Unknown
Monthly
Unauthenticated information disclosure in Essential Addons for Elementor (WordPress plugin, all versions before 6.6.10) exposes WooCommerce product metadata - title, price, and SKU - for products in draft, pending, and private status that WordPress would otherwise withhold from public visitors. The plugin's product-comparison feature resolves product objects without performing authorization, post-status, or visibility checks, violating object-level access control (CWE-639). A public proof-of-concept exists per WPScan (the original reporter), and SSVC marks the flaw as automatable, though EPSS remains very low (0.15%) and the vulnerability is not currently listed in CISA KEV.
Stored XSS in Essential Addons for Elementor (WordPress plugin) before 6.6.10 allows any Contributor-level or higher user to inject arbitrary JavaScript via an unsanitized HTML tag name in the Pricing Table widget title field. The payload executes in the browser of any user who views the affected page - critically including administrators previewing or visiting the post - enabling session hijacking or privilege escalation to full site control. A publicly available proof-of-concept exists, raising the realistic threat above the CVSS 4.8 medium score.
Stored Cross-Site Scripting in Animation Addons for Elementor WordPress plugin (all versions before 2.7.0) allows authenticated users with the upload_files capability - Author role and above - to upload unsanitized SVG or SVGZ files containing embedded JavaScript. When a victim visits or previews a page rendering the malicious file, the script executes in their browser under the site's origin, potentially enabling session hijacking or privilege escalation to administrator. No active exploitation is confirmed via CISA KEV, but a publicly available proof-of-concept exists and a vendor patch has been released at version 2.7.0.
Insecure Direct Object Reference in the WP Travel WordPress plugin (all versions before 11.8.1) exposes customer booking records to any authenticated WordPress user. By supplying an arbitrary booking identifier to the customer account dashboard endpoint, a low-privileged attacker can retrieve another customer's full booking details, including billing address information. No special role is required beyond a basic site login; a publicly available proof-of-concept exists, though active exploitation has not been confirmed by CISA KEV.
Unauthenticated booking fraud is possible in the WP Travel WordPress plugin before 11.8.1 due to missing PayPal Instant Payment Notification (IPN) postback verification. Any unauthenticated attacker can send a forged IPN POST request to the plugin's payment handler, causing it to flip an arbitrary pending booking to a paid and confirmed state at a price of the attacker's choosing - enabling fraudulent travel reservations without payment. A publicly available proof-of-concept exists (reported by WPScan), and SSVC classifies the attack as automatable with partial technical impact, though no active exploitation is confirmed in the CISA KEV catalog.
Stored Cross-Site Scripting in the Fluent Forms WordPress plugin (all versions before 6.2.6) allows a Contributor-level user with delegated form-management permissions to embed a persistent malicious script into a form field configuration setting, which executes against every subsequent visitor - including administrators - who loads any page rendering that form. The vulnerability is especially significant in multisite WordPress environments, where contributors routinely lack the unfiltered_html capability yet may hold form-management delegation rights. A publicly available proof-of-concept exists per WPScan; no active exploitation is confirmed in CISA KEV at time of analysis.
IP spoofing via untrusted HTTP headers in WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05 allows unauthenticated attackers to defeat the plugin's own brute-force login protection and downgrade its firewall by forging headers that match a hardcoded whitelisted IP range. The plugin fails to validate that IP-sourcing headers (such as X-Forwarded-For or X-Real-IP) originate from a trusted reverse proxy, making any client-controlled header a viable forgery vector. A publicly available proof-of-concept exists per WPScan's disclosure, though EPSS remains low (0.16%, 5th percentile) and no active exploitation has been confirmed in CISA KEV.
Missing authorization in Frontend Admin by DynamiApps WordPress plugin (versions before 3.29.7) exposes taxonomy term creation, modification, and deletion operations to any authenticated user, including Subscribers - the lowest WordPress role. Rooted in CWE-862 (Missing Authorization), the plugin's taxonomy management handlers execute without invoking WordPress capability checks, granting low-privilege accounts editor-level control over site taxonomy. A public POC is available via WPScan; however, EPSS sits at 0.14% (4th percentile) and no CISA KEV listing exists, suggesting limited real-world exploitation activity despite the accessible POC.
Unauthenticated integrity corruption in Points and Rewards for WooCommerce (versions before 2.10.1) allows remote attackers to arbitrarily modify or corrupt the wallet balance and loyalty points of any user account - including driving values negative - without possessing any credentials. The missing authorization check on a wallet/points update action fails to verify that the requester owns the targeted account, making cross-account manipulation trivially possible. A publicly available proof-of-concept exists per WPScan; the vulnerability is not currently listed in CISA KEV and carries a low EPSS score (0.15%, 4th percentile), suggesting exploitation has not yet been observed at scale.
Unauthenticated deletion of all custom icon font packs is possible in Ultimate Addons for WPBakery Page Builder WordPress plugin before version 3.21.4. The plugin's icon font deletion endpoint performs no WordPress capability check and no nonce verification, meaning any unauthenticated HTTP request can permanently erase every custom-uploaded icon font pack on an affected site in a single request. A publicly available proof-of-concept exists and SSVC assesses the attack as automatable, though EPSS remains very low at 0.15% (5th percentile), indicating no significant observed exploitation at scale; the vulnerability is absent from CISA KEV.
RegistrationMagic WordPress plugin versions prior to 6.0.9.4 allows unauthenticated remote attackers to overwrite other users' front-end form submissions and the WordPress profile fields of the associated non-administrator accounts by exploiting absent authorization, ownership, and nonce validation on a submission-editing action. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials and no user interaction against any default plugin deployment. A public proof-of-concept exists per WPScan, though EPSS sits at 0.14% (4th percentile) and this CVE is not in CISA KEV, indicating no confirmed widespread active exploitation at time of analysis.
Unauthorized access to other users' form submission data is possible in RegistrationMagic WordPress plugin versions prior to 6.0.9.4 due to missing OTP-to-identity binding validation. The plugin accepts a one-time password from a cookie without confirming it corresponds to the identity being requested, enabling unauthenticated network-based retrieval of personal information submitted through front-end registration forms. A publicly available exploit exists per WPScan, though EPSS at 0.14% (4th percentile) and the absence of a CISA KEV listing indicate exploitation has not been observed at scale.
Search Atlas SEO WordPress plugin (all versions before 2.6.12) exposes its Google Indexing API integration to any authenticated user - including low-privilege subscribers - due to a missing capability and nonce check in an AJAX handler. Any user with a valid WordPress session can invoke the plugin's Google Indexing API endpoint to submit or remove site URLs from Google's search index and exhaust the site's indexing API quota. A publicly available exploit exists via WPScan, though EPSS at 0.14% (4th percentile) and the absence of a CISA KEV listing indicate limited observed exploitation activity at this time.
The Appointment Booking Plugin for WordPress (all versions before 5.6.8) allows unauthenticated visitors to set privileged booking fields - including approval status - through the plugin's public booking funnel, silently bypassing the site's manual booking approval workflow. Any site relying on appointment approval as a gatekeeping mechanism can have that control subverted by any internet-accessible visitor with no credentials required. A publicly available proof-of-concept exists per WPScan; however, EPSS remains at 0.15% (5th percentile), indicating limited observed exploitation activity despite the trivially low attack complexity.
Stored cross-site scripting in the GiveWP WordPress plugin before version 4.16.3 allows authenticated users holding the GiveWP Worker role or above to inject arbitrary JavaScript into donation-form template settings, which then executes in the browsers of any visitor viewing the public donation form. The attack requires existing privileged access within the GiveWP role hierarchy, limiting opportunistic exploitation, though a publicly available proof-of-concept lowers the barrier for targeted abuse. EPSS sits at 0.17% (7th percentile) and the vulnerability has not been added to CISA KEV, suggesting limited observed exploitation in the wild despite POC availability.
Authenticated information disclosure in the LifterLMS WordPress plugin before 10.0.10 exposes internal post type titles - including coupon codes - to any subscriber-level user. The root cause is a missing capability check in a select2 query AJAX handler that only verifies login status, not whether the user holds an appropriate WordPress capability. A publicly available proof-of-concept exists (via WPScan), though EPSS sits at just 0.16% (5th percentile), indicating low broad exploitation likelihood; no active exploitation is confirmed by CISA KEV.
Stored cross-site scripting in LifterLMS WordPress plugin versions before 10.0.10 allows authenticated course editors to inject event-handler JavaScript into course pricing fields, which then executes in administrator browser sessions when the course is viewed. A publicly available proof-of-concept from WPScan confirms exploitability. EPSS at 0.17% (7th percentile) indicates low opportunistic exploitation probability, consistent with the authenticated-insider requirement and dependence on manual admin interaction.
Unauthorized customer PII exposure in MotoPress Hotel Booking WordPress plugin before 6.0.4 allows any authenticated subscriber-level user to retrieve full personal details - name, email, phone number, and address - belonging to any customer booking in the system. The flaw stems from a missing capability check in an AJAX action handler, meaning the plugin never verifies whether the requesting user is authorized to view the target booking before returning its data. A publicly available exploit exists per WPScan, though EPSS at 0.16% (5th percentile) and absence from CISA KEV suggest exploitation remains opportunistic rather than widespread.
SQL injection in the WP Hotel Booking WordPress plugin before 2.3.2 allows users holding plugin-specific booking-management roles to extract data from the underlying WordPress database via an unsanitized search parameter on the administrative booking listing page. The CVSS scope change (S:C) and high confidentiality impact (C:H) indicate the injected queries can reach data beyond the plugin's own tables, such as WordPress user credentials or site configuration. A publicly available exploit exists via WPScan, though EPSS sits at 0.18% (7th percentile) and the vulnerability is not listed in CISA KEV, suggesting targeted rather than widespread exploitation risk.
Bit Form WordPress plugin before version 3.1.2 fails to enforce form deactivation state on its public submission handlers, enabling unauthenticated network-accessible attackers to submit data to forms the site owner has intentionally disabled and trigger any configured backend workflows such as email notifications. The vulnerability carries a low CVSS score of 3.7 with AC:H, reflecting that exploitation requires knowledge of a specific deactivated form's endpoint, and real-world impact is limited to low integrity effects - spurious entries and unwanted workflow executions rather than data exfiltration or system compromise. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.15% (5th percentile) indicates exploitation has not meaningfully materialized across the wild.
Authenticated privilege escalation in the Sync Post With Other Site WordPress plugin (all versions before 1.9.3) allows any Contributor-level user to create, publish, and overwrite arbitrary Pages - including content authored by administrators - by exploiting an operator-precedence flaw in a REST route's authorization check. A public proof-of-concept is available via WPScan, though EPSS sits at 0.15% (5th percentile) and SSVC marks exploitation as non-automatable, suggesting opportunistic rather than widespread active exploitation. No CISA KEV listing exists at time of analysis.
Stored cross-site scripting in the WP Real IP-based Access Control WordPress plugin (all versions through 1.3.1) allows unauthenticated remote attackers to inject persistent JavaScript into the plugin's settings page, which executes in the browser of any administrator who subsequently views that page. The root cause is a complete absence of capability checks and nonce validation on the option-storing endpoint, combined with unescaped output rendering on the settings page. A publicly available proof-of-concept exploit exists per WPScan; however, the vulnerability is not currently listed in the CISA KEV catalog and carries a low EPSS score of 0.19% (9th percentile), suggesting no confirmed widespread exploitation at time of analysis.
Easy Appointments WordPress plugin through version 3.12.26 exposes an appointment-listing REST endpoint to any authenticated user by gating it on a capability held by every WordPress user - including subscribers, the lowest authenticated role. Any user with a basic account can query this endpoint to enumerate all site bookings, extracting customer names, appointment schedules, and booking statuses belonging to other clients. A publicly available exploit is documented by WPScan; however, EPSS sits at 0.16% (5th percentile) and the vulnerability is not in CISA KEV, indicating limited observed mass exploitation at time of analysis.
Insecure direct object reference in the Easy Appointments WordPress plugin (all versions through 3.12.26) permits any authenticated subscriber-level user to retrieve personal information belonging to any appointment booking customer by iterating a customer identifier. The plugin fails to enforce ownership or capability checks before returning stored customer records, exposing PII across the entire customer base to the lowest-privileged WordPress role. No active exploitation is confirmed in CISA KEV, but a publicly available exploit exists via WPScan's disclosure, and EPSS sits at 0.15% - consistent with targeted rather than automated mass exploitation.
Improper access control in the Easy Appointments WordPress plugin through version 3.12.26 allows any contributor-level WordPress user to delete the site's booking configuration and functionally disable the appointment system. The vulnerable action handler performs neither a WordPress capability check nor nonce validation, meaning any authenticated user at or above contributor role can trigger the deletion without administrative approval. A publicly available exploit exists per WPScan, though EPSS at 0.15% (5th percentile) indicates limited observed exploitation; no CISA KEV listing is present.
Broken access control in the Easy Appointments WordPress plugin through version 3.12.26 permits any contributor-level authenticated user to perform privileged appointment-management actions - including reading all customer booking details and creating, modifying, or deleting appointments - without holding the required capabilities. The plugin relies exclusively on WordPress nonce verification as its authorization gate for these AJAX actions, but nonces are available to all authenticated users regardless of role and do not encode privilege level. A publicly available exploit exists per WPScan; no vendor patch has been identified at time of analysis.
Easy Appointments WordPress plugin through version 3.12.26 exposes all stored customer personal information to any authenticated contributor-level user due to missing per-request capability and nonce validation on a customer-listing handler. Any user holding a contributor role - a low-privilege WordPress role normally limited to drafting posts - can invoke the unprotected endpoint and enumerate the full customer dataset. A publicly available proof-of-concept exists per WPScan, though EPSS places exploitation probability at 0.16% (5th percentile) and the flaw has not been listed in CISA KEV, suggesting limited observed exploitation.
Easy Appointments WordPress plugin through version 3.12.26 exposes an insecure direct object reference (IDOR) that lets any subscriber-level user overwrite the customer metadata of another user's appointment by reusing a nonce harvested from their own edit form. The shared nonce mechanism provides CSRF protection but no ownership enforcement, so an attacker can target arbitrary appointment IDs without restriction. A publicly available proof-of-concept exists (WPScan), and the vulnerability can be chained into a notification hijack: when an administrator approves an affected appointment with customer notifications enabled, the confirmation email is delivered to the attacker-controlled address rather than the legitimate customer, exposing booking details to an unauthorized party.
Order integrity bypass in the PayU CommercePro Plugin for WordPress (versions through 3.8.9) enables unauthenticated remote attackers to tamper with WooCommerce order totals, shipping details, and metadata without paying the correct amount. The plugin processes payment-gateway callbacks without verifying the cryptographic signature that PayU issues, meaning any HTTP client can forge a callback and manipulate arbitrary orders. A publicly available proof-of-concept exploit exists per WPScan; no active exploitation has been confirmed in CISA KEV at time of analysis.
Stored cross-site scripting in the PhotoSwipe WordPress plugin (all versions through 4.1.1.1) allows an authenticated Author-level user to plant a persistent JavaScript payload inside a link's title attribute, which the plugin writes unescaped into the page DOM as a lightbox caption. Any visitor - including site administrators - who clicks the link triggers payload execution in their browser, enabling session hijacking and full WordPress takeover. A publicly available proof-of-concept exists; no patched release has been identified at time of analysis.
Unauthenticated information disclosure in the ShinyStat Analytics WordPress plugin (versions before 1.0.17) exposes non-published WooCommerce product data - including draft, pending, and private listings - via an unprotected REST API endpoint that performs no authorization check. Any internet-accessible WordPress/WooCommerce site running an affected version is vulnerable without credentials or user interaction, consistent with the AV:N/AC:L/PR:N/UI:N CVSS vector. A publicly available proof-of-concept is documented by WPScan; no active exploitation has been confirmed in CISA KEV at time of analysis.
Authenticated customers of the FluentCart WordPress plugin can manipulate other users' subscriptions by exploiting missing ownership verification in payment-method endpoints. The vulnerability affects versions before 1.4.0 and allows an attacker with low privileges to change payment methods or cancel subscriptions if they know the target subscription identifier. Publicly available exploit code exists, but EPSS probability is low (0.13%) and no active exploitation in CISA KEV has been reported.
The Quiz and Survey Master WordPress plugin before version 11.1.5 permits authenticated users with contributor-level permissions to delete arbitrary output templates due to a missing capability check. Public exploit code is available, though no active exploitation has been confirmed. A vendor patch (version 11.1.5) addresses this issue.
Stored cross-site scripting in the Event Tickets and Registration WordPress plugin before 5.28.4 enables Editors and above to inject malicious scripts in event titles, which execute against higher-privileged users on multisite setups when they view the ticket history log. The vulnerability has a low CVSS of 3.5 and a low EPSS of 0.15%, but exploit code is publicly available. A patch in version 5.28.4 is available from the vendor.
Stored cross-site scripting (XSS) in the Calendar WordPress plugin prior to version 1.3.18 allows authenticated users with Contributor-level access to inject arbitrary JavaScript into an event field. The script executes in the browsers of any user viewing the calendar page, potentially leading to session hijacking or privilege escalation. A public exploit is available, increasing the immediate risk despite the privilege requirement.
Username enumeration and brute-force password attempt in Quiz and Survey Master WordPress plugin before 11.1.3 allows unauthenticated attackers to enumerate valid usernames and bypass brute-force protections via distinct responses on front-end credential checks. Publicly available exploit code exists, though no active exploitation has been reported. The medium-severity flaw, while not directly exposing passwords, facilitates credential-stuffing and further attacks against identified accounts.
Unauthenticated attachment deletion in the User Frontend WordPress plugin before 4.3.8 allows remote attackers to permanently delete author-less attachments, such as guest uploads or placeholder media. The vulnerability stems from missing ownership checks on attachment deletion requests, and a proof-of-concept exploit is publicly available. The vendor has released a patch in version 4.3.8.
Open redirect vulnerability in Contact Form 7 WordPress plugin prior to version 2.5 allows unauthenticated attackers to redirect victims to arbitrary external sites after the Stripe checkout flow. Publicly available exploit code exists, but no active exploitation has been confirmed. With a CVSS score of 4.7 (medium) and low EPSS not provided, the risk is moderate due to required user interaction and limited impact.
Stored cross-site scripting in Smart Manager for WordPress before version 8.92.0 enables authenticated attackers with at least Contributor role to inject JavaScript that executes in an administrator's browser via the management grid. A publicly available proof-of-concept exists, though no active exploitation is confirmed. The vendor has released patched version 8.92.0.
Reflected XSS in the Sina Extension for Elementor WordPress plugin allows unauthenticated attackers to execute arbitrary JavaScript in victims' browsers. The vulnerability exists in an unauthenticated AJAX handler that fails to escape user input before reflecting it. Public exploit code is available, and the vendor has released a patch in version 3.10.2.
SQL injection vulnerability in the WPBot WordPress plugin before version 8.5.2 allows authenticated administrators to inject arbitrary SQL queries via unsanitized field identifiers. This injection executes when a site visitor triggers a search, potentially leading to low-level data exposure or modification. A public exploit is available, though no active exploitation has been confirmed by CISA KEV.
Stored Cross-Site Scripting in Simply Schedule Appointments up to 1.6.12.2 allows unauthenticated attackers to inject arbitrary web scripts. A double‑encoding fault causes payloads to bypass the plugin’s wp_kses_post() sanitizer and then execute when an administrator views appointment notifications. The vulnerability is fixed in version 1.6.12.4; a public proof‑of‑concept exists but no active exploitation has been confirmed.
Integrity bypass in The Events Calendar WordPress plugin allows unauthenticated attackers to mark existing Event Aggregator import records as failed and insert arbitrary content into a hidden comment. Public exploit code is available, and the vulnerability is automatable via the REST API, increasing the risk beyond the moderate CVSS score.
Reflected cross-site scripting (XSS) in the WordPress Document Gallery plugin before version 5.1.1 allows unauthenticated attackers to inject malicious scripts via an unsanitized parameter in an AJAX action. A publicly available proof-of-concept exploit exists, increasing the immediate risk for sites running affected versions.
Stored cross-site scripting in the Advanced Ads WordPress plugin versions before 2.0.23 allows authenticated users with Contributor role or higher to inject arbitrary web scripts via an unsanitized shortcode parameter. An attacker can leverage this to execute JavaScript in the browser of anyone viewing the affected page, potentially hijacking sessions or escalating privileges when administrators visit the content. A public proof-of-concept exists, but no active exploitation is confirmed.
Unauthenticated server-side request forgery (SSRF) and arbitrary local file read in Printcart Designer for WooCommerce versions prior to 2.5.3 allows attackers to exfiltrate sensitive configuration files and probe internal network resources. Public exploit code is available, and the patch has been released by the vendor.
License setting overwrite in ProfileGrid WordPress plugin versions before 5.9.9.7 allows authenticated users with Subscriber-level access or higher to overwrite premium license settings due to a missing capability check. Publicly available exploit code exists but active exploitation has not been confirmed. The flaw stems from relying solely on a nonce exposed to any logged‑in user, bypassing proper authorization.
Missing authorization checks in ProfileGrid WordPress plugin prior to 5.9.9.7 allow authenticated subscribers to manipulate private messages of other users. Attackers can soft-delete threads, alter metadata, and mark messages as read without owning the thread, impacting user privacy and data integrity. Public exploit code exists, but no active exploitation has been confirmed, and EPSS indicates very low exploitation probability (0.13%).
Authentication bypass in ProfileGrid WordPress plugin allows unauthenticated attackers to forge PayPal IPN payment notifications, granting paid membership to any group without payment. The vulnerability affects all versions before 5.9.9.7. A public proof-of-concept exploit is available, though the EPSS score (0.14%, percentile 3) indicates low likelihood of widespread exploitation at this time.
Reflected XSS in Post Status Notifier Lite WordPress plugin (all versions before 1.13.0) allows an unauthenticated remote attacker to inject and execute arbitrary JavaScript in a logged-in WordPress administrator's browser by tricking them into following a crafted URL targeting `admin.php?page=post-status-notifier-lite`. The plugin fails to escape the `mod` GET parameter before reflecting it into the admin settings page output, producing a Scope:Changed impact per CVSS - meaning successful exploitation crosses the plugin boundary into the broader WordPress admin session context. A publicly available POC exists via WPScan, though EPSS sits at just 0.21% (11th percentile), indicating low observed exploitation activity and no CISA KEV listing at time of analysis.
Reflected XSS in WP Compress WordPress plugin (versions before 7.10.04) allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by crafting a malicious link that injects the attacker's domain as the CDN host for script assets. The plugin's loader emits script elements pointing to the attacker-controlled origin without sanitizing the CDN host query parameter, achieving cross-site scope execution within the target WordPress site. Publicly available exploit code exists per WPScan reporting; no active exploitation is confirmed in CISA KEV, and EPSS is low at 0.20% (11th percentile), consistent with SSVC's 'poc, non-automatable, partial impact' classification.
Payment enforcement bypass in the Timetics WordPress booking plugin (versions before 1.0.57) allows unauthenticated remote users to generate fully-approved appointments for priced services without completing any payment. The plugin fails to validate booking status when the chosen payment method falls outside its recognized gateway list, effectively treating unverified payment submissions as completed transactions. A public proof-of-concept is available (reported by WPScan), and SSVC assessment confirms the flaw is automatable with partial technical impact, though EPSS remains low at 0.14%, suggesting exploitation is opportunistic rather than widespread.
Subscriber-level users on WordPress sites running WPBot before 8.2.0 can modify the plugin's retrieval-augmented-generation (RAG) configuration without authorization, because the relevant settings handler performs neither a WordPress capability check nor a nonce validation. A publicly available proof-of-concept lowers the exploitation bar significantly, making this actionable for any low-skill attacker who holds or can self-register a subscriber account on the target site. No public exploit identified at time of analysis by CISA KEV, but POC availability combined with low access requirements makes remediation a priority for sites with open user registration.
Academy LMS WordPress plugin versions prior to 3.8.1 exposes an Insecure Direct Object Reference (IDOR) flaw across multiple lesson AJAX handlers, allowing any subscriber-level authenticated user to read and overwrite other users' lesson notes and fraudulently mark course content as completed on their behalf. The vulnerability affects all Academy LMS installations running an unpatched version and is worsened by a publicly available exploit published via WPScan, though no active exploitation has been confirmed through CISA KEV. In environments where course completion carries compliance, certification, or audit significance, the integrity impact exceeds what the Medium CVSS score alone conveys.
Insecure Direct Object Reference (IDOR) in the Classified Listing WordPress plugin before 5.3.9 exposes payment receipt data across arbitrary user accounts. Any authenticated user holding subscriber-level access - the default role assigned upon registration on most WordPress sites - can query the payment-receipt handler with any order ID and receive full receipt details belonging to another user, because no ownership check is performed. A publicly available exploit exists per WPScan, and a vendor-released patch at version 5.3.9 is available; no KEV listing is present at time of analysis.
Unauthenticated workflow replay in the Bit Form WordPress plugin (versions before 3.1.0) allows external attackers to re-trigger any form's configured workflow actions - including notification emails and third-party service integrations - by submitting an expired workflow-trigger token that the plugin fails to properly reject. The root cause is missing authorization enforcement at the token-validation layer after WordPress transient expiry, classified under CWE-862. No public exploitation in CISA KEV is recorded, but a publicly available proof-of-concept exists per WPScan, elevating operational risk for sites with high-value workflow integrations such as CRM hooks or payment notifications.
Path traversal in the Bit Form WordPress plugin (versions before 3.1.0) allows unauthenticated remote attackers to read arbitrary files from the server - including wp-config.php, which contains database credentials and authentication keys - by supplying a crafted path in a form file-field that is then read and attached to a notification email. A publicly available proof-of-concept exploit exists, reported by WPScan, though the CVSS AC:H rating and SSVC Automatable:no designation indicate exploitation is not trivial. EPSS stands at 0.16% (6th percentile), and this CVE is not listed in CISA KEV, suggesting exploitation remains opportunistic rather than widespread at time of analysis.
Information disclosure in Elementor Website Builder (all versions before 4.1.4) allows authenticated WordPress users with Contributor-level access or above to read the title, body, and metadata of private posts, private pages, and drafts belonging to other users - including site administrators - via an improperly permission-checked REST endpoint. A publicly available proof-of-concept exploit exists (reported by WPScan), though EPSS places exploitation probability at 0.14% (4th percentile), indicating limited current in-the-wild activity despite public PoC. No active exploitation has been confirmed by CISA KEV; the vendor has released a patched version (4.1.4).
ThumbPress WordPress plugin (all versions before 6.2.2) allows any authenticated subscriber-level user to deactivate the plugin by exploiting a missing capability check on an AJAX action endpoint. This disrupts the site's image-handling functionality, constituting a targeted availability and integrity attack against WordPress installations. A publicly available exploit exists per WPScan; the vulnerability is not listed in CISA KEV, so active widespread exploitation is not confirmed at time of analysis.
Cross-site request forgery in the MailerSend WordPress plugin before 1.0.8 enables an unauthenticated remote attacker to wipe the plugin's SMTP configuration and deactivate it entirely by tricking a logged-in administrator into visiting a crafted page. The plugin's configuration-delete action validates the manage_options capability but entirely omits WordPress nonce verification, making administrator sessions exploitable via social engineering. A publicly available exploit demonstrates the attack; successful exploitation silently breaks all outbound email from the affected WordPress site, impacting password resets, order notifications, and transactional messaging.
PayPlus Payment Gateway WordPress plugin before 8.2.2 exposes an unauthenticated AJAX action that performs no authorization or order-ownership validation, allowing any remote, unauthenticated attacker to retrieve the secret order key of arbitrary WooCommerce orders. Under certain plugin configurations, the same endpoint additionally permits modification of order statuses, extending impact to data integrity. A publicly available proof-of-concept exists per WPScan reporting, though EPSS sits at only 0.13% (3rd percentile), indicating limited observed exploitation despite the SSVC Automatable=yes classification - no public exploit identified at time of analysis beyond the POC, and this CVE is not currently listed in CISA KEV.
PayPlus Payment Gateway WordPress plugin before 8.2.2 exposes an unauthenticated AJAX action that performs no authorization or order-ownership validation, enabling any remote unauthenticated actor to tamper with payment-related metadata on arbitrary WooCommerce orders across the site. A publicly available proof-of-concept exploit exists, and the SSVC framework classifies this as automatable with partial technical impact, making scripted mass-scanning of vulnerable WooCommerce shops feasible. No active exploitation is confirmed in CISA KEV, and the EPSS score of 0.13% (3rd percentile) suggests opportunistic rather than widespread exploitation at time of analysis.
Path traversal in the All-in-One WP Migration and Backup WordPress plugin (versions 7.87 through 7.105) allows unauthenticated network attackers to create or append log files at arbitrary filesystem locations outside the plugin's intended storage directory. A publicly available proof-of-concept exploit exists via WPScan and the SSVC framework classifies exploitation as automatable, though EPSS at 0.16% (6th percentile) indicates limited observed opportunistic activity and no CISA KEV listing confirms active exploitation at time of analysis. The constrained write capability - log file creation and appending only, not arbitrary content injection - limits direct impact, but filesystem write access outside the web root could serve as a precursor step in chained attacks depending on server permissions.
HTML injection in the Kirki WordPress plugin before 6.0.12 allows unauthenticated attackers to embed arbitrary HTML into password-reset emails delivered to registered site users, enabling targeted phishing from a trusted site domain. The flaw affects all Kirki versions below 6.0.12 and requires no authentication to trigger, though successful exploitation depends on the target user interacting with the malicious email. A publicly available POC exists per WPScan; the vulnerability is not currently listed in CISA KEV, and the 0.10% EPSS score (1st percentile) indicates minimal observed automated exploitation.
Unauthenticated comment manipulation in the Kirki WordPress plugin (versions before 6.0.12) allows remote attackers to overwrite the content of any existing comment or inject new pre-approved comments under a spoofed identity, bypassing moderation entirely. The root cause is a missing authorization check (CWE-862) on a REST API route exposed by the plugin by default. A publicly available proof-of-concept exploit exists per WPScan, and SSVC classifies the attack as automatable, increasing the likelihood of mass exploitation against unpatched sites. No CISA KEV listing is present, but the trivial attack path warrants prompt patching.
Missing authorization on the booking cancellation endpoint in the WP Travel WordPress plugin (all versions before 11.7.1) permits any unauthenticated internet visitor to cancel arbitrary bookings on affected sites. The action is exposed without capability checks or ownership verification, meaning no login or elevated role is required. A public proof-of-concept is available via WPScan; no confirmed active exploitation in CISA KEV at time of analysis, though the trivial attack complexity makes opportunistic abuse realistic.
Incorrect authorization on REST API endpoints in the All in One SEO WordPress plugin (before 4.9.9) allows authenticated users with low-level roles such as Contributor to overwrite or reset the site-wide AI integration configuration. The flaw is classified under CWE-863 (Incorrect Authorization), meaning the plugin registers REST API routes without enforcing appropriate role checks before permitting state-modifying operations. A publicly available proof-of-concept exists per WPScan, though no active exploitation has been confirmed by CISA KEV. The practical blast radius is limited to integrity of the plugin's AI settings, with no evidence of confidentiality or availability impact.
Shortcode injection in the Reviews Feed WordPress plugin before 2.6.5 allows unauthenticated network attackers to execute arbitrary WordPress shortcodes on any site page that renders the affected feed. The attack is indirect: an adversary plants a shortcode payload inside a review on a connected third-party review platform (e.g., a Google Business profile linked to the plugin); when the plugin ingests and renders that review through its dynamic block without neutralizing shortcode syntax, WordPress's native shortcode processor executes the embedded macro. A publicly available proof-of-concept exists per WPScan; no active exploitation has been confirmed in CISA KEV, though the public POC meaningfully elevates practical risk above what the moderate CVSS score of 4.8 suggests.
Royal Addons for Elementor WordPress plugin before 1.7.1063 exposes private and draft Elementor template content to unauthenticated users through a REST endpoint that fails to enforce WordPress post-status access controls. Any unauthenticated visitor can retrieve rendered HTML of restricted templates referenced by non-public navigation menu items, bypassing intended content access controls. A public proof-of-concept exists per WPScan and SSVC flags this as automatable, though EPSS at 0.15% (4th percentile) reflects no confirmed widespread exploitation; no CISA KEV listing exists.
Broken object-level authorization in the WPS Bookings for WooCommerce WordPress plugin (all versions before 3.11.7) allows any authenticated low-privilege user - including Subscribers and Customers - to cancel booking orders belonging to other customers without ownership verification. This IDOR flaw (CWE-639) enables a malicious registered user to void legitimate bookings across the platform, causing business disruption and financial harm to merchants and their customers. A publicly available proof-of-concept exists via WPScan; no active exploitation is confirmed in CISA KEV, and EPSS at 0.13% (3rd percentile) indicates limited observed exploitation activity at time of analysis.
Unauthenticated account deletion in the User Registration & Membership WordPress plugin (all versions before 5.2.3) exposes a membership payment action endpoint that performs no capability check on the caller, allowing any unauthenticated remote attacker to supply an arbitrary user identifier and delete recently-registered, payment-pending accounts. The flaw is a classic CWE-639 Insecure Direct Object Reference - the plugin trusts a caller-supplied user ID without verifying the caller has authority to act on it. A publicly available proof-of-concept exists, and SSVC classifies exploitation as automatable, though the EPSS score of 0.14% (3rd percentile) indicates limited observed exploitation volume at the time of analysis.
Stored Cross-Site Scripting in the NEX-Forms WordPress plugin before version 9.2.3 allows unauthenticated remote attackers to inject persistent malicious scripts into the admin dashboard by submitting crafted form data that is stored without sanitization and rendered without output escaping. When an administrator views the submitted entries panel, the stored payload executes in their browser, enabling session hijacking or secondary site takeover actions. A public proof-of-concept is available via WPScan, though EPSS data (0.24%, 14th percentile) and the SSVC Automatable:no classification indicate targeted rather than mass-automated exploitation at this time.
Path traversal in FunnelKit WordPress plugin before 3.15.0.6 enables authenticated administrators to delete arbitrary .json files outside the plugin's intended directory during template-import operations. The root cause is CWE-73 (External Control of File Name or Path): the deletion handler accepts user-supplied paths without canonicalization or boundary enforcement. Leveraging CVSS scope change (S:C), a malicious admin can target configuration files belonging to other installed plugins, causing cascading denial-of-service across the WordPress installation. A publicly available exploit exists; the vulnerability is not in the CISA KEV catalog at time of analysis.
RTMKit WordPress plugin versions before 2.0.9 allows users holding at least the Author role to invoke a restricted builder AJAX action without adequate capability verification, letting them create and activate site-wide templates that override globally displayed areas - headers, footers, and other layout regions - ordinarily controlled only by administrators. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.13% (3rd percentile) and CISA KEV does not list active exploitation, suggesting opportunistic rather than widespread abuse. The integrity impact is real but bounded: no data theft or remote code execution occurs, only unauthorized content modification visible to all site visitors.
Unauthorized post title disclosure in the RTMKit WordPress plugin before 2.0.9 allows any site user holding at least the Contributor role to enumerate private, draft, pending, scheduled, and trashed posts authored by other users. The root cause is a missing capability check in an AJAX handler that resolves a caller-supplied post identifier directly - a classic IDOR (CWE-639) pattern. No public exploit is in CISA KEV, but a publicly available proof-of-concept exists per WPScan, and the vendor has released a patch in version 2.0.9.
Stored cross-site scripting in the Header Footer Builder for Elementor WordPress plugin before 1.2.1 permits any Contributor-level user to inject persistent JavaScript into every page of the affected site by importing a crafted template through the plugin's dashboard action, which incorrectly requires only edit_posts capability rather than administrator access. Once the malicious Elementor HTML widget is imported with site-wide display scope, the payload executes in the browser of every visitor and administrator who loads the site - enabling session hijacking, credential theft, or admin account takeover. A publicly available exploit exists per WPScan (EUVD-2026-44878); no CISA KEV listing at time of analysis.
Unauthenticated media file upload in the Customer Reviews for WooCommerce WordPress plugin (all versions before 5.113.0) allows any remote user to push image and video files directly into the WordPress Media Library, leading to media library pollution and disk space exhaustion. The flaw is conditionally exploitable - the plugin's review media attachment feature must be enabled - but when active, requires no credentials, nonce, or capability check on the affected AJAX action. No active exploitation is confirmed in CISA KEV, though a publicly available proof-of-concept has been published by WPScan, and the SSVC framework flags the attack as automatable.
Unauthorized access to private chatbot conversations in the AI Engine WordPress plugin before 3.5.5 allows any authenticated subscriber-level user to both read and overwrite other users' chat records when the discussions feature is enabled. The plugin fails to verify that a client-supplied conversation identifier belongs to the requesting user (CWE-639 IDOR), enabling session data theft and record hijacking. Public exploit code is available via WPScan, though EPSS stands at only 0.13% (3rd percentile), suggesting no widespread automated exploitation; active exploitation is not confirmed in the CISA KEV at time of analysis.
SQL injection in WP Job Portal WordPress plugin before 2.5.5 enables authenticated subscriber-level users to exfiltrate data from the underlying WordPress database. Because subscriber accounts are explicitly self-registerable (no admin approval required), the practical authentication barrier is near-zero for any external attacker. A publicly available exploit exists per WPScan, though EPSS at 0.18% (7th percentile) indicates limited observed exploitation to date and no CISA KEV listing at time of analysis.
Cross-Site Request Forgery in the Appointment Booking Plugin for WordPress (versions before 5.6.3) allows an unauthenticated attacker to perform privileged administrative actions - including overwriting the booking-form configuration and disconnecting the connected payment gateway - by tricking a logged-in administrator into clicking a malicious link or visiting an attacker-controlled page. The root cause is absent CSRF nonce validation across multiple state-changing actions handled by the plugin's central request dispatcher. A publicly available proof-of-concept exists per the WPScan advisory, though EPSS sits at 0.10% (1st percentile), indicating negligible observed exploitation activity and no CISA KEV listing at time of analysis.
Stored cross-site scripting via prompt injection in the BetterDocs WordPress plugin (versions 4.0.0 through 4.5.5) allows unauthenticated attackers to permanently implant malicious JavaScript into documentation pages by manipulating the plugin's AI-generated summary feature. Because the AI output is stored unsanitized and the generation endpoint requires no authentication, an attacker can craft adversarial prompts that cause the AI to produce and persist executable script payloads - payloads that then fire in the browser of every subsequent visitor, including WordPress administrators. A publicly available exploit exists via WPScan; no active exploitation confirmed in CISA KEV at time of analysis.
Kali Forms - Contact Form & Drag-and-Drop Builder WordPress plugin before version 2.4.17 allows any authenticated Contributor-level (or higher) user to duplicate arbitrary posts they do not own by exploiting a missing per-object authorization check in the plugin's AJAX post-duplication action. The attacker gains a published copy of the target post under their own ownership and can extract private post metadata, including secrets stored by other Kali Forms instances on the same site. A publicly available proof-of-concept exists per WPScan; the vulnerability is not currently listed in the CISA KEV catalog, though the low privilege bar and default-enabled feature make it an actionable risk on any multi-user WordPress installation running the affected plugin.
Unauthenticated file upload to the WordPress Media Library is possible in Kali Forms - Contact Form & Drag-and-Drop Builder versions before 2.4.17, because the plugin's upload handler accepts file submissions without verifying that a corresponding form with a file-upload field actually exists on the site. Any unauthenticated remote attacker can directly invoke the upload endpoint and deposit files into the Media Library. Impact is bounded by WordPress's core MIME type allowlist, which prevents upload of executable files and thereby rules out code execution; a publicly available proof-of-concept is confirmed by WPScan, and no CISA KEV listing is present at time of analysis.
Account takeover in the WP 2FA WordPress plugin (all versions before 3.1.1.2) is achievable by any attacker who has obtained a valid user's credentials. The plugin fails to verify that the email address submitted during two-factor authentication enrollment belongs to the authenticated account (CWE-862: Missing Authorization), allowing the attacker to redirect the setup verification code to an attacker-controlled inbox and complete 2FA enrollment on behalf of the victim. A publicly available proof-of-concept exists per WPScan; this vulnerability is not currently listed in the CISA KEV catalog, but the combination of a PoC, medium-prevalence deployment, and account-takeover impact warrants prompt patching.
SureForms WordPress plugin before 2.11.1 permits unauthenticated attackers to submit manipulated payment amounts below the configured price on any form using a dynamically-sourced or hidden variable payment field, enabling financial fraud against site operators. The integrity bypass is confined to forms with variable pricing; fixed-price forms are explicitly unaffected. A publicly available proof-of-concept exists via WPScan, and a vendor patch is available in version 2.11.1 - though no CISA KEV listing confirms active mass exploitation at time of analysis.
Stored cross-site scripting in the Ultimate Before After Image Slider & Gallery WordPress plugin (all versions before 4.7.1) enables users with administrator-level access to plant persistent malicious scripts via the BEAF Slider widget's shortcode field, which then execute silently in the browsers of any site visitor loading a page displaying the widget. The plugin pipes the field value through WordPress's native do_shortcode() function without sanitizing or escaping the output, causing unrecognized content to be echoed verbatim to the rendered page. A publicly available proof-of-concept has been disclosed by WPScan; no active exploitation has been confirmed in the CISA Known Exploited Vulnerabilities catalog.
Information disclosure in the WP Job Portal WordPress plugin before version 2.5.5 allows any authenticated subscriber-level user - accounts that are self-registerable - to harvest private contact email addresses belonging to other employers by cycling through job listing identifiers. The plugin endpoint that returns an employer's contact email for a given job fails to verify that the requesting user has any ownership or access rights to that record, making this a classic IDOR (Insecure Direct Object Reference) flaw. Publicly available exploit code exists per WPScan; however, EPSS remains very low at 0.13% (3rd percentile) and the attack is not listed in CISA KEV, suggesting exploitation is not yet widespread.
Missing authorization in WP Job Portal WordPress plugin before 2.5.5 allows any self-registered subscriber to approve, feature, or reject arbitrary job listings owned by other users, bypassing both capability and ownership checks entirely. The subscriber role is self-registerable on most WordPress sites, meaning an unauthenticated attacker can trivially obtain the access level needed to exploit this flaw with no admin interaction required. A publicly available proof-of-concept exists; no CISA KEV listing indicates confirmed mass exploitation at time of analysis.
Broken object-level authorization in the Tutor LMS WordPress plugin before 3.9.13 allows any authenticated instructor-level user to overwrite and take over arbitrary posts or pages sitewide, including administrator-owned content. The content-builder save handler validates the request against an unrelated identifier rather than confirming the requesting user owns or is permitted to edit the target post, making the authorization check entirely ineffective. A publicly available proof-of-concept exploit exists; no active exploitation has been confirmed by CISA KEV at time of analysis, though the low barrier (instructor account only) and high integrity impact elevate real-world risk significantly.
Tutor LMS WordPress plugin (all versions before 3.9.13) allows authenticated users with subscriber-level access to post auto-approved comments containing arbitrary HTML and external links on any site content, bypassing the comment moderation queue entirely. The vulnerable comment handler performs no authorization check and no post-target validation before creating comments, making this exploitable by any registered user on sites with open registration - a common LMS deployment pattern. A publicly available POC from WPScan exists; no CISA KEV listing indicates confirmed mass exploitation, but the low privilege bar and POC availability make this a realistic content-integrity threat.
Unauthenticated information disclosure in Essential Addons for Elementor (WordPress plugin, all versions before 6.6.10) exposes WooCommerce product metadata - title, price, and SKU - for products in draft, pending, and private status that WordPress would otherwise withhold from public visitors. The plugin's product-comparison feature resolves product objects without performing authorization, post-status, or visibility checks, violating object-level access control (CWE-639). A public proof-of-concept exists per WPScan (the original reporter), and SSVC marks the flaw as automatable, though EPSS remains very low (0.15%) and the vulnerability is not currently listed in CISA KEV.
Stored XSS in Essential Addons for Elementor (WordPress plugin) before 6.6.10 allows any Contributor-level or higher user to inject arbitrary JavaScript via an unsanitized HTML tag name in the Pricing Table widget title field. The payload executes in the browser of any user who views the affected page - critically including administrators previewing or visiting the post - enabling session hijacking or privilege escalation to full site control. A publicly available proof-of-concept exists, raising the realistic threat above the CVSS 4.8 medium score.
Stored Cross-Site Scripting in Animation Addons for Elementor WordPress plugin (all versions before 2.7.0) allows authenticated users with the upload_files capability - Author role and above - to upload unsanitized SVG or SVGZ files containing embedded JavaScript. When a victim visits or previews a page rendering the malicious file, the script executes in their browser under the site's origin, potentially enabling session hijacking or privilege escalation to administrator. No active exploitation is confirmed via CISA KEV, but a publicly available proof-of-concept exists and a vendor patch has been released at version 2.7.0.
Insecure Direct Object Reference in the WP Travel WordPress plugin (all versions before 11.8.1) exposes customer booking records to any authenticated WordPress user. By supplying an arbitrary booking identifier to the customer account dashboard endpoint, a low-privileged attacker can retrieve another customer's full booking details, including billing address information. No special role is required beyond a basic site login; a publicly available proof-of-concept exists, though active exploitation has not been confirmed by CISA KEV.
Unauthenticated booking fraud is possible in the WP Travel WordPress plugin before 11.8.1 due to missing PayPal Instant Payment Notification (IPN) postback verification. Any unauthenticated attacker can send a forged IPN POST request to the plugin's payment handler, causing it to flip an arbitrary pending booking to a paid and confirmed state at a price of the attacker's choosing - enabling fraudulent travel reservations without payment. A publicly available proof-of-concept exists (reported by WPScan), and SSVC classifies the attack as automatable with partial technical impact, though no active exploitation is confirmed in the CISA KEV catalog.
Stored Cross-Site Scripting in the Fluent Forms WordPress plugin (all versions before 6.2.6) allows a Contributor-level user with delegated form-management permissions to embed a persistent malicious script into a form field configuration setting, which executes against every subsequent visitor - including administrators - who loads any page rendering that form. The vulnerability is especially significant in multisite WordPress environments, where contributors routinely lack the unfiltered_html capability yet may hold form-management delegation rights. A publicly available proof-of-concept exists per WPScan; no active exploitation is confirmed in CISA KEV at time of analysis.
IP spoofing via untrusted HTTP headers in WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05 allows unauthenticated attackers to defeat the plugin's own brute-force login protection and downgrade its firewall by forging headers that match a hardcoded whitelisted IP range. The plugin fails to validate that IP-sourcing headers (such as X-Forwarded-For or X-Real-IP) originate from a trusted reverse proxy, making any client-controlled header a viable forgery vector. A publicly available proof-of-concept exists per WPScan's disclosure, though EPSS remains low (0.16%, 5th percentile) and no active exploitation has been confirmed in CISA KEV.
Missing authorization in Frontend Admin by DynamiApps WordPress plugin (versions before 3.29.7) exposes taxonomy term creation, modification, and deletion operations to any authenticated user, including Subscribers - the lowest WordPress role. Rooted in CWE-862 (Missing Authorization), the plugin's taxonomy management handlers execute without invoking WordPress capability checks, granting low-privilege accounts editor-level control over site taxonomy. A public POC is available via WPScan; however, EPSS sits at 0.14% (4th percentile) and no CISA KEV listing exists, suggesting limited real-world exploitation activity despite the accessible POC.
Unauthenticated integrity corruption in Points and Rewards for WooCommerce (versions before 2.10.1) allows remote attackers to arbitrarily modify or corrupt the wallet balance and loyalty points of any user account - including driving values negative - without possessing any credentials. The missing authorization check on a wallet/points update action fails to verify that the requester owns the targeted account, making cross-account manipulation trivially possible. A publicly available proof-of-concept exists per WPScan; the vulnerability is not currently listed in CISA KEV and carries a low EPSS score (0.15%, 4th percentile), suggesting exploitation has not yet been observed at scale.
Unauthenticated deletion of all custom icon font packs is possible in Ultimate Addons for WPBakery Page Builder WordPress plugin before version 3.21.4. The plugin's icon font deletion endpoint performs no WordPress capability check and no nonce verification, meaning any unauthenticated HTTP request can permanently erase every custom-uploaded icon font pack on an affected site in a single request. A publicly available proof-of-concept exists and SSVC assesses the attack as automatable, though EPSS remains very low at 0.15% (5th percentile), indicating no significant observed exploitation at scale; the vulnerability is absent from CISA KEV.
RegistrationMagic WordPress plugin versions prior to 6.0.9.4 allows unauthenticated remote attackers to overwrite other users' front-end form submissions and the WordPress profile fields of the associated non-administrator accounts by exploiting absent authorization, ownership, and nonce validation on a submission-editing action. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials and no user interaction against any default plugin deployment. A public proof-of-concept exists per WPScan, though EPSS sits at 0.14% (4th percentile) and this CVE is not in CISA KEV, indicating no confirmed widespread active exploitation at time of analysis.
Unauthorized access to other users' form submission data is possible in RegistrationMagic WordPress plugin versions prior to 6.0.9.4 due to missing OTP-to-identity binding validation. The plugin accepts a one-time password from a cookie without confirming it corresponds to the identity being requested, enabling unauthenticated network-based retrieval of personal information submitted through front-end registration forms. A publicly available exploit exists per WPScan, though EPSS at 0.14% (4th percentile) and the absence of a CISA KEV listing indicate exploitation has not been observed at scale.
Search Atlas SEO WordPress plugin (all versions before 2.6.12) exposes its Google Indexing API integration to any authenticated user - including low-privilege subscribers - due to a missing capability and nonce check in an AJAX handler. Any user with a valid WordPress session can invoke the plugin's Google Indexing API endpoint to submit or remove site URLs from Google's search index and exhaust the site's indexing API quota. A publicly available exploit exists via WPScan, though EPSS at 0.14% (4th percentile) and the absence of a CISA KEV listing indicate limited observed exploitation activity at this time.
The Appointment Booking Plugin for WordPress (all versions before 5.6.8) allows unauthenticated visitors to set privileged booking fields - including approval status - through the plugin's public booking funnel, silently bypassing the site's manual booking approval workflow. Any site relying on appointment approval as a gatekeeping mechanism can have that control subverted by any internet-accessible visitor with no credentials required. A publicly available proof-of-concept exists per WPScan; however, EPSS remains at 0.15% (5th percentile), indicating limited observed exploitation activity despite the trivially low attack complexity.
Stored cross-site scripting in the GiveWP WordPress plugin before version 4.16.3 allows authenticated users holding the GiveWP Worker role or above to inject arbitrary JavaScript into donation-form template settings, which then executes in the browsers of any visitor viewing the public donation form. The attack requires existing privileged access within the GiveWP role hierarchy, limiting opportunistic exploitation, though a publicly available proof-of-concept lowers the barrier for targeted abuse. EPSS sits at 0.17% (7th percentile) and the vulnerability has not been added to CISA KEV, suggesting limited observed exploitation in the wild despite POC availability.
Authenticated information disclosure in the LifterLMS WordPress plugin before 10.0.10 exposes internal post type titles - including coupon codes - to any subscriber-level user. The root cause is a missing capability check in a select2 query AJAX handler that only verifies login status, not whether the user holds an appropriate WordPress capability. A publicly available proof-of-concept exists (via WPScan), though EPSS sits at just 0.16% (5th percentile), indicating low broad exploitation likelihood; no active exploitation is confirmed by CISA KEV.
Stored cross-site scripting in LifterLMS WordPress plugin versions before 10.0.10 allows authenticated course editors to inject event-handler JavaScript into course pricing fields, which then executes in administrator browser sessions when the course is viewed. A publicly available proof-of-concept from WPScan confirms exploitability. EPSS at 0.17% (7th percentile) indicates low opportunistic exploitation probability, consistent with the authenticated-insider requirement and dependence on manual admin interaction.
Unauthorized customer PII exposure in MotoPress Hotel Booking WordPress plugin before 6.0.4 allows any authenticated subscriber-level user to retrieve full personal details - name, email, phone number, and address - belonging to any customer booking in the system. The flaw stems from a missing capability check in an AJAX action handler, meaning the plugin never verifies whether the requesting user is authorized to view the target booking before returning its data. A publicly available exploit exists per WPScan, though EPSS at 0.16% (5th percentile) and absence from CISA KEV suggest exploitation remains opportunistic rather than widespread.
SQL injection in the WP Hotel Booking WordPress plugin before 2.3.2 allows users holding plugin-specific booking-management roles to extract data from the underlying WordPress database via an unsanitized search parameter on the administrative booking listing page. The CVSS scope change (S:C) and high confidentiality impact (C:H) indicate the injected queries can reach data beyond the plugin's own tables, such as WordPress user credentials or site configuration. A publicly available exploit exists via WPScan, though EPSS sits at 0.18% (7th percentile) and the vulnerability is not listed in CISA KEV, suggesting targeted rather than widespread exploitation risk.
Bit Form WordPress plugin before version 3.1.2 fails to enforce form deactivation state on its public submission handlers, enabling unauthenticated network-accessible attackers to submit data to forms the site owner has intentionally disabled and trigger any configured backend workflows such as email notifications. The vulnerability carries a low CVSS score of 3.7 with AC:H, reflecting that exploitation requires knowledge of a specific deactivated form's endpoint, and real-world impact is limited to low integrity effects - spurious entries and unwanted workflow executions rather than data exfiltration or system compromise. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.15% (5th percentile) indicates exploitation has not meaningfully materialized across the wild.
Authenticated privilege escalation in the Sync Post With Other Site WordPress plugin (all versions before 1.9.3) allows any Contributor-level user to create, publish, and overwrite arbitrary Pages - including content authored by administrators - by exploiting an operator-precedence flaw in a REST route's authorization check. A public proof-of-concept is available via WPScan, though EPSS sits at 0.15% (5th percentile) and SSVC marks exploitation as non-automatable, suggesting opportunistic rather than widespread active exploitation. No CISA KEV listing exists at time of analysis.
Stored cross-site scripting in the WP Real IP-based Access Control WordPress plugin (all versions through 1.3.1) allows unauthenticated remote attackers to inject persistent JavaScript into the plugin's settings page, which executes in the browser of any administrator who subsequently views that page. The root cause is a complete absence of capability checks and nonce validation on the option-storing endpoint, combined with unescaped output rendering on the settings page. A publicly available proof-of-concept exploit exists per WPScan; however, the vulnerability is not currently listed in the CISA KEV catalog and carries a low EPSS score of 0.19% (9th percentile), suggesting no confirmed widespread exploitation at time of analysis.
Easy Appointments WordPress plugin through version 3.12.26 exposes an appointment-listing REST endpoint to any authenticated user by gating it on a capability held by every WordPress user - including subscribers, the lowest authenticated role. Any user with a basic account can query this endpoint to enumerate all site bookings, extracting customer names, appointment schedules, and booking statuses belonging to other clients. A publicly available exploit is documented by WPScan; however, EPSS sits at 0.16% (5th percentile) and the vulnerability is not in CISA KEV, indicating limited observed mass exploitation at time of analysis.
Insecure direct object reference in the Easy Appointments WordPress plugin (all versions through 3.12.26) permits any authenticated subscriber-level user to retrieve personal information belonging to any appointment booking customer by iterating a customer identifier. The plugin fails to enforce ownership or capability checks before returning stored customer records, exposing PII across the entire customer base to the lowest-privileged WordPress role. No active exploitation is confirmed in CISA KEV, but a publicly available exploit exists via WPScan's disclosure, and EPSS sits at 0.15% - consistent with targeted rather than automated mass exploitation.
Improper access control in the Easy Appointments WordPress plugin through version 3.12.26 allows any contributor-level WordPress user to delete the site's booking configuration and functionally disable the appointment system. The vulnerable action handler performs neither a WordPress capability check nor nonce validation, meaning any authenticated user at or above contributor role can trigger the deletion without administrative approval. A publicly available exploit exists per WPScan, though EPSS at 0.15% (5th percentile) indicates limited observed exploitation; no CISA KEV listing is present.
Broken access control in the Easy Appointments WordPress plugin through version 3.12.26 permits any contributor-level authenticated user to perform privileged appointment-management actions - including reading all customer booking details and creating, modifying, or deleting appointments - without holding the required capabilities. The plugin relies exclusively on WordPress nonce verification as its authorization gate for these AJAX actions, but nonces are available to all authenticated users regardless of role and do not encode privilege level. A publicly available exploit exists per WPScan; no vendor patch has been identified at time of analysis.
Easy Appointments WordPress plugin through version 3.12.26 exposes all stored customer personal information to any authenticated contributor-level user due to missing per-request capability and nonce validation on a customer-listing handler. Any user holding a contributor role - a low-privilege WordPress role normally limited to drafting posts - can invoke the unprotected endpoint and enumerate the full customer dataset. A publicly available proof-of-concept exists per WPScan, though EPSS places exploitation probability at 0.16% (5th percentile) and the flaw has not been listed in CISA KEV, suggesting limited observed exploitation.
Easy Appointments WordPress plugin through version 3.12.26 exposes an insecure direct object reference (IDOR) that lets any subscriber-level user overwrite the customer metadata of another user's appointment by reusing a nonce harvested from their own edit form. The shared nonce mechanism provides CSRF protection but no ownership enforcement, so an attacker can target arbitrary appointment IDs without restriction. A publicly available proof-of-concept exists (WPScan), and the vulnerability can be chained into a notification hijack: when an administrator approves an affected appointment with customer notifications enabled, the confirmation email is delivered to the attacker-controlled address rather than the legitimate customer, exposing booking details to an unauthorized party.
Order integrity bypass in the PayU CommercePro Plugin for WordPress (versions through 3.8.9) enables unauthenticated remote attackers to tamper with WooCommerce order totals, shipping details, and metadata without paying the correct amount. The plugin processes payment-gateway callbacks without verifying the cryptographic signature that PayU issues, meaning any HTTP client can forge a callback and manipulate arbitrary orders. A publicly available proof-of-concept exploit exists per WPScan; no active exploitation has been confirmed in CISA KEV at time of analysis.
Stored cross-site scripting in the PhotoSwipe WordPress plugin (all versions through 4.1.1.1) allows an authenticated Author-level user to plant a persistent JavaScript payload inside a link's title attribute, which the plugin writes unescaped into the page DOM as a lightbox caption. Any visitor - including site administrators - who clicks the link triggers payload execution in their browser, enabling session hijacking and full WordPress takeover. A publicly available proof-of-concept exists; no patched release has been identified at time of analysis.
Unauthenticated information disclosure in the ShinyStat Analytics WordPress plugin (versions before 1.0.17) exposes non-published WooCommerce product data - including draft, pending, and private listings - via an unprotected REST API endpoint that performs no authorization check. Any internet-accessible WordPress/WooCommerce site running an affected version is vulnerable without credentials or user interaction, consistent with the AV:N/AC:L/PR:N/UI:N CVSS vector. A publicly available proof-of-concept is documented by WPScan; no active exploitation has been confirmed in CISA KEV at time of analysis.
Authenticated customers of the FluentCart WordPress plugin can manipulate other users' subscriptions by exploiting missing ownership verification in payment-method endpoints. The vulnerability affects versions before 1.4.0 and allows an attacker with low privileges to change payment methods or cancel subscriptions if they know the target subscription identifier. Publicly available exploit code exists, but EPSS probability is low (0.13%) and no active exploitation in CISA KEV has been reported.
The Quiz and Survey Master WordPress plugin before version 11.1.5 permits authenticated users with contributor-level permissions to delete arbitrary output templates due to a missing capability check. Public exploit code is available, though no active exploitation has been confirmed. A vendor patch (version 11.1.5) addresses this issue.
Stored cross-site scripting in the Event Tickets and Registration WordPress plugin before 5.28.4 enables Editors and above to inject malicious scripts in event titles, which execute against higher-privileged users on multisite setups when they view the ticket history log. The vulnerability has a low CVSS of 3.5 and a low EPSS of 0.15%, but exploit code is publicly available. A patch in version 5.28.4 is available from the vendor.
Stored cross-site scripting (XSS) in the Calendar WordPress plugin prior to version 1.3.18 allows authenticated users with Contributor-level access to inject arbitrary JavaScript into an event field. The script executes in the browsers of any user viewing the calendar page, potentially leading to session hijacking or privilege escalation. A public exploit is available, increasing the immediate risk despite the privilege requirement.
Username enumeration and brute-force password attempt in Quiz and Survey Master WordPress plugin before 11.1.3 allows unauthenticated attackers to enumerate valid usernames and bypass brute-force protections via distinct responses on front-end credential checks. Publicly available exploit code exists, though no active exploitation has been reported. The medium-severity flaw, while not directly exposing passwords, facilitates credential-stuffing and further attacks against identified accounts.
Unauthenticated attachment deletion in the User Frontend WordPress plugin before 4.3.8 allows remote attackers to permanently delete author-less attachments, such as guest uploads or placeholder media. The vulnerability stems from missing ownership checks on attachment deletion requests, and a proof-of-concept exploit is publicly available. The vendor has released a patch in version 4.3.8.
Open redirect vulnerability in Contact Form 7 WordPress plugin prior to version 2.5 allows unauthenticated attackers to redirect victims to arbitrary external sites after the Stripe checkout flow. Publicly available exploit code exists, but no active exploitation has been confirmed. With a CVSS score of 4.7 (medium) and low EPSS not provided, the risk is moderate due to required user interaction and limited impact.
Stored cross-site scripting in Smart Manager for WordPress before version 8.92.0 enables authenticated attackers with at least Contributor role to inject JavaScript that executes in an administrator's browser via the management grid. A publicly available proof-of-concept exists, though no active exploitation is confirmed. The vendor has released patched version 8.92.0.
Reflected XSS in the Sina Extension for Elementor WordPress plugin allows unauthenticated attackers to execute arbitrary JavaScript in victims' browsers. The vulnerability exists in an unauthenticated AJAX handler that fails to escape user input before reflecting it. Public exploit code is available, and the vendor has released a patch in version 3.10.2.
SQL injection vulnerability in the WPBot WordPress plugin before version 8.5.2 allows authenticated administrators to inject arbitrary SQL queries via unsanitized field identifiers. This injection executes when a site visitor triggers a search, potentially leading to low-level data exposure or modification. A public exploit is available, though no active exploitation has been confirmed by CISA KEV.
Stored Cross-Site Scripting in Simply Schedule Appointments up to 1.6.12.2 allows unauthenticated attackers to inject arbitrary web scripts. A double‑encoding fault causes payloads to bypass the plugin’s wp_kses_post() sanitizer and then execute when an administrator views appointment notifications. The vulnerability is fixed in version 1.6.12.4; a public proof‑of‑concept exists but no active exploitation has been confirmed.
Integrity bypass in The Events Calendar WordPress plugin allows unauthenticated attackers to mark existing Event Aggregator import records as failed and insert arbitrary content into a hidden comment. Public exploit code is available, and the vulnerability is automatable via the REST API, increasing the risk beyond the moderate CVSS score.
Reflected cross-site scripting (XSS) in the WordPress Document Gallery plugin before version 5.1.1 allows unauthenticated attackers to inject malicious scripts via an unsanitized parameter in an AJAX action. A publicly available proof-of-concept exploit exists, increasing the immediate risk for sites running affected versions.
Stored cross-site scripting in the Advanced Ads WordPress plugin versions before 2.0.23 allows authenticated users with Contributor role or higher to inject arbitrary web scripts via an unsanitized shortcode parameter. An attacker can leverage this to execute JavaScript in the browser of anyone viewing the affected page, potentially hijacking sessions or escalating privileges when administrators visit the content. A public proof-of-concept exists, but no active exploitation is confirmed.
Unauthenticated server-side request forgery (SSRF) and arbitrary local file read in Printcart Designer for WooCommerce versions prior to 2.5.3 allows attackers to exfiltrate sensitive configuration files and probe internal network resources. Public exploit code is available, and the patch has been released by the vendor.
License setting overwrite in ProfileGrid WordPress plugin versions before 5.9.9.7 allows authenticated users with Subscriber-level access or higher to overwrite premium license settings due to a missing capability check. Publicly available exploit code exists but active exploitation has not been confirmed. The flaw stems from relying solely on a nonce exposed to any logged‑in user, bypassing proper authorization.
Missing authorization checks in ProfileGrid WordPress plugin prior to 5.9.9.7 allow authenticated subscribers to manipulate private messages of other users. Attackers can soft-delete threads, alter metadata, and mark messages as read without owning the thread, impacting user privacy and data integrity. Public exploit code exists, but no active exploitation has been confirmed, and EPSS indicates very low exploitation probability (0.13%).
Authentication bypass in ProfileGrid WordPress plugin allows unauthenticated attackers to forge PayPal IPN payment notifications, granting paid membership to any group without payment. The vulnerability affects all versions before 5.9.9.7. A public proof-of-concept exploit is available, though the EPSS score (0.14%, percentile 3) indicates low likelihood of widespread exploitation at this time.
Reflected XSS in Post Status Notifier Lite WordPress plugin (all versions before 1.13.0) allows an unauthenticated remote attacker to inject and execute arbitrary JavaScript in a logged-in WordPress administrator's browser by tricking them into following a crafted URL targeting `admin.php?page=post-status-notifier-lite`. The plugin fails to escape the `mod` GET parameter before reflecting it into the admin settings page output, producing a Scope:Changed impact per CVSS - meaning successful exploitation crosses the plugin boundary into the broader WordPress admin session context. A publicly available POC exists via WPScan, though EPSS sits at just 0.21% (11th percentile), indicating low observed exploitation activity and no CISA KEV listing at time of analysis.
Reflected XSS in WP Compress WordPress plugin (versions before 7.10.04) allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by crafting a malicious link that injects the attacker's domain as the CDN host for script assets. The plugin's loader emits script elements pointing to the attacker-controlled origin without sanitizing the CDN host query parameter, achieving cross-site scope execution within the target WordPress site. Publicly available exploit code exists per WPScan reporting; no active exploitation is confirmed in CISA KEV, and EPSS is low at 0.20% (11th percentile), consistent with SSVC's 'poc, non-automatable, partial impact' classification.
Payment enforcement bypass in the Timetics WordPress booking plugin (versions before 1.0.57) allows unauthenticated remote users to generate fully-approved appointments for priced services without completing any payment. The plugin fails to validate booking status when the chosen payment method falls outside its recognized gateway list, effectively treating unverified payment submissions as completed transactions. A public proof-of-concept is available (reported by WPScan), and SSVC assessment confirms the flaw is automatable with partial technical impact, though EPSS remains low at 0.14%, suggesting exploitation is opportunistic rather than widespread.
Subscriber-level users on WordPress sites running WPBot before 8.2.0 can modify the plugin's retrieval-augmented-generation (RAG) configuration without authorization, because the relevant settings handler performs neither a WordPress capability check nor a nonce validation. A publicly available proof-of-concept lowers the exploitation bar significantly, making this actionable for any low-skill attacker who holds or can self-register a subscriber account on the target site. No public exploit identified at time of analysis by CISA KEV, but POC availability combined with low access requirements makes remediation a priority for sites with open user registration.
Academy LMS WordPress plugin versions prior to 3.8.1 exposes an Insecure Direct Object Reference (IDOR) flaw across multiple lesson AJAX handlers, allowing any subscriber-level authenticated user to read and overwrite other users' lesson notes and fraudulently mark course content as completed on their behalf. The vulnerability affects all Academy LMS installations running an unpatched version and is worsened by a publicly available exploit published via WPScan, though no active exploitation has been confirmed through CISA KEV. In environments where course completion carries compliance, certification, or audit significance, the integrity impact exceeds what the Medium CVSS score alone conveys.
Insecure Direct Object Reference (IDOR) in the Classified Listing WordPress plugin before 5.3.9 exposes payment receipt data across arbitrary user accounts. Any authenticated user holding subscriber-level access - the default role assigned upon registration on most WordPress sites - can query the payment-receipt handler with any order ID and receive full receipt details belonging to another user, because no ownership check is performed. A publicly available exploit exists per WPScan, and a vendor-released patch at version 5.3.9 is available; no KEV listing is present at time of analysis.
Unauthenticated workflow replay in the Bit Form WordPress plugin (versions before 3.1.0) allows external attackers to re-trigger any form's configured workflow actions - including notification emails and third-party service integrations - by submitting an expired workflow-trigger token that the plugin fails to properly reject. The root cause is missing authorization enforcement at the token-validation layer after WordPress transient expiry, classified under CWE-862. No public exploitation in CISA KEV is recorded, but a publicly available proof-of-concept exists per WPScan, elevating operational risk for sites with high-value workflow integrations such as CRM hooks or payment notifications.
Path traversal in the Bit Form WordPress plugin (versions before 3.1.0) allows unauthenticated remote attackers to read arbitrary files from the server - including wp-config.php, which contains database credentials and authentication keys - by supplying a crafted path in a form file-field that is then read and attached to a notification email. A publicly available proof-of-concept exploit exists, reported by WPScan, though the CVSS AC:H rating and SSVC Automatable:no designation indicate exploitation is not trivial. EPSS stands at 0.16% (6th percentile), and this CVE is not listed in CISA KEV, suggesting exploitation remains opportunistic rather than widespread at time of analysis.
Information disclosure in Elementor Website Builder (all versions before 4.1.4) allows authenticated WordPress users with Contributor-level access or above to read the title, body, and metadata of private posts, private pages, and drafts belonging to other users - including site administrators - via an improperly permission-checked REST endpoint. A publicly available proof-of-concept exploit exists (reported by WPScan), though EPSS places exploitation probability at 0.14% (4th percentile), indicating limited current in-the-wild activity despite public PoC. No active exploitation has been confirmed by CISA KEV; the vendor has released a patched version (4.1.4).
ThumbPress WordPress plugin (all versions before 6.2.2) allows any authenticated subscriber-level user to deactivate the plugin by exploiting a missing capability check on an AJAX action endpoint. This disrupts the site's image-handling functionality, constituting a targeted availability and integrity attack against WordPress installations. A publicly available exploit exists per WPScan; the vulnerability is not listed in CISA KEV, so active widespread exploitation is not confirmed at time of analysis.
Cross-site request forgery in the MailerSend WordPress plugin before 1.0.8 enables an unauthenticated remote attacker to wipe the plugin's SMTP configuration and deactivate it entirely by tricking a logged-in administrator into visiting a crafted page. The plugin's configuration-delete action validates the manage_options capability but entirely omits WordPress nonce verification, making administrator sessions exploitable via social engineering. A publicly available exploit demonstrates the attack; successful exploitation silently breaks all outbound email from the affected WordPress site, impacting password resets, order notifications, and transactional messaging.
PayPlus Payment Gateway WordPress plugin before 8.2.2 exposes an unauthenticated AJAX action that performs no authorization or order-ownership validation, allowing any remote, unauthenticated attacker to retrieve the secret order key of arbitrary WooCommerce orders. Under certain plugin configurations, the same endpoint additionally permits modification of order statuses, extending impact to data integrity. A publicly available proof-of-concept exists per WPScan reporting, though EPSS sits at only 0.13% (3rd percentile), indicating limited observed exploitation despite the SSVC Automatable=yes classification - no public exploit identified at time of analysis beyond the POC, and this CVE is not currently listed in CISA KEV.
PayPlus Payment Gateway WordPress plugin before 8.2.2 exposes an unauthenticated AJAX action that performs no authorization or order-ownership validation, enabling any remote unauthenticated actor to tamper with payment-related metadata on arbitrary WooCommerce orders across the site. A publicly available proof-of-concept exploit exists, and the SSVC framework classifies this as automatable with partial technical impact, making scripted mass-scanning of vulnerable WooCommerce shops feasible. No active exploitation is confirmed in CISA KEV, and the EPSS score of 0.13% (3rd percentile) suggests opportunistic rather than widespread exploitation at time of analysis.
Path traversal in the All-in-One WP Migration and Backup WordPress plugin (versions 7.87 through 7.105) allows unauthenticated network attackers to create or append log files at arbitrary filesystem locations outside the plugin's intended storage directory. A publicly available proof-of-concept exploit exists via WPScan and the SSVC framework classifies exploitation as automatable, though EPSS at 0.16% (6th percentile) indicates limited observed opportunistic activity and no CISA KEV listing confirms active exploitation at time of analysis. The constrained write capability - log file creation and appending only, not arbitrary content injection - limits direct impact, but filesystem write access outside the web root could serve as a precursor step in chained attacks depending on server permissions.
HTML injection in the Kirki WordPress plugin before 6.0.12 allows unauthenticated attackers to embed arbitrary HTML into password-reset emails delivered to registered site users, enabling targeted phishing from a trusted site domain. The flaw affects all Kirki versions below 6.0.12 and requires no authentication to trigger, though successful exploitation depends on the target user interacting with the malicious email. A publicly available POC exists per WPScan; the vulnerability is not currently listed in CISA KEV, and the 0.10% EPSS score (1st percentile) indicates minimal observed automated exploitation.
Unauthenticated comment manipulation in the Kirki WordPress plugin (versions before 6.0.12) allows remote attackers to overwrite the content of any existing comment or inject new pre-approved comments under a spoofed identity, bypassing moderation entirely. The root cause is a missing authorization check (CWE-862) on a REST API route exposed by the plugin by default. A publicly available proof-of-concept exploit exists per WPScan, and SSVC classifies the attack as automatable, increasing the likelihood of mass exploitation against unpatched sites. No CISA KEV listing is present, but the trivial attack path warrants prompt patching.
Missing authorization on the booking cancellation endpoint in the WP Travel WordPress plugin (all versions before 11.7.1) permits any unauthenticated internet visitor to cancel arbitrary bookings on affected sites. The action is exposed without capability checks or ownership verification, meaning no login or elevated role is required. A public proof-of-concept is available via WPScan; no confirmed active exploitation in CISA KEV at time of analysis, though the trivial attack complexity makes opportunistic abuse realistic.
Incorrect authorization on REST API endpoints in the All in One SEO WordPress plugin (before 4.9.9) allows authenticated users with low-level roles such as Contributor to overwrite or reset the site-wide AI integration configuration. The flaw is classified under CWE-863 (Incorrect Authorization), meaning the plugin registers REST API routes without enforcing appropriate role checks before permitting state-modifying operations. A publicly available proof-of-concept exists per WPScan, though no active exploitation has been confirmed by CISA KEV. The practical blast radius is limited to integrity of the plugin's AI settings, with no evidence of confidentiality or availability impact.
Shortcode injection in the Reviews Feed WordPress plugin before 2.6.5 allows unauthenticated network attackers to execute arbitrary WordPress shortcodes on any site page that renders the affected feed. The attack is indirect: an adversary plants a shortcode payload inside a review on a connected third-party review platform (e.g., a Google Business profile linked to the plugin); when the plugin ingests and renders that review through its dynamic block without neutralizing shortcode syntax, WordPress's native shortcode processor executes the embedded macro. A publicly available proof-of-concept exists per WPScan; no active exploitation has been confirmed in CISA KEV, though the public POC meaningfully elevates practical risk above what the moderate CVSS score of 4.8 suggests.
Royal Addons for Elementor WordPress plugin before 1.7.1063 exposes private and draft Elementor template content to unauthenticated users through a REST endpoint that fails to enforce WordPress post-status access controls. Any unauthenticated visitor can retrieve rendered HTML of restricted templates referenced by non-public navigation menu items, bypassing intended content access controls. A public proof-of-concept exists per WPScan and SSVC flags this as automatable, though EPSS at 0.15% (4th percentile) reflects no confirmed widespread exploitation; no CISA KEV listing exists.
Broken object-level authorization in the WPS Bookings for WooCommerce WordPress plugin (all versions before 3.11.7) allows any authenticated low-privilege user - including Subscribers and Customers - to cancel booking orders belonging to other customers without ownership verification. This IDOR flaw (CWE-639) enables a malicious registered user to void legitimate bookings across the platform, causing business disruption and financial harm to merchants and their customers. A publicly available proof-of-concept exists via WPScan; no active exploitation is confirmed in CISA KEV, and EPSS at 0.13% (3rd percentile) indicates limited observed exploitation activity at time of analysis.
Unauthenticated account deletion in the User Registration & Membership WordPress plugin (all versions before 5.2.3) exposes a membership payment action endpoint that performs no capability check on the caller, allowing any unauthenticated remote attacker to supply an arbitrary user identifier and delete recently-registered, payment-pending accounts. The flaw is a classic CWE-639 Insecure Direct Object Reference - the plugin trusts a caller-supplied user ID without verifying the caller has authority to act on it. A publicly available proof-of-concept exists, and SSVC classifies exploitation as automatable, though the EPSS score of 0.14% (3rd percentile) indicates limited observed exploitation volume at the time of analysis.
Stored Cross-Site Scripting in the NEX-Forms WordPress plugin before version 9.2.3 allows unauthenticated remote attackers to inject persistent malicious scripts into the admin dashboard by submitting crafted form data that is stored without sanitization and rendered without output escaping. When an administrator views the submitted entries panel, the stored payload executes in their browser, enabling session hijacking or secondary site takeover actions. A public proof-of-concept is available via WPScan, though EPSS data (0.24%, 14th percentile) and the SSVC Automatable:no classification indicate targeted rather than mass-automated exploitation at this time.
Path traversal in FunnelKit WordPress plugin before 3.15.0.6 enables authenticated administrators to delete arbitrary .json files outside the plugin's intended directory during template-import operations. The root cause is CWE-73 (External Control of File Name or Path): the deletion handler accepts user-supplied paths without canonicalization or boundary enforcement. Leveraging CVSS scope change (S:C), a malicious admin can target configuration files belonging to other installed plugins, causing cascading denial-of-service across the WordPress installation. A publicly available exploit exists; the vulnerability is not in the CISA KEV catalog at time of analysis.
RTMKit WordPress plugin versions before 2.0.9 allows users holding at least the Author role to invoke a restricted builder AJAX action without adequate capability verification, letting them create and activate site-wide templates that override globally displayed areas - headers, footers, and other layout regions - ordinarily controlled only by administrators. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.13% (3rd percentile) and CISA KEV does not list active exploitation, suggesting opportunistic rather than widespread abuse. The integrity impact is real but bounded: no data theft or remote code execution occurs, only unauthorized content modification visible to all site visitors.
Unauthorized post title disclosure in the RTMKit WordPress plugin before 2.0.9 allows any site user holding at least the Contributor role to enumerate private, draft, pending, scheduled, and trashed posts authored by other users. The root cause is a missing capability check in an AJAX handler that resolves a caller-supplied post identifier directly - a classic IDOR (CWE-639) pattern. No public exploit is in CISA KEV, but a publicly available proof-of-concept exists per WPScan, and the vendor has released a patch in version 2.0.9.
Stored cross-site scripting in the Header Footer Builder for Elementor WordPress plugin before 1.2.1 permits any Contributor-level user to inject persistent JavaScript into every page of the affected site by importing a crafted template through the plugin's dashboard action, which incorrectly requires only edit_posts capability rather than administrator access. Once the malicious Elementor HTML widget is imported with site-wide display scope, the payload executes in the browser of every visitor and administrator who loads the site - enabling session hijacking, credential theft, or admin account takeover. A publicly available exploit exists per WPScan (EUVD-2026-44878); no CISA KEV listing at time of analysis.
Unauthenticated media file upload in the Customer Reviews for WooCommerce WordPress plugin (all versions before 5.113.0) allows any remote user to push image and video files directly into the WordPress Media Library, leading to media library pollution and disk space exhaustion. The flaw is conditionally exploitable - the plugin's review media attachment feature must be enabled - but when active, requires no credentials, nonce, or capability check on the affected AJAX action. No active exploitation is confirmed in CISA KEV, though a publicly available proof-of-concept has been published by WPScan, and the SSVC framework flags the attack as automatable.
Unauthorized access to private chatbot conversations in the AI Engine WordPress plugin before 3.5.5 allows any authenticated subscriber-level user to both read and overwrite other users' chat records when the discussions feature is enabled. The plugin fails to verify that a client-supplied conversation identifier belongs to the requesting user (CWE-639 IDOR), enabling session data theft and record hijacking. Public exploit code is available via WPScan, though EPSS stands at only 0.13% (3rd percentile), suggesting no widespread automated exploitation; active exploitation is not confirmed in the CISA KEV at time of analysis.
SQL injection in WP Job Portal WordPress plugin before 2.5.5 enables authenticated subscriber-level users to exfiltrate data from the underlying WordPress database. Because subscriber accounts are explicitly self-registerable (no admin approval required), the practical authentication barrier is near-zero for any external attacker. A publicly available exploit exists per WPScan, though EPSS at 0.18% (7th percentile) indicates limited observed exploitation to date and no CISA KEV listing at time of analysis.
Cross-Site Request Forgery in the Appointment Booking Plugin for WordPress (versions before 5.6.3) allows an unauthenticated attacker to perform privileged administrative actions - including overwriting the booking-form configuration and disconnecting the connected payment gateway - by tricking a logged-in administrator into clicking a malicious link or visiting an attacker-controlled page. The root cause is absent CSRF nonce validation across multiple state-changing actions handled by the plugin's central request dispatcher. A publicly available proof-of-concept exists per the WPScan advisory, though EPSS sits at 0.10% (1st percentile), indicating negligible observed exploitation activity and no CISA KEV listing at time of analysis.
Stored cross-site scripting via prompt injection in the BetterDocs WordPress plugin (versions 4.0.0 through 4.5.5) allows unauthenticated attackers to permanently implant malicious JavaScript into documentation pages by manipulating the plugin's AI-generated summary feature. Because the AI output is stored unsanitized and the generation endpoint requires no authentication, an attacker can craft adversarial prompts that cause the AI to produce and persist executable script payloads - payloads that then fire in the browser of every subsequent visitor, including WordPress administrators. A publicly available exploit exists via WPScan; no active exploitation confirmed in CISA KEV at time of analysis.
Kali Forms - Contact Form & Drag-and-Drop Builder WordPress plugin before version 2.4.17 allows any authenticated Contributor-level (or higher) user to duplicate arbitrary posts they do not own by exploiting a missing per-object authorization check in the plugin's AJAX post-duplication action. The attacker gains a published copy of the target post under their own ownership and can extract private post metadata, including secrets stored by other Kali Forms instances on the same site. A publicly available proof-of-concept exists per WPScan; the vulnerability is not currently listed in the CISA KEV catalog, though the low privilege bar and default-enabled feature make it an actionable risk on any multi-user WordPress installation running the affected plugin.
Unauthenticated file upload to the WordPress Media Library is possible in Kali Forms - Contact Form & Drag-and-Drop Builder versions before 2.4.17, because the plugin's upload handler accepts file submissions without verifying that a corresponding form with a file-upload field actually exists on the site. Any unauthenticated remote attacker can directly invoke the upload endpoint and deposit files into the Media Library. Impact is bounded by WordPress's core MIME type allowlist, which prevents upload of executable files and thereby rules out code execution; a publicly available proof-of-concept is confirmed by WPScan, and no CISA KEV listing is present at time of analysis.
Account takeover in the WP 2FA WordPress plugin (all versions before 3.1.1.2) is achievable by any attacker who has obtained a valid user's credentials. The plugin fails to verify that the email address submitted during two-factor authentication enrollment belongs to the authenticated account (CWE-862: Missing Authorization), allowing the attacker to redirect the setup verification code to an attacker-controlled inbox and complete 2FA enrollment on behalf of the victim. A publicly available proof-of-concept exists per WPScan; this vulnerability is not currently listed in the CISA KEV catalog, but the combination of a PoC, medium-prevalence deployment, and account-takeover impact warrants prompt patching.
SureForms WordPress plugin before 2.11.1 permits unauthenticated attackers to submit manipulated payment amounts below the configured price on any form using a dynamically-sourced or hidden variable payment field, enabling financial fraud against site operators. The integrity bypass is confined to forms with variable pricing; fixed-price forms are explicitly unaffected. A publicly available proof-of-concept exists via WPScan, and a vendor patch is available in version 2.11.1 - though no CISA KEV listing confirms active mass exploitation at time of analysis.
Stored cross-site scripting in the Ultimate Before After Image Slider & Gallery WordPress plugin (all versions before 4.7.1) enables users with administrator-level access to plant persistent malicious scripts via the BEAF Slider widget's shortcode field, which then execute silently in the browsers of any site visitor loading a page displaying the widget. The plugin pipes the field value through WordPress's native do_shortcode() function without sanitizing or escaping the output, causing unrecognized content to be echoed verbatim to the rendered page. A publicly available proof-of-concept has been disclosed by WPScan; no active exploitation has been confirmed in the CISA Known Exploited Vulnerabilities catalog.
Information disclosure in the WP Job Portal WordPress plugin before version 2.5.5 allows any authenticated subscriber-level user - accounts that are self-registerable - to harvest private contact email addresses belonging to other employers by cycling through job listing identifiers. The plugin endpoint that returns an employer's contact email for a given job fails to verify that the requesting user has any ownership or access rights to that record, making this a classic IDOR (Insecure Direct Object Reference) flaw. Publicly available exploit code exists per WPScan; however, EPSS remains very low at 0.13% (3rd percentile) and the attack is not listed in CISA KEV, suggesting exploitation is not yet widespread.
Missing authorization in WP Job Portal WordPress plugin before 2.5.5 allows any self-registered subscriber to approve, feature, or reject arbitrary job listings owned by other users, bypassing both capability and ownership checks entirely. The subscriber role is self-registerable on most WordPress sites, meaning an unauthenticated attacker can trivially obtain the access level needed to exploit this flaw with no admin interaction required. A publicly available proof-of-concept exists; no CISA KEV listing indicates confirmed mass exploitation at time of analysis.
Broken object-level authorization in the Tutor LMS WordPress plugin before 3.9.13 allows any authenticated instructor-level user to overwrite and take over arbitrary posts or pages sitewide, including administrator-owned content. The content-builder save handler validates the request against an unrelated identifier rather than confirming the requesting user owns or is permitted to edit the target post, making the authorization check entirely ineffective. A publicly available proof-of-concept exploit exists; no active exploitation has been confirmed by CISA KEV at time of analysis, though the low barrier (instructor account only) and high integrity impact elevate real-world risk significantly.
Tutor LMS WordPress plugin (all versions before 3.9.13) allows authenticated users with subscriber-level access to post auto-approved comments containing arbitrary HTML and external links on any site content, bypassing the comment moderation queue entirely. The vulnerable comment handler performs no authorization check and no post-target validation before creating comments, making this exploitable by any registered user on sites with open registration - a common LMS deployment pattern. A publicly available POC from WPScan exists; no CISA KEV listing indicates confirmed mass exploitation, but the low privilege bar and POC availability make this a realistic content-integrity threat.