Unknown
Monthly
Stored cross-site scripting in the Brizy WordPress plugin before 2.8.19 allows any authenticated user with Contributor role or above to plant persistent XSS payloads via unsanitized featured-image focal-point coordinates submitted through an AJAX action. When a higher-privileged user (Editor or Administrator) later opens the affected post for review, the injected script executes silently in their browser session, enabling session hijacking or unauthorized administrative actions. A publicly available exploit exists per WPScan; the vendor has released a fix in version 2.8.19.
Stored XSS in the Brizy WordPress plugin (all versions before 2.8.19) allows authenticated Author-level users to inject arbitrary JavaScript into site-global design data, which is then rendered unsanitized on every front-end page of the affected site. Every visitor's browser - including site administrators - silently executes the payload upon page load, enabling session hijacking, credential theft, or full site takeover. A publicly available proof-of-concept exists per WPScan, though no active exploitation is confirmed in CISA KEV; EPSS sits at 0.16% (6th percentile), suggesting opportunistic rather than automated mass exploitation.
Contest Gallery WordPress plugin (all versions before 30.0.7) exposes the site's complete stored OpenAI prompt history to any authenticated user holding at minimum a Subscriber role, due to a handler that performs neither a capability check nor a nonce verification. An attacker with a basic WordPress account can call the unprotected AJAX endpoint directly to exfiltrate the full prompt history, potentially exposing confidential business logic, AI workflows, or sensitive data embedded in prompts. No active exploitation is confirmed (not in CISA KEV), but a publicly available proof-of-concept exists per WPScan, and EPSS remains low at 0.13% (3rd percentile).
Missing authorization in the miniOrange 2FA WordPress plugin before 6.2.7 allows any authenticated low-privileged user to trigger OTP email delivery to arbitrary email addresses and exhaust the site's metered OTP quota. The plugin's second-factor enrollment endpoint neither restricts which users may invoke it nor binds the OTP recipient to the enrolling user's own address, enabling both unsolicited OTP email delivery and a denial-of-service attack against other users' 2FA flows. No public exploitation or KEV listing has been identified, though a public proof-of-concept is available via WPScan; EPSS stands at 0.13% (3rd percentile), indicating low observed exploitation activity.
Stored cross-site scripting in the Nested Pages WordPress plugin (all versions before 3.2.15) allows authenticated users holding the Editor role - or Contributor/Author roles when the plugin is configured to manage those post types - to inject arbitrary JavaScript via unsanitized post titles that are reflected unescaped into HTML attributes on the plugin's administrative listing screen. Any higher-privileged user (including Administrators) who subsequently loads that screen will execute the attacker-controlled script within their own authenticated session, enabling session hijacking, credential theft, or unauthorized administrative actions. A publicly available proof-of-concept exploit exists per the WPScan advisory; the vulnerability is not listed in CISA KEV and the EPSS score is negligible (0.15%, 5th percentile), suggesting opportunistic rather than widespread active exploitation.
Server-Side Request Forgery in the Visualizer WordPress plugin before 4.0.6 allows any authenticated Contributor-level user to pivot through the WordPress server and reach link-local instance-metadata endpoints (e.g., 169.254.169.254), returning the full response to the attacker. On cloud-hosted WordPress deployments (AWS, GCP, Azure), this enables non-blind exfiltration of IAM credentials and other instance metadata, potentially leading to full cloud account compromise. A publicly available proof-of-concept exploit exists; exploitation probability is currently low (EPSS 0.14%, 3rd percentile) but the concrete cloud-credential impact makes this a material priority for cloud-hosted sites.
SQL injection in the Database for Contact Form 7, WPforms, Elementor forms WordPress plugin (versions before 1.5.5) exposes the underlying WordPress database to unauthorized read access by any user holding a specific capability that defaults to administrators but can be explicitly delegated to lower-privileged roles. The CVSS scope-change rating (S:C/C:H) reflects that a successful injection reaches beyond the plugin itself into the shared WordPress database, potentially exposing all stored form submissions, user data, and other sensitive records. Publicly available exploit code exists per WPScan; however, EPSS at 0.16% (5th percentile) and absence from CISA KEV indicate no confirmed widespread active exploitation at time of analysis.
Horizontal privilege escalation in the Paid Membership Subscriptions WordPress plugin (all versions before 3.0.8) allows any subscriber-level authenticated user to hijack and overwrite another member's subscription - including plan tier, status, and expiration date - by submitting a crafted change-subscription checkout request with an arbitrary subscription ID. The root cause is a missing ownership verification check at the business logic layer of the checkout flow (CWE-284). A publicly available proof-of-concept exploit has been published by WPScan, though EPSS sits at just 0.13% (3rd percentile), suggesting limited automated exploitation so far. The vulnerability is not listed in CISA KEV at time of analysis.
Stored cross-site scripting in the Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 allows contributor-level (and higher) WordPress users to inject arbitrary JavaScript into quiz question settings via an unquoted HTML attribute. The injected payload persists and executes in the browser of any site visitor who views the affected quiz, enabling session hijacking, credential theft, or defacement targeting the broader user base. No active exploitation is confirmed by CISA KEV, but a public proof-of-concept is available via WPScan, and vendor-released patch version 11.2.2 is available.
Unauthenticated consent-record forgery and privacy-queue flooding affect GDPR Framework By Data443 WordPress plugin versions prior to 2.4.0. The plugin fails to verify the identity of the data subject or check authorization when recording cookie-consent choices and processing privacy requests, allowing any unauthenticated remote attacker to submit fraudulent GDPR consent records on behalf of arbitrary email addresses and to inject unlimited entries into the site's privacy-request queue. A publicly available proof-of-concept exists per WPScan; the vulnerability is not listed in the CISA KEV catalog, and EPSS sits at 0.15% (4th percentile), indicating low observed exploitation at time of analysis.
Improper access control in the wpForo Forum WordPress plugin before 3.1.3 permits any subscriber-level authenticated user to write to administrator-controlled profile fields - including account activation status and forum reputation score - during a standard self-service profile update. This allows a banned or pending user to self-activate their own account, bypassing moderator enforcement, and to forge an arbitrarily high reputation score that may unlock elevated forum privileges. No CISA KEV listing exists, but a publicly available exploit is documented by WPScan; the EPSS score of 0.14% (4th percentile) indicates low observed exploitation probability at scale, though the low barrier to attack (any registered user) makes it a meaningful integrity risk for moderated forums.
Signature forgery in the MonsterInsights WordPress plugin before 11.1.0 allows unauthenticated network attackers to overwrite plugin configuration values when the site is not connected to Google Analytics. The root cause is that the HMAC signing key used to authenticate a specific AJAX action defaults to an empty string in that disconnected state, making any forged HMAC trivially valid. The practical impact is limited to disrupting server-side analytics in Manual GA4 mode; no public exploit identified as actively exploited (not in CISA KEV), though a publicly available proof-of-concept exists and the EPSS probability is low at 0.15%.
Blind Server-Side Request Forgery in the EmbedPress WordPress plugin (all versions before 4.6.1) allows unauthenticated remote attackers to coerce the WordPress server into issuing arbitrary HTTP requests to internal hosts and services, bypassing WordPress core URL validation entirely. The vulnerability exists on unauthenticated endpoints, requiring zero credentials or user interaction, making mass exploitation trivially automatable against any site running a vulnerable plugin version. A publicly available proof-of-concept exists (via WPScan), though EPSS of 0.14% (4th percentile) suggests exploitation remains limited in practice; no active exploitation is confirmed by CISA KEV.
Server-Side Request Forgery in Simple Google Calendar Outlook Events Widget WordPress plugin (all versions before 3.1.0) permits unauthenticated remote attackers to supply arbitrary URLs that the server fetches without validation, potentially exposing responses from internal services. The plugin is confirmed vulnerable by WPScan and a public exploit exists, though EPSS at 0.14% (4th percentile) indicates limited observed exploitation despite the available POC. This vulnerability is not listed in CISA KEV at time of analysis.
Broken object-level authorization in the Dokan WordPress plugin (versions before 5.0.9) allows any authenticated vendor on a multivendor marketplace to overwrite product attributes and default attributes belonging to other vendors via the plugin's REST API write endpoints. Exploitation requires only a low-privilege vendor account - no admin access needed - making this accessible to any registered seller on the platform. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.13% (3rd percentile), indicating limited observed exploitation activity so far; the vulnerability is not listed in CISA KEV.
Order ownership bypass in Dokan Multivendor for WordPress (versions before 5.0.9) allows any authenticated vendor to modify the status of arbitrary WooCommerce orders across the entire marketplace, including orders owned by other vendors and customers. The flaw stems from a REST endpoint handling bulk order-status changes that accepts attacker-supplied order IDs without verifying the requesting vendor's ownership of those orders. No active exploitation is confirmed (not in CISA KEV), but a publicly available proof-of-concept exists and EPSS at 0.13% (3rd percentile) reflects low observed exploitation to date.
Unauthorized lesson content disclosure in Academy LMS WordPress plugin before 3.8.3 allows any subscriber-level authenticated user to read arbitrary lesson content via the REST API - including lessons from paid courses they have not purchased and lessons in unpublished states (draft, pending, private). The root cause is a complete absence of enrollment and publication-status validation in the single-lesson REST API endpoint. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.13% (3rd percentile) and SSVC classification as non-automatable indicate limited observed exploitation activity at the time of analysis.
PHP Object Injection in Clearfy Cache WordPress plugin (versions before 2.4.3) exposes administrator-authenticated users to potential remote code execution through unrestricted deserialization during settings import. The plugin's import handler passes attacker-controlled serialized data to PHP's unserialize() without class whitelisting, enabling object injection. A publicly available POC exists via WPScan, though RCE is conditional on a suitable gadget chain being present in the WordPress environment; EPSS is low (0.21%, 12th percentile) and no CISA KEV listing has been issued, indicating no confirmed widespread exploitation.
ProfileGrid WordPress plugin before version 6.0.0.0 exposes pending group membership request data to any authenticated user due to missing authorization checks on the listing endpoint. Any subscriber-level account can enumerate the names and request timestamps of users awaiting approval for any group, including groups configured as private. No active exploitation is confirmed (not in CISA KEV), though a public exploit exists via WPScan; EPSS of 0.13% (3rd percentile) places real-world exploitation probability as very low.
Stored cross-site scripting in the Simple Membership WordPress plugin before 4.7.8 allows unauthenticated attackers to inject arbitrary JavaScript into the WordPress administration dashboard by supplying a malicious subscriber name in a payment approval request. Because the plugin neither sanitizes the input at ingestion nor escapes it on output when rendered for administrators, the payload persists server-side and executes in any administrator's browser session upon viewing the affected dashboard panel. A public proof-of-concept exploit exists (reported by WPScan); however, EPSS stands at 0.17% (7th percentile) and CISA KEV listing is absent, indicating limited observed mass exploitation at time of analysis.
Stored cross-site scripting in the Blog Floating Button WordPress plugin (≤1.4.20) allows unauthenticated attackers to inject malicious JavaScript via the HTTP User-Agent header into the plugin's visitor tracking REST endpoint. The payload persists in the database and executes in the browser session of any administrator who opens the plugin's access report page, enabling full site takeover through the hijacked admin session. A publicly available proof-of-concept from WPScan confirms the attack path; no vendor-released patch has been identified at time of analysis.
GEO my WP WordPress plugin versions before 4.5.5.3 allows any subscriber-level (or higher) authenticated user to modify or permanently delete geolocation records belonging to other users or posts by supplying arbitrary record IDs to two unprotected AJAX actions. The root cause is a complete absence of ownership and capability checks on these endpoints, a textbook CWE-639 IDOR. A publicly available exploit exists per WPScan; however, no public exploit identified at time of analysis corresponds to confirmed active exploitation (not in CISA KEV), and the EPSS score of 0.13% at the 3rd percentile reflects low observed exploitation activity despite POC availability. A vendor-released patch is available in version 4.5.5.3.
Insecure Direct Object Reference (IDOR) in the Tag, Category, and Taxonomy Manager WordPress plugin before 3.51.0 allows authenticated contributors to disclose content from private or draft posts they do not own. The plugin fails to verify post ownership before processing a referenced post ID and returning derived data, enabling a contributor to enumerate and extract information from restricted content authored by other users. No public exploitation in the wild has been confirmed (no CISA KEV listing), though WPScan has published a publicly available proof-of-concept.
Stored XSS in the SVG Support WordPress plugin (before 2.5.17) is achieved by uploading a script-bearing .svgz file, bypassing the plugin's sanitization logic that applies only to .svg uploads despite both extensions being registered and served as SVG content. Any WordPress user role granted SVG upload access - such as an Author - can plant the payload, which then executes in the browser of any subsequent visitor, including administrators, enabling session hijacking or privileged action injection. A public proof-of-concept exists via WPScan; EPSS is low (0.16%, 6th percentile) and SSVC rates exploitation as non-automatable, but the stored nature of the payload and admin-reachability elevate practical impact.
Path traversal in the 'Import and export users and customers' WordPress plugin (versions before 2.4.3) enables high-privileged WordPress users to read arbitrary files on the underlying server by supplying a crafted file path during the CSV import workflow. Confidentiality impact is rated High by NVD (CVSS:3.1 C:H), exposing sensitive server files such as wp-config.php, /etc/passwd, or application secrets. A publicly available proof-of-concept exists via WPScan, though EPSS sits at a low 0.16% (6th percentile), indicating that mass exploitation has not materialized despite POC disclosure - likely because high-privilege access is a prerequisite.
PHP object injection via unsafe deserialization in the ChamaWP WordPress plugin (versions before 1.0.13) enables unauthenticated network attackers to achieve remote code execution, contingent on the presence of a suitable gadget chain within the broader WordPress installation. The CVSS vector (PR:N, UI:N) confirms no authentication or user interaction is required, though the AC:H rating reflects the dependency on exploitable gadget chains from co-installed plugins or libraries. A public proof-of-concept exists per WPScan, with EPSS at 0.22% (13th percentile), indicating low current automated exploitation activity despite code availability - this suggests targeted rather than widespread opportunistic exploitation at time of analysis.
Unauthorized revenue data disclosure in the Classified Listing WordPress plugin (before 5.4.4) allows any authenticated contributor-level user to read daily store revenue figures restricted to administrators and report managers. The flaw stems from a missing capability check (CWE-862) on an AJAX action that aggregates store revenue totals, exposing potentially sensitive business intelligence to lower-privileged users. No public exploit identified at time of analysis per KEV, though a publicly available exploit exists per WPScan reporting; the EPSS score of 0.13% (3rd percentile) suggests limited real-world exploitation interest despite code availability.
The Classified Listing WordPress plugin before version 5.4.4 exposes private, draft, and pending post content to authenticated contributors due to a missing authorization and ownership check on an AJAX endpoint. Any user with contributor-level access or higher can read arbitrary post content belonging to other users, including administrators' unpublished material. A publicly available exploit exists via WPScan, though EPSS at 0.13% (3rd percentile) and the absence of a CISA KEV listing indicate active exploitation is not confirmed at time of analysis.
Post-deletion authorization bypass in the Contest Gallery WordPress plugin before 30.0.7 allows any authenticated Author-level or higher user to permanently delete arbitrary posts, pages, and other WordPress content they do not own. The plugin's post-deletion AJAX handler enforces only a coarse role-membership test, entirely omitting per-object capability verification and nonce validation - the two controls that WordPress's built-in permission model relies on to prevent cross-user destructive actions. A public exploit is available via WPScan, lowering the skill barrier; though EPSS is low at 0.13%, any multi-author site with untrusted Author accounts faces real and irreversible content destruction risk.
Broken access control in Simply Schedule Appointments WordPress plugin before 1.6.12.11 exposes all customer appointment records to any authenticated Contributor-level user site-wide. The administrative appointment-listing shortcode omits a capability check, and the per-user result scoping logic defaults to showing all records when the requesting user is not recognized as staff. Any WordPress user holding the Contributor role or higher - a commonly granted role in multi-author sites - can enumerate names, email addresses, phone numbers, and appointment notes belonging to every customer in the system. A publicly available proof-of-concept exists, though EPSS at 0.13% and SSVC Automatable:No suggest exploitation remains targeted rather than widespread.
Unauthenticated REST API access in the webtoffee-cookie-consent WordPress plugin before 3.5.3 allows any network attacker to export or delete stored visitor consent records, create arbitrary WordPress posts, and alter the plugin's licensing state. All versions prior to 3.5.3 are affected with no special configuration required, as the missing permission callbacks expose endpoints to public access by default. A publicly available exploit exists per WPScan, though EPSS sits at 0.22% (12th percentile), indicating exploitation has not yet reached widespread automated abuse; no public exploit identified at time of analysis for active in-the-wild campaigns.
Stored Cross-Site Scripting in the Charitable WordPress donation plugin (versions before 1.8.5.3) allows authenticated users holding a high-privilege campaign-management role to inject persistent malicious scripts via an unsanitized campaign image text field that is rendered unescaped inside an HTML attribute on the public-facing campaign page. Any site visitor who loads that page becomes a potential victim, enabling session hijacking, credential theft, or defacement against the site's front-end audience. A publicly available proof-of-concept exploit exists; however, no active exploitation has been confirmed in CISA KEV, and the EPSS score of 0.16% (6th percentile) reflects low broad-exploitation probability consistent with the high-privilege prerequisite.
Broken object-level authorization in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3.7) allows any authenticated user with the Contributor role or higher to modify the title and publication status of arbitrary posts and pages sitewide - including content they do not own. The plugin's quick-edit event handler validates only a global WordPress capability (e.g., edit_posts) without confirming whether the requesting user owns the target object, enabling horizontal and vertical privilege escalation over site content. A publicly available proof-of-concept exists; however, no confirmed active exploitation has been identified and the EPSS score sits at 0.13%, indicating limited real-world adversary interest at time of analysis.
Stored cross-site scripting in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3.7) permits any authenticated user holding the Author role or higher to permanently inject arbitrary JavaScript into event timeline content. Because the plugin fails to sanitize or escape this input before storing and rendering it on public event pages, every site visitor - including administrators - who loads the affected event page executes the attacker's script in their own browser context. A publicly available proof-of-concept exists; no active exploitation is confirmed in CISA KEV, but the low barrier to entry (any Author-level account) elevates practical risk on sites permitting open or semi-open registration.
PHP object injection in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3.7) allows authenticated contributors to deserialize attacker-controlled PHP objects through event content fields. Exploitation to achieve remote code execution, arbitrary file deletion, or sensitive data retrieval depends entirely on the presence of a usable POP (Property-Oriented Programming) chain from a co-installed plugin or theme - none exists within this plugin itself. A publicly available exploit exists per WPScan (EUVD-2026-51948), and this CVE represents an incomplete remediation of prior object-injection advisories affecting the same plugin.
Cross-site request forgery in the Frontend File Manager Plugin for WordPress (all versions through 23.6) enables attackers to silently modify file metadata belonging to authenticated users by luring victims to attacker-controlled pages, with the corrupted metadata directly enabling unauthorized download of those files. When the plugin's guest upload feature is active, the vulnerable metadata update endpoint becomes fully unauthenticated, eliminating the need for any victim interaction and exposing every user's uploaded files to arbitrary metadata manipulation. WPScan has published a proof-of-concept, though EPSS at 0.10% (1st percentile) indicates limited observed exploitation activity to date - no public exploit identified at time of analysis reaches CISA KEV status.
Insecure Direct Object Reference (IDOR) in the ProfileGrid WordPress plugin before 5.9.9.8 allows any authenticated user - including low-privilege Subscribers - to delete arbitrary other users' notifications by enumerating integer notification identifiers. The plugin's notification deletion endpoint fails to verify that the requested notification belongs to the authenticated requester, exposing all users' notifications to deletion by any site member. A publicly available exploit exists per WPScan, though EPSS sits at 0.13% (3rd percentile), indicating low observed exploitation activity at time of analysis.
Stored cross-site scripting in the Narrative Publisher WordPress plugin (≤1.0.7) lets contributor-level authenticated users inject arbitrary JavaScript into a REST-accessible post meta field that is neither access-controlled nor escaped on output. When any higher-privileged user - editor, administrator - views the affected post, the malicious script executes in their browser session, enabling session hijacking or privilege escalation to site administrator. A public proof-of-concept is available via WPScan; no KEV listing is present and the EPSS score (0.15%, 5th percentile) indicates limited opportunistic exploitation at time of analysis.
Cache management actions in the LWS Optimize WordPress plugin before version 3.4 lack authorization checks, permitting any authenticated user - including low-privileged Subscribers - to flush the site's caches and trigger repeated, resource-intensive cache rebuilds. The vulnerability is classified as CWE-862 (Missing Authorization) and carries a CVSS 3.1 score of 4.3 (Medium), with impact limited to availability degradation rather than data exposure or modification. A publicly available proof-of-concept exists per WPScan reporting, though EPSS sits at a very low 0.13% (3rd percentile) and the vulnerability is not listed in CISA KEV, indicating limited observed exploitation interest.
Stored cross-site scripting in Element Pack Addons for Elementor WordPress plugin before 8.7.13 allows contributor-level (or higher) authenticated users to inject persistent JavaScript payloads via unsanitized data attributes, which a bundled front-end library subsequently re-parses and renders in victim browsers. Any site visitor loading the compromised page executes the attacker's script in their browser session, enabling session token theft, credential harvesting, or arbitrary actions on behalf of the victim - including administrators. A public proof-of-concept exists via WPScan, though EPSS at 0.16% and SSVC exploitation status of 'none' indicate no observed widespread exploitation at time of analysis.
Clever Mega Menu for Visual Composer (WordPress plugin, versions through 1.0.1) allows any authenticated user with as little as Subscriber-level access to overwrite navigation menu item content and settings through an unprotected AJAX endpoint. The plugin fails to perform either a nonce check or a capability check before processing menu item metadata updates, meaning WordPress role-based access control over menu management is completely bypassed. A publicly available exploit exists via WPScan, though EPSS places exploitation probability at 0.14% (4th percentile) with no CISA KEV listing, indicating limited observed exploitation at time of analysis.
Simple Restrict WordPress plugin before 1.2.9 exposes restricted post and page content through the WordPress REST API due to an authorization bypass. The plugin enforces its own permission system on the front-end but falls back to a generic WordPress capability check on REST API routes, allowing any contributor-level or higher WordPress account to read content that was explicitly restricted via the plugin's access controls. No public exploit identified at time of KEV review, though a proof-of-concept is publicly available via WPScan; the EPSS of 0.13% at the 3rd percentile confirms negligible observed exploitation activity.
Stored XSS in the RT Mega Menu WordPress plugin (versions before 1.5.2) allows any subscriber-level authenticated user to inject persistent JavaScript into the site's public navigation, executing against every visitor who hovers over menu items - including administrators - enabling session theft and full site takeover. The AJAX endpoint that saves mega-menu configuration performs no capability check, relying solely on a nonce that any logged-in user can read from a standard admin page, making the access barrier trivially low. A public exploit is documented by WPScan, and the vendor has released version 1.5.2 as the confirmed fix; no public exploit identified at time of analysis corresponds to active widespread exploitation (no CISA KEV listing), though the public exploit code exists and the low subscriber-level barrier makes this dangerous on sites with open registration.
Meta Box WordPress plugin before 5.13.1 allows any user holding a Contributor-level role (or equivalent low-privilege account) to permanently delete arbitrary media attachments owned by other users, including administrators, due to a missing authorization check on the deletion endpoint. The root cause is CWE-862: the plugin performs the deletion operation without verifying whether the requesting user has ownership or administrative rights over the target attachment. Publicly available exploit code exists (sourced from WPScan), and while EPSS sits at a low 0.17% (6th percentile), the low attack complexity and wide availability of Contributor accounts on multi-author WordPress sites make this a realistic insider or compromised-account threat.
Insecure Direct Object Reference in FluentBoards WordPress plugin before 1.95.3 allows any authenticated user holding member access to at least one board to silently exfiltrate task titles, descriptions, and file attachments from all other boards on the site by supplying arbitrary board item identifiers in an import request. The server performs no authorization check to verify that requested items belong to boards the invoking user is permitted to access, making any board member a potential insider threat against sensitive project data. A public proof-of-concept is available via WPScan; however, EPSS sits at 0.13% (3rd percentile) and no CISA KEV entry exists, indicating limited observed exploitation despite disclosure.
Stored Cross-Site Scripting in JetEngine WordPress plugin before 3.8.12 allows users holding the Contributor role or higher to inject persistent malicious scripts via unescaped post meta values rendered by plugin shortcodes, with execution occurring in the browser context of higher-privileged users including administrators. A publicly available exploit exists per WPScan, though EPSS remains low at 0.15% (5th percentile), suggesting limited observed mass exploitation at time of analysis. The scope-change characteristic (S:C in CVSS) elevates the real-world impact: successful exploitation can lead to admin session hijacking or unauthorized privileged actions despite the medium base score.
Reflected XSS in King Addons for Elementor (all versions before 51.1.76) permits unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by embedding a malicious payload in an unsanitized grid setting parameter reflected verbatim into an HTML attribute via an unauthenticated AJAX endpoint. The attack requires social engineering to deliver a crafted URL to a target user, with no privilege or authentication prerequisite on the server side. A publicly available exploit exists per WPScan; exploitation is not confirmed in CISA KEV, and EPSS at 0.17% (7th percentile) indicates limited observed exploitation at this time.
Vote-limit bypass in YOP Poll WordPress plugin before 7.0.6 allows unauthenticated remote attackers to cast unlimited votes on any public poll by spoofing IP addresses through client-controlled HTTP forwarding headers. The plugin enforces its per-IP vote restriction by reading attacker-supplied headers such as X-Forwarded-For rather than the validated TCP connection IP, making the restriction trivially circumventable. A publicly available proof-of-concept exists per WPScan reporting; EPSS sits at 0.14% (4th percentile), indicating low broad exploitation activity at time of analysis despite the low attack complexity.
Broken object-level authorization in the Event Tickets and Registration WordPress plugin before 5.29.0.1 allows any contributor-level (or higher) WordPress user to overwrite the seating layout, ticket inventory, and attendee seat assignments for events they do not own. The flaw stems from insufficient ownership verification on seating-related actions, meaning a low-privileged authenticated user can manipulate another author's event data without restriction. No public exploitation in the wild has been confirmed by CISA KEV, but a public proof-of-concept exists per WPScan reporting, and the EPSS score of 0.13% (3rd percentile) reflects minimal observed scanning or exploitation activity at time of analysis.
Unauthenticated order status manipulation is possible in the Event Tickets and Registration WordPress plugin across all versions before 5.29.0.1, due to a completely absent authorization check on an order-management REST endpoint. Any remote actor - with no credentials or privileges - can alter the status of existing orders, enabling fraud scenarios such as marking unpaid orders as completed. A publicly available exploit exists per WPScan; however, EPSS at 0.14% (4th percentile) indicates mass exploitation has not materialized at time of analysis, and the vulnerability is not listed in CISA KEV.
Authentication bypass in the Authora : Easy login with mobile number WordPress plugin (all versions before 1.7.7) exposes one-time login codes and valid verification tokens directly in the HTTP response of an unauthenticated endpoint, completely nullifying the mobile-based OTC authentication mechanism. Any unauthenticated attacker who knows a registered user's mobile number - including an administrator's - can obtain a valid session token without receiving an SMS, achieving full account takeover. A publicly available proof-of-concept exploit exists via WPScan; EPSS sits at 0.14% (4th percentile), indicating limited observed exploitation despite POC availability and no CISA KEV listing.
Unauthenticated forged conversion event injection in Pixel Tag Manager for WooCommerce (all versions before 2.2.1) allows any remote attacker to submit fabricated e-commerce conversion events to the site's server-side advertising APIs - such as Meta Conversions API or Google Ads - using the site's own stored credentials. The root cause is a missing authorization check on a WordPress AJAX action (CWE-284), meaning the endpoint processes requests from anyone without verifying identity or role. A publicly available exploit exists per WPScan; however, the EPSS score of 0.14% (4th percentile) indicates opportunistic exploitation has not yet been observed at scale.
Stored cross-site scripting in the Download Manager WordPress plugin before 3.3.66 allows any authenticated user with the Author role or above to inject a malicious JavaScript payload into a download package title, which then executes in the browser of every visitor - including unauthenticated users - who views any page rendering that package. A publicly available proof-of-concept exists, though the EPSS score of 0.19% (9th percentile) and absence of a CISA KEV listing suggest exploitation remains limited and targeted rather than widespread. Vendor-released patch version 3.3.66 is available.
Unrestricted mass assignment in the Booking for Appointments and Events Calendar WordPress plugin (before 2.4.4) permits any user holding the Amelia Manager role to overwrite arbitrary database columns on stored user records by injecting unsanitized fields into customer import requests. This can enable data tampering or privilege manipulation within the booking system's user table. No public exploitation is confirmed via CISA KEV, but a POC is publicly available through WPScan; EPSS remains at 0.13% (3rd percentile), consistent with limited real-world exploitation probability given the high-privilege prerequisite.
Improper authorization in the Brizy WordPress plugin before 2.8.18 allows any authenticated user holding the Contributor role or above to read the full content of arbitrary posts, bypassing WordPress's native visibility controls for private, pending, and draft posts. The flaw resides in a specific request handler that returns post content without verifying whether the requesting user is entitled to view it (CWE-639, IDOR). A publicly available proof-of-concept exploit has been published by WPScan; however, no confirmed active exploitation appears in CISA KEV, and the EPSS score of 0.13% (3rd percentile) reflects limited observed exploitation activity at time of analysis.
CSRF in Podlove Podcast Publisher WordPress plugin (all versions before 4.5.3) allows unauthenticated remote attackers to forge administrative requests that create rogue records or delete legitimate plugin data, provided a logged-in administrator can be socially engineered into visiting a malicious page. A publicly available proof-of-concept exists per WPScan and SSVC data, though EPSS sits at just 0.10% (1st percentile), indicating no significant opportunistic exploitation activity. No CISA KEV listing confirms active in-the-wild exploitation at time of analysis.
Unauthenticated server-side request forgery in the Pixelavo WordPress plugin before 1.5.4 allows any visitor to inject arbitrary Facebook conversion events using the site administrator's stored Conversions API access token. The plugin registers an AJAX endpoint protected only by a nonce that is emitted in plaintext on every public page load, rendering the nonce trivially obtainable and the endpoint effectively unprotected. Attackers can poison the administrator's Facebook Ads analytics with fabricated conversion data and exhaust the configured API quota, degrading ad targeting and measurement. A publicly available exploit exists; no confirmed active exploitation (CISA KEV) at time of analysis.
Missing authorization controls in the Buckaroo WooCommerce Payments Plugin before 4.9.0 allow any authenticated WordPress user - including low-privilege Subscribers - to trigger payment capture refunds against any captured order via an unprotected AJAX endpoint. The flaw causes direct financial integrity loss for merchants, as unauthorized refund processing reverses captured payments without any approval workflow. A publicly available exploit exists per WPScan, though EPSS remains very low at 0.13% (3rd percentile), indicating exploitation has not become widespread despite the accessible attack surface.
Stored cross-site scripting in wpForo Forum WordPress plugin before 3.1.2 allows a subscriber-level authenticated user to inject persistent JavaScript into a profile field that executes in any visitor's browser - including logged-in administrators - upon viewing the attacker's public participant profile page. A publicly available proof-of-concept exploit exists, and the CVSS scope change (S:C) reflects that the injected script runs in victim browser contexts entirely outside the plugin's security boundary, enabling credential theft or admin-level site takeover. EPSS is low (0.15%, 5th percentile), suggesting mass exploitation has not yet materialized despite the public POC.
Unauthenticated OAuth state hijacking in Builderall for WordPress (versions before 3.0.2) enables remote attackers to overwrite the plugin's stored third-party integration access token by completing an OAuth authorization flow that is never bound to the initiating user session. Practical impact is constrained to sites already connected to a paid Builderall account - without that precondition, the overwrite is transient rather than durable. No confirmed active exploitation exists in CISA KEV, but WPScan has published a public proof-of-concept, making this accessible beyond sophisticated attackers despite an EPSS of 0.18% (7th percentile).
CSS injection in the Spectra Legacy WordPress plugin before version 2.20.0 allows authenticated Contributors to embed arbitrary CSS via unvalidated block style attributes that are output verbatim to page front-ends. Anonymous visitors loading affected pages are exposed to attacker-controlled styles enabling page defacement, UI redressing, external resource loading, and side-channel data exfiltration through CSS attribute selectors. JavaScript execution is explicitly blocked by WordPress KSES filtering, constraining the worst-case impact; a publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.12% (2nd percentile), indicating low observed exploitation probability and no CISA KEV listing.
Stored cross-site scripting in the Codeless Page Builder WordPress plugin (versions through 1.1.4) allows contributor-level users to inject arbitrary HTML and JavaScript by supplying unsanitized input as an HTML tag name via a shortcode attribute. When a higher-privileged user such as an administrator views the crafted content, the payload executes in their browser session, enabling session hijacking or unauthorized administrative actions. A public exploit proof-of-concept is available via WPScan; exploitation probability is low per EPSS (0.15%, 5th percentile), suggesting opportunistic rather than widespread active targeting.
Stored cross-site scripting in Admin Columns for ACF Fields WordPress plugin (through 0.3.2) allows contributor-level users to inject unsanitized JavaScript via Advanced Custom Fields values that execute in the browser session of any higher-privileged user who views the affected post-list admin screen. The scope change (S:C in CVSS) reflects that the payload crosses privilege boundaries - a low-privileged contributor can target editors and administrators. A publicly available exploit has been published by WPScan, though EPSS at 0.15% (5th percentile) indicates limited observed exploitation in the wild, and this CVE is not listed in the CISA KEV catalog.
Broken object-level authorization in Fluent Support WordPress plugin before 2.3.1 allows restricted support agents to reassign the customer field on any ticket system-wide, bypassing per-ticket scope enforcement. Affected are WordPress installations running Fluent Support versions prior to 2.3.1 where restricted support agent accounts exist. An authenticated agent can manipulate ticket ownership across the entire helpdesk, exposing customer metadata and corrupting ticket assignment integrity. A publicly available proof-of-concept exists; EPSS probability is very low (0.13%, 3rd percentile) and no CISA KEV listing indicates no confirmed mass exploitation.
Unauthenticated order manipulation in the Direct Payments for WooCommerce WordPress plugin before 2.5.3 enables any remote attacker to forge payment completion states, overwrite payment-method labels, and attach fabricated proof-of-payment files to arbitrary customer orders. The flaw stems from multiple AJAX handlers that process order updates without verifying the requester owns or is otherwise authorized to modify the targeted order. A publicly available proof-of-concept exists and the SSVC framework rates this as automatable, meaningfully amplifying the fraud risk for affected merchants despite the EPSS score of 0.15% (4th percentile).
Stored cross-site scripting in the Bit Form WordPress plugin (versions before 3.1.4) allows administrator-level users to inject persistent JavaScript into a conversational-form display setting that then executes in the browser of any site visitor who views the affected form. The vulnerability is particularly relevant on WordPress multisite installations, where administrators do not hold the unfiltered_html capability and are therefore expected to be constrained to safe content - making this a bypass of that trust model. A public proof-of-concept exists per WPScan, though EPSS sits at 0.16% (6th percentile), suggesting negligible observed exploitation activity at time of analysis.
Directory traversal in Support Genix WordPress plugin before 1.4.48 exposes arbitrary server files to unauthenticated remote attackers via the ticket-attachment download route. Exploitation is constrained to files matching an allowlisted extension set, yet this still enables disclosure of other users' private ticket attachments and any other allowlisted-extension files accessible to the web server process. A publicly available proof-of-concept exists per WPScan, though EPSS sits at only 0.25% (17th percentile), indicating low observed exploitation pressure despite the low attack complexity.
Missing authorization on attachment download endpoints in the Support Genix WordPress plugin (before 1.4.48) exposes private support ticket files to unauthenticated network access. Any caller who possesses a stored attachment's filename can retrieve it directly, bypassing ticket ownership and login checks entirely. A publicly available exploit exists per WPScan, though EPSS sits at 0.14% (4th percentile), indicating no widespread opportunistic exploitation at time of analysis; no CISA KEV listing.
Insecure Direct Object Reference (IDOR) in the wpForo Forum WordPress plugin before 3.1.2 allows any subscriber-level authenticated user to permanently delete the AI chat message history of arbitrary other users by submitting deletion requests without ownership verification. The plugin's AI chat message deletion endpoint does not validate that the targeted conversation belongs to the requesting user, enabling low-privilege account holders to cause irreversible data loss across the platform. A publicly available proof-of-concept exists per WPScan reporting; however, EPSS is extremely low at 0.13% (3rd percentile) and the vulnerability has not been added to the CISA KEV catalog, indicating limited observed exploitation.
Broken Object Level Authorization in the Academy LMS WordPress plugin through 3.8.2 exposes every user's quiz attempt records - including IP addresses, full names, registration dates, and quiz results - to any authenticated subscriber-level user who is enrolled in at least one course. The flaw stems from missing ownership checks on quiz attempt record retrieval endpoints (CWE-639), enabling horizontal privilege escalation across the entire site's student population. A publicly available proof-of-concept exists per WPScan; exploitation probability remains low (EPSS 0.13%, 3rd percentile) with no confirmed active exploitation in CISA KEV.
Stored XSS in ElementsKit Elementor Addons (WordPress plugin before 3.10.01) allows administrative users to inject malicious JavaScript into megamenu menu-item settings, which is rendered unsanitized to all page visitors. The most critical exploitation path targets WordPress multisite networks: a subsite Administrator - a role WordPress normally bars from injecting raw HTML via the unfiltered_html capability - can bypass this restriction through the plugin's misconfigured save routine, planting a payload that executes in Super Admin and site visitor sessions. A publicly available proof-of-concept exists per WPScan; EPSS is low (0.16%) but SSVC flags total technical impact due to the Super Admin session takeover potential on multisite deployments.
Broken object-level authorization (IDOR) in the BuddyPress WordPress plugin, all versions before 14.5.0, permits any authenticated user at the Subscriber level or above to read, modify, or delete private messages belonging to other users via the plugin's messaging endpoints. A publicly available proof-of-concept exists per WPScan reporting, though EPSS data places exploitation probability at just 0.13% (3rd percentile) and SSVC classification marks it as not automatable, indicating exploitation is currently opportunistic and targeted rather than widespread. No CISA KEV listing is present, but the low privilege bar combined with network accessibility makes this a meaningful privacy and integrity risk on any community-facing or multi-tenant WordPress deployment running BuddyPress.
SQL injection in WP Go Maps WordPress plugin (all versions before 10.1.04) allows unauthenticated network attackers to read data from the underlying WordPress database by injecting malicious SQL syntax into an unsanitized plugin parameter. Reported by WPScan, a publicly available proof-of-concept exploit exists for this flaw; however, CISA KEV does not list active exploitation, and EPSS at 0.18% (7th percentile) indicates low observed exploitation probability in the wild. The SSVC framework's 'non-automatable' classification and the CVSS AC:H rating indicate that exploitation requires attacker effort beyond trivial scripting, moderating the real-world urgency despite the unauthenticated attack vector.
Insecure Direct Object Reference (IDOR) in JS Help Desk WordPress plugin before 3.1.5 exposes support ticket data to any low-privileged authenticated user who supplies an arbitrary ticket ID. The plugin performs no ownership check when loading ticket contents, meaning a registered user can enumerate ticket IDs and read PII, message bodies, and reporter identity belonging to other users. A publicly available proof-of-concept exists per WPScan; no confirmed active exploitation (CISA KEV) has been identified, and EPSS remains very low at 0.13%.
User email enumeration in the JS Help Desk WordPress plugin (versions before 3.1.4) allows any Contributor-level site user to harvest the email addresses of all registered WordPress users. Two design flaws compound: the plugin unconditionally grants a support-agent capability to the built-in Contributor role at activation time, and the user-listing handler omits any capability check entirely, making the Contributor elevation the effective attack precondition. A public proof-of-concept is documented by WPScan; however, EPSS places exploitation probability at 0.14% (4th percentile), indicating no public exploit is currently being run at scale. No CISA KEV listing is present.
Broken authorization in the JS Help Desk WordPress plugin (versions prior to 3.1.4) allows any authenticated user at Subscriber level or above to overwrite the content of any support-ticket reply site-wide, regardless of ownership. The plugin's reply-update endpoint fails to validate that the requesting user owns the targeted reply, enabling unauthorized content manipulation across all tickets. A publicly available proof-of-concept exploit exists; no active exploitation has been confirmed in CISA KEV at time of analysis.
JS Help Desk WordPress plugin before 3.1.4 exposes all support ticket content to any authenticated WordPress user due to missing authorization and ownership checks in its search handler. Any account at Subscriber level or above can enumerate and read the subject and full message body of every other user's support ticket by interacting with the plugin's nonce-gated AJAX endpoint, bypassing the intended per-user data isolation. A publicly available proof-of-concept exploit exists per WPScan; EPSS is low at 0.14% (4th percentile), suggesting opportunistic rather than widespread automated exploitation, but the low authentication bar makes this a meaningful data exposure risk on multi-user WordPress sites.
Unauthenticated order document enumeration in the FluentCart WordPress plugin (all versions before 1.5.3) exposes customer PII - names, email addresses, and billing and shipping postal addresses - across every order in a store. CWE-639 (IDOR) is the root cause: order documents are keyed on sequential numeric identifiers with no authorization or ownership validation, so any unauthenticated visitor can iterate through all historical orders. A publicly available exploit exists per WPScan; no active exploitation is confirmed in CISA KEV, though the trivial enumeration method and public PoC substantially lower the barrier to mass data harvesting.
Stored XSS in WP Photo Album Plus (all versions up to 9.2.03.001) allows unauthenticated remote attackers to inject persistent malicious scripts into photo comments by exploiting a decode-after-sanitize flaw in the plugin's comment pipeline. The sanitization sequence in `wppa-functions.php` applies `wp_kses` then `wp_strip_all_tags()` on write, but neither function decodes HTML entities before inspecting markup - a double-encoded payload such as `<script>` passes both filters as harmless text, is stored one entity-decode level down, and renders as executable HTML when a victim's browser processes the page. A public proof-of-concept is available via WPScan; however, the vulnerability is not in CISA KEV and EPSS sits at 0.15% (5th percentile), indicating no observed mass exploitation at time of analysis.
Reflected cross-site scripting in the Ultimate Addons for WPBakery Page Builder WordPress plugin (all versions before 3.21.5) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted URL processed by the plugin's shared link-rendering function, uavc_link_init(). A publicly available proof-of-concept exploit was reported by WPScan, though EPSS places exploitation probability at just 0.15% (5th percentile), suggesting opportunistic rather than widespread active exploitation. No CISA KEV listing was identified at the time of analysis.
Unauthenticated download of exported member and payment PII is possible in the Paid Membership Subscriptions WordPress plugin before 3.0.7 due to export files being written to a predictable, unprotected path within the publicly accessible uploads directory. Any site running an affected version where an administrator has recently triggered an export is at risk of exposing member personally identifiable information and payment records to any network-accessible attacker. A publicly available proof-of-concept exploit exists per WPScan, and while the CVSS base score is low (3.7), the data sensitivity of the exposed artifact elevates real-world impact beyond what the score alone suggests.
Insecure Direct Object Reference in the Paid Membership Subscriptions WordPress plugin (before 3.0.7) allows any authenticated subscriber-level user to enumerate and retrieve payment records belonging to other members. The AJAX handler responsible for payment data retrieval performs neither a WordPress capability check nor a nonce validation, meaning horizontal privilege escalation requires only a valid low-privilege account on the target site. A publicly available proof-of-concept exists per WPScan, though no CISA KEV listing confirms active widespread exploitation at time of analysis.
Stored XSS in the NewStatPress WordPress plugin (all versions before 1.4.5) allows unauthenticated remote attackers to inject persistent malicious scripts by supplying crafted HTTP request data that the plugin logs without sanitization and later renders in its statistics widgets. Any authenticated user - including administrators - who views the affected widget triggers the stored payload in their browser, enabling session hijacking, credential theft, or unauthorized administrative actions. A public exploit exists via WPScan, though EPSS at 0.17% (7th percentile) indicates exploitation has not yet become widespread.
Unauthenticated data overwrite in the Events Made Easy WordPress plugin (all versions before 3.1.4) allows any remote, unauthenticated attacker to overwrite personal data stored in any person record by exploiting a missing authorization check on data-change endpoints. The plugin's nonce mechanism is public and shared, providing no per-record token or ownership binding, making it trivially bypassable under CWE-639. A publicly available exploit exists per WPScan research; no active exploitation has been confirmed in CISA KEV at time of analysis.
Unauthenticated mailing list subscription abuse in the Mailgun for WordPress plugin before 2.2.1 allows any remote attacker to enroll arbitrary email addresses into the site owner's Mailgun mailing lists by exploiting an unprotected AJAX endpoint. The plugin's stored API credentials are silently invoked on the attacker's behalf, effectively weaponizing the site owner's Mailgun account against third-party email addresses. A public exploit is available via WPScan, though the EPSS score of 0.14% (4th percentile) and absence from CISA KEV indicate limited observed exploitation to date.
Stored XSS in the Lightbox with PhotoSwipe WordPress plugin before 5.9.0 allows author-level users (lacking unfiltered_html) to inject arbitrary JavaScript into image lightbox captions via an unsanitized link data attribute. The payload executes in the browser of any visitor or administrator who opens the affected lightbox, enabling session hijacking or privilege escalation against site administrators. A publicly available exploit documents the technique; no active exploitation is confirmed via CISA KEV, though the author-level entry bar is low on sites with multiple contributors.
SQL injection in the Check & Log Email WordPress plugin (all versions before 2.0.15) allows authenticated WordPress administrators to execute arbitrary SQL queries against the underlying database via unsanitized parameters. With PR:H per the CVSS vector, exploitation is constrained to admin-level accounts, making the primary threat a rogue insider or a follow-on attack after admin credential compromise. A public proof-of-concept is available through WPScan; however, EPSS at 0.16% (6th percentile) and absence from CISA KEV indicate no confirmed widespread exploitation campaign at time of analysis.
GiveWP WordPress donation plugin before version 4.16.3 allows unauthenticated users to route donations through payment gateways the administrator has explicitly disabled, by supplying a gateway identifier via request input that the plugin fails to validate against the admin-configured allowlist. Rooted in CWE-862 (Missing Authorization), this bypasses financial controls that site operators may have disabled for compliance, fraud prevention, or contractual reasons - making the practical business risk higher than the CVSS Medium score suggests. A publicly available proof-of-concept exists via WPScan; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Broken object-level authorization in the Tutor LMS WordPress plugin (all versions before 4.0.0) allows any authenticated subscriber-level user to read Q&A threads and inject replies into courses they are not enrolled in or authorized to access. Exploitation requires only a valid WordPress account, making the barrier low for multi-tenant LMS deployments where user registration is open. A publicly available proof-of-concept exists per WPScan, and while not listed in CISA KEV, the low authentication requirement and POC availability elevate realistic risk for exposed installations.
Unauthenticated post metadata manipulation in WP Delicious (WordPress plugin before 1.10.2) allows any remote actor to inflate "like" counters and grow an associated identifier list on arbitrary posts without any credentials or user interaction. The flaw stems from a missing authorization check on a WordPress AJAX action accessible to unauthenticated visitors. A publicly available proof-of-concept exists; SSVC confirms automatable exploitation with partial technical impact, though no CISA KEV listing indicates active widespread exploitation has not been confirmed.
Stored cross-site scripting in the Brizy WordPress plugin before 2.8.19 allows any authenticated user with Contributor role or above to plant persistent XSS payloads via unsanitized featured-image focal-point coordinates submitted through an AJAX action. When a higher-privileged user (Editor or Administrator) later opens the affected post for review, the injected script executes silently in their browser session, enabling session hijacking or unauthorized administrative actions. A publicly available exploit exists per WPScan; the vendor has released a fix in version 2.8.19.
Stored XSS in the Brizy WordPress plugin (all versions before 2.8.19) allows authenticated Author-level users to inject arbitrary JavaScript into site-global design data, which is then rendered unsanitized on every front-end page of the affected site. Every visitor's browser - including site administrators - silently executes the payload upon page load, enabling session hijacking, credential theft, or full site takeover. A publicly available proof-of-concept exists per WPScan, though no active exploitation is confirmed in CISA KEV; EPSS sits at 0.16% (6th percentile), suggesting opportunistic rather than automated mass exploitation.
Contest Gallery WordPress plugin (all versions before 30.0.7) exposes the site's complete stored OpenAI prompt history to any authenticated user holding at minimum a Subscriber role, due to a handler that performs neither a capability check nor a nonce verification. An attacker with a basic WordPress account can call the unprotected AJAX endpoint directly to exfiltrate the full prompt history, potentially exposing confidential business logic, AI workflows, or sensitive data embedded in prompts. No active exploitation is confirmed (not in CISA KEV), but a publicly available proof-of-concept exists per WPScan, and EPSS remains low at 0.13% (3rd percentile).
Missing authorization in the miniOrange 2FA WordPress plugin before 6.2.7 allows any authenticated low-privileged user to trigger OTP email delivery to arbitrary email addresses and exhaust the site's metered OTP quota. The plugin's second-factor enrollment endpoint neither restricts which users may invoke it nor binds the OTP recipient to the enrolling user's own address, enabling both unsolicited OTP email delivery and a denial-of-service attack against other users' 2FA flows. No public exploitation or KEV listing has been identified, though a public proof-of-concept is available via WPScan; EPSS stands at 0.13% (3rd percentile), indicating low observed exploitation activity.
Stored cross-site scripting in the Nested Pages WordPress plugin (all versions before 3.2.15) allows authenticated users holding the Editor role - or Contributor/Author roles when the plugin is configured to manage those post types - to inject arbitrary JavaScript via unsanitized post titles that are reflected unescaped into HTML attributes on the plugin's administrative listing screen. Any higher-privileged user (including Administrators) who subsequently loads that screen will execute the attacker-controlled script within their own authenticated session, enabling session hijacking, credential theft, or unauthorized administrative actions. A publicly available proof-of-concept exploit exists per the WPScan advisory; the vulnerability is not listed in CISA KEV and the EPSS score is negligible (0.15%, 5th percentile), suggesting opportunistic rather than widespread active exploitation.
Server-Side Request Forgery in the Visualizer WordPress plugin before 4.0.6 allows any authenticated Contributor-level user to pivot through the WordPress server and reach link-local instance-metadata endpoints (e.g., 169.254.169.254), returning the full response to the attacker. On cloud-hosted WordPress deployments (AWS, GCP, Azure), this enables non-blind exfiltration of IAM credentials and other instance metadata, potentially leading to full cloud account compromise. A publicly available proof-of-concept exploit exists; exploitation probability is currently low (EPSS 0.14%, 3rd percentile) but the concrete cloud-credential impact makes this a material priority for cloud-hosted sites.
SQL injection in the Database for Contact Form 7, WPforms, Elementor forms WordPress plugin (versions before 1.5.5) exposes the underlying WordPress database to unauthorized read access by any user holding a specific capability that defaults to administrators but can be explicitly delegated to lower-privileged roles. The CVSS scope-change rating (S:C/C:H) reflects that a successful injection reaches beyond the plugin itself into the shared WordPress database, potentially exposing all stored form submissions, user data, and other sensitive records. Publicly available exploit code exists per WPScan; however, EPSS at 0.16% (5th percentile) and absence from CISA KEV indicate no confirmed widespread active exploitation at time of analysis.
Horizontal privilege escalation in the Paid Membership Subscriptions WordPress plugin (all versions before 3.0.8) allows any subscriber-level authenticated user to hijack and overwrite another member's subscription - including plan tier, status, and expiration date - by submitting a crafted change-subscription checkout request with an arbitrary subscription ID. The root cause is a missing ownership verification check at the business logic layer of the checkout flow (CWE-284). A publicly available proof-of-concept exploit has been published by WPScan, though EPSS sits at just 0.13% (3rd percentile), suggesting limited automated exploitation so far. The vulnerability is not listed in CISA KEV at time of analysis.
Stored cross-site scripting in the Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 allows contributor-level (and higher) WordPress users to inject arbitrary JavaScript into quiz question settings via an unquoted HTML attribute. The injected payload persists and executes in the browser of any site visitor who views the affected quiz, enabling session hijacking, credential theft, or defacement targeting the broader user base. No active exploitation is confirmed by CISA KEV, but a public proof-of-concept is available via WPScan, and vendor-released patch version 11.2.2 is available.
Unauthenticated consent-record forgery and privacy-queue flooding affect GDPR Framework By Data443 WordPress plugin versions prior to 2.4.0. The plugin fails to verify the identity of the data subject or check authorization when recording cookie-consent choices and processing privacy requests, allowing any unauthenticated remote attacker to submit fraudulent GDPR consent records on behalf of arbitrary email addresses and to inject unlimited entries into the site's privacy-request queue. A publicly available proof-of-concept exists per WPScan; the vulnerability is not listed in the CISA KEV catalog, and EPSS sits at 0.15% (4th percentile), indicating low observed exploitation at time of analysis.
Improper access control in the wpForo Forum WordPress plugin before 3.1.3 permits any subscriber-level authenticated user to write to administrator-controlled profile fields - including account activation status and forum reputation score - during a standard self-service profile update. This allows a banned or pending user to self-activate their own account, bypassing moderator enforcement, and to forge an arbitrarily high reputation score that may unlock elevated forum privileges. No CISA KEV listing exists, but a publicly available exploit is documented by WPScan; the EPSS score of 0.14% (4th percentile) indicates low observed exploitation probability at scale, though the low barrier to attack (any registered user) makes it a meaningful integrity risk for moderated forums.
Signature forgery in the MonsterInsights WordPress plugin before 11.1.0 allows unauthenticated network attackers to overwrite plugin configuration values when the site is not connected to Google Analytics. The root cause is that the HMAC signing key used to authenticate a specific AJAX action defaults to an empty string in that disconnected state, making any forged HMAC trivially valid. The practical impact is limited to disrupting server-side analytics in Manual GA4 mode; no public exploit identified as actively exploited (not in CISA KEV), though a publicly available proof-of-concept exists and the EPSS probability is low at 0.15%.
Blind Server-Side Request Forgery in the EmbedPress WordPress plugin (all versions before 4.6.1) allows unauthenticated remote attackers to coerce the WordPress server into issuing arbitrary HTTP requests to internal hosts and services, bypassing WordPress core URL validation entirely. The vulnerability exists on unauthenticated endpoints, requiring zero credentials or user interaction, making mass exploitation trivially automatable against any site running a vulnerable plugin version. A publicly available proof-of-concept exists (via WPScan), though EPSS of 0.14% (4th percentile) suggests exploitation remains limited in practice; no active exploitation is confirmed by CISA KEV.
Server-Side Request Forgery in Simple Google Calendar Outlook Events Widget WordPress plugin (all versions before 3.1.0) permits unauthenticated remote attackers to supply arbitrary URLs that the server fetches without validation, potentially exposing responses from internal services. The plugin is confirmed vulnerable by WPScan and a public exploit exists, though EPSS at 0.14% (4th percentile) indicates limited observed exploitation despite the available POC. This vulnerability is not listed in CISA KEV at time of analysis.
Broken object-level authorization in the Dokan WordPress plugin (versions before 5.0.9) allows any authenticated vendor on a multivendor marketplace to overwrite product attributes and default attributes belonging to other vendors via the plugin's REST API write endpoints. Exploitation requires only a low-privilege vendor account - no admin access needed - making this accessible to any registered seller on the platform. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.13% (3rd percentile), indicating limited observed exploitation activity so far; the vulnerability is not listed in CISA KEV.
Order ownership bypass in Dokan Multivendor for WordPress (versions before 5.0.9) allows any authenticated vendor to modify the status of arbitrary WooCommerce orders across the entire marketplace, including orders owned by other vendors and customers. The flaw stems from a REST endpoint handling bulk order-status changes that accepts attacker-supplied order IDs without verifying the requesting vendor's ownership of those orders. No active exploitation is confirmed (not in CISA KEV), but a publicly available proof-of-concept exists and EPSS at 0.13% (3rd percentile) reflects low observed exploitation to date.
Unauthorized lesson content disclosure in Academy LMS WordPress plugin before 3.8.3 allows any subscriber-level authenticated user to read arbitrary lesson content via the REST API - including lessons from paid courses they have not purchased and lessons in unpublished states (draft, pending, private). The root cause is a complete absence of enrollment and publication-status validation in the single-lesson REST API endpoint. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.13% (3rd percentile) and SSVC classification as non-automatable indicate limited observed exploitation activity at the time of analysis.
PHP Object Injection in Clearfy Cache WordPress plugin (versions before 2.4.3) exposes administrator-authenticated users to potential remote code execution through unrestricted deserialization during settings import. The plugin's import handler passes attacker-controlled serialized data to PHP's unserialize() without class whitelisting, enabling object injection. A publicly available POC exists via WPScan, though RCE is conditional on a suitable gadget chain being present in the WordPress environment; EPSS is low (0.21%, 12th percentile) and no CISA KEV listing has been issued, indicating no confirmed widespread exploitation.
ProfileGrid WordPress plugin before version 6.0.0.0 exposes pending group membership request data to any authenticated user due to missing authorization checks on the listing endpoint. Any subscriber-level account can enumerate the names and request timestamps of users awaiting approval for any group, including groups configured as private. No active exploitation is confirmed (not in CISA KEV), though a public exploit exists via WPScan; EPSS of 0.13% (3rd percentile) places real-world exploitation probability as very low.
Stored cross-site scripting in the Simple Membership WordPress plugin before 4.7.8 allows unauthenticated attackers to inject arbitrary JavaScript into the WordPress administration dashboard by supplying a malicious subscriber name in a payment approval request. Because the plugin neither sanitizes the input at ingestion nor escapes it on output when rendered for administrators, the payload persists server-side and executes in any administrator's browser session upon viewing the affected dashboard panel. A public proof-of-concept exploit exists (reported by WPScan); however, EPSS stands at 0.17% (7th percentile) and CISA KEV listing is absent, indicating limited observed mass exploitation at time of analysis.
Stored cross-site scripting in the Blog Floating Button WordPress plugin (≤1.4.20) allows unauthenticated attackers to inject malicious JavaScript via the HTTP User-Agent header into the plugin's visitor tracking REST endpoint. The payload persists in the database and executes in the browser session of any administrator who opens the plugin's access report page, enabling full site takeover through the hijacked admin session. A publicly available proof-of-concept from WPScan confirms the attack path; no vendor-released patch has been identified at time of analysis.
GEO my WP WordPress plugin versions before 4.5.5.3 allows any subscriber-level (or higher) authenticated user to modify or permanently delete geolocation records belonging to other users or posts by supplying arbitrary record IDs to two unprotected AJAX actions. The root cause is a complete absence of ownership and capability checks on these endpoints, a textbook CWE-639 IDOR. A publicly available exploit exists per WPScan; however, no public exploit identified at time of analysis corresponds to confirmed active exploitation (not in CISA KEV), and the EPSS score of 0.13% at the 3rd percentile reflects low observed exploitation activity despite POC availability. A vendor-released patch is available in version 4.5.5.3.
Insecure Direct Object Reference (IDOR) in the Tag, Category, and Taxonomy Manager WordPress plugin before 3.51.0 allows authenticated contributors to disclose content from private or draft posts they do not own. The plugin fails to verify post ownership before processing a referenced post ID and returning derived data, enabling a contributor to enumerate and extract information from restricted content authored by other users. No public exploitation in the wild has been confirmed (no CISA KEV listing), though WPScan has published a publicly available proof-of-concept.
Stored XSS in the SVG Support WordPress plugin (before 2.5.17) is achieved by uploading a script-bearing .svgz file, bypassing the plugin's sanitization logic that applies only to .svg uploads despite both extensions being registered and served as SVG content. Any WordPress user role granted SVG upload access - such as an Author - can plant the payload, which then executes in the browser of any subsequent visitor, including administrators, enabling session hijacking or privileged action injection. A public proof-of-concept exists via WPScan; EPSS is low (0.16%, 6th percentile) and SSVC rates exploitation as non-automatable, but the stored nature of the payload and admin-reachability elevate practical impact.
Path traversal in the 'Import and export users and customers' WordPress plugin (versions before 2.4.3) enables high-privileged WordPress users to read arbitrary files on the underlying server by supplying a crafted file path during the CSV import workflow. Confidentiality impact is rated High by NVD (CVSS:3.1 C:H), exposing sensitive server files such as wp-config.php, /etc/passwd, or application secrets. A publicly available proof-of-concept exists via WPScan, though EPSS sits at a low 0.16% (6th percentile), indicating that mass exploitation has not materialized despite POC disclosure - likely because high-privilege access is a prerequisite.
PHP object injection via unsafe deserialization in the ChamaWP WordPress plugin (versions before 1.0.13) enables unauthenticated network attackers to achieve remote code execution, contingent on the presence of a suitable gadget chain within the broader WordPress installation. The CVSS vector (PR:N, UI:N) confirms no authentication or user interaction is required, though the AC:H rating reflects the dependency on exploitable gadget chains from co-installed plugins or libraries. A public proof-of-concept exists per WPScan, with EPSS at 0.22% (13th percentile), indicating low current automated exploitation activity despite code availability - this suggests targeted rather than widespread opportunistic exploitation at time of analysis.
Unauthorized revenue data disclosure in the Classified Listing WordPress plugin (before 5.4.4) allows any authenticated contributor-level user to read daily store revenue figures restricted to administrators and report managers. The flaw stems from a missing capability check (CWE-862) on an AJAX action that aggregates store revenue totals, exposing potentially sensitive business intelligence to lower-privileged users. No public exploit identified at time of analysis per KEV, though a publicly available exploit exists per WPScan reporting; the EPSS score of 0.13% (3rd percentile) suggests limited real-world exploitation interest despite code availability.
The Classified Listing WordPress plugin before version 5.4.4 exposes private, draft, and pending post content to authenticated contributors due to a missing authorization and ownership check on an AJAX endpoint. Any user with contributor-level access or higher can read arbitrary post content belonging to other users, including administrators' unpublished material. A publicly available exploit exists via WPScan, though EPSS at 0.13% (3rd percentile) and the absence of a CISA KEV listing indicate active exploitation is not confirmed at time of analysis.
Post-deletion authorization bypass in the Contest Gallery WordPress plugin before 30.0.7 allows any authenticated Author-level or higher user to permanently delete arbitrary posts, pages, and other WordPress content they do not own. The plugin's post-deletion AJAX handler enforces only a coarse role-membership test, entirely omitting per-object capability verification and nonce validation - the two controls that WordPress's built-in permission model relies on to prevent cross-user destructive actions. A public exploit is available via WPScan, lowering the skill barrier; though EPSS is low at 0.13%, any multi-author site with untrusted Author accounts faces real and irreversible content destruction risk.
Broken access control in Simply Schedule Appointments WordPress plugin before 1.6.12.11 exposes all customer appointment records to any authenticated Contributor-level user site-wide. The administrative appointment-listing shortcode omits a capability check, and the per-user result scoping logic defaults to showing all records when the requesting user is not recognized as staff. Any WordPress user holding the Contributor role or higher - a commonly granted role in multi-author sites - can enumerate names, email addresses, phone numbers, and appointment notes belonging to every customer in the system. A publicly available proof-of-concept exists, though EPSS at 0.13% and SSVC Automatable:No suggest exploitation remains targeted rather than widespread.
Unauthenticated REST API access in the webtoffee-cookie-consent WordPress plugin before 3.5.3 allows any network attacker to export or delete stored visitor consent records, create arbitrary WordPress posts, and alter the plugin's licensing state. All versions prior to 3.5.3 are affected with no special configuration required, as the missing permission callbacks expose endpoints to public access by default. A publicly available exploit exists per WPScan, though EPSS sits at 0.22% (12th percentile), indicating exploitation has not yet reached widespread automated abuse; no public exploit identified at time of analysis for active in-the-wild campaigns.
Stored Cross-Site Scripting in the Charitable WordPress donation plugin (versions before 1.8.5.3) allows authenticated users holding a high-privilege campaign-management role to inject persistent malicious scripts via an unsanitized campaign image text field that is rendered unescaped inside an HTML attribute on the public-facing campaign page. Any site visitor who loads that page becomes a potential victim, enabling session hijacking, credential theft, or defacement against the site's front-end audience. A publicly available proof-of-concept exploit exists; however, no active exploitation has been confirmed in CISA KEV, and the EPSS score of 0.16% (6th percentile) reflects low broad-exploitation probability consistent with the high-privilege prerequisite.
Broken object-level authorization in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3.7) allows any authenticated user with the Contributor role or higher to modify the title and publication status of arbitrary posts and pages sitewide - including content they do not own. The plugin's quick-edit event handler validates only a global WordPress capability (e.g., edit_posts) without confirming whether the requesting user owns the target object, enabling horizontal and vertical privilege escalation over site content. A publicly available proof-of-concept exists; however, no confirmed active exploitation has been identified and the EPSS score sits at 0.13%, indicating limited real-world adversary interest at time of analysis.
Stored cross-site scripting in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3.7) permits any authenticated user holding the Author role or higher to permanently inject arbitrary JavaScript into event timeline content. Because the plugin fails to sanitize or escape this input before storing and rendering it on public event pages, every site visitor - including administrators - who loads the affected event page executes the attacker's script in their own browser context. A publicly available proof-of-concept exists; no active exploitation is confirmed in CISA KEV, but the low barrier to entry (any Author-level account) elevates practical risk on sites permitting open or semi-open registration.
PHP object injection in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3.7) allows authenticated contributors to deserialize attacker-controlled PHP objects through event content fields. Exploitation to achieve remote code execution, arbitrary file deletion, or sensitive data retrieval depends entirely on the presence of a usable POP (Property-Oriented Programming) chain from a co-installed plugin or theme - none exists within this plugin itself. A publicly available exploit exists per WPScan (EUVD-2026-51948), and this CVE represents an incomplete remediation of prior object-injection advisories affecting the same plugin.
Cross-site request forgery in the Frontend File Manager Plugin for WordPress (all versions through 23.6) enables attackers to silently modify file metadata belonging to authenticated users by luring victims to attacker-controlled pages, with the corrupted metadata directly enabling unauthorized download of those files. When the plugin's guest upload feature is active, the vulnerable metadata update endpoint becomes fully unauthenticated, eliminating the need for any victim interaction and exposing every user's uploaded files to arbitrary metadata manipulation. WPScan has published a proof-of-concept, though EPSS at 0.10% (1st percentile) indicates limited observed exploitation activity to date - no public exploit identified at time of analysis reaches CISA KEV status.
Insecure Direct Object Reference (IDOR) in the ProfileGrid WordPress plugin before 5.9.9.8 allows any authenticated user - including low-privilege Subscribers - to delete arbitrary other users' notifications by enumerating integer notification identifiers. The plugin's notification deletion endpoint fails to verify that the requested notification belongs to the authenticated requester, exposing all users' notifications to deletion by any site member. A publicly available exploit exists per WPScan, though EPSS sits at 0.13% (3rd percentile), indicating low observed exploitation activity at time of analysis.
Stored cross-site scripting in the Narrative Publisher WordPress plugin (≤1.0.7) lets contributor-level authenticated users inject arbitrary JavaScript into a REST-accessible post meta field that is neither access-controlled nor escaped on output. When any higher-privileged user - editor, administrator - views the affected post, the malicious script executes in their browser session, enabling session hijacking or privilege escalation to site administrator. A public proof-of-concept is available via WPScan; no KEV listing is present and the EPSS score (0.15%, 5th percentile) indicates limited opportunistic exploitation at time of analysis.
Cache management actions in the LWS Optimize WordPress plugin before version 3.4 lack authorization checks, permitting any authenticated user - including low-privileged Subscribers - to flush the site's caches and trigger repeated, resource-intensive cache rebuilds. The vulnerability is classified as CWE-862 (Missing Authorization) and carries a CVSS 3.1 score of 4.3 (Medium), with impact limited to availability degradation rather than data exposure or modification. A publicly available proof-of-concept exists per WPScan reporting, though EPSS sits at a very low 0.13% (3rd percentile) and the vulnerability is not listed in CISA KEV, indicating limited observed exploitation interest.
Stored cross-site scripting in Element Pack Addons for Elementor WordPress plugin before 8.7.13 allows contributor-level (or higher) authenticated users to inject persistent JavaScript payloads via unsanitized data attributes, which a bundled front-end library subsequently re-parses and renders in victim browsers. Any site visitor loading the compromised page executes the attacker's script in their browser session, enabling session token theft, credential harvesting, or arbitrary actions on behalf of the victim - including administrators. A public proof-of-concept exists via WPScan, though EPSS at 0.16% and SSVC exploitation status of 'none' indicate no observed widespread exploitation at time of analysis.
Clever Mega Menu for Visual Composer (WordPress plugin, versions through 1.0.1) allows any authenticated user with as little as Subscriber-level access to overwrite navigation menu item content and settings through an unprotected AJAX endpoint. The plugin fails to perform either a nonce check or a capability check before processing menu item metadata updates, meaning WordPress role-based access control over menu management is completely bypassed. A publicly available exploit exists via WPScan, though EPSS places exploitation probability at 0.14% (4th percentile) with no CISA KEV listing, indicating limited observed exploitation at time of analysis.
Simple Restrict WordPress plugin before 1.2.9 exposes restricted post and page content through the WordPress REST API due to an authorization bypass. The plugin enforces its own permission system on the front-end but falls back to a generic WordPress capability check on REST API routes, allowing any contributor-level or higher WordPress account to read content that was explicitly restricted via the plugin's access controls. No public exploit identified at time of KEV review, though a proof-of-concept is publicly available via WPScan; the EPSS of 0.13% at the 3rd percentile confirms negligible observed exploitation activity.
Stored XSS in the RT Mega Menu WordPress plugin (versions before 1.5.2) allows any subscriber-level authenticated user to inject persistent JavaScript into the site's public navigation, executing against every visitor who hovers over menu items - including administrators - enabling session theft and full site takeover. The AJAX endpoint that saves mega-menu configuration performs no capability check, relying solely on a nonce that any logged-in user can read from a standard admin page, making the access barrier trivially low. A public exploit is documented by WPScan, and the vendor has released version 1.5.2 as the confirmed fix; no public exploit identified at time of analysis corresponds to active widespread exploitation (no CISA KEV listing), though the public exploit code exists and the low subscriber-level barrier makes this dangerous on sites with open registration.
Meta Box WordPress plugin before 5.13.1 allows any user holding a Contributor-level role (or equivalent low-privilege account) to permanently delete arbitrary media attachments owned by other users, including administrators, due to a missing authorization check on the deletion endpoint. The root cause is CWE-862: the plugin performs the deletion operation without verifying whether the requesting user has ownership or administrative rights over the target attachment. Publicly available exploit code exists (sourced from WPScan), and while EPSS sits at a low 0.17% (6th percentile), the low attack complexity and wide availability of Contributor accounts on multi-author WordPress sites make this a realistic insider or compromised-account threat.
Insecure Direct Object Reference in FluentBoards WordPress plugin before 1.95.3 allows any authenticated user holding member access to at least one board to silently exfiltrate task titles, descriptions, and file attachments from all other boards on the site by supplying arbitrary board item identifiers in an import request. The server performs no authorization check to verify that requested items belong to boards the invoking user is permitted to access, making any board member a potential insider threat against sensitive project data. A public proof-of-concept is available via WPScan; however, EPSS sits at 0.13% (3rd percentile) and no CISA KEV entry exists, indicating limited observed exploitation despite disclosure.
Stored Cross-Site Scripting in JetEngine WordPress plugin before 3.8.12 allows users holding the Contributor role or higher to inject persistent malicious scripts via unescaped post meta values rendered by plugin shortcodes, with execution occurring in the browser context of higher-privileged users including administrators. A publicly available exploit exists per WPScan, though EPSS remains low at 0.15% (5th percentile), suggesting limited observed mass exploitation at time of analysis. The scope-change characteristic (S:C in CVSS) elevates the real-world impact: successful exploitation can lead to admin session hijacking or unauthorized privileged actions despite the medium base score.
Reflected XSS in King Addons for Elementor (all versions before 51.1.76) permits unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by embedding a malicious payload in an unsanitized grid setting parameter reflected verbatim into an HTML attribute via an unauthenticated AJAX endpoint. The attack requires social engineering to deliver a crafted URL to a target user, with no privilege or authentication prerequisite on the server side. A publicly available exploit exists per WPScan; exploitation is not confirmed in CISA KEV, and EPSS at 0.17% (7th percentile) indicates limited observed exploitation at this time.
Vote-limit bypass in YOP Poll WordPress plugin before 7.0.6 allows unauthenticated remote attackers to cast unlimited votes on any public poll by spoofing IP addresses through client-controlled HTTP forwarding headers. The plugin enforces its per-IP vote restriction by reading attacker-supplied headers such as X-Forwarded-For rather than the validated TCP connection IP, making the restriction trivially circumventable. A publicly available proof-of-concept exists per WPScan reporting; EPSS sits at 0.14% (4th percentile), indicating low broad exploitation activity at time of analysis despite the low attack complexity.
Broken object-level authorization in the Event Tickets and Registration WordPress plugin before 5.29.0.1 allows any contributor-level (or higher) WordPress user to overwrite the seating layout, ticket inventory, and attendee seat assignments for events they do not own. The flaw stems from insufficient ownership verification on seating-related actions, meaning a low-privileged authenticated user can manipulate another author's event data without restriction. No public exploitation in the wild has been confirmed by CISA KEV, but a public proof-of-concept exists per WPScan reporting, and the EPSS score of 0.13% (3rd percentile) reflects minimal observed scanning or exploitation activity at time of analysis.
Unauthenticated order status manipulation is possible in the Event Tickets and Registration WordPress plugin across all versions before 5.29.0.1, due to a completely absent authorization check on an order-management REST endpoint. Any remote actor - with no credentials or privileges - can alter the status of existing orders, enabling fraud scenarios such as marking unpaid orders as completed. A publicly available exploit exists per WPScan; however, EPSS at 0.14% (4th percentile) indicates mass exploitation has not materialized at time of analysis, and the vulnerability is not listed in CISA KEV.
Authentication bypass in the Authora : Easy login with mobile number WordPress plugin (all versions before 1.7.7) exposes one-time login codes and valid verification tokens directly in the HTTP response of an unauthenticated endpoint, completely nullifying the mobile-based OTC authentication mechanism. Any unauthenticated attacker who knows a registered user's mobile number - including an administrator's - can obtain a valid session token without receiving an SMS, achieving full account takeover. A publicly available proof-of-concept exploit exists via WPScan; EPSS sits at 0.14% (4th percentile), indicating limited observed exploitation despite POC availability and no CISA KEV listing.
Unauthenticated forged conversion event injection in Pixel Tag Manager for WooCommerce (all versions before 2.2.1) allows any remote attacker to submit fabricated e-commerce conversion events to the site's server-side advertising APIs - such as Meta Conversions API or Google Ads - using the site's own stored credentials. The root cause is a missing authorization check on a WordPress AJAX action (CWE-284), meaning the endpoint processes requests from anyone without verifying identity or role. A publicly available exploit exists per WPScan; however, the EPSS score of 0.14% (4th percentile) indicates opportunistic exploitation has not yet been observed at scale.
Stored cross-site scripting in the Download Manager WordPress plugin before 3.3.66 allows any authenticated user with the Author role or above to inject a malicious JavaScript payload into a download package title, which then executes in the browser of every visitor - including unauthenticated users - who views any page rendering that package. A publicly available proof-of-concept exists, though the EPSS score of 0.19% (9th percentile) and absence of a CISA KEV listing suggest exploitation remains limited and targeted rather than widespread. Vendor-released patch version 3.3.66 is available.
Unrestricted mass assignment in the Booking for Appointments and Events Calendar WordPress plugin (before 2.4.4) permits any user holding the Amelia Manager role to overwrite arbitrary database columns on stored user records by injecting unsanitized fields into customer import requests. This can enable data tampering or privilege manipulation within the booking system's user table. No public exploitation is confirmed via CISA KEV, but a POC is publicly available through WPScan; EPSS remains at 0.13% (3rd percentile), consistent with limited real-world exploitation probability given the high-privilege prerequisite.
Improper authorization in the Brizy WordPress plugin before 2.8.18 allows any authenticated user holding the Contributor role or above to read the full content of arbitrary posts, bypassing WordPress's native visibility controls for private, pending, and draft posts. The flaw resides in a specific request handler that returns post content without verifying whether the requesting user is entitled to view it (CWE-639, IDOR). A publicly available proof-of-concept exploit has been published by WPScan; however, no confirmed active exploitation appears in CISA KEV, and the EPSS score of 0.13% (3rd percentile) reflects limited observed exploitation activity at time of analysis.
CSRF in Podlove Podcast Publisher WordPress plugin (all versions before 4.5.3) allows unauthenticated remote attackers to forge administrative requests that create rogue records or delete legitimate plugin data, provided a logged-in administrator can be socially engineered into visiting a malicious page. A publicly available proof-of-concept exists per WPScan and SSVC data, though EPSS sits at just 0.10% (1st percentile), indicating no significant opportunistic exploitation activity. No CISA KEV listing confirms active in-the-wild exploitation at time of analysis.
Unauthenticated server-side request forgery in the Pixelavo WordPress plugin before 1.5.4 allows any visitor to inject arbitrary Facebook conversion events using the site administrator's stored Conversions API access token. The plugin registers an AJAX endpoint protected only by a nonce that is emitted in plaintext on every public page load, rendering the nonce trivially obtainable and the endpoint effectively unprotected. Attackers can poison the administrator's Facebook Ads analytics with fabricated conversion data and exhaust the configured API quota, degrading ad targeting and measurement. A publicly available exploit exists; no confirmed active exploitation (CISA KEV) at time of analysis.
Missing authorization controls in the Buckaroo WooCommerce Payments Plugin before 4.9.0 allow any authenticated WordPress user - including low-privilege Subscribers - to trigger payment capture refunds against any captured order via an unprotected AJAX endpoint. The flaw causes direct financial integrity loss for merchants, as unauthorized refund processing reverses captured payments without any approval workflow. A publicly available exploit exists per WPScan, though EPSS remains very low at 0.13% (3rd percentile), indicating exploitation has not become widespread despite the accessible attack surface.
Stored cross-site scripting in wpForo Forum WordPress plugin before 3.1.2 allows a subscriber-level authenticated user to inject persistent JavaScript into a profile field that executes in any visitor's browser - including logged-in administrators - upon viewing the attacker's public participant profile page. A publicly available proof-of-concept exploit exists, and the CVSS scope change (S:C) reflects that the injected script runs in victim browser contexts entirely outside the plugin's security boundary, enabling credential theft or admin-level site takeover. EPSS is low (0.15%, 5th percentile), suggesting mass exploitation has not yet materialized despite the public POC.
Unauthenticated OAuth state hijacking in Builderall for WordPress (versions before 3.0.2) enables remote attackers to overwrite the plugin's stored third-party integration access token by completing an OAuth authorization flow that is never bound to the initiating user session. Practical impact is constrained to sites already connected to a paid Builderall account - without that precondition, the overwrite is transient rather than durable. No confirmed active exploitation exists in CISA KEV, but WPScan has published a public proof-of-concept, making this accessible beyond sophisticated attackers despite an EPSS of 0.18% (7th percentile).
CSS injection in the Spectra Legacy WordPress plugin before version 2.20.0 allows authenticated Contributors to embed arbitrary CSS via unvalidated block style attributes that are output verbatim to page front-ends. Anonymous visitors loading affected pages are exposed to attacker-controlled styles enabling page defacement, UI redressing, external resource loading, and side-channel data exfiltration through CSS attribute selectors. JavaScript execution is explicitly blocked by WordPress KSES filtering, constraining the worst-case impact; a publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.12% (2nd percentile), indicating low observed exploitation probability and no CISA KEV listing.
Stored cross-site scripting in the Codeless Page Builder WordPress plugin (versions through 1.1.4) allows contributor-level users to inject arbitrary HTML and JavaScript by supplying unsanitized input as an HTML tag name via a shortcode attribute. When a higher-privileged user such as an administrator views the crafted content, the payload executes in their browser session, enabling session hijacking or unauthorized administrative actions. A public exploit proof-of-concept is available via WPScan; exploitation probability is low per EPSS (0.15%, 5th percentile), suggesting opportunistic rather than widespread active targeting.
Stored cross-site scripting in Admin Columns for ACF Fields WordPress plugin (through 0.3.2) allows contributor-level users to inject unsanitized JavaScript via Advanced Custom Fields values that execute in the browser session of any higher-privileged user who views the affected post-list admin screen. The scope change (S:C in CVSS) reflects that the payload crosses privilege boundaries - a low-privileged contributor can target editors and administrators. A publicly available exploit has been published by WPScan, though EPSS at 0.15% (5th percentile) indicates limited observed exploitation in the wild, and this CVE is not listed in the CISA KEV catalog.
Broken object-level authorization in Fluent Support WordPress plugin before 2.3.1 allows restricted support agents to reassign the customer field on any ticket system-wide, bypassing per-ticket scope enforcement. Affected are WordPress installations running Fluent Support versions prior to 2.3.1 where restricted support agent accounts exist. An authenticated agent can manipulate ticket ownership across the entire helpdesk, exposing customer metadata and corrupting ticket assignment integrity. A publicly available proof-of-concept exists; EPSS probability is very low (0.13%, 3rd percentile) and no CISA KEV listing indicates no confirmed mass exploitation.
Unauthenticated order manipulation in the Direct Payments for WooCommerce WordPress plugin before 2.5.3 enables any remote attacker to forge payment completion states, overwrite payment-method labels, and attach fabricated proof-of-payment files to arbitrary customer orders. The flaw stems from multiple AJAX handlers that process order updates without verifying the requester owns or is otherwise authorized to modify the targeted order. A publicly available proof-of-concept exists and the SSVC framework rates this as automatable, meaningfully amplifying the fraud risk for affected merchants despite the EPSS score of 0.15% (4th percentile).
Stored cross-site scripting in the Bit Form WordPress plugin (versions before 3.1.4) allows administrator-level users to inject persistent JavaScript into a conversational-form display setting that then executes in the browser of any site visitor who views the affected form. The vulnerability is particularly relevant on WordPress multisite installations, where administrators do not hold the unfiltered_html capability and are therefore expected to be constrained to safe content - making this a bypass of that trust model. A public proof-of-concept exists per WPScan, though EPSS sits at 0.16% (6th percentile), suggesting negligible observed exploitation activity at time of analysis.
Directory traversal in Support Genix WordPress plugin before 1.4.48 exposes arbitrary server files to unauthenticated remote attackers via the ticket-attachment download route. Exploitation is constrained to files matching an allowlisted extension set, yet this still enables disclosure of other users' private ticket attachments and any other allowlisted-extension files accessible to the web server process. A publicly available proof-of-concept exists per WPScan, though EPSS sits at only 0.25% (17th percentile), indicating low observed exploitation pressure despite the low attack complexity.
Missing authorization on attachment download endpoints in the Support Genix WordPress plugin (before 1.4.48) exposes private support ticket files to unauthenticated network access. Any caller who possesses a stored attachment's filename can retrieve it directly, bypassing ticket ownership and login checks entirely. A publicly available exploit exists per WPScan, though EPSS sits at 0.14% (4th percentile), indicating no widespread opportunistic exploitation at time of analysis; no CISA KEV listing.
Insecure Direct Object Reference (IDOR) in the wpForo Forum WordPress plugin before 3.1.2 allows any subscriber-level authenticated user to permanently delete the AI chat message history of arbitrary other users by submitting deletion requests without ownership verification. The plugin's AI chat message deletion endpoint does not validate that the targeted conversation belongs to the requesting user, enabling low-privilege account holders to cause irreversible data loss across the platform. A publicly available proof-of-concept exists per WPScan reporting; however, EPSS is extremely low at 0.13% (3rd percentile) and the vulnerability has not been added to the CISA KEV catalog, indicating limited observed exploitation.
Broken Object Level Authorization in the Academy LMS WordPress plugin through 3.8.2 exposes every user's quiz attempt records - including IP addresses, full names, registration dates, and quiz results - to any authenticated subscriber-level user who is enrolled in at least one course. The flaw stems from missing ownership checks on quiz attempt record retrieval endpoints (CWE-639), enabling horizontal privilege escalation across the entire site's student population. A publicly available proof-of-concept exists per WPScan; exploitation probability remains low (EPSS 0.13%, 3rd percentile) with no confirmed active exploitation in CISA KEV.
Stored XSS in ElementsKit Elementor Addons (WordPress plugin before 3.10.01) allows administrative users to inject malicious JavaScript into megamenu menu-item settings, which is rendered unsanitized to all page visitors. The most critical exploitation path targets WordPress multisite networks: a subsite Administrator - a role WordPress normally bars from injecting raw HTML via the unfiltered_html capability - can bypass this restriction through the plugin's misconfigured save routine, planting a payload that executes in Super Admin and site visitor sessions. A publicly available proof-of-concept exists per WPScan; EPSS is low (0.16%) but SSVC flags total technical impact due to the Super Admin session takeover potential on multisite deployments.
Broken object-level authorization (IDOR) in the BuddyPress WordPress plugin, all versions before 14.5.0, permits any authenticated user at the Subscriber level or above to read, modify, or delete private messages belonging to other users via the plugin's messaging endpoints. A publicly available proof-of-concept exists per WPScan reporting, though EPSS data places exploitation probability at just 0.13% (3rd percentile) and SSVC classification marks it as not automatable, indicating exploitation is currently opportunistic and targeted rather than widespread. No CISA KEV listing is present, but the low privilege bar combined with network accessibility makes this a meaningful privacy and integrity risk on any community-facing or multi-tenant WordPress deployment running BuddyPress.
SQL injection in WP Go Maps WordPress plugin (all versions before 10.1.04) allows unauthenticated network attackers to read data from the underlying WordPress database by injecting malicious SQL syntax into an unsanitized plugin parameter. Reported by WPScan, a publicly available proof-of-concept exploit exists for this flaw; however, CISA KEV does not list active exploitation, and EPSS at 0.18% (7th percentile) indicates low observed exploitation probability in the wild. The SSVC framework's 'non-automatable' classification and the CVSS AC:H rating indicate that exploitation requires attacker effort beyond trivial scripting, moderating the real-world urgency despite the unauthenticated attack vector.
Insecure Direct Object Reference (IDOR) in JS Help Desk WordPress plugin before 3.1.5 exposes support ticket data to any low-privileged authenticated user who supplies an arbitrary ticket ID. The plugin performs no ownership check when loading ticket contents, meaning a registered user can enumerate ticket IDs and read PII, message bodies, and reporter identity belonging to other users. A publicly available proof-of-concept exists per WPScan; no confirmed active exploitation (CISA KEV) has been identified, and EPSS remains very low at 0.13%.
User email enumeration in the JS Help Desk WordPress plugin (versions before 3.1.4) allows any Contributor-level site user to harvest the email addresses of all registered WordPress users. Two design flaws compound: the plugin unconditionally grants a support-agent capability to the built-in Contributor role at activation time, and the user-listing handler omits any capability check entirely, making the Contributor elevation the effective attack precondition. A public proof-of-concept is documented by WPScan; however, EPSS places exploitation probability at 0.14% (4th percentile), indicating no public exploit is currently being run at scale. No CISA KEV listing is present.
Broken authorization in the JS Help Desk WordPress plugin (versions prior to 3.1.4) allows any authenticated user at Subscriber level or above to overwrite the content of any support-ticket reply site-wide, regardless of ownership. The plugin's reply-update endpoint fails to validate that the requesting user owns the targeted reply, enabling unauthorized content manipulation across all tickets. A publicly available proof-of-concept exploit exists; no active exploitation has been confirmed in CISA KEV at time of analysis.
JS Help Desk WordPress plugin before 3.1.4 exposes all support ticket content to any authenticated WordPress user due to missing authorization and ownership checks in its search handler. Any account at Subscriber level or above can enumerate and read the subject and full message body of every other user's support ticket by interacting with the plugin's nonce-gated AJAX endpoint, bypassing the intended per-user data isolation. A publicly available proof-of-concept exploit exists per WPScan; EPSS is low at 0.14% (4th percentile), suggesting opportunistic rather than widespread automated exploitation, but the low authentication bar makes this a meaningful data exposure risk on multi-user WordPress sites.
Unauthenticated order document enumeration in the FluentCart WordPress plugin (all versions before 1.5.3) exposes customer PII - names, email addresses, and billing and shipping postal addresses - across every order in a store. CWE-639 (IDOR) is the root cause: order documents are keyed on sequential numeric identifiers with no authorization or ownership validation, so any unauthenticated visitor can iterate through all historical orders. A publicly available exploit exists per WPScan; no active exploitation is confirmed in CISA KEV, though the trivial enumeration method and public PoC substantially lower the barrier to mass data harvesting.
Stored XSS in WP Photo Album Plus (all versions up to 9.2.03.001) allows unauthenticated remote attackers to inject persistent malicious scripts into photo comments by exploiting a decode-after-sanitize flaw in the plugin's comment pipeline. The sanitization sequence in `wppa-functions.php` applies `wp_kses` then `wp_strip_all_tags()` on write, but neither function decodes HTML entities before inspecting markup - a double-encoded payload such as `<script>` passes both filters as harmless text, is stored one entity-decode level down, and renders as executable HTML when a victim's browser processes the page. A public proof-of-concept is available via WPScan; however, the vulnerability is not in CISA KEV and EPSS sits at 0.15% (5th percentile), indicating no observed mass exploitation at time of analysis.
Reflected cross-site scripting in the Ultimate Addons for WPBakery Page Builder WordPress plugin (all versions before 3.21.5) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted URL processed by the plugin's shared link-rendering function, uavc_link_init(). A publicly available proof-of-concept exploit was reported by WPScan, though EPSS places exploitation probability at just 0.15% (5th percentile), suggesting opportunistic rather than widespread active exploitation. No CISA KEV listing was identified at the time of analysis.
Unauthenticated download of exported member and payment PII is possible in the Paid Membership Subscriptions WordPress plugin before 3.0.7 due to export files being written to a predictable, unprotected path within the publicly accessible uploads directory. Any site running an affected version where an administrator has recently triggered an export is at risk of exposing member personally identifiable information and payment records to any network-accessible attacker. A publicly available proof-of-concept exploit exists per WPScan, and while the CVSS base score is low (3.7), the data sensitivity of the exposed artifact elevates real-world impact beyond what the score alone suggests.
Insecure Direct Object Reference in the Paid Membership Subscriptions WordPress plugin (before 3.0.7) allows any authenticated subscriber-level user to enumerate and retrieve payment records belonging to other members. The AJAX handler responsible for payment data retrieval performs neither a WordPress capability check nor a nonce validation, meaning horizontal privilege escalation requires only a valid low-privilege account on the target site. A publicly available proof-of-concept exists per WPScan, though no CISA KEV listing confirms active widespread exploitation at time of analysis.
Stored XSS in the NewStatPress WordPress plugin (all versions before 1.4.5) allows unauthenticated remote attackers to inject persistent malicious scripts by supplying crafted HTTP request data that the plugin logs without sanitization and later renders in its statistics widgets. Any authenticated user - including administrators - who views the affected widget triggers the stored payload in their browser, enabling session hijacking, credential theft, or unauthorized administrative actions. A public exploit exists via WPScan, though EPSS at 0.17% (7th percentile) indicates exploitation has not yet become widespread.
Unauthenticated data overwrite in the Events Made Easy WordPress plugin (all versions before 3.1.4) allows any remote, unauthenticated attacker to overwrite personal data stored in any person record by exploiting a missing authorization check on data-change endpoints. The plugin's nonce mechanism is public and shared, providing no per-record token or ownership binding, making it trivially bypassable under CWE-639. A publicly available exploit exists per WPScan research; no active exploitation has been confirmed in CISA KEV at time of analysis.
Unauthenticated mailing list subscription abuse in the Mailgun for WordPress plugin before 2.2.1 allows any remote attacker to enroll arbitrary email addresses into the site owner's Mailgun mailing lists by exploiting an unprotected AJAX endpoint. The plugin's stored API credentials are silently invoked on the attacker's behalf, effectively weaponizing the site owner's Mailgun account against third-party email addresses. A public exploit is available via WPScan, though the EPSS score of 0.14% (4th percentile) and absence from CISA KEV indicate limited observed exploitation to date.
Stored XSS in the Lightbox with PhotoSwipe WordPress plugin before 5.9.0 allows author-level users (lacking unfiltered_html) to inject arbitrary JavaScript into image lightbox captions via an unsanitized link data attribute. The payload executes in the browser of any visitor or administrator who opens the affected lightbox, enabling session hijacking or privilege escalation against site administrators. A publicly available exploit documents the technique; no active exploitation is confirmed via CISA KEV, though the author-level entry bar is low on sites with multiple contributors.
SQL injection in the Check & Log Email WordPress plugin (all versions before 2.0.15) allows authenticated WordPress administrators to execute arbitrary SQL queries against the underlying database via unsanitized parameters. With PR:H per the CVSS vector, exploitation is constrained to admin-level accounts, making the primary threat a rogue insider or a follow-on attack after admin credential compromise. A public proof-of-concept is available through WPScan; however, EPSS at 0.16% (6th percentile) and absence from CISA KEV indicate no confirmed widespread exploitation campaign at time of analysis.
GiveWP WordPress donation plugin before version 4.16.3 allows unauthenticated users to route donations through payment gateways the administrator has explicitly disabled, by supplying a gateway identifier via request input that the plugin fails to validate against the admin-configured allowlist. Rooted in CWE-862 (Missing Authorization), this bypasses financial controls that site operators may have disabled for compliance, fraud prevention, or contractual reasons - making the practical business risk higher than the CVSS Medium score suggests. A publicly available proof-of-concept exists via WPScan; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Broken object-level authorization in the Tutor LMS WordPress plugin (all versions before 4.0.0) allows any authenticated subscriber-level user to read Q&A threads and inject replies into courses they are not enrolled in or authorized to access. Exploitation requires only a valid WordPress account, making the barrier low for multi-tenant LMS deployments where user registration is open. A publicly available proof-of-concept exists per WPScan, and while not listed in CISA KEV, the low authentication requirement and POC availability elevate realistic risk for exposed installations.
Unauthenticated post metadata manipulation in WP Delicious (WordPress plugin before 1.10.2) allows any remote actor to inflate "like" counters and grow an associated identifier list on arbitrary posts without any credentials or user interaction. The flaw stems from a missing authorization check on a WordPress AJAX action accessible to unauthenticated visitors. A publicly available proof-of-concept exists; SSVC confirms automatable exploitation with partial technical impact, though no CISA KEV listing indicates active widespread exploitation has not been confirmed.