Wolf
Monthly
Blind SQL injection in the PluginUs.Net WOLF bulk-editor WordPress plugin, affecting all versions through 1.1.1, allows an attacker who already holds high-privilege authenticated access to the WordPress site to inject arbitrary SQL through the plugin's bulk-editing input and infer database contents indirectly. Because the injection is blind, extraction is slower and no victim user interaction is required; the practical exposure is limited by the PR:H prerequisite, meaning an administrator-level account or an account with access to the WOLF bulk-editor interface is required before exploitation is possible. No public exploit code was identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); EPSS data was not provided, and the overall priority is moderate rather than emergency.
Stored Cross-Site Scripting in the WOLF WordPress plugin before 1.1.0 lets an unauthenticated attacker persist malicious script into a post by exploiting a CSRF-exposed AJAX action lacking nonce and capability checks. Because a logged-in administrator must be tricked into triggering the request (UI:R), exploitation is CSRF-driven rather than direct, but a successful attack injects attacker-controlled JavaScript that executes in the context of anyone viewing the affected post. Publicly available exploit code exists (reported by WPScan), though the EPSS score is very low (0.12%, 2nd percentile) and it is not on the CISA KEV list.
SQL injection vulnerability in the RealMag777 WOLF bulk-editor WordPress plugin (versions up to 1.0.8.7) that allows authenticated administrators to execute blind SQL injection attacks. With a low EPSS score of 0.02% and no KEV listing, this vulnerability requires high privileges to exploit and is not currently being actively exploited in the wild.
Blind SQL injection in the PluginUs.Net WOLF bulk-editor WordPress plugin, affecting all versions through 1.1.1, allows an attacker who already holds high-privilege authenticated access to the WordPress site to inject arbitrary SQL through the plugin's bulk-editing input and infer database contents indirectly. Because the injection is blind, extraction is slower and no victim user interaction is required; the practical exposure is limited by the PR:H prerequisite, meaning an administrator-level account or an account with access to the WOLF bulk-editor interface is required before exploitation is possible. No public exploit code was identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); EPSS data was not provided, and the overall priority is moderate rather than emergency.
Stored Cross-Site Scripting in the WOLF WordPress plugin before 1.1.0 lets an unauthenticated attacker persist malicious script into a post by exploiting a CSRF-exposed AJAX action lacking nonce and capability checks. Because a logged-in administrator must be tricked into triggering the request (UI:R), exploitation is CSRF-driven rather than direct, but a successful attack injects attacker-controlled JavaScript that executes in the context of anyone viewing the affected post. Publicly available exploit code exists (reported by WPScan), though the EPSS score is very low (0.12%, 2nd percentile) and it is not on the CISA KEV list.
SQL injection vulnerability in the RealMag777 WOLF bulk-editor WordPress plugin (versions up to 1.0.8.7) that allows authenticated administrators to execute blind SQL injection attacks. With a low EPSS score of 0.02% and no KEV listing, this vulnerability requires high privileges to exploit and is not currently being actively exploited in the wild.