Wbolt Com
Monthly
Unauthenticated broken access control in the Online Contact Widget WordPress plugin (versions ≤ 1.3.0) permits any network-accessible attacker to bypass authorization checks entirely, yielding high confidentiality impact against affected WordPress installations. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires no credentials, no user interaction, and minimal complexity, making the attack trivially repeatable at scale. No public exploit code or active exploitation has been confirmed at time of analysis, though the low complexity substantially reduces the barrier for independent exploit development.
Remote code execution in the Spider Analyser WordPress plugin (by wbolt.com) affects all versions up to and including 2.1.3, allowing remote attackers to inject and run arbitrary PHP code on the underlying web server without authentication. Because the CVSS vector carries PR:N/UI:N with a scope change, exploitation requires no login or user interaction and can compromise the entire hosting environment. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the maximal 10.0 score makes it a high-priority patch target for affected sites.
Stored Cross-Site Scripting in the Smart SEO Tool WordPress plugin (versions <= 4.1.2) allows an authenticated Contributor-level user to inject malicious JavaScript into SEO-related fields, which then executes in the browsers of higher-privileged users - such as administrators - who view the affected content. Successful exploitation could enable session hijacking and subsequent full site takeover if an admin account is compromised. No public exploit code or confirmed active exploitation has been identified at time of analysis; the vulnerability was reported by Patchstack.
Unauthenticated broken access control in the Online Contact Widget WordPress plugin (versions ≤ 1.3.0) permits any network-accessible attacker to bypass authorization checks entirely, yielding high confidentiality impact against affected WordPress installations. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires no credentials, no user interaction, and minimal complexity, making the attack trivially repeatable at scale. No public exploit code or active exploitation has been confirmed at time of analysis, though the low complexity substantially reduces the barrier for independent exploit development.
Remote code execution in the Spider Analyser WordPress plugin (by wbolt.com) affects all versions up to and including 2.1.3, allowing remote attackers to inject and run arbitrary PHP code on the underlying web server without authentication. Because the CVSS vector carries PR:N/UI:N with a scope change, exploitation requires no login or user interaction and can compromise the entire hosting environment. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the maximal 10.0 score makes it a high-priority patch target for affected sites.
Stored Cross-Site Scripting in the Smart SEO Tool WordPress plugin (versions <= 4.1.2) allows an authenticated Contributor-level user to inject malicious JavaScript into SEO-related fields, which then executes in the browsers of higher-privileged users - such as administrators - who view the affected content. Successful exploitation could enable session hijacking and subsequent full site takeover if an admin account is compromised. No public exploit code or confirmed active exploitation has been identified at time of analysis; the vulnerability was reported by Patchstack.