confirmed, though a publicly available proof-of-concept exists via WPScan, and EPSS sits at just 0.14% (3rd percentile), suggesting opportunistic rather than widespread active exploitation.
Insecure Direct Object Reference (IDOR) in the Salon Booking System WordPress plugin through version 10.30.33 allows any authenticated user - including self-registered subscriber and customer accounts - to enumerate booking identifiers via a REST API endpoint and retrieve personal data belonging to any other customer, including name, email, phone number, physical address, and private appointment notes. The plugin fails to verify that the requested booking belongs to the calling user, requiring only a basic read-level WordPress capability. A publicly available proof-of-concept exists per WPScan disclosure; no active exploitation has been confirmed in CISA KEV at time of analysis.
Pinpoint Booking System WordPress plugin (all versions through 2.9.9.6.9) accepts client-supplied booking prices without any server-side validation, allowing unauthenticated visitors to create reservations at arbitrary prices including zero. By selecting a payment method that triggers instant approval, an attacker can obtain a confirmed, cost-free booking - a direct financial impact on site operators. Publicly available exploit code exists via WPScan, though EPSS at 0.14% (3rd percentile) indicates minimal observed automated exploitation at time of analysis; no CISA KEV listing is present.
Block User Account WordPress plugin before 2.0.1 fails to enforce account suspension across every authentication path, leaving blocked users able to retain their full role-level read and write access through the WordPress REST API when they hold an application password created prior to being blocked. All sites running the plugin at versions below 2.0.1 are affected. A publicly available exploit exists per WPScan reporting, though no active exploitation has been confirmed by CISA KEV, and the EPSS score of 0.17% (7th percentile) reflects limited observed real-world exploitation pressure.
Broken object-level authorization in the RSS Aggregator by Feedzy WordPress plugin before 5.2.6 allows authenticated users with author-level access or higher to perform unauthorized actions against import jobs and content they do not own. Affected actions include permanently deleting posts generated by another user's import job, resetting deduplication and scheduling state, disabling jobs, and clearing error logs. Critically, one endpoint performs no object-type check at all, enabling any sufficiently privileged authenticated user to unpublish arbitrary posts and pages site-wide regardless of ownership. A publicly available exploit exists per WPScan; no active exploitation confirmed in CISA KEV at time of analysis.
SQL injection in the Term Pages WordPress plugin (versions before 2.0.0) allows unauthenticated remote attackers to execute arbitrary SQL queries against the WordPress database by submitting a crafted request containing a malicious parameter. The vulnerability stems from missing input sanitization and output escaping prior to SQL statement construction (CWE-89). A publicly available exploit exists per WPScan, though EPSS sits at just 0.18% (7th percentile), suggesting exploitation remains limited at this time despite accessible proof-of-concept code. No CISA KEV listing has been confirmed.
MotoPress Hotel Booking WordPress plugin versions before 6.2.3 permits any authenticated subscriber-level user to modify or overwrite the personal data of arbitrary customers by supplying a chosen record identifier, with no server-side ownership verification in place. The flaw affects WordPress hospitality sites running the plugin in its standard configuration and can be triggered by any user who holds even the lowest WordPress account role - a realistic threat on sites with open guest registration. A publicly available proof-of-concept exists per WPScan, though EPSS data (0.14%, 4th percentile) indicates mass automated exploitation has not materialized; upgrading to version 6.2.3 is the confirmed fix.
Unauthorized payment record creation in MotoPress Hotel Booking WordPress plugin before 6.2.3 enables unauthenticated remote attackers to forge completed payment entries against any booking - falsely confirming reservations as paid without executing a real financial transaction. The vulnerable REST endpoint performs no authorization or ownership validation, making any booking ID on an affected site a viable target. A publicly available proof-of-concept exists per WPScan; however, EPSS remains at 0.15% (4th percentile), and no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Missing authorization on multiple AJAX settings handlers in Customer Reviews for WooCommerce (all versions before 5.116.0) allows any authenticated WordPress user - including low-privilege Subscribers - to invoke administrative settings functions, overwrite plugin configuration options, and read sensitive store configuration data. The flaw stems from absent nonce verification and WordPress capability checks on AJAX actions that should be restricted to shop administrators. A public exploit exists via WPScan, though EPSS signals low widespread opportunistic exploitation at 0.14% (4th percentile); no CISA KEV listing indicates mass exploitation has not been observed.
Server-side request forgery in the Podcast Player WordPress plugin (all versions before 8.3.1) allows unauthenticated remote attackers to force the server to issue HTTP requests to arbitrary hosts - including internal cloud metadata services, internal APIs, and private network endpoints - and read back any response that parses as RSS/XML. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero-friction exploitation requiring no credentials and no user interaction against any WordPress site running an affected plugin version. Publicly available exploit code exists per WPScan; the vulnerability is not listed in CISA KEV, and EPSS sits at 0.15% (4th percentile), indicating limited observed exploitation to date despite the public POC.
Stored XSS in the Advanced Excerpt WordPress plugin before 4.5 permits administrators - critically including those without the `unfiltered_html` capability, such as site-level admins in WordPress multisite deployments - to inject persistent JavaScript payloads via unsanitized plugin settings, which then execute silently in every visitor's browser on affected pages. A publicly available proof-of-concept exists per WPScan's disclosure (EUVD-2026-55021), though EPSS remains very low at 0.16% (6th percentile) and the vulnerability is not confirmed in CISA KEV. The primary risk surface is WordPress multisite environments, where this plugin's settings bypass the platform-level capability restriction that normally prevents restricted admins from injecting raw HTML.
LearnPress WordPress plugin before version 4.4.4 exposes a blind, bounded server-side request forgery (SSRF) exploitable by users holding the instructor role, allowing the WordPress server to issue HTTP requests to arbitrary external hosts chosen by the attacker. Reported by WPScan and tracked under CWE-918, the flaw stems from absent URL validation on a user-controllable input. A public proof-of-concept exists; however, EPSS at 0.14% (4th percentile) and the absence of a CISA KEV listing indicate negligible observed exploitation activity, consistent with the high-privilege requirement.
Broken object-level authorization in the CubeWP Framework WordPress plugin through version 1.1.30 exposes arbitrary post and user metadata via an unprotected REST API endpoint. Any authenticated user with the Contributor role or higher can request metadata from posts they do not own - including draft, pending, private, and password-protected content - as well as metadata belonging to any user account, including site administrators. A publicly available exploit has been disclosed by WPScan, though EPSS signals (0.13%, 3rd percentile) indicate real-world exploitation remains limited at time of analysis.
Stored XSS in the Saitama Addon Pack WordPress plugin (≤ 1.0.8) lets contributor-level users inject persistent JavaScript into post metadata fields that have no sanitization or escaping applied before output. When a higher-privileged user - editor or administrator - opens the affected content for review, the payload executes in their browser session. A public exploit is available via WPScan; no active exploitation is recorded in CISA KEV, and EPSS sits at the 6th percentile, consistent with targeted rather than opportunistic abuse.
Payment amount validation bypass in the Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin (all versions through 3.1.0) enables any customer to complete a purchase by paying less than the full order total, with the order subsequently marked as fully paid by the merchant system. The flaw lies in the PayPal Data Transfer (PDT) return handler, which processes the post-payment callback without performing server-side reconciliation of the amount actually transferred against the stored order total. A publicly available exploit is documented by WPScan, though EPSS at 0.14% indicates exploitation has not yet scaled to widespread automated abuse; the real risk is deliberate buyer fraud rather than opportunistic scanning.
Payment verification bypass in the Accept PayPal & Stripe with Subscriptions for WooCommerce plugin (through version 3.1.0) lets unauthenticated shoppers complete WooCommerce orders without paying the merchant a single cent. The plugin fails to validate that the PayPal account receiving the payment matches the merchant's configured account, so an attacker can pay the full order amount to their own PayPal account and the plugin will still mark the order as paid and fulfilled. A publicly available proof-of-concept exists, per WPScan, and EPSS is low (0.14%), indicating no widespread automated exploitation at time of analysis.
SQL injection in the Library Management System WordPress plugin (all versions before 3.6.7) allows any user holding a Subscriber role or higher to inject arbitrary SQL into the underlying WordPress database, extracting sensitive records including user password hashes. A publicly available proof-of-concept exploit is confirmed via WPScan. No CISA KEV listing exists and EPSS sits at 0.17% (6th percentile), indicating limited observed automated exploitation, but the low privilege bar and public POC make this a meaningful and urgent patching priority for any affected site.
Stored Cross-Site Scripting in the JetEngine WordPress plugin (all versions before 3.8.13.1) allows unauthenticated remote attackers to upload SVG files containing arbitrary JavaScript, which then executes persistently in the browser of any user who views the file. The plugin neither sanitizes SVG content on upload nor restricts the upload endpoint to authenticated users, making the attack fully unauthenticated. A publicly available proof-of-concept exists per WPScan, though EPSS of 0.17% (7th percentile) and absence from CISA KEV suggest exploitation remains targeted rather than widespread at this time.
Path traversal in the AI Engine WordPress plugin before 3.6.6 allows server-side file contents to be read and exfiltrated to an external AI service without path sanitization. When the plugin's public API feature is enabled (a non-default setting), subscriber-level users can trigger this; otherwise the same flaw is accessible to WordPress administrators - and on multisite installations, a non-super subsite administrator can exploit it to read network-wide configuration files and extract embedded secrets such as database credentials and API keys. A publicly available proof-of-concept exists per WPScan; EPSS sits at 0.16% (5th percentile), indicating limited opportunistic scanning activity to date but no confirmed mass exploitation.
Unauthorized file deletion in AI Engine WordPress plugin (before 3.6.4) allows a network attacker who has obtained a guest user's session cookie and file reference to delete that guest's uploaded chatbot files without any server-side ownership check. The plugin authorizes deletion actions solely on a client-supplied session value, making it vulnerable to CWE-639 (Authorization Bypass Through User-Controlled Key). A publicly available proof-of-concept exists per WPScan, though EPSS at 0.14% (3rd percentile) indicates exploitation has not yet been observed at scale.
Download Monitor WordPress plugin versions before 5.2.6 fails to enforce authorization on an AJAX download-logging endpoint and simultaneously leaks the nonce that would normally gatekeep it to unauthenticated visitors, enabling arbitrary log injection. Any unauthenticated remote attacker can inject fabricated entries into the plugin's download log to artificially inflate a site's download statistics. Publicly available exploit code exists per WPScan reporting; however, with no CISA KEV listing and an EPSS of 0.14% (3rd percentile), real-world exploitation appears limited to opportunistic or targeted campaigns rather than widespread active abuse.
WP Directory Kit WordPress plugin before version 1.5.5 exposes sensitive site data to any authenticated user due to missing authorization and nonce validation on an AJAX endpoint. Any subscriber-level account holder can trigger the vulnerable action to enumerate the full WordPress user list and access unpublished directory listings belonging to other users - data that should be restricted to privileged roles. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.14% (4th percentile), suggesting exploitation has not yet become widespread despite the low barrier to abuse.
Unauthorized data exposure in the WP Directory Kit WordPress plugin (all versions before 1.5.5) allows any authenticated user - including low-privilege Subscribers - to retrieve stored contact messages and associated personal data belonging to other users by invoking an unprotected AJAX endpoint. The root cause is the complete absence of WordPress authorization checks and nonce verification on an authenticated AJAX action, meaning the plugin performs no ownership or permission validation before returning sensitive inter-user data. A publicly available proof-of-concept has been published by WPScan; however, EPSS sits at just 0.14% (4th percentile) and no CISA KEV listing exists, indicating low observed exploitation activity at time of analysis despite the public PoC.
Dokan's WooCommerce multivendor marketplace WordPress plugin (versions before 5.0.11) exposes a broken object-level authorization flaw in one of its order REST API endpoints, enabling any authenticated vendor to grant their own customers free download access to paid downloadable files belonging to other vendors without the file owner's consent. Publicly available exploit code exists for this issue, reported by WPScan. Despite a CVSS score of 5.4 (Medium) and confirmed POC availability, the EPSS probability of 0.13% (3rd percentile) indicates that widespread automated exploitation is not currently observed, though the business impact - unauthorized file distribution and revenue theft across a multivendor marketplace - is directly harmful to affected platform operators.
Visitor analytics data exposure in WP Statistics WordPress plugin versions before 14.16.10 allows any authenticated WordPress user - including those with only Subscriber-level access - to invoke dashboard analytics AJAX handlers and retrieve the site's full visitor metrics without authorization. The plugin's AJAX handlers validate a WordPress nonce but omit the required capability check, and because WordPress issues valid nonces to all authenticated users regardless of role, this effectively grants analytics read access to anyone with a site account. Publicly available exploit code exists per WPScan reporting, though no active exploitation is confirmed in the CISA KEV catalog and EPSS remains at 0.14% (4th percentile), indicating limited observed mass exploitation to date.
Stored cross-site scripting in the YMC Filter WordPress plugin (all versions before 3.12.9) allows Author-role users to upload malicious SVG files whose embedded JavaScript executes in the browsers of any site user - including administrators - who views the file. A publicly available proof-of-concept exploit exists via WPScan, lowering the skill bar significantly for attackers who already hold an Author-level account. The EPSS score of 0.15% (5th percentile) indicates negligible automated exploitation activity, placing real-world risk primarily in multi-author WordPress environments where untrusted contributors hold Author-level access.
Stored cross-site scripting in the YMC Filter WordPress plugin (versions 3.6.0 through 3.12.7) enables any Contributor-level authenticated user to persistently inject arbitrary JavaScript into layout builder settings, which then executes in every site visitor's browser via an unsanitized public endpoint. The plugin compounds the flaw by failing to verify object ownership when saving layout settings, meaning low-privilege users can overwrite settings they do not control. A public proof-of-concept is available via WPScan; the vulnerability is patched in version 3.12.8.
Reflected XSS in the Link Library WordPress plugin before 7.9.4 allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into visiting a crafted URL containing an unsanitized parameter. The CVSS scope is Changed (S:C), meaning attacker-controlled script runs in the victim's browsing context, enabling session theft or privilege escalation against logged-in WordPress users. No public exploit identified at time of analysis is contradicted here - a publicly available exploit code exists per WPScan, though EPSS of 0.17% (7th percentile) indicates limited observed exploitation at time of analysis and no CISA KEV listing exists.
Price manipulation in the Appointment Hour Booking WordPress plugin (all versions before 1.5.88) allows any unauthenticated visitor to submit a crafted booking request with an attacker-controlled price - including zero or negative amounts - that the server accepts without validation and stores as authoritative, corrupting both booking and payment records. A publicly available proof-of-concept has been disclosed via WPScan, though the EPSS score of 0.14% (3rd percentile) indicates minimal observed exploitation at this time. Vendor-released patch version 1.5.88 is available and resolves the missing server-side price validation.
Authentication bypass in the Newsletters WordPress plugin (all versions before 4.16) allows remote unauthenticated attackers to gain privileged API access via PHP type juggling against a non-strict key comparison. Exploitation is conditional on the plugin's optional API being enabled, but when active, attackers can modify subscriber records and send bulk emails without any credentials. A publicly available proof-of-concept is documented by WPScan; EPSS at 0.19% (9th percentile) suggests limited automated exploitation to date, and no CISA KEV listing has been issued.
CAPTCHA bypass in the Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before 1.42.0 allows unauthenticated network attackers to defeat anti-abuse protections on Forminator-integrated forms by exploiting a flawed validation cache keying mechanism. After solving a single legitimate Turnstile challenge, an attacker can replay token-less form submissions during the validation cache window because the cache is bound to an attacker-controlled, reusable request value rather than the one-time challenge token. A publicly available proof-of-concept exists (WPScan); this vulnerability is not currently listed in CISA KEV, and no EPSS score was provided in source data.
Payment integrity bypass in the Subscriptions for WooCommerce plugin (versions before 2.0.1) enables financial fraud by allowing substitution of an arbitrary approved PayPal order token during the WooCommerce order-received flow. The plugin captures a client-supplied token and marks any order paid solely based on a COMPLETED capture status, without verifying that the captured amount matches the order total or that the token belongs to the specific order. Unauthenticated attackers - where guest checkout is enabled - can exploit this to obtain goods or subscription access without paying the actual order price. A publicly available proof-of-concept exists; no CISA KEV listing at time of analysis.
WP Events Manager for WordPress (all versions before 2.2.5) exposes a payment notification endpoint that accepts fraudulent booking-paid confirmations from unauthenticated attackers. The plugin neither validates that an incoming payment callback originates from the configured merchant nor that the notified amount matches the booking total, enabling any remote actor to mark arbitrary bookings - including other users' bookings - as fully paid without money reaching the merchant. A publicly available exploit exists; the vulnerability is not currently listed in CISA KEV, but the AV:N/AC:L/PR:N/UI:N attack profile means exploitation requires zero privileges and trivial effort.
Denial of Service in the WP Maps WordPress plugin before 4.9.7 allows any authenticated subscriber to exhaust server resources by exploiting a missing capability check in an AJAX action handler. The flaw, discovered and reported by WPScan, permits a low-privileged user to invoke an unrestricted operation that triggers uncontrolled recursion, potentially rendering the affected WordPress site unavailable. A publicly available proof-of-concept exists, though EPSS remains low (0.14%) and CISA has not listed this in KEV, suggesting exploitation is currently opportunistic rather than widespread.
Broken Object Level Authorization in MStore API WordPress plugin (all versions before 4.21.0) exposes every WooCommerce order and associated customer PII to any authenticated WordPress user, including low-privileged Subscribers. The vendor-orders endpoint performs no caller-scoping check, meaning a Subscriber can enumerate the entire store's order history. Publicly available exploit code exists per WPScan, though EPSS at 0.13% (3rd percentile) indicates exploitation has not become widespread at time of analysis; no CISA KEV listing confirms active exploitation.
Stored cross-site scripting in Meow Gallery WordPress plugin (all versions before 5.5.2) allows any WordPress user holding the Author role or higher to persist a JavaScript payload via unsanitized attachment alt text in linked gallery anchor attributes. Any visitor - including site administrators - who subsequently loads a post containing the affected gallery executes the injected script, enabling session hijacking, credential theft, or malicious redirects. A publicly available proof-of-concept exists per WPScan; EPSS at 0.15% reflects low automated exploitation probability, though the threat to sites with multiple or untrusted author accounts is concrete.
Unauthenticated cloud credential hijacking in the Templately WordPress plugin (all versions before 3.7.1) allows any remote attacker to overwrite the site administrator's stored cloud service connection with an account under their control. This severs the legitimate administrator's access to the cloud template library and redirects the site's template source to attacker-controlled infrastructure, enabling supply-chain-style content injection against the WordPress admin. A publicly available proof-of-concept exists per WPScan, though EPSS remains very low (0.14%, 3rd percentile), and no CISA KEV listing confirms active widespread exploitation at time of analysis.
Stored cross-site scripting in BNE Testimonials WordPress plugin (all versions before 2.0.8.2) allows contributor-level authenticated users to inject arbitrary JavaScript into an inline script block via an unescaped shortcode attribute. The payload persists in published content and executes in the browser of any visitor who views the affected page, including administrators. A public proof-of-concept is documented by WPScan; however, the vulnerability is not listed in CISA KEV and EPSS sits at the 5th percentile, indicating low automated exploitation probability.
Insecure Direct Object Reference (IDOR) in the Subscriptions for WooCommerce WordPress plugin before 2.0.1 allows any authenticated customer to read subscription records belonging to other customers by supplying an arbitrary subscription ID. The plugin fails to enforce ownership checks before returning subscription details - subscribed product, status, and date fields - exposing sensitive order metadata across tenant boundaries. A publicly available proof-of-concept exists per WPScan, but with an EPSS of 0.13% (3rd percentile) and no CISA KEV listing, mass exploitation is not currently observed.
Stored Cross-Site Scripting in the Comments WordPress plugin (all versions before 7.6.60) permits unauthenticated attackers to permanently inject malicious JavaScript into the site database by submitting a crafted URL that the plugin fails to escape before rendering inside an HTML attribute. Any authenticated user - including site administrators - who subsequently views the affected content triggers payload execution in their browser, potentially enabling session hijacking and full site takeover. A publicly available exploit is referenced via WPScan, though EPSS at 0.17% (7th percentile) indicates low observed exploitation volume at time of analysis, and the vulnerability is not listed in CISA KEV.
Reflected XSS in the Subscribe2 WordPress plugin (versions before 10.46) allows an unauthenticated attacker to inject arbitrary JavaScript into a public subscription form by luring a visitor to a crafted link. Exploitation requires the victim to interact with the malicious URL - no server-side authentication is needed - enabling session theft, credential harvesting, or DOM-based actions scoped to the victim's browser. A publicly available proof-of-concept exists per WPScan; EPSS at 0.16% (5th percentile) indicates limited automated exploitation despite the low attack complexity.
RealHomes Memberships WordPress plugin before 3.1.0 permits any authenticated user - including low-privilege Subscribers - to claim paid membership packages for free by exploiting missing payment verification, absent nonce validation, and no capability checks on the membership grant endpoint. The business impact is direct financial loss for site operators running paid real estate membership tiers. No active exploitation has been confirmed by CISA KEV, but a public exploit is available via WPScan, lowering the barrier for abuse.
Cross-site request forgery in the Google Authenticator WordPress plugin before version 0.56 allows an unauthenticated attacker to overwrite a logged-in user's TOTP secret by tricking them into loading a malicious page. The forged request silently replaces the victim's two-factor secret with one the attacker controls, enabling the attacker to generate valid OTPs and lock the legitimate account owner out. A public proof-of-concept is available via WPScan; no active exploitation is confirmed in CISA KEV, and EPSS of 0.11% (2nd percentile) aligns with SSVC's 'not automatable' designation.
Missing capability check in the SEO Redirection Plugin for WordPress (versions before 9.19) exposes authenticated AJAX endpoints to any logged-in user, regardless of role. A subscriber-level account - the lowest WordPress user tier - can invoke the unprotected action to enumerate all configured 301 redirect rules, revealing source and destination URLs that may disclose internal site architecture, campaign tracking patterns, or sensitive path structures. No public exploitation in the wild has been confirmed by CISA KEV, but a proof-of-concept is publicly available per WPScan, raising the probability of opportunistic abuse against unpatched sites.
Stored Cross-Site Scripting in the Nexter Blocks WordPress plugin before 5.0.2 allows any authenticated user with file upload capability (Author role by default) to upload a malicious SVG file containing embedded JavaScript that executes in any victim's browser upon accessing the file. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.15% (5th percentile) and absence from CISA KEV indicate low observed exploitation to date. The NVD-assigned CVSS PR:N conflicts with the description's clear authentication requirement - defenders should treat this as an authenticated vulnerability, which meaningfully narrows real-world exposure.
Stored Cross-Site Scripting in the Slick Slider WordPress plugin before 0.5.3 allows any authenticated user holding the Contributor role or higher to inject persistent JavaScript through an unsanitized shortcode attribute value that is rendered directly into an HTML attribute. The payload executes in the browser of any user - including administrators - who subsequently views the affected post, enabling session hijacking, credential theft, or privilege escalation. A publicly available proof-of-concept exploit exists and a vendor patch (version 0.5.3) has been released; no active exploitation has been confirmed by CISA KEV at time of analysis.
Stored Cross-Site Scripting in the Child Pages Card WordPress plugin (all versions before 1.09) allows contributors and higher-privileged authenticated users to inject persistent JavaScript payloads via unsanitized shortcode attributes. When an administrator or other privileged user views a page containing the malicious shortcode, the injected script executes in their browser, enabling session hijacking or unauthorized privileged actions. A public exploit is available via WPScan; no confirmed active exploitation (CISA KEV) has been observed, though the public PoC meaningfully lowers the barrier to abuse.
SQL injection in the Welcart e-Commerce WordPress plugin (all versions before 2.11.32) enables authenticated users holding at minimum the Editor role - or Welcart's custom shop-management roles - to execute arbitrary SQL against the underlying WordPress database by supplying a crafted CSV file through the plugin's import feature. A publicly available proof-of-concept exploit exists (reported by WPScan), meaningfully lowering the bar for abuse by any account with sufficient role access. No active exploitation is confirmed in CISA KEV at time of analysis, but the combination of a public POC and high database impact (confidentiality and integrity both rated High) makes patching urgent for multi-editor or multi-manager WordPress deployments.
Stored XSS with privilege bypass in the EONSR AEO Agent WordPress plugin (versions through 3.7.9) allows unauthenticated remote attackers to inject persistent arbitrary JavaScript into published posts, attributed to administrators, that executes in the browser of any site visitor including administrators. The REST API route responsible for post creation performs no authorization check and explicitly disables HTML sanitization before saving content, making this a trivially exploitable unauthenticated write-then-persist attack chain. A publicly available exploit has been published by WPScan; no active exploitation has been confirmed in CISA KEV at time of analysis.
Cleartext exposure of third-party API keys and authentication tokens in AI Engine WordPress plugin (before 3.6.4) allows Editor-role users to read secrets that are intended to be administrator-only. The plugin inlines sensitive configuration values into admin page JavaScript without redaction, making them readable to any authenticated user with Editor access who inspects the page source. A public proof-of-concept exists per WPScan, though EPSS remains low at 0.17% (7th percentile) and the vulnerability is not in the CISA KEV catalog.
ProfileGrid WordPress plugin (all versions before 6.0.0.0) exposes group member lists and member identifiers to unauthenticated visitors due to a handler registered without any authorization checks, completely bypassing the plugin's member-visibility settings for private and closed groups. Any unauthenticated visitor who can reach the WordPress site can enumerate group members and their identifiers across all group types, including those the site owner intended to restrict. A publicly available exploit exists per WPScan, and the SSVC classification flags this as automatable - though EPSS at 0.14% (4th percentile) indicates exploitation has not become widespread despite the low barrier to entry.
Open email relay in the Estatik Real Estate Plugin for WordPress (before 4.3.3) allows unauthenticated remote attackers to send arbitrary emails through any affected WordPress site by submitting crafted property inquiry form requests with controlled recipient address, subject, body, and Reply-To header. The plugin's anti-spam check is trivially bypassed and provides no constraint on recipient routing, effectively turning victim sites into spam or phishing infrastructure. A publicly available exploit exists per WPScan; EPSS sits at 0.14% (3rd percentile) and CISA KEV does not list active exploitation, suggesting limited but plausible abuse given SSVC confirms the attack is automatable.
tourmaster WordPress plugin (all versions before 5.4.9) exposes exported customer booking and order data via a fixed, predictable file path inside its publicly accessible web directory, with no authentication or access control enforcing download restrictions. Any unauthenticated network attacker who knows or can derive the static export file URL can retrieve personally identifiable information - names, contact details, and booking records - after an administrator has triggered an export. A publicly available proof-of-concept exists per WPScan, and exploitation is fully automatable (SSVC), though EPSS sits at 0.14% and no CISA KEV listing exists at time of analysis.
Unauthorized retrieval of other customers' payment receipt images is possible in PeproDev WooCommerce Receipt Uploader (≤ 2.8.0) because the plugin's token-based attachment access mechanism never validates that a requested attachment ID belongs to the order the token was issued for. Unauthenticated network attackers can forge or repurpose a token - trivially obtained by placing any order - to iterate over attachment IDs and exfiltrate payment receipts uploaded by unrelated customers, potentially exposing financial documents containing banking details or PII. A publicly available proof-of-concept exists per WPScan reporting (EUVD-2026-53719); no CISA KEV listing indicates widespread active exploitation has not been confirmed, though SSVC rates the attack as automatable.
Unauthenticated IDOR write in PeproDev WooCommerce Receipt Uploader (all versions ≤ 2.8.0) allows any remote attacker to submit or manipulate receipt uploads without credentials or authorization checks, bypassing the WordPress nonce and capability verification that WooCommerce plugins are expected to enforce. The plugin remains unpatched as of the time of writing, and a publicly available proof-of-concept exploit exists via WPScan. Despite automation potential (SSVC: Automatable yes), EPSS sits at 0.10% (1st percentile) and CISA has not listed this in KEV, indicating limited observed real-world exploitation to date.
Unauthorized information disclosure in the MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin (all versions before 7.0.4) exposes import log files and import-related post metadata to any authenticated user, including low-privilege subscribers. The flaw stems from a missing authorization and CSRF check on an AJAX action, meaning any logged-in WordPress user on an affected site can invoke the endpoint and read sensitive operational data. A publicly available proof-of-concept exists (reported by WPScan), though EPSS places exploitation probability at 0.10% and SSVC confirms no known active exploitation at time of analysis.
Stored Cross-Site Scripting in GeoDirectory WordPress plugin before 2.8.110 allows authenticated editors and higher-privileged users to persist malicious JavaScript via the place-category setting, which is rendered unsanitized on admin pages. The vulnerability is specifically significant in WordPress multisite deployments where the unfiltered_html capability is intentionally revoked for editors, as it bypasses that restriction through the plugin's own inadequate output handling. A public proof-of-concept exists via WPScan, though EPSS at 0.16% (6th percentile) and SSVC exploitation status of 'none' indicate no confirmed active exploitation at time of analysis.
Unauthenticated information disclosure in DHL Shipping Germany for WooCommerce (versions before 4.0.1) exposes stored shipping labels - each containing customer name and postal address - to any visitor who can request predictable filenames from the label storage directory. The plugin relies exclusively on an Apache .htaccess file for directory access control, which nginx and other non-Apache web servers silently ignore, leaving the directory fully browsable over the network. A publicly available exploit exists (via WPScan), though EPSS of 0.14% at the 4th percentile indicates low observed exploitation activity, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated IDOR in the DHL Shipping Germany for WooCommerce WordPress plugin (versions before 4.0.1) exposes every generated shipping label to any internet visitor. The plugin's label-download endpoint performs no authorization check whatsoever - no capability check, nonce, login requirement, or order-ownership verification - and labels are indexed by predictable sequential IDs, enabling trivial full enumeration. A publicly available exploit exists; successful exploitation leaks customer full names, complete postal addresses, and order references at scale, carrying significant GDPR implications for any German e-commerce operator running the affected plugin.
Information disclosure in the GeoDirectory WordPress plugin (before 2.8.168) exposes the email addresses of all registered users - including site administrators - to any authenticated Contributor-level or higher user. The root cause is an unrestricted user-search handler that performs no authorization check against WordPress's capability system, meaning any low-privilege authenticated user can invoke it freely. Publicly available exploit code exists per WPScan, though EPSS at 0.14% (4th percentile) and absence from CISA KEV suggest opportunistic exploitation remains limited at time of analysis.
Stored XSS in the WP Custom HTML Page WordPress plugin (≤0.6.2) enables users with the Author role to persist arbitrary JavaScript via an unsanitized custom page handler, which then executes for every visitor - including administrators - at a publicly accessible URL. The plugin fails both to sanitize HTML input and to enforce WordPress's native unfiltered_html capability restriction, effectively granting Author-level users a privilege they should not have. A publicly available exploit is documented by WPScan; EPSS (0.15%, 5th percentile) indicates no observed widespread opportunistic exploitation, though the public-URL delivery mechanism means admin-targeted attacks require no active phishing.
Insecure Direct Object Reference (IDOR) in the MultiVendorX WordPress plugin before 5.0.11 exposes confidential financial and commission data across vendor accounts. Any authenticated vendor-level user can query a REST API endpoint using an arbitrary store identifier to retrieve another vendor's earnings and commission records, bypassing per-store ownership validation entirely. No active exploitation is confirmed in CISA KEV, but a publicly available exploit exists per WPScan, and the low EPSS score (0.14%, 4th percentile) suggests limited opportunistic scanning activity at this time.
Cross-site request forgery in the GDPR Cookie Compliance WordPress plugin before 5.1.0 allows an unauthenticated attacker to forcibly expire and delete any visitor's session cookies by luring them to a crafted link. The plugin exposes a cookie-expiration action that performs no nonce or request-origin validation, meaning a single malicious URL can silently trigger it in any logged-in user's browser context. Exploitation logs the targeted user out of the WordPress site. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.12% (2nd percentile) indicates exploitation remains rare in the wild; this is not in CISA KEV.
Stored XSS in the Orbit Fox WordPress plugin (versions before 3.0.8) allows authenticated users holding at least the Author role to upload malicious SVG files containing arbitrary JavaScript, which then executes in the browser context of any visitor who views the file - including administrators. The vulnerability is gated on the plugin's optional SVG upload feature being enabled. A public proof-of-concept is available via WPScan; CISA KEV listing is not confirmed, and EPSS sits at a low 0.17% (7th percentile), indicating limited automated campaign targeting at time of analysis. Vendor-released patch version 3.0.8 is available.
Unrestricted file upload in the Chat Widget WordPress plugin before 1.8.2 allows any network-reachable user to submit arbitrary files to the plugin's public response endpoint, bypassing all validation of type, extension, content, and size. Uploaded files are stored in the WordPress uploads directory under bare UUIDs - stripping the original extension - which explicitly prevents code execution or stored XSS despite the CWE-434 classification. Real-world impact is bounded to disk exhaustion and abuse of the hosting environment to serve attacker-controlled static content, conditional on the channel's response storage or mail-forwarding feature being configured. No public exploit identified via CISA KEV; however, a proof-of-concept is publicly available per WPScan, and EPSS at 0.16% (6th percentile) signals minimal observed exploitation activity.
Broken object-level authorization in the REST API Log WordPress plugin (all versions before 1.7.1) permits unauthenticated attackers who hold any valid log-download token - regardless of which entry it was issued for - to retrieve arbitrary log entries from any other user, exposing stored credentials, authentication tokens, and private REST API payloads. The root cause is twofold: tokens are not cryptographically bound to specific log entry IDs, and the plugin performs no WordPress capability check on the requester. A public exploit PoC is referenced via WPScan, though EPSS at 0.18% and SSVC exploitation status of 'none' indicate no confirmed widespread abuse at time of analysis.
Missing authorization in the Wired Impact Volunteer Management WordPress plugin (versions before 2.8.2) allows any authenticated WordPress user with at least a Subscriber role to remove RSVPs belonging to other users from any volunteer opportunity. The vulnerability stems from an AJAX action handler that neither verifies the requesting user's authorization level nor confirms ownership of the RSVP being deleted, enabling unauthorized data manipulation across the entire volunteer management system. A publicly available proof-of-concept exists via WPScan, though EPSS sits at 0.13% (3rd percentile) and SSVC confirms no active exploitation, suggesting limited real-world attacker interest at this time.
Open redirect in Clearfy Cache WordPress plugin (versions before 2.4.3) allows unauthenticated attackers to redirect site visitors to arbitrary external URLs by exploiting the Cyrlitera old-URL redirect handler, which passes a decoded request URI to an unsafe redirect function without target validation. Exploitation requires that the non-default Cyrlitera redirect option is enabled on the target site, and a victim must interact with an attacker-crafted URL. No public KEV listing exists, EPSS sits at the 4th percentile (0.14%), but a publicly available proof-of-concept has been published by WPScan.
Clearfy Cache WordPress plugin versions before 2.4.3 exposes admin-only settings pages and their contents - including administrative nonces - to any authenticated user at Subscriber level or above due to a missing capability check on an alternate admin-page dispatch path. While the canonical admin URL enforces access controls correctly, the unguarded dispatch path bypasses those restrictions entirely. A publicly available proof-of-concept exists per WPScan reporting, though EPSS sits at 0.13% (3rd percentile), indicating low observed exploitation probability despite POC availability; no confirmed active exploitation (CISA KEV) has been recorded.
Stored Cross-Site Scripting in the PowerPress Podcasting plugin by Blubrry (WordPress) before version 11.16.11 allows any authenticated user holding the Contributor role to inject and persist arbitrary JavaScript via unsanitized Podcast Episode settings fields. The injected payload executes in the browsers of higher-privileged users - including editors and administrators - who view the affected content, enabling session hijacking, credential theft, or unauthorized administrative actions. A publicly available proof-of-concept exists per WPScan; no active exploitation is confirmed by CISA KEV, and the EPSS probability stands at a low 0.15%, suggesting opportunistic rather than widespread exploitation at this time.
Authorization bypass in the Brizy WordPress plugin before 2.8.19 permits authenticated Contributor-level users to hijack template-type metadata on templates owned by other users. The plugin validates authorization against one request parameter while executing the write operation against a different, attacker-controlled parameter - a textbook CWE-639 Insecure Direct Object Reference variant. A publicly available exploit is documented by WPScan; however, no active exploitation is confirmed via CISA KEV, and the EPSS score of 0.13% (3rd percentile) indicates negligible observed in-the-wild activity.
Unauthenticated IDOR in WP Travel Engine WordPress plugin before 6.8.5 exposes all customer booking records and stored billing information to any unauthenticated attacker who supplies a valid booking identifier to an unprotected cart action. The root cause is a complete absence of authorization and ownership checks - the plugin accepts a caller-supplied booking ID and processes it without verifying the requestor's identity or entitlement. Beyond disclosure, attackers can overwrite any customer's booking record with their own data, enabling fraud, booking manipulation, or data corruption at travel agencies. A publicly available proof-of-concept exists, and at 15% EPSS this vulnerability is elevated for its CVSS 5.3 rating - warranting prompt attention.
Stored cross-site scripting in the Welcart e-Commerce WordPress plugin (all versions before 2.11.34) allows any authenticated user holding the Author role or above to permanently inject malicious JavaScript into product pages, executing in every subsequent visitor's browser. A publicly available proof-of-concept exploit exists and the EPSS score of 16% reflects above-average exploitation probability for a medium-severity plugin flaw. The vendor has released a fix in version 2.11.34, and patching is the primary recommended action.
Broken authorization in the Cookie Consent WordPress plugin before 0.0.10 allows any authenticated user - including a subscriber - to invoke administrator-intended REST API endpoints that control consent settings. Affected sites on the vendor's paid plan face an additional confidentiality exposure: the same misconfigured routes permit low-privileged users to read stored visitor consent logs, data that may carry GDPR compliance significance. A publicly available exploit exists, and an EPSS of 18% signals meaningful near-term exploitation probability despite the moderate CVSS score.
Stored XSS in the Patterns Kit WordPress plugin (versions through 1.0.3) enables any Contributor-level user to inject a JavaScript payload into an unescaped link attribute, which a client-side script inserts directly into the DOM. Victim browsers execute the payload when a user views the content and clicks the affected element, with the CVSS scope change (S:C) confirming the attack crosses from the WordPress application into the victim browser context. No vendor-released patch has been identified at time of analysis; a public proof-of-concept is available and the 16% EPSS score indicates above-average real-world exploitation probability for this severity class.
WP Crowdfunding WordPress plugin before version 2.2.1 allows any subscriber-level authenticated user to create crowdfunding campaign posts by exploiting a missing capability check in an AJAX action endpoint. The plugin fails to verify whether the requesting user holds the campaign-submission permission, allowing low-privilege WordPress roles to perform actions reserved for higher-privileged users. A publicly available exploit exists via WPScan, and an elevated EPSS of 14% signals meaningful real-world exploitation interest despite no CISA KEV listing.
Insecure Direct Object Reference in WP Crowdfunding (WordPress plugin, all versions before 2.2.1) allows any authenticated user with Subscriber-level access to read personal data from arbitrary WooCommerce orders and enumerate the store's complete order history. The flaw stems from missing order ownership verification, meaning low-privilege accounts - freely obtainable on sites with open registration - can harvest customer PII at scale. A publicly available exploit documented by WPScan exists, and the 14% EPSS score indicates meaningful real-world exploitation interest beyond what the mid-range CVSS score alone suggests.
Broken object-level authorization in the WP Crowdfunding WordPress plugin before 2.2.1 allows any authenticated user - including low-privilege Subscribers - to modify the update history of campaigns they do not own and trigger notification emails to that campaign's backers. The vulnerability stems from missing ownership verification on campaign update endpoints, enabling horizontal privilege escalation across all campaigns on the affected site. A publicly available proof-of-concept exists (reported by WPScan), and the EPSS score of 14% is notably elevated relative to most WordPress plugin flaws, warranting prompt patching on sites hosting active crowdfunding campaigns.
Insecure Direct Object Reference (IDOR) in KiviCare WordPress plugin before 4.5.2 allows any authenticated patient-level user to retrieve bills, invoices, and appointment records belonging to other patients without authorization. The plugin fails to verify record ownership server-side, meaning a low-privilege patient account is sufficient to enumerate and access sensitive healthcare and financial records of arbitrary other patients. A publicly available proof-of-concept exists via WPScan, and the EPSS score of 14% indicates meaningful near-term exploitation probability.
Eventin WordPress plugin versions from 4.1.9 through 4.1.19 exposes customer order records - including personal information - to any contributor-level or higher WordPress user via an Insecure Direct Object Reference (IDOR) flaw. Authenticated users can enumerate order identifiers sequentially to read arbitrary customers' purchase data without authorization. A public proof-of-concept is available via WPScan, and an EPSS score of 14% places this notably above the median for WordPress plugin vulnerabilities, indicating active interest from threat actors even without a CISA KEV listing.
Eventin WordPress plugin versions before 4.1.20 exposes stored customer records - including names and email addresses - to any authenticated WordPress user holding contributor-level access or higher, due to missing server-side capability checks on customer data retrieval. A publicly available proof-of-concept exploit exists per the WPScan advisory, and an EPSS score of 15% places exploitation probability well above the median for medium-severity CVEs. The vendor-released patch (version 4.1.20) resolves the access control gap; no active exploitation is confirmed in the CISA KEV catalog at time of analysis.
Unauthorized access to paid course content in LearnPress WordPress plugin (all versions before 4.4.4) allows any authenticated user - including low-privilege subscribers - to retrieve lesson material from courses they have not purchased or enrolled in. The flaw resides in the plugin's AI-assistant feature, which processes lesson content requests without first verifying the requesting user's enrollment status, exposing an authorization bypass at the content-serving layer. With a publicly available proof-of-concept from WPScan and a 15% EPSS score, this is a realistic and low-barrier threat to any WordPress e-learning deployment running an affected version.
Duplicate Post WordPress plugin before version 1.5.5 contains an IDOR flaw (CWE-639) in its bulk copy and delete operations that enables authenticated users with plugin-level access to permanently delete arbitrary posts across the entire site, including content owned by other users. The missing per-object authorization check means that any WordPress user role an administrator has configured to use the plugin can bypass ownership boundaries and destroy content they did not create. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.13% (3rd percentile) and absence from CISA KEV indicate no confirmed widespread exploitation at time of analysis.
Server-Side Request Forgery in the All-in-One Video Gallery WordPress plugin (all versions prior to 4.9.2) allows low-privileged WordPress users to weaponize the server as an HTTP proxy by abusing the public ?vdl=<post_id> download handler, which fetches and streams back the URL stored in a post's mp4 metadata field without destination validation. Attackers who can set that meta value can redirect server-side requests to internal network resources, cloud instance metadata endpoints, or RFC-1918 address space, with the full HTTP response returned to the attacker. No confirmed active exploitation (CISA KEV) at time of analysis, but a publicly available proof-of-concept exploit reported by WPScan exists; EPSS is low at 0.13% (3rd percentile), suggesting exploitation remains targeted rather than widespread.
Sensitive information exposure in the Advanced Classifieds & Directory Pro WordPress plugin (versions through 3.4.2) allows unauthenticated remote attackers to retrieve custom field listing data via the publicly accessible AJAX action `acadp_public_custom_fields_listings`, bypassing WordPress authentication entirely. A publicly available proof-of-concept has been published by WPScan, though EPSS places exploitation probability at the 1st percentile, suggesting limited observed exploitation to date. No CISA KEV listing exists, and a vendor-released patch is available in version 3.4.3.
Insecure Direct Object Reference (IDOR) in the FoodBoxBooker WordPress plugin before 1.0.8 allows any authenticated user - including those with only Subscriber-level access - to overwrite the profile details of any other account on the site, including administrator accounts. The plugin fails to verify that the account being modified belongs to the requesting user, enabling horizontal and vertical privilege abuse without any special configuration. A publicly available proof-of-concept exists; exploitation is not confirmed in CISA KEV but the low barrier to entry makes this a practical account-takeover risk on any affected WordPress site.
Stored cross-site scripting in the s2Member WordPress plugin (all versions before 260805) allows contributors to inject arbitrary JavaScript into post content via unescaped shortcode attributes rendered inside an inline script block. Any site visitor who opens the affected post will execute the attacker's script in their browser. A publicly available proof-of-concept exploit exists, reported by WPScan, though EPSS sits at the 5th percentile suggesting opportunistic rather than widespread active exploitation at time of analysis.
SQL injection in the vitepos WordPress plugin before version 3.6.0 enables authenticated administrators to exfiltrate database contents via a crafted REST API report request. The vulnerability stems from an unsanitized identifier taken directly from the request body and concatenated into a SQL query, a textbook CWE-89 flaw. A publicly available exploit proof-of-concept exists per WPScan, though no active exploitation is confirmed in CISA KEV and the EPSS score of 0.16% reflects the high authentication bar.
Broken Object Level Authorization in the Booking for Appointments and Events Calendar WordPress plugin (versions 9.0 through 9.6) permits any authenticated employee (provider) to read and modify the stored personal data of arbitrary customers by incrementing sequential record identifiers in the Employee Panel. The plugin fails to verify that the requesting employee has a legitimate relationship with the customer being accessed, enabling horizontal privilege escalation across all customer records. A publicly available exploit exists per WPScan, though EPSS of 0.13% (3rd percentile) suggests exploitation has remained uncommon; no CISA KEV listing has been confirmed at time of analysis.
OAuth token hijacking in the Salon Booking System WordPress plugin (through 10.30.33) allows unauthenticated remote attackers to overwrite the site's stored Google Calendar connection credentials with attacker-controlled OAuth tokens, fully hijacking the calendar integration. Exploitation requires the target site to have independently configured a Google OAuth client for the calendar sync feature, limiting the exposed population. No public exploit has reached CISA KEV status, but a publicly available proof-of-concept was published by WPScan, and EPSS remains low at 0.14% (3rd percentile), consistent with a niche plugin requiring a non-default configuration. The primary consequence is persistent integrity and availability disruption of the booking-calendar workflow, with a secondary confidentiality risk if future appointment data is synced to the attacker's Google account.
Unauthenticated price manipulation in the Salon Booking System WordPress plugin (through 10.30.33) allows any remote visitor to tamper with the stored total of arbitrary bookings by invoking unprotected booking-modification AJAX endpoints. The plugin neither restricts access to these actions nor verifies that the requesting user owns the targeted booking, creating a CWE-862 missing-authorization flaw. No public exploitation in CISA KEV has been confirmed, though a publicly available proof-of-concept exists via WPScan, and EPSS sits at just 0.14% (3rd percentile), suggesting opportunistic rather than widespread active exploitation.
Insecure Direct Object Reference (IDOR) in the Salon Booking System WordPress plugin through version 10.30.33 allows any authenticated user - including self-registered subscriber and customer accounts - to enumerate booking identifiers via a REST API endpoint and retrieve personal data belonging to any other customer, including name, email, phone number, physical address, and private appointment notes. The plugin fails to verify that the requested booking belongs to the calling user, requiring only a basic read-level WordPress capability. A publicly available proof-of-concept exists per WPScan disclosure; no active exploitation has been confirmed in CISA KEV at time of analysis.
Pinpoint Booking System WordPress plugin (all versions through 2.9.9.6.9) accepts client-supplied booking prices without any server-side validation, allowing unauthenticated visitors to create reservations at arbitrary prices including zero. By selecting a payment method that triggers instant approval, an attacker can obtain a confirmed, cost-free booking - a direct financial impact on site operators. Publicly available exploit code exists via WPScan, though EPSS at 0.14% (3rd percentile) indicates minimal observed automated exploitation at time of analysis; no CISA KEV listing is present.
Block User Account WordPress plugin before 2.0.1 fails to enforce account suspension across every authentication path, leaving blocked users able to retain their full role-level read and write access through the WordPress REST API when they hold an application password created prior to being blocked. All sites running the plugin at versions below 2.0.1 are affected. A publicly available exploit exists per WPScan reporting, though no active exploitation has been confirmed by CISA KEV, and the EPSS score of 0.17% (7th percentile) reflects limited observed real-world exploitation pressure.
Broken object-level authorization in the RSS Aggregator by Feedzy WordPress plugin before 5.2.6 allows authenticated users with author-level access or higher to perform unauthorized actions against import jobs and content they do not own. Affected actions include permanently deleting posts generated by another user's import job, resetting deduplication and scheduling state, disabling jobs, and clearing error logs. Critically, one endpoint performs no object-type check at all, enabling any sufficiently privileged authenticated user to unpublish arbitrary posts and pages site-wide regardless of ownership. A publicly available exploit exists per WPScan; no active exploitation confirmed in CISA KEV at time of analysis.
SQL injection in the Term Pages WordPress plugin (versions before 2.0.0) allows unauthenticated remote attackers to execute arbitrary SQL queries against the WordPress database by submitting a crafted request containing a malicious parameter. The vulnerability stems from missing input sanitization and output escaping prior to SQL statement construction (CWE-89). A publicly available exploit exists per WPScan, though EPSS sits at just 0.18% (7th percentile), suggesting exploitation remains limited at this time despite accessible proof-of-concept code. No CISA KEV listing has been confirmed.
MotoPress Hotel Booking WordPress plugin versions before 6.2.3 permits any authenticated subscriber-level user to modify or overwrite the personal data of arbitrary customers by supplying a chosen record identifier, with no server-side ownership verification in place. The flaw affects WordPress hospitality sites running the plugin in its standard configuration and can be triggered by any user who holds even the lowest WordPress account role - a realistic threat on sites with open guest registration. A publicly available proof-of-concept exists per WPScan, though EPSS data (0.14%, 4th percentile) indicates mass automated exploitation has not materialized; upgrading to version 6.2.3 is the confirmed fix.
Unauthorized payment record creation in MotoPress Hotel Booking WordPress plugin before 6.2.3 enables unauthenticated remote attackers to forge completed payment entries against any booking - falsely confirming reservations as paid without executing a real financial transaction. The vulnerable REST endpoint performs no authorization or ownership validation, making any booking ID on an affected site a viable target. A publicly available proof-of-concept exists per WPScan; however, EPSS remains at 0.15% (4th percentile), and no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Missing authorization on multiple AJAX settings handlers in Customer Reviews for WooCommerce (all versions before 5.116.0) allows any authenticated WordPress user - including low-privilege Subscribers - to invoke administrative settings functions, overwrite plugin configuration options, and read sensitive store configuration data. The flaw stems from absent nonce verification and WordPress capability checks on AJAX actions that should be restricted to shop administrators. A public exploit exists via WPScan, though EPSS signals low widespread opportunistic exploitation at 0.14% (4th percentile); no CISA KEV listing indicates mass exploitation has not been observed.
Server-side request forgery in the Podcast Player WordPress plugin (all versions before 8.3.1) allows unauthenticated remote attackers to force the server to issue HTTP requests to arbitrary hosts - including internal cloud metadata services, internal APIs, and private network endpoints - and read back any response that parses as RSS/XML. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero-friction exploitation requiring no credentials and no user interaction against any WordPress site running an affected plugin version. Publicly available exploit code exists per WPScan; the vulnerability is not listed in CISA KEV, and EPSS sits at 0.15% (4th percentile), indicating limited observed exploitation to date despite the public POC.
Stored XSS in the Advanced Excerpt WordPress plugin before 4.5 permits administrators - critically including those without the `unfiltered_html` capability, such as site-level admins in WordPress multisite deployments - to inject persistent JavaScript payloads via unsanitized plugin settings, which then execute silently in every visitor's browser on affected pages. A publicly available proof-of-concept exists per WPScan's disclosure (EUVD-2026-55021), though EPSS remains very low at 0.16% (6th percentile) and the vulnerability is not confirmed in CISA KEV. The primary risk surface is WordPress multisite environments, where this plugin's settings bypass the platform-level capability restriction that normally prevents restricted admins from injecting raw HTML.
LearnPress WordPress plugin before version 4.4.4 exposes a blind, bounded server-side request forgery (SSRF) exploitable by users holding the instructor role, allowing the WordPress server to issue HTTP requests to arbitrary external hosts chosen by the attacker. Reported by WPScan and tracked under CWE-918, the flaw stems from absent URL validation on a user-controllable input. A public proof-of-concept exists; however, EPSS at 0.14% (4th percentile) and the absence of a CISA KEV listing indicate negligible observed exploitation activity, consistent with the high-privilege requirement.
Broken object-level authorization in the CubeWP Framework WordPress plugin through version 1.1.30 exposes arbitrary post and user metadata via an unprotected REST API endpoint. Any authenticated user with the Contributor role or higher can request metadata from posts they do not own - including draft, pending, private, and password-protected content - as well as metadata belonging to any user account, including site administrators. A publicly available exploit has been disclosed by WPScan, though EPSS signals (0.13%, 3rd percentile) indicate real-world exploitation remains limited at time of analysis.
Stored XSS in the Saitama Addon Pack WordPress plugin (≤ 1.0.8) lets contributor-level users inject persistent JavaScript into post metadata fields that have no sanitization or escaping applied before output. When a higher-privileged user - editor or administrator - opens the affected content for review, the payload executes in their browser session. A public exploit is available via WPScan; no active exploitation is recorded in CISA KEV, and EPSS sits at the 6th percentile, consistent with targeted rather than opportunistic abuse.
Payment amount validation bypass in the Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin (all versions through 3.1.0) enables any customer to complete a purchase by paying less than the full order total, with the order subsequently marked as fully paid by the merchant system. The flaw lies in the PayPal Data Transfer (PDT) return handler, which processes the post-payment callback without performing server-side reconciliation of the amount actually transferred against the stored order total. A publicly available exploit is documented by WPScan, though EPSS at 0.14% indicates exploitation has not yet scaled to widespread automated abuse; the real risk is deliberate buyer fraud rather than opportunistic scanning.
Payment verification bypass in the Accept PayPal & Stripe with Subscriptions for WooCommerce plugin (through version 3.1.0) lets unauthenticated shoppers complete WooCommerce orders without paying the merchant a single cent. The plugin fails to validate that the PayPal account receiving the payment matches the merchant's configured account, so an attacker can pay the full order amount to their own PayPal account and the plugin will still mark the order as paid and fulfilled. A publicly available proof-of-concept exists, per WPScan, and EPSS is low (0.14%), indicating no widespread automated exploitation at time of analysis.
SQL injection in the Library Management System WordPress plugin (all versions before 3.6.7) allows any user holding a Subscriber role or higher to inject arbitrary SQL into the underlying WordPress database, extracting sensitive records including user password hashes. A publicly available proof-of-concept exploit is confirmed via WPScan. No CISA KEV listing exists and EPSS sits at 0.17% (6th percentile), indicating limited observed automated exploitation, but the low privilege bar and public POC make this a meaningful and urgent patching priority for any affected site.
Stored Cross-Site Scripting in the JetEngine WordPress plugin (all versions before 3.8.13.1) allows unauthenticated remote attackers to upload SVG files containing arbitrary JavaScript, which then executes persistently in the browser of any user who views the file. The plugin neither sanitizes SVG content on upload nor restricts the upload endpoint to authenticated users, making the attack fully unauthenticated. A publicly available proof-of-concept exists per WPScan, though EPSS of 0.17% (7th percentile) and absence from CISA KEV suggest exploitation remains targeted rather than widespread at this time.
Path traversal in the AI Engine WordPress plugin before 3.6.6 allows server-side file contents to be read and exfiltrated to an external AI service without path sanitization. When the plugin's public API feature is enabled (a non-default setting), subscriber-level users can trigger this; otherwise the same flaw is accessible to WordPress administrators - and on multisite installations, a non-super subsite administrator can exploit it to read network-wide configuration files and extract embedded secrets such as database credentials and API keys. A publicly available proof-of-concept exists per WPScan; EPSS sits at 0.16% (5th percentile), indicating limited opportunistic scanning activity to date but no confirmed mass exploitation.
Unauthorized file deletion in AI Engine WordPress plugin (before 3.6.4) allows a network attacker who has obtained a guest user's session cookie and file reference to delete that guest's uploaded chatbot files without any server-side ownership check. The plugin authorizes deletion actions solely on a client-supplied session value, making it vulnerable to CWE-639 (Authorization Bypass Through User-Controlled Key). A publicly available proof-of-concept exists per WPScan, though EPSS at 0.14% (3rd percentile) indicates exploitation has not yet been observed at scale.
Download Monitor WordPress plugin versions before 5.2.6 fails to enforce authorization on an AJAX download-logging endpoint and simultaneously leaks the nonce that would normally gatekeep it to unauthenticated visitors, enabling arbitrary log injection. Any unauthenticated remote attacker can inject fabricated entries into the plugin's download log to artificially inflate a site's download statistics. Publicly available exploit code exists per WPScan reporting; however, with no CISA KEV listing and an EPSS of 0.14% (3rd percentile), real-world exploitation appears limited to opportunistic or targeted campaigns rather than widespread active abuse.
WP Directory Kit WordPress plugin before version 1.5.5 exposes sensitive site data to any authenticated user due to missing authorization and nonce validation on an AJAX endpoint. Any subscriber-level account holder can trigger the vulnerable action to enumerate the full WordPress user list and access unpublished directory listings belonging to other users - data that should be restricted to privileged roles. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.14% (4th percentile), suggesting exploitation has not yet become widespread despite the low barrier to abuse.
Unauthorized data exposure in the WP Directory Kit WordPress plugin (all versions before 1.5.5) allows any authenticated user - including low-privilege Subscribers - to retrieve stored contact messages and associated personal data belonging to other users by invoking an unprotected AJAX endpoint. The root cause is the complete absence of WordPress authorization checks and nonce verification on an authenticated AJAX action, meaning the plugin performs no ownership or permission validation before returning sensitive inter-user data. A publicly available proof-of-concept has been published by WPScan; however, EPSS sits at just 0.14% (4th percentile) and no CISA KEV listing exists, indicating low observed exploitation activity at time of analysis despite the public PoC.
Dokan's WooCommerce multivendor marketplace WordPress plugin (versions before 5.0.11) exposes a broken object-level authorization flaw in one of its order REST API endpoints, enabling any authenticated vendor to grant their own customers free download access to paid downloadable files belonging to other vendors without the file owner's consent. Publicly available exploit code exists for this issue, reported by WPScan. Despite a CVSS score of 5.4 (Medium) and confirmed POC availability, the EPSS probability of 0.13% (3rd percentile) indicates that widespread automated exploitation is not currently observed, though the business impact - unauthorized file distribution and revenue theft across a multivendor marketplace - is directly harmful to affected platform operators.
Visitor analytics data exposure in WP Statistics WordPress plugin versions before 14.16.10 allows any authenticated WordPress user - including those with only Subscriber-level access - to invoke dashboard analytics AJAX handlers and retrieve the site's full visitor metrics without authorization. The plugin's AJAX handlers validate a WordPress nonce but omit the required capability check, and because WordPress issues valid nonces to all authenticated users regardless of role, this effectively grants analytics read access to anyone with a site account. Publicly available exploit code exists per WPScan reporting, though no active exploitation is confirmed in the CISA KEV catalog and EPSS remains at 0.14% (4th percentile), indicating limited observed mass exploitation to date.
Stored cross-site scripting in the YMC Filter WordPress plugin (all versions before 3.12.9) allows Author-role users to upload malicious SVG files whose embedded JavaScript executes in the browsers of any site user - including administrators - who views the file. A publicly available proof-of-concept exploit exists via WPScan, lowering the skill bar significantly for attackers who already hold an Author-level account. The EPSS score of 0.15% (5th percentile) indicates negligible automated exploitation activity, placing real-world risk primarily in multi-author WordPress environments where untrusted contributors hold Author-level access.
Stored cross-site scripting in the YMC Filter WordPress plugin (versions 3.6.0 through 3.12.7) enables any Contributor-level authenticated user to persistently inject arbitrary JavaScript into layout builder settings, which then executes in every site visitor's browser via an unsanitized public endpoint. The plugin compounds the flaw by failing to verify object ownership when saving layout settings, meaning low-privilege users can overwrite settings they do not control. A public proof-of-concept is available via WPScan; the vulnerability is patched in version 3.12.8.
Reflected XSS in the Link Library WordPress plugin before 7.9.4 allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into visiting a crafted URL containing an unsanitized parameter. The CVSS scope is Changed (S:C), meaning attacker-controlled script runs in the victim's browsing context, enabling session theft or privilege escalation against logged-in WordPress users. No public exploit identified at time of analysis is contradicted here - a publicly available exploit code exists per WPScan, though EPSS of 0.17% (7th percentile) indicates limited observed exploitation at time of analysis and no CISA KEV listing exists.
Price manipulation in the Appointment Hour Booking WordPress plugin (all versions before 1.5.88) allows any unauthenticated visitor to submit a crafted booking request with an attacker-controlled price - including zero or negative amounts - that the server accepts without validation and stores as authoritative, corrupting both booking and payment records. A publicly available proof-of-concept has been disclosed via WPScan, though the EPSS score of 0.14% (3rd percentile) indicates minimal observed exploitation at this time. Vendor-released patch version 1.5.88 is available and resolves the missing server-side price validation.
Authentication bypass in the Newsletters WordPress plugin (all versions before 4.16) allows remote unauthenticated attackers to gain privileged API access via PHP type juggling against a non-strict key comparison. Exploitation is conditional on the plugin's optional API being enabled, but when active, attackers can modify subscriber records and send bulk emails without any credentials. A publicly available proof-of-concept is documented by WPScan; EPSS at 0.19% (9th percentile) suggests limited automated exploitation to date, and no CISA KEV listing has been issued.
CAPTCHA bypass in the Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before 1.42.0 allows unauthenticated network attackers to defeat anti-abuse protections on Forminator-integrated forms by exploiting a flawed validation cache keying mechanism. After solving a single legitimate Turnstile challenge, an attacker can replay token-less form submissions during the validation cache window because the cache is bound to an attacker-controlled, reusable request value rather than the one-time challenge token. A publicly available proof-of-concept exists (WPScan); this vulnerability is not currently listed in CISA KEV, and no EPSS score was provided in source data.
Payment integrity bypass in the Subscriptions for WooCommerce plugin (versions before 2.0.1) enables financial fraud by allowing substitution of an arbitrary approved PayPal order token during the WooCommerce order-received flow. The plugin captures a client-supplied token and marks any order paid solely based on a COMPLETED capture status, without verifying that the captured amount matches the order total or that the token belongs to the specific order. Unauthenticated attackers - where guest checkout is enabled - can exploit this to obtain goods or subscription access without paying the actual order price. A publicly available proof-of-concept exists; no CISA KEV listing at time of analysis.
WP Events Manager for WordPress (all versions before 2.2.5) exposes a payment notification endpoint that accepts fraudulent booking-paid confirmations from unauthenticated attackers. The plugin neither validates that an incoming payment callback originates from the configured merchant nor that the notified amount matches the booking total, enabling any remote actor to mark arbitrary bookings - including other users' bookings - as fully paid without money reaching the merchant. A publicly available exploit exists; the vulnerability is not currently listed in CISA KEV, but the AV:N/AC:L/PR:N/UI:N attack profile means exploitation requires zero privileges and trivial effort.
Denial of Service in the WP Maps WordPress plugin before 4.9.7 allows any authenticated subscriber to exhaust server resources by exploiting a missing capability check in an AJAX action handler. The flaw, discovered and reported by WPScan, permits a low-privileged user to invoke an unrestricted operation that triggers uncontrolled recursion, potentially rendering the affected WordPress site unavailable. A publicly available proof-of-concept exists, though EPSS remains low (0.14%) and CISA has not listed this in KEV, suggesting exploitation is currently opportunistic rather than widespread.
Broken Object Level Authorization in MStore API WordPress plugin (all versions before 4.21.0) exposes every WooCommerce order and associated customer PII to any authenticated WordPress user, including low-privileged Subscribers. The vendor-orders endpoint performs no caller-scoping check, meaning a Subscriber can enumerate the entire store's order history. Publicly available exploit code exists per WPScan, though EPSS at 0.13% (3rd percentile) indicates exploitation has not become widespread at time of analysis; no CISA KEV listing confirms active exploitation.
Stored cross-site scripting in Meow Gallery WordPress plugin (all versions before 5.5.2) allows any WordPress user holding the Author role or higher to persist a JavaScript payload via unsanitized attachment alt text in linked gallery anchor attributes. Any visitor - including site administrators - who subsequently loads a post containing the affected gallery executes the injected script, enabling session hijacking, credential theft, or malicious redirects. A publicly available proof-of-concept exists per WPScan; EPSS at 0.15% reflects low automated exploitation probability, though the threat to sites with multiple or untrusted author accounts is concrete.
Unauthenticated cloud credential hijacking in the Templately WordPress plugin (all versions before 3.7.1) allows any remote attacker to overwrite the site administrator's stored cloud service connection with an account under their control. This severs the legitimate administrator's access to the cloud template library and redirects the site's template source to attacker-controlled infrastructure, enabling supply-chain-style content injection against the WordPress admin. A publicly available proof-of-concept exists per WPScan, though EPSS remains very low (0.14%, 3rd percentile), and no CISA KEV listing confirms active widespread exploitation at time of analysis.
Stored cross-site scripting in BNE Testimonials WordPress plugin (all versions before 2.0.8.2) allows contributor-level authenticated users to inject arbitrary JavaScript into an inline script block via an unescaped shortcode attribute. The payload persists in published content and executes in the browser of any visitor who views the affected page, including administrators. A public proof-of-concept is documented by WPScan; however, the vulnerability is not listed in CISA KEV and EPSS sits at the 5th percentile, indicating low automated exploitation probability.
Insecure Direct Object Reference (IDOR) in the Subscriptions for WooCommerce WordPress plugin before 2.0.1 allows any authenticated customer to read subscription records belonging to other customers by supplying an arbitrary subscription ID. The plugin fails to enforce ownership checks before returning subscription details - subscribed product, status, and date fields - exposing sensitive order metadata across tenant boundaries. A publicly available proof-of-concept exists per WPScan, but with an EPSS of 0.13% (3rd percentile) and no CISA KEV listing, mass exploitation is not currently observed.
Stored Cross-Site Scripting in the Comments WordPress plugin (all versions before 7.6.60) permits unauthenticated attackers to permanently inject malicious JavaScript into the site database by submitting a crafted URL that the plugin fails to escape before rendering inside an HTML attribute. Any authenticated user - including site administrators - who subsequently views the affected content triggers payload execution in their browser, potentially enabling session hijacking and full site takeover. A publicly available exploit is referenced via WPScan, though EPSS at 0.17% (7th percentile) indicates low observed exploitation volume at time of analysis, and the vulnerability is not listed in CISA KEV.
Reflected XSS in the Subscribe2 WordPress plugin (versions before 10.46) allows an unauthenticated attacker to inject arbitrary JavaScript into a public subscription form by luring a visitor to a crafted link. Exploitation requires the victim to interact with the malicious URL - no server-side authentication is needed - enabling session theft, credential harvesting, or DOM-based actions scoped to the victim's browser. A publicly available proof-of-concept exists per WPScan; EPSS at 0.16% (5th percentile) indicates limited automated exploitation despite the low attack complexity.
RealHomes Memberships WordPress plugin before 3.1.0 permits any authenticated user - including low-privilege Subscribers - to claim paid membership packages for free by exploiting missing payment verification, absent nonce validation, and no capability checks on the membership grant endpoint. The business impact is direct financial loss for site operators running paid real estate membership tiers. No active exploitation has been confirmed by CISA KEV, but a public exploit is available via WPScan, lowering the barrier for abuse.
Cross-site request forgery in the Google Authenticator WordPress plugin before version 0.56 allows an unauthenticated attacker to overwrite a logged-in user's TOTP secret by tricking them into loading a malicious page. The forged request silently replaces the victim's two-factor secret with one the attacker controls, enabling the attacker to generate valid OTPs and lock the legitimate account owner out. A public proof-of-concept is available via WPScan; no active exploitation is confirmed in CISA KEV, and EPSS of 0.11% (2nd percentile) aligns with SSVC's 'not automatable' designation.
Missing capability check in the SEO Redirection Plugin for WordPress (versions before 9.19) exposes authenticated AJAX endpoints to any logged-in user, regardless of role. A subscriber-level account - the lowest WordPress user tier - can invoke the unprotected action to enumerate all configured 301 redirect rules, revealing source and destination URLs that may disclose internal site architecture, campaign tracking patterns, or sensitive path structures. No public exploitation in the wild has been confirmed by CISA KEV, but a proof-of-concept is publicly available per WPScan, raising the probability of opportunistic abuse against unpatched sites.
Stored Cross-Site Scripting in the Nexter Blocks WordPress plugin before 5.0.2 allows any authenticated user with file upload capability (Author role by default) to upload a malicious SVG file containing embedded JavaScript that executes in any victim's browser upon accessing the file. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.15% (5th percentile) and absence from CISA KEV indicate low observed exploitation to date. The NVD-assigned CVSS PR:N conflicts with the description's clear authentication requirement - defenders should treat this as an authenticated vulnerability, which meaningfully narrows real-world exposure.
Stored Cross-Site Scripting in the Slick Slider WordPress plugin before 0.5.3 allows any authenticated user holding the Contributor role or higher to inject persistent JavaScript through an unsanitized shortcode attribute value that is rendered directly into an HTML attribute. The payload executes in the browser of any user - including administrators - who subsequently views the affected post, enabling session hijacking, credential theft, or privilege escalation. A publicly available proof-of-concept exploit exists and a vendor patch (version 0.5.3) has been released; no active exploitation has been confirmed by CISA KEV at time of analysis.
Stored Cross-Site Scripting in the Child Pages Card WordPress plugin (all versions before 1.09) allows contributors and higher-privileged authenticated users to inject persistent JavaScript payloads via unsanitized shortcode attributes. When an administrator or other privileged user views a page containing the malicious shortcode, the injected script executes in their browser, enabling session hijacking or unauthorized privileged actions. A public exploit is available via WPScan; no confirmed active exploitation (CISA KEV) has been observed, though the public PoC meaningfully lowers the barrier to abuse.
SQL injection in the Welcart e-Commerce WordPress plugin (all versions before 2.11.32) enables authenticated users holding at minimum the Editor role - or Welcart's custom shop-management roles - to execute arbitrary SQL against the underlying WordPress database by supplying a crafted CSV file through the plugin's import feature. A publicly available proof-of-concept exploit exists (reported by WPScan), meaningfully lowering the bar for abuse by any account with sufficient role access. No active exploitation is confirmed in CISA KEV at time of analysis, but the combination of a public POC and high database impact (confidentiality and integrity both rated High) makes patching urgent for multi-editor or multi-manager WordPress deployments.
Stored XSS with privilege bypass in the EONSR AEO Agent WordPress plugin (versions through 3.7.9) allows unauthenticated remote attackers to inject persistent arbitrary JavaScript into published posts, attributed to administrators, that executes in the browser of any site visitor including administrators. The REST API route responsible for post creation performs no authorization check and explicitly disables HTML sanitization before saving content, making this a trivially exploitable unauthenticated write-then-persist attack chain. A publicly available exploit has been published by WPScan; no active exploitation has been confirmed in CISA KEV at time of analysis.
Cleartext exposure of third-party API keys and authentication tokens in AI Engine WordPress plugin (before 3.6.4) allows Editor-role users to read secrets that are intended to be administrator-only. The plugin inlines sensitive configuration values into admin page JavaScript without redaction, making them readable to any authenticated user with Editor access who inspects the page source. A public proof-of-concept exists per WPScan, though EPSS remains low at 0.17% (7th percentile) and the vulnerability is not in the CISA KEV catalog.
ProfileGrid WordPress plugin (all versions before 6.0.0.0) exposes group member lists and member identifiers to unauthenticated visitors due to a handler registered without any authorization checks, completely bypassing the plugin's member-visibility settings for private and closed groups. Any unauthenticated visitor who can reach the WordPress site can enumerate group members and their identifiers across all group types, including those the site owner intended to restrict. A publicly available exploit exists per WPScan, and the SSVC classification flags this as automatable - though EPSS at 0.14% (4th percentile) indicates exploitation has not become widespread despite the low barrier to entry.
Open email relay in the Estatik Real Estate Plugin for WordPress (before 4.3.3) allows unauthenticated remote attackers to send arbitrary emails through any affected WordPress site by submitting crafted property inquiry form requests with controlled recipient address, subject, body, and Reply-To header. The plugin's anti-spam check is trivially bypassed and provides no constraint on recipient routing, effectively turning victim sites into spam or phishing infrastructure. A publicly available exploit exists per WPScan; EPSS sits at 0.14% (3rd percentile) and CISA KEV does not list active exploitation, suggesting limited but plausible abuse given SSVC confirms the attack is automatable.
tourmaster WordPress plugin (all versions before 5.4.9) exposes exported customer booking and order data via a fixed, predictable file path inside its publicly accessible web directory, with no authentication or access control enforcing download restrictions. Any unauthenticated network attacker who knows or can derive the static export file URL can retrieve personally identifiable information - names, contact details, and booking records - after an administrator has triggered an export. A publicly available proof-of-concept exists per WPScan, and exploitation is fully automatable (SSVC), though EPSS sits at 0.14% and no CISA KEV listing exists at time of analysis.
Unauthorized retrieval of other customers' payment receipt images is possible in PeproDev WooCommerce Receipt Uploader (≤ 2.8.0) because the plugin's token-based attachment access mechanism never validates that a requested attachment ID belongs to the order the token was issued for. Unauthenticated network attackers can forge or repurpose a token - trivially obtained by placing any order - to iterate over attachment IDs and exfiltrate payment receipts uploaded by unrelated customers, potentially exposing financial documents containing banking details or PII. A publicly available proof-of-concept exists per WPScan reporting (EUVD-2026-53719); no CISA KEV listing indicates widespread active exploitation has not been confirmed, though SSVC rates the attack as automatable.
Unauthenticated IDOR write in PeproDev WooCommerce Receipt Uploader (all versions ≤ 2.8.0) allows any remote attacker to submit or manipulate receipt uploads without credentials or authorization checks, bypassing the WordPress nonce and capability verification that WooCommerce plugins are expected to enforce. The plugin remains unpatched as of the time of writing, and a publicly available proof-of-concept exploit exists via WPScan. Despite automation potential (SSVC: Automatable yes), EPSS sits at 0.10% (1st percentile) and CISA has not listed this in KEV, indicating limited observed real-world exploitation to date.
Unauthorized information disclosure in the MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin (all versions before 7.0.4) exposes import log files and import-related post metadata to any authenticated user, including low-privilege subscribers. The flaw stems from a missing authorization and CSRF check on an AJAX action, meaning any logged-in WordPress user on an affected site can invoke the endpoint and read sensitive operational data. A publicly available proof-of-concept exists (reported by WPScan), though EPSS places exploitation probability at 0.10% and SSVC confirms no known active exploitation at time of analysis.
Stored Cross-Site Scripting in GeoDirectory WordPress plugin before 2.8.110 allows authenticated editors and higher-privileged users to persist malicious JavaScript via the place-category setting, which is rendered unsanitized on admin pages. The vulnerability is specifically significant in WordPress multisite deployments where the unfiltered_html capability is intentionally revoked for editors, as it bypasses that restriction through the plugin's own inadequate output handling. A public proof-of-concept exists via WPScan, though EPSS at 0.16% (6th percentile) and SSVC exploitation status of 'none' indicate no confirmed active exploitation at time of analysis.
Unauthenticated information disclosure in DHL Shipping Germany for WooCommerce (versions before 4.0.1) exposes stored shipping labels - each containing customer name and postal address - to any visitor who can request predictable filenames from the label storage directory. The plugin relies exclusively on an Apache .htaccess file for directory access control, which nginx and other non-Apache web servers silently ignore, leaving the directory fully browsable over the network. A publicly available exploit exists (via WPScan), though EPSS of 0.14% at the 4th percentile indicates low observed exploitation activity, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated IDOR in the DHL Shipping Germany for WooCommerce WordPress plugin (versions before 4.0.1) exposes every generated shipping label to any internet visitor. The plugin's label-download endpoint performs no authorization check whatsoever - no capability check, nonce, login requirement, or order-ownership verification - and labels are indexed by predictable sequential IDs, enabling trivial full enumeration. A publicly available exploit exists; successful exploitation leaks customer full names, complete postal addresses, and order references at scale, carrying significant GDPR implications for any German e-commerce operator running the affected plugin.
Information disclosure in the GeoDirectory WordPress plugin (before 2.8.168) exposes the email addresses of all registered users - including site administrators - to any authenticated Contributor-level or higher user. The root cause is an unrestricted user-search handler that performs no authorization check against WordPress's capability system, meaning any low-privilege authenticated user can invoke it freely. Publicly available exploit code exists per WPScan, though EPSS at 0.14% (4th percentile) and absence from CISA KEV suggest opportunistic exploitation remains limited at time of analysis.
Stored XSS in the WP Custom HTML Page WordPress plugin (≤0.6.2) enables users with the Author role to persist arbitrary JavaScript via an unsanitized custom page handler, which then executes for every visitor - including administrators - at a publicly accessible URL. The plugin fails both to sanitize HTML input and to enforce WordPress's native unfiltered_html capability restriction, effectively granting Author-level users a privilege they should not have. A publicly available exploit is documented by WPScan; EPSS (0.15%, 5th percentile) indicates no observed widespread opportunistic exploitation, though the public-URL delivery mechanism means admin-targeted attacks require no active phishing.
Insecure Direct Object Reference (IDOR) in the MultiVendorX WordPress plugin before 5.0.11 exposes confidential financial and commission data across vendor accounts. Any authenticated vendor-level user can query a REST API endpoint using an arbitrary store identifier to retrieve another vendor's earnings and commission records, bypassing per-store ownership validation entirely. No active exploitation is confirmed in CISA KEV, but a publicly available exploit exists per WPScan, and the low EPSS score (0.14%, 4th percentile) suggests limited opportunistic scanning activity at this time.
Cross-site request forgery in the GDPR Cookie Compliance WordPress plugin before 5.1.0 allows an unauthenticated attacker to forcibly expire and delete any visitor's session cookies by luring them to a crafted link. The plugin exposes a cookie-expiration action that performs no nonce or request-origin validation, meaning a single malicious URL can silently trigger it in any logged-in user's browser context. Exploitation logs the targeted user out of the WordPress site. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.12% (2nd percentile) indicates exploitation remains rare in the wild; this is not in CISA KEV.
Stored XSS in the Orbit Fox WordPress plugin (versions before 3.0.8) allows authenticated users holding at least the Author role to upload malicious SVG files containing arbitrary JavaScript, which then executes in the browser context of any visitor who views the file - including administrators. The vulnerability is gated on the plugin's optional SVG upload feature being enabled. A public proof-of-concept is available via WPScan; CISA KEV listing is not confirmed, and EPSS sits at a low 0.17% (7th percentile), indicating limited automated campaign targeting at time of analysis. Vendor-released patch version 3.0.8 is available.
Unrestricted file upload in the Chat Widget WordPress plugin before 1.8.2 allows any network-reachable user to submit arbitrary files to the plugin's public response endpoint, bypassing all validation of type, extension, content, and size. Uploaded files are stored in the WordPress uploads directory under bare UUIDs - stripping the original extension - which explicitly prevents code execution or stored XSS despite the CWE-434 classification. Real-world impact is bounded to disk exhaustion and abuse of the hosting environment to serve attacker-controlled static content, conditional on the channel's response storage or mail-forwarding feature being configured. No public exploit identified via CISA KEV; however, a proof-of-concept is publicly available per WPScan, and EPSS at 0.16% (6th percentile) signals minimal observed exploitation activity.
Broken object-level authorization in the REST API Log WordPress plugin (all versions before 1.7.1) permits unauthenticated attackers who hold any valid log-download token - regardless of which entry it was issued for - to retrieve arbitrary log entries from any other user, exposing stored credentials, authentication tokens, and private REST API payloads. The root cause is twofold: tokens are not cryptographically bound to specific log entry IDs, and the plugin performs no WordPress capability check on the requester. A public exploit PoC is referenced via WPScan, though EPSS at 0.18% and SSVC exploitation status of 'none' indicate no confirmed widespread abuse at time of analysis.
Missing authorization in the Wired Impact Volunteer Management WordPress plugin (versions before 2.8.2) allows any authenticated WordPress user with at least a Subscriber role to remove RSVPs belonging to other users from any volunteer opportunity. The vulnerability stems from an AJAX action handler that neither verifies the requesting user's authorization level nor confirms ownership of the RSVP being deleted, enabling unauthorized data manipulation across the entire volunteer management system. A publicly available proof-of-concept exists via WPScan, though EPSS sits at 0.13% (3rd percentile) and SSVC confirms no active exploitation, suggesting limited real-world attacker interest at this time.
Open redirect in Clearfy Cache WordPress plugin (versions before 2.4.3) allows unauthenticated attackers to redirect site visitors to arbitrary external URLs by exploiting the Cyrlitera old-URL redirect handler, which passes a decoded request URI to an unsafe redirect function without target validation. Exploitation requires that the non-default Cyrlitera redirect option is enabled on the target site, and a victim must interact with an attacker-crafted URL. No public KEV listing exists, EPSS sits at the 4th percentile (0.14%), but a publicly available proof-of-concept has been published by WPScan.
Clearfy Cache WordPress plugin versions before 2.4.3 exposes admin-only settings pages and their contents - including administrative nonces - to any authenticated user at Subscriber level or above due to a missing capability check on an alternate admin-page dispatch path. While the canonical admin URL enforces access controls correctly, the unguarded dispatch path bypasses those restrictions entirely. A publicly available proof-of-concept exists per WPScan reporting, though EPSS sits at 0.13% (3rd percentile), indicating low observed exploitation probability despite POC availability; no confirmed active exploitation (CISA KEV) has been recorded.
Stored Cross-Site Scripting in the PowerPress Podcasting plugin by Blubrry (WordPress) before version 11.16.11 allows any authenticated user holding the Contributor role to inject and persist arbitrary JavaScript via unsanitized Podcast Episode settings fields. The injected payload executes in the browsers of higher-privileged users - including editors and administrators - who view the affected content, enabling session hijacking, credential theft, or unauthorized administrative actions. A publicly available proof-of-concept exists per WPScan; no active exploitation is confirmed by CISA KEV, and the EPSS probability stands at a low 0.15%, suggesting opportunistic rather than widespread exploitation at this time.
Authorization bypass in the Brizy WordPress plugin before 2.8.19 permits authenticated Contributor-level users to hijack template-type metadata on templates owned by other users. The plugin validates authorization against one request parameter while executing the write operation against a different, attacker-controlled parameter - a textbook CWE-639 Insecure Direct Object Reference variant. A publicly available exploit is documented by WPScan; however, no active exploitation is confirmed via CISA KEV, and the EPSS score of 0.13% (3rd percentile) indicates negligible observed in-the-wild activity.