WordPress
Monthly
LatePoint WordPress plugin through 5.7.4 allows unauthenticated remote attackers who know a target customer's registered email address or phone number to bypass OTP authentication by racing the attempts counter and brute-forcing the 6-digit code, potentially taking over that customer's account, bookings, and personal data. Exploitation requires the site to use LatePoint's OTP/passwordless login flow and the attacker to win a concurrency race while guessing the code; no public exploit identified at time of analysis.
Stored cross-site scripting in the LearnPress WordPress LMS plugin (all versions up to and including 4.4.10) lets attackers plant arbitrary JavaScript that executes in a store administrator's browser when they open the affected order details or invoice export screens in wp-admin. Two injection points exist: the 'quantity' parameter handled by the frontend REST courses controller and the 'order_comments' field captured during checkout; the unauthenticated path depends on the site having guest checkout enabled, while sites with guest checkout disabled still expose both vectors to any Subscriber-level account. CISA KEV does not list this issue and no public exploit identified at time of analysis; exploitation requires the victimized operator to view a poisoned order or invoice page, which keeps it a credible but moderate-priority risk despite a 7.2 CVSS score reflecting scope change into the admin context.
PHP Object Injection in the Kirki WordPress plugin through 6.3.2 allows an authenticated Editor-level user to submit serialized data to the template import endpoint, but real impact is conditional on another installed plugin or theme providing a usable POP chain. Kirki itself contains no gadget chain, so the flaw alone does not enable file deletion, data theft, or code execution; the supplied 7.2 score overstates immediate risk, and no public exploit was identified at time of analysis. By default, KIRKI_USERS_DEFAULT_FULL_ACCESS lets Editors reach the endpoint despite the PR:H vector.
Unauthenticated information disclosure in the Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress through 6.3.2 allows remote attackers to read arbitrary users’ profile data by manipulating the 'context' parameter. The flaw is exploitable only when a published page uses a Kirki template containing at least one user-type dynamic content block, but under that condition no authentication or user interaction is needed and user IDs can be enumerated through standard WordPress REST endpoints. Impact is limited to disclosure of string-valued profile and user-meta fields, with no integrity or availability effect; no public exploit code was identified at time of analysis.
Cross-site request forgery in the aThemeArt Theme Helper WordPress plugin (all versions up to and including 1.0.8) allows a remote attacker with no credentials of their own (CVSS:3.1/AV:N/AC:L/PR:N) to induce a logged-in privileged WordPress user - typically an administrator - to submit a forged request to the site, causing state-changing plugin actions to execute with the victim's authority. The flaw is a missing CSRF token check (CWE-352); the forged action is limited to operations the plugin exposes without nonce validation, and exploitation hinges on the victim having an active authenticated session and being tricked into interacting with attacker-supplied content (UI:R). A Patchstack advisory is the only public reference, and no public exploit code or confirmed active exploitation has been identified at time of analysis. Note that the supplied CVSS 3.1 vector (8.8, C:H/I:H/A:H) is more severe than our independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L), which reflects that impact is bounded by the victim's privilege level and by which nonce-less plugin endpoints exist.
Missing authorization checks in the Advanced Post Manager WordPress plugin through version 4.5.6 let an authenticated user invoke functionality that should be reserved for higher-privileged roles, weakening the site's access-control boundary. Exploitation requires a valid low-privileged session (CVSS PR:L), so realistic exposure exists mainly on sites with open registration or attacker-controlled accounts, and no public exploit code has been identified at time of analysis. The demonstrated impact is limited to integrity and availability (C:N/I:L/A:L per our assessment), which is why this reads as a moderate-priority issue rather than a top-tier emergency.
SQL injection in the MapSVG WordPress plugin (mapsvg-lite-interactive-vector-maps) affects all versions through 8.16.1 and lets an authenticated low-privileged user, such as a subscriber, contributor or customer account, inject arbitrary SQL through the plugin's vulnerable request handling, exposing database contents. The issue is remotely reachable with low attack complexity and needs no victim interaction, but it does require a valid account on a site that both runs the affected plugin and permits untrusted low-privilege registration; sites that do not hand out such accounts face materially lower real-world exposure. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so the practical risk is driven by the population of sites exposing low-privileged authenticated access to the plugin.
Stored cross-site scripting in the WP Sessions Time Monitoring Full Automatic WordPress plugin affects all versions up to and including 1.1.5 and allows unauthenticated attackers to inject arbitrary JavaScript that persists in the site's stored data. Because the CVSS vector is PR:N, exploitation requires no prior authentication, but the injected payload only fires when a victim - typically an administrator reviewing the plugin's active-session and activity views - subsequently loads the affected page, so impact is deferred and depends on a privileged user visiting the poisoned view. The issue is assessed as moderate priority rather than a top-tier emergency, and no public exploit code or confirmed active exploitation was identified at time of analysis; the primary mitigations are updating or disabling the plugin and restricting exposure of its admin views.
Stored cross-site scripting in the GoSMTP Pro WordPress plugin (all versions up to and including 1.2.3) lets unauthenticated attackers plant arbitrary JavaScript inside the plugin's email-log records by submitting a comment crafted so that it survives WordPress comment kses moderation while entity-encoded, then is decoded into live HTML by core email notification handling and written verbatim to the plugin's log table. The script fires only when a privileged user, typically an administrator, opens the email-log page in wp-admin, which keeps real-world impact moderate despite the network-reachable, unauthenticated injection path; there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis. Exposure is limited to sites that accept comments from unauthenticated visitors and have GoSMTP Pro active with comment notification email logging enabled, while sites with comments disabled or logging unused are not affected.
SQL injection in the Vitepos - Point of Sale (POS) for WooCommerce WordPress plugin, affecting all versions up to and including 3.5.1, lets an attacker append arbitrary SQL through the 'src_by' parameter on the /vitepos/v1/vendor/list REST route and read sensitive data out of the site's database. Exploitation requires the affected plugin to be installed and active, and our assessment rates the route as reachable by any user holding a low-privileged POS role (for example vtpos-cashier) rather than by a fully anonymous visitor, although the vendor advisory also claims unauthenticated exploitation; no public exploit code has been identified at time of analysis. Impact is confidentiality-only - database disclosure, not modification - with no user interaction required.
Stored cross-site scripting in the SureCart plugin for WordPress (versions up to and including 4.9.4) allows unauthenticated attackers to inject arbitrary web scripts via the 'comment' parameter, which execute when a victim visits a page that loads the SureCart components runtime and lacks an sc-checkout element. While the entry point is unauthenticated, successful exploitation requires a specific combination of page layout (e.g., a post with a [sc_buy_button] shortcode and no sc-checkout element) and victim interaction, significantly limiting the real-world attack surface. No public exploit identified at time of analysis.
Arbitrary file upload in the DoubleScale All-in-One CRM WordPress plugin through version 1.5.1 allows authenticated attackers with subscriber-level access or higher to upload executable PHP files when the Helpdesk module is enabled, which can lead to remote code execution. The flaw is an unrestricted upload issue (CWE-434) with a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and no public exploit was identified at time of analysis. The assessed exploitation conditions require both a valid low-privilege WordPress account and an active Helpdesk module, making the risk highest on sites that allow open user registration.
Vulnity Security, a WordPress plugin maintained by Manuel Galan, can be bypassed to gain administrator access on Nginx-based installations running version 1.4.3 or earlier. The plugin's delegated-login feature writes a pairing credential file and auto-generates an Nginx configuration snippet intended to block web access to it, but the snippet guards the wrong directory path, leaving the credential file reachable by unauthenticated attackers who can then forge signed REST API requests and authenticate as an administrator. No public exploit code or confirmed active exploitation was identified at time of analysis, but the attack requires no authentication and no user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.1), with High complexity arising from the dependency on a qualifying Nginx deployment where the delegated-login pairing credential exists and the flawed snippet is active; Apache and other web servers appear unaffected.
Stored cross-site scripting in the premium build of the User Registration PRO WordPress plugin (all versions up to and including 6.2.9) lets unauthenticated attackers inject arbitrary JavaScript through the HTTP Referer header into a vulnerable AJAX endpoint, with the payload persisting so it executes whenever a victim loads the injected page. The nonce that normally protects that endpoint is localized into the page source of every front-end page for anonymous visitors, so no account or credentials are required, although the attacker must target a site running the paid premium build - the free WordPress.org distribution is not affected - and the payload only fires once a user actually visits the compromised page. No public exploit code and no confirmed active exploitation were identified at time of analysis; the assessed severity of 7.2 reflects the scope change and the limited, though real, confidentiality and integrity impact of script execution in a victim's browser.
PHP object injection in the Gravity Forms WordPress plugin (all versions before 3.1.1) allows unauthenticated, network-reachable attackers to feed crafted serialized data into a PHP unserialize() call, which can lead to object injection and, if a suitable gadget chain is present in the running PHP stack, to full compromise of confidentiality, integrity, and availability. The flaw is rated CVSS 8.1 with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning no credentials and no user interaction are needed, but the high attack-complexity component reflects that exploitation depends on a usable POP gadget chain existing in the plugin, WordPress core, or another installed plugin or theme. At time of analysis there is no public exploit identified (no CISA KEV listing and no published proof-of-concept in the supplied intelligence), and the vulnerability was reported through Patchstack to the vendor, with version 3.1.1 identified as the fixed release.
Reflected cross-site scripting (XSS) in the Houzez WordPress theme (versions up to and including 4.4.0) allows remote attackers to execute arbitrary script in a victim's browser by tricking them into clicking a crafted URL while the theme is active. The flaw requires user interaction (UI:R) and is unauthenticated from the attacker's side (PR:N), but since it is reflected and not stored, each victim must be individually targeted via phishing or a malicious link. No public exploit code or confirmed active exploitation was identified in the available intelligence at the time of analysis; the assessed CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Blind SQL injection in the halfdata Green Popups WordPress plugin before 7.6.3 lets a remote attacker inject crafted SQL through an HTTP request and extract data from the site's database one inferred bit at a time. The vendor (Patchstack) rates this 9.3 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, indicating network reachability, low complexity, a scope change, and high confidentiality impact, while our independent assessment scores it 9.3 as well but with PR:L instead of PR:N - meaning the true privilege prerequisite is not confirmed from the available data and pre-authentication exploitability cannot be assumed. There is no CISA KEV entry and no public exploit code identified at time of analysis, so this should be treated as a serious but not confirmed actively exploited issue; because it is blind, extraction is inference-based and slower than direct-output injection but still permits theft of user, configuration, and credential-adjacent data.
Remote code execution in the Theme-one The Grid WordPress plugin through version 2.8.1 allows network attackers to inject code or commands via the plugin's grid-generation code path, with the supplied CVSS:3.1 vector indicating AV:N/AC:L/PR:N/UI:N (unauthenticated and no user interaction per the vector, though the exact endpoint and authentication prerequisite should be verified in the Patchstack advisory). The provided vector rates this as 10.0 Critical with full confidentiality, integrity, and availability impact, while our independent assessment adjusts scope from Changed to Unchanged but still considers impact High. No public exploit identified at time of analysis, and no KEV or EPSS data was provided.
Authenticated OS command injection in the WP Photo Album Plus WordPress plugin (all versions up to and including 9.3.02.002) lets any WordPress user granted the plugin-defined wppa_upload capability execute arbitrary operating-system commands as the web-server user, achieving full server-side code execution where ImageMagick is the active image backend. Rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the flaw is reachable through the update-photo AJAX action's value parameter, and no public exploit code was identified at time of analysis; the bug is not in CISA KEV. Because wppa_upload is a plugin-level privilege that administrators can delegate to lower-privileged roles, the effective attacker pool can extend well beyond site administrators on misconfigured sites.
Stored cross-site scripting in WPConsent (Cookie Banner & Cookie Consent for Privacy Compliance) through 1.1.9 allows unauthenticated attackers to inject arbitrary web scripts into comment content that execute when a user views an injected page. Exploitation is constrained: it requires the optional Script Blocking feature to be enabled, the ability to submit comments that are rendered, and two coordinated comments that place event-handler syntax in an allowed code element and the deterministic ___noise___ restoration key in an allowed abbr title attribute, with the key offset confirmable via an unauthenticated wpconsent_debug=1 request. No public exploit identified at time of analysis, and the assessed vector is AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N, so the non-default configuration and precise coordination limit realistic exploitation below the raw 7.2 score.
Stored cross-site scripting in the HivePress Business Directory, Listings & Classified Ads plugin for WordPress (all versions up to and including 1.7.32) allows unauthenticated attackers to persist arbitrary JavaScript that executes whenever a user views a page rendering an affected custom user attribute. The published CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N); our assessment retains that score but raises attack complexity to High (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) because exploitation depends on a site administrator having configured a custom user attribute whose display_format template places the %value% token inside an href, src, or style attribute context - a documented but non-default use of the plugin's attribute display feature. No public exploit identified at time of analysis, and although an upstream fix has been merged (PR #375 / changeset 3747070), the realistic affected population is limited to sites with such an attribute template already in place.
Unauthenticated PHP object injection in the WordPress plugin Sunshine Photo Cart (all versions up to and including 3.7.4) allows an attacker to store a crafted serialized payload through the plugin's public favorites page, which is then deserialized when any image in a non-viewable or private gallery is viewed. The plugin ships no usable POP gadget chain of its own, so the flaw has no impact on a site running only this plugin; impact materialises only when a separate plugin or theme on the same installation provides a chain, in which case the attacker could delete arbitrary files, retrieve sensitive data, or execute code depending on that chain. No public exploit code or confirmed active exploitation was identified at time of analysis, and while the submitted CVSS is 9.8 the mandatory external gadget-chain precondition means our independent assessment rates it AV:N/AC:H/PR:N/UI:N with high confidentiality, integrity, and availability impact when the precondition is met.
Stored cross-site scripting in the TranslatePress - Translate Multilingual Sites with AI Translation WordPress plugin through version 3.3.7 allows unauthenticated attackers to inject arbitrary web scripts via the 'comment' parameter, which then execute in the browser of any visitor who loads the affected translated page. Successful exploitation depends on two conditions that coincide with the plugin's normal use case: the site must permit unmoderated comment submission on at least one post (WordPress holds first-time commenters for moderation by default, so this usually means a modified Discussion setting), and a secondary language must be configured so that comments are processed by the plugin's translation-render code path. Wordfence rates the issue at CVSS 3.1 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), confirming unauthenticated remote exploitation with no user interaction on the attacker's side and a scope change reflecting how stored script in a comment can act beyond the vulnerable component, and no public exploit code has been identified at time of analysis.
Remote code execution via arbitrary file upload affects the YaySMTP WordPress plugin in all versions up to and including 2.7.7, where an authenticated subscriber-level user can upload executable files through the putFile function. The plugin relies on sanitize_file_name() without an allow-list, MIME check, or safe-extension rename, and its only server-side guard is a .htaccess file with 'Require all denied' that nginx and Apache with AllowOverride None ignore, so full RCE is achievable on those configurations. No public exploit code was identified at time of analysis and there is no confirmed CISA KEV active exploitation; exploitation requires authentication at subscriber level or above, which is commonly available when open user registration is enabled.
Stored cross-site scripting in the WordPress plugin CP Multi View Events Calendar (CodePeople) in all versions up to and including 1.4.42 lets unauthenticated attackers inject arbitrary JavaScript through the CalendarTitle parameter, which is then rendered without escaping and executes in the browser of any user - including administrators - who later views the poisoned calendar page. Exploitation is conditional on a non-default configuration: a site administrator must have enabled the 'Allow edition in frontend?' option on at least one calendar view, which exposes the unauthenticated event-add endpoint together with a publicly accessible nonce that the attacker uses to submit the malicious title. No public exploit code was identified at the time of analysis and the issue is not listed in CISA KEV, but the 7.2 CVSS score with PR:N (unauthenticated) and scope change (S:C) makes the attack path low-complexity once that frontend-editing setting is active.
Unauthenticated account takeover in the WordPress plugin OTP Login & Register Woocommerce (versions before 2.7.3) is possible because the plugin counts one-time-password verification attempts against a value supplied by the client, which an attacker can freely change to reset the counter and brute-force the short numeric login code. Affected are WordPress sites running the plugin with its OTP-based login/registration flow enabled; publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been recorded, and the EPSS score is low at 0.15% (4th percentile). Successful brute-force yields full account takeover without knowing the victim's password, but the attack still requires enumerating a valid account identifier and issuing many requests, which is why the assessed severity is moderate (CVSS 7.4) rather than critical.
Cross-site request forgery in the Salon Booking System WordPress plugin (versions before 10.31.9) allows unauthenticated attackers to forge REST API requests in a logged-in administrator's browser by tricking the victim into clicking a crafted link, potentially leading to full site takeover via creation of a new administrator account. The flaw (CWE-352) stems from the plugin discarding WordPress core's nonce check for cookie-authenticated sessions across the entire REST API, so no plugin-specific feature toggle is needed beyond having the vulnerable version installed. Publicly available exploit code exists; EPSS is low at 0.11% (1st percentile), and there is no confirmed active exploitation (CISA KEV).
Stored cross-site scripting in the WordPress Profile Builder plugin (Cozmoslabs) affects all versions up to and including 4.0.3 and lets unauthenticated remote attackers plant arbitrary JavaScript through the First Name registration field, which executes in the browser of any user who later views the injected page - realistically an administrator processing pending registrations. The attack is explicitly gated on the plugin's Email Confirmation feature being enabled, so sites using default or other registration flows are not reachable through this path. Scoring is CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) with a scope change reflecting script execution in the victim's browser context, and no public exploit has been identified at time of analysis.
Authenticated attackers with Subscriber-level or higher PilotPress membership on WordPress sites can escalate to full Administrator privileges by exploiting a flawed ONTRAPORT synchronization routine in PilotPress versions up to and including 2.0.43. The defect allows an attacker to rename a remote ONTRAPORT contact to an existing Administrator's WordPress login, then leverage the plugin's authentication hook to cause WordPress core to issue an Administrator authentication cookie. This is a genuine high-priority vulnerability (CVSS 8.8), requiring a valid ONTRAPORT contact and the Customer Center nonce, but no victim interaction. No public exploit code was identified at time of analysis.
PHP object injection in the Search Regex WordPress plugin version 3.5 lets an authenticated attacker with subscriber-level access or above pass crafted serialized data into the plugin's replace_all function, which is then deserialized by PHP without validation. When a usable POP gadget chain exists in the installed plugin, WordPress core, or another active plugin, this object injection can be escalated to arbitrary code execution, giving the attacker full control of the site. No public exploit code or confirmed in-the-wild exploitation was identified at the time of analysis, and exploitation is conditional on both an authenticated account and a viable gadget chain.
Stored cross-site scripting in the NotificationX WordPress plugin (all versions up to and including 3.3.3) lets remote unauthenticated attackers inject arbitrary JavaScript through the 'name' parameter, which then executes in the browser of any visitor loading an affected page. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2), no authentication or victim interaction is required to deliver the payload, but exploitation is conditional: a site administrator must first enable the WordPress.org Reviews campaign and place the notificationx-pro/notificationx dynamic block on a publicly reachable page, neither of which is a default configuration. No confirmed active exploitation (not in CISA KEV) and no public exploit code has been identified at time of analysis, and the independent assessment rates this as a real-but-conditional, lower-tier priority rather than an urgent threat; a fix is available in version 3.3.4.
Stored DOM-based cross-site scripting in SiteOrigin CSS 1.6.7 and earlier allows unauthenticated attackers to inject scripts through the WordPress comment 'Website' (comment_author_url) field, executing when a victim loads a page where the plugin renders the stored comment URL into a DOM sink. Exploitation requires the site to accept comments from unauthenticated visitors and to use an affected plugin version; the CVSS 3.1 score of 7.2 reflects network reachability, low complexity, no authentication, and a scope change, with limited confidentiality and integrity impact. No public exploit code was identified at time of analysis.
Stored DOM-based cross-site scripting in the SiteOrigin CSS WordPress plugin (all versions up to and including 1.6.7) lets an unauthenticated attacker smuggle script into a page via the 'href' parameter, which the plugin's Visual Inspector later writes into the DOM without sanitization. Exploitation is not self-firing: the attacker's comment must survive moderation and be approved, and an administrator must subsequently open the Visual Inspector and manually click the injected anchor link - a mandatory user-interaction step that the CVSS base vector understates (our assessment re-scores it AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N versus the published 7.2). There is no confirmed active exploitation or public exploit code identified at time of analysis, and the practical impact is bounded to script execution in an authenticated administrator's browser context.
Stored cross-site scripting in the WP Ghost (Hide My WP Ghost) - Security & Firewall plugin for WordPress versions up to and including 7.0.12 lets unauthenticated attackers inject arbitrary web scripts through the plugin's replaceHeadersAndTags function, which performs insufficient input sanitization and output escaping; the injected payload persists and executes in a victim's browser when they click the crafted link, with impact limited to that victim's session (no availability impact). Exploitation requires the affected code path to be reachable on a site running 7.0.12 or earlier, but no authentication (CVSS PR:N) and no special non-default plugin configuration; although the published CVSS 3.1 vector scores UI:N, the practical trigger is a victim clicking the injected link, which is why our assessment adjusts user interaction to UI:R while keeping the same 7.2 base impact. The vendor has released a fix in version 7.0.13 (WordPress.org changeset from 7.0.12 to 7.0.13), no public exploit code has been identified and there is no CISA KEV entry indicating active exploitation at time of analysis. Reported by Wordfence, a credible source for WordPress plugin vulnerability intelligence.
Unauthenticated arbitrary file upload in the ELEX WordPress HelpDesk & Customer Ticketing System plugin (all versions up to and including 3.3.7) lets a remote attacker write attacker-controlled files, including potentially executable ones, into the WordPress installation via email attachments processed by the initMailPart function, enabling remote code execution with a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No WordPress authentication or victim interaction is required; the only prerequisite is that the plugin's email-piping/IMAP mailbox feature is configured and actively polling an inbox, since the attacker reaches the vulnerable code simply by sending a crafted email to that monitored support mailbox. Exploitation is therefore configuration-dependent rather than universal, and sites that do not use IMAP mail fetching are not exposed; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor fix is available in version 3.3.8.
Unauthenticated privilege escalation in the Cozmoslabs User Profile Builder WordPress plugin (all versions up to and including 4.0.3) allows an attacker to obtain a fully activated administrator account: they submit role=administrator through the public [wppb-register] registration form, then click the activation link emailed to them, and the activation handler applies that role via WP_User::set_role() without any allow-list check. The attack is conditional rather than trivial - the site must already carry a legacy registration form field with meta-name 'role' from before the 4.0.3 upgrade (the 4.0.3 reserved-name block deliberately exempts pre-existing fields), must have email confirmation enabled so the wp_signups path is used, and must allow open user registration. That combination of stable site-state prerequisites is why CVSS 3.1 scores it 8.1 with AC:H despite PR:N/UI:N, and no public exploit code has been identified at the time of analysis.
Unauthenticated path traversal in the 10Web Booster WordPress plugin (versions up to and including 2.34.5) lets remote attackers create arbitrary directories outside the plugin's cache root, with 0777 permissions applied recursively, and plant a cached page inside them by feeding unsanitized GET parameter names and values into the cache path. The write primitive is strictly limited - the filename is hard-coded to source.html and the body is the server-rendered page buffer rather than attacker-supplied content, so no executable file can be planted and code execution is not achievable, with the realistic outcomes being cache poisoning and stray directory creation (published CVSS 7.5 with I:H; the independent assessment revises integrity impact to Low), and no public exploit identified at time of analysis.
Stored cross-site scripting in the Salon Booking System WordPress plugin (Appointment Booking for Salons, Barbershops & Spas, all versions up to and including 10.31.9) lets unauthenticated attackers inject arbitrary JavaScript through the sln[<checkout-field-key>] checkout parameter, which is persisted and later executed when a user loads the affected page - in practice the admin customer view. Impact is conditional: the site must have at least one admin-configured custom checkout field of type Html or File, a documented but non-default plugin feature, so sites without such a field are not exploitable. No public exploit code has been identified at time of analysis, and the independent assessment rates the issue as a moderate, conditional risk rather than an emergency, downgrading the vendor's AC:L to AC:H because of the configuration dependency and the admin-context trigger.
Stored DOM-based cross-site scripting in the Opti-Behavior WordPress plugin (all versions up to and including 1.9.2.1) allows unauthenticated attackers to inject arbitrary JavaScript that executes when a victim later views recorded heatmap, session, or analytics data. The heatmap recording endpoint requires no authentication, and its only guard - a nonce - is freely obtainable by any anonymous visitor through the plugin's public opti_behavior_refresh_nonces AJAX action, so there is effectively no privilege barrier; the payload is stored rather than reflected, meaning it fires only when an administrator or other user loads the affected analytics page. The assessed CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (7.2), there is no CISA KEV entry and no public exploit code identified at time of analysis, and it should be treated as a genuine but moderate-priority issue rather than an emergency.
Privilege escalation in the Theme My Login plugin for WordPress (versions up to and including 7.2.1) allows unauthenticated attackers to change arbitrary user passwords on multisite installations in certain configurations, leading to account takeover and potential full network compromise. The flaw stems from improper validation of user identity before password updates (CWE-269). Exploitation requires a non-default multisite setup, and no public exploit code is identified at time of analysis; the effective attack complexity is higher than the base CVSS 9.8 score implies due to this configuration dependency.
Stored DOM-based cross-site scripting in the WordPress plugin Opti-Behavior (Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights) through version 1.9.2.1 lets unauthenticated attackers write arbitrary script content into heatmap/analytics records via the 'targetUrl' parameter, which is later rendered into a DOM sink when a user - most plausibly an administrator viewing the heatmap analytics metabox - accesses the injected page. The write endpoint is gated only by a nonce (optiBehaviorHeatmapConfig.nonce) that the plugin itself publicly emits to every anonymous visitor on tracked pages, so no account or login of any kind is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C, 7.2). Exploitation requires the plugin to be installed and active with heatmap/session tracking enabled on at least one page; no public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation, though the code references in the advisory make the vulnerable paths easy to locate.
Unauthenticated attackers can store arbitrary JavaScript in WordPress sites running the Simply Schedule Appointments plugin through version 1.6.12.35 by submitting an unsanitized 'status' parameter; the payload is written to the plugin's debug log unconditionally because debug logging is enabled by default. The script does not fire automatically for arbitrary visitors: execution is gated behind the plugin's debug-log viewer, which is reachable by anyone holding the site-wide Support PIN (an HMAC-MD5 of AUTH_SALT displayed in wp-admin), so the realistic victim is an administrator or support agent reviewing the log during routine troubleshooting, where the script executes in their session (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). There is no CISA KEV listing and no public exploit code identified at time of analysis, and the practical risk is lower on sites that rarely open the debug log or that rotate/restrict the Support PIN; signals are moderately concerning but do not indicate an urgent, widespread threat.
Stored cross-site scripting in the Ultra Addons for Contact Form 7 WordPress plugin (all versions up to and including 3.5.54) lets unauthenticated attackers upload a text-type file whose contents begin with HTML markup, which is then persisted and executed in the browser of any user who later views the injected page - a classic CWE-79 stored XSS. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (7.2), no authentication or user interaction is needed to deliver the payload, though execution depends on a victim subsequently loading the affected page. Exploitation is only reachable on sites that run the plugin and expose its file-upload/database add-on on a Contact Form 7 form; there is no public exploit identified at time of analysis and the issue is not in CISA KEV, so this is a credible moderate-priority web flaw rather than an emergency.
Stored cross-site scripting in the Schema & Structured Data for WP & AMP plugin (versions up to 1.67) allows unauthenticated attackers to inject arbitrary JavaScript via the 'saswp_review_text' parameter, because the nonce used as the sole authorization check is publicly exposed in the [saswp-reviews-form] shortcode. Exploitation requires the shortcode to be present, making it a genuine but deployment-specific issue that sits in the mid-tier of urgency. No public exploit code or active exploitation has been identified at time of analysis.
Arbitrary file deletion in the Groundhogg CRM, Newsletters and Marketing Automation plugin for WordPress (all versions up to and including 4.9.3) lets an authenticated user who holds the plugin's import_contacts capability - granted by default to Groundhogg's custom Sales Representative role - name an arbitrary server-side path and have the plugin delete it, with a realistic escalation to remote code execution (for example by removing wp-config.php). The flaw is reachable through the contact-import (CSV), REST API, and webhook paths that call copy_file, and it received a CVSS of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H); there is no CISA KEV listing and no public exploit code identified at time of analysis. The practical risk is bounded by the authentication requirement and by the attacker's need to know or guess the absolute path of a valuable target, but the capability is assigned by default and no user interaction or non-default configuration is needed, making this a credible, actionable priority rather than an inflated high-CVSS issue.
Sensitive information exposure in Modula Image Gallery 3.0.11 and earlier allows unauthenticated remote attackers to read the plaintext Password Protect password and username for published galleries by requesting the core WordPress REST route /wp-json/wp/v2/modula-gallery/{id}. The plugin redacts the same modulaSettings values on its dedicated /wp-json/modula/v2/gallery/{id}/settings endpoint, but the custom post type's show_in_rest=true registration leaves the core route without equivalent redaction. No public exploit identified at time of analysis; exploitation requires the target site to have enabled Password Protect for a gallery, so practical exposure is narrower than the 7.5 CVSS score suggests.
Unauthenticated privilege escalation in the My Calendar - Accessible Event Manager WordPress plugin (all versions up to and including 3.8.7) allows remote attackers to overwrite the credentials of the default Administrator account (user ID 1) and gain full wp-admin access. The flaw arises from unsanitized reflection of the `mcs` GET parameter into post content, enabling injection of a nested `[my_calendar above=...]` shortcode that is processed by `mc_generate_calendar_nav()`, which calls arbitrary PHP functions via `call_user_func()` without authorization or callable allowlisting. No public exploit code has been identified at time of analysis, but the plugin's auto-generated `/my-calendar/` page is publicly accessible by default, making exploitation trivially reachable by an unauthenticated attacker.
Unauthenticated order enumeration and PII disclosure in the Klarna for WooCommerce (Klarna Payments for WooCommerce) WordPress plugin affects all versions up to and including 4.13.3, allowing any remote attacker to retrieve the secret order_key plus full billing and shipping personal data for any order in the store. Because the plugin fails to verify authorization (CWE-862) before emitting order details inline as the klarna_payments_params JavaScript variable on the order-pay endpoint, and WooCommerce order IDs are sequential integers, a full store-wide order dump can be obtained with ordinary sequential GET requests and no session, order_key, or credentials. The CVSS vector confirms the exposure is remote, unauthenticated, and requires no user interaction (AV:N/AC:L/PR:N/UI:N), with high confidentiality impact only; exploitation is trivially automatable, though no public exploit code and no confirmed active exploitation were identified at time of analysis. This is a genuine high-priority information-disclosure flaw rather than an inflated high-CVSS score, since every signal aligns with easy mass abuse across any default storefront running an affected version.
An authorization bypass in the FunnelKit Funnel Builder for WooCommerce Checkout WordPress plugin (all versions up to and including 3.16.0.6) lets unauthenticated attackers pull billing PII - full name, street address, email address, and phone number - for any WooCommerce order on a site by simply iterating sequential order IDs. Exploitation requires no authentication, privileges, or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, 7.5), and the sequential ID space makes automated bulk extraction practical, so a single vulnerable store can leak its entire customer billing dataset. The hard precondition is that a FunnelKit thank-you page rendering the [wfty_order_meta] or [wfty_order_total] shortcode must exist and be reachable - stores that do not use these shortcodes are not exposed. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; Wordfence-coordinated disclosure tracks it as a genuine medium-to-high priority data-exposure flaw rather than a drop-everything emergency.
Privilege escalation in the Nexter Extension WordPress plugin (all versions up to and including 4.7.11) allows an authenticated Subscriber-level or higher user to restore a stale stored Administrator role onto their own account, effectively becoming an Administrator. Exploitation is tightly constrained: the attacker's account must previously have held the Administrator role, must have used the plugin's View Admin Role Switcher, and must have been demoted specifically through the wp-admin/users.php?action=promote bulk role-change control rather than the Edit User screen. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV, and the assessed conditions are why the effective risk is lower than the 7.5 (HIGH) base score implies.
Stored cross-site scripting in the Mang Board WordPress plugin (all versions up to and including 2.4.3) lets unauthenticated attackers inject arbitrary JavaScript that executes in the browser of any user who later loads the poisoned board content. The injection path is unusually easy because the wp_ajax_nopriv_mb_template endpoint is publicly reachable, nonce verification is not enforced in content_reply mode, and admin-ajax.php answers with Content-Type: text/html so script tags embedded in the JSON body are parsed and executed. Wordfence rates it CVSS 7.2 (scope changed, PR:N/UI:N) and an upstream fix commit is referenced in the plugin's Trac changeset, but no public exploit code has been identified at time of analysis and there is no confirmed active exploitation, so this is an elevated-priority, patch-now issue rather than a top-tier emergency - the residual constraint is that execution requires a victim, ideally a privileged one, to view the injected page.
Unauthenticated attackers can take over any WordPress user account, including administrators, on sites running the MailOptin plugin up to version 1.2.78.6 that have a 'WordPress User Registration' opt-in form published. The flaw allows manipulation of the optin_data[form_custom_field_mappings] parameter to override saved mappings, enabling injection of arbitrary wp_users column names (e.g., ID, user_pass) into wp_insert_user(), which then updates the target account's password. No authentication, nonce, or capability check is required, and the only prerequisite is the presence of the registration form; sites using MailOptin solely for mailing-list optins without this connection are not affected. No public exploit identified at time of analysis.
Privilege escalation in the InstaWP Connect - 1-click WP Staging & Migration WordPress plugin (all versions up to and including 0.1.4.1) lets any authenticated user at Subscriber level or above read the site's plaintext InstaWP master API key from a plugin settings page and redeem it for a full administrator session. The key is disclosed because the admin page is registered with a role name returned by InstaWP_Setting::get_allowed_role() in place of a real capability, and because generate_section_field() prints the master API key directly into a plain-text HTML input without a manage_options check; the attacker then derives the bearer secret from that key, satisfies the plugin's REST validate_api_request(), and calls POST /wp-json/instawp-connect/v2/auto-login to mint a 30-second single-use login URL that sets an administrator authentication cookie. Exploitation is not default-configured: it additionally requires the site to be actively connected to InstaWP (a valid master API key in instawp_api_options) and an administrator to have added the attacker's role to the plugin's Sync Tab Access list (instawp_sync_tab_roles) while still retaining administrator in that list, so realistic exposure is narrower than the 7.5 base score implies. There is no public exploit code identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); authentication requirements are authenticated (CVSS PR:L) with high attack complexity (AC:H).
Unauthenticated attackers can read other customers' stored billing and shipping address PII on WordPress sites running the FluentCart plugin through version 1.7.0, exploiting an insecure direct object reference in the plugin's public AJAX checkout endpoint. Because the attacker supplies both the order_id and the address ID being compared, the plugin's internal id-equality guard is trivially satisfied, and sequential AUTO_INCREMENT order/address IDs can be enumerated at the soft rate limit of five requests per sixty seconds to harvest street address, city, state, postcode, phone, company name, VAT number and legal registration ID. The issue is confidentiality-only (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), with no write, modification or availability impact; it is not listed in CISA KEV and no public exploit code was identified at time of analysis.
Unauthenticated account takeover of WordPress sites running miniOrange OTP Login, Verification and SMS Notifications through 5.5.8 is possible because the Delay OTP grace flag is stored per user rather than being bound to the originating session, cookie, IP address, or device. When OTP-only login and Delay OTP Verification are enabled and the target account is inside its grace interval, an attacker can submit a known username with `mo_wp_login_intent=otp` and any non-empty password to inherit that user's verified state and log in as any account, including administrators. No public exploit code or CISA KEV active exploitation was identified at time of analysis, and exploitation is constrained by non-default settings plus a race-window timing precondition (CVSS 8.1, AC:H).
Unauthenticated file upload in the WordPress plugin Mang Board (all versions up to and including 2.4.4) lets an anonymous visitor place executable content on the server and reach remote code execution, because the mbw_file_upload handler enforces its extension allowlist only on the file_name parameter while the filename actually saved is derived from the unvalidated image_path parameter. Exploitation fits the assessed CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N), requiring no WordPress account and no user interaction: guest posting is the plugin's default board mode, and the nonce the request must carry is printed on every public board page and therefore readable by any unauthenticated visitor. No public exploit code has been identified at time of analysis; the practical limiting factor is configuration, since an administrator who has disabled guest posting removes the unauthenticated attack surface.
Stored cross-site scripting (XSS) in the Colibri Page Builder WordPress plugin versions up to and including 1.0.390 allows unauthenticated attackers to inject arbitrary web scripts via the comment parameter; the payload is stored and executes when any user views the injected page. The vulnerability has a CVSS v3.1 score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and no public exploit has been identified at time of analysis. While the score is elevated due to scope change and low confidentiality/integrity impact, the practical risk is notable but the raw score overstates the absolute danger; sites with comments disabled are not exposed.
Stored cross-site scripting in the Feedzy RSS Feeds (RSS Aggregator by Feedzy) WordPress plugin, affecting all versions up to and including 5.2.11, allows a remote attacker to place arbitrary JavaScript into a page generated from an imported feed item by embedding a payload in the 'media:thumbnail@url' field, which then executes when a user views that page. The bug is not exploitable against an arbitrary site: the target must already have the plugin configured to import from an RSS feed whose content the attacker controls or can influence, and the script only fires when a visitor or administrator opens the resulting page. The published CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) reads as a low-complexity unauthenticated issue, but the assessed vector raises attack complexity to High (AC:H) because of the feed-control prerequisite; no public exploit code has been identified at time of analysis and there is no CISA KEV listing, and the vendor has released version 5.2.12 that fixes the flaw.
Privilege escalation in the Customer Email Verification for WooCommerce WordPress plugin through 3.3.0 allows unauthenticated attackers to gain authentication as any WordPress account that still has an unverified email address, including administrators, by brute-forcing a per-user activation secret that has only about 101 possible values. The weakness is genuine and high impact (full account takeover), but real-world risk is heavily gated by three preconditions: the plugin's 'Encoding method' must be set to the non-default 'hashids' option, the attacker must recover or brute-force the Hashids salt (which defaults to an md5(time()) value fixed at first initialization), and the targeted account's email must remain unverified. An upstream changeset addressing the issue is referenced in the WordPress plugin repository, and no public exploit code was identified at time of analysis; CVSS 3.1 scores it 8.1 (High, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), so despite the High score it should be triaged as lower priority than a default-configuration, unauthenticated account-takeover bug in most deployments.
Stored cross-site scripting in the Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress (all versions up to and including 7.5.5) allows unauthenticated commenters to plant script payloads in comment content that execute in visitors' browsers once the comment is approved and rendered. The flaw is a bypass of WordPress's wp_kses comment sanitization: the payload uses only allow-listed tags and hides executable tokens as plain text inside quoted attribute values, and the XSS is only realized when Complianz's own Cookie-Blocker output-buffer filter applies str_replace() rewrites that break out of the attribute context. Attack complexity is assessed as High rather than Low, because exploitation requires the Cookie-Blocker output buffering and the yotu-wp integration code path to be active, and critically requires a moderator to approve the malicious comment before it renders; no public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation. Overall this is a real but non-urgent, lower-tier issue gated by human comment moderation rather than a mass-exploitation priority.
Privilege escalation to full WordPress site takeover is possible in the Backuply backup/restore plugin (all versions up to and including 1.5.8) via a second-order SQL injection that an authenticated subscriber-level user plants in the profile Biographical Info field and that only fires when an administrator later creates a backup capturing that value and then restores it. During the restore the injected SQL executes blind inside an INSERT into wp_usermeta, allowing the attacker to alter database records - most notably to set the default_role option in wp_options to administrator and enable open registration, so a subsequently registered account is granted Administrator rights. Exploitation cannot be self-triggered by the attacker (UI:R) and requires a valid authenticated account (PR:L, no anonymous path); no public exploit identified at time of analysis.
Unauthenticated stored cross-site scripting in the WordPress plugin Flying Scripts (Delay JavaScript to Improve Site Speed & Performance) through 1.2.4 lets attackers inject script through comment input that the plugin's output-buffer rewriter later re-emits into an HTML attribute. The bypass relies on a crafted payload using only WordPress kses-allowed markup-an <abbr title> attribute plus a double-quote-bearing <code> body-and the plugin's predictable unsalted ___noise___ placeholder substitution, so the script executes when a victim views the affected page. No public exploit identified at time of analysis, and exploitation requires the vulnerable plugin to be installed with its rewriting active and a comment or equivalent input path enabled, making this a moderate-priority issue despite the CVSS 7.2 scope-changed rating.
Reflected cross-site scripting in the 8theme XStore WordPress theme affects all installations running a version before 9.7.9, allowing remote attackers to inject script that executes in the browser of a site visitor who loads a crafted URL. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) confirms the flaw is network-reachable at low complexity and requires no authentication, but it does require the victim to click or load an attacker-supplied link (UI:R), and the scope change (S:C) means the injected script runs in the victim's browser context rather than on the server. Impact is limited to the victim's browser session within the site origin; because the payload is reflected and not stored, each victim must be individually lured, and no public exploit code was identified at time of analysis. A vendor fix is available in version 9.7.9 per the Patchstack advisory.
Frontend Admin by DynamiApps (the acf-frontend-form-element WordPress plugin) through version 3.29.13 assigns privileges incorrectly, letting a submitted frontend form escalate the submitting user's role - most seriously to administrator - which on WordPress equates to full site compromise. The provided CVSS 3.1 vector scores this 9.8 as network-reachable with no privileges required (PR:N), while our independent assessment scores it 8.8 with PR:L, because the real-world precondition is that a Frontend Admin form capable of affecting roles (for example a user-registration or profile-edit form) is published and reachable by the attacker; sites that expose such a form to anonymous visitors are effectively unauthenticated targets, whereas sites gating it behind login require at least a low-privilege account first. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so there is no confirmation of active exploitation, though the low complexity and high payoff make opportunistic scanning plausible.
Stored cross-site scripting in maxfoundry Social Share Buttons for WordPress through 1.31 lets malicious input persist in content handled by the share-button plugin and execute in the browser of any user who later views the poisoned page. The supplied CVSS vector scores it 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L); our independent assessment applies PR:L because stored XSS in WordPress plugins usually requires at least a low-privilege authenticated account unless a specific unauthenticated sink exists, and the required victim interaction means impact occurs only when a logged-in user or administrator loads the affected page. No public exploit identified at time of analysis, and no CISA KEV or EPSS data was provided.
Blind SQL injection in the Link Whisper Free WordPress plugin (versions up to 0.9.7) enables remote attackers to extract sensitive information from the site's database by injecting crafted SQL commands into an unspecified request handler. The vulnerability is rated critical with a CVSS score of 9.3, and the supplied vector indicates network exploitability, low complexity, and no authentication or user interaction required (PR:N/UI:N); however, the independent assessment notes that the true authentication requirements are unconfirmed and may involve a low-privilege account, and the exact trigger parameter is not publicly documented. No public exploit code or confirmed active exploitation is identified at time of analysis.
PHP object injection in Link Whisper Free (a WordPress plugin) through version 0.9.7 allows unauthenticated remote attackers to pass untrusted data into PHP's unserialize() and instantiate arbitrary objects, per the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8) supplied with the advisory. Our independent assessment keeps the network-reachable, unauthenticated, no-interaction prerequisites but raises attack complexity to High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), because CWE-502 only translates into full confidentiality, integrity, and availability loss when a usable POP gadget chain exists somewhere in the plugin, its bundled libraries, or other code loaded on the target site; absent such a chain the injected object may be inert. No public exploit identified at time of analysis, there is no CISA KEV listing, and no EPSS score was provided, so exposure today is limited to sites running the vulnerable plugin version that also happen to carry a viable gadget chain.
Reflected cross-site scripting in the Link Whisper Free WordPress plugin (versions through 0.9.7) allows remote attackers to inject malicious scripts into a victim's browser by tricking them into following a crafted link. Exploitation requires user interaction and the payload is reflected, not stored, so the attacker must lure a victim to a specially crafted URL while the plugin is active. No authentication is required of the attacker, but impact is greatest if the victim has an authenticated WordPress session, such as an administrator. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis.
Authorization bypass in the Webba Booking Lite WordPress plugin (webba-booking-lite, all versions through 6.5.2) allows remote attackers to retrieve booking data they are not entitled to by supplying a user-controlled object identifier that the plugin fails to check against the requester's permissions. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5 High) characterizes this as an unauthenticated, network-reachable confidentiality breach with no integrity or availability impact, though our independent assessment notes that IDORs of this class in WordPress plugins frequently require at least a low-privileged session in practice, so the authentication prerequisite should be confirmed against the Patchstack advisory. There is no CISA KEV listing and no public exploit code identified at time of analysis, and the practical exposure is limited to sites with the vulnerable plugin installed and active, with impact confined to unauthorized disclosure of booking/attendee data rather than modification or denial of service.
SQL injection in the Mang Board WP WordPress plugin (Kitae Park) affects all versions through 2.4.4 and lets an attacker inject arbitrary SQL into the site's backend database queries, with the primary impact being high confidentiality loss (bulk read of user records, password hashes, and other stored data) plus a limited integrity effect. The vendor/Patchstack vector advertises a 9.3 score with scope change and no privileges required (PR:N/UI:N), but the independent assessment rates the issue as PR:L with unchanged scope (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), so the authentication requirement should be treated as unconfirmed - the PR:N rating in the published vector is unusually permissive for a WordPress plugin SQLi and is not corroborated by the description text, which names no vulnerable parameter, endpoint, or feature. Only a Patchstack database entry is available: no vendor patch version is stated and no public exploit code has been identified at time of analysis.
Authenticated low-privilege users can exploit missing authorization checks in the ThemeGrill User Registration plugin (versions up to 5.2.8) to perform unauthorized actions, potentially altering site data or user information. This broken access control flaw (CWE-862) has a CVSS score of 7.1 and requires network access with low complexity, but no user interaction. No public exploit code or active exploitation has been identified at this time.
Privilege escalation in the Fluent CRM WordPress plugin version 3.2.5 and earlier allows an authenticated low-privileged user - such as a subscriber or self-registered account - to elevate their privileges and gain control over site resources, with a CVSS 3.1 score of 8.8 and high impact to confidentiality, integrity, and availability. Exploitation is not anonymous: it requires a valid low-privilege WordPress account plus an active vulnerable plugin installation, but no user interaction is needed (PR:L, UI:N) and no non-default configuration is named in the advisory. No public exploit identified at time of analysis; this is a genuine priority, not a high-CVSS-but-low-real-risk issue.
FluentCart, the WPManageNinja e-commerce plugin for WordPress, embeds sensitive information inside data it sends to clients in versions through 1.7.1, letting remote attackers pull that embedded data without authenticating. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) shows the exposure is network-reachable, low-complexity and requires no credentials or user interaction, but yields only confidentiality impact - no integrity or availability effect. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; exposure is limited to WordPress sites running this specific plugin at 1.7.1 or earlier.
Privilege escalation in the Fluent CRM WordPress plugin (all versions through 3.2.5) allows a low-privileged account to elevate itself to higher privileges, including administrator-equivalent capabilities, by abusing an incorrectly assigned privilege (CWE-266). The vendor-supplied vector scores this 9.8 (AV:N/AC:L/PR:N/UI:N), but the independent vector analysis assigns PR:L, meaning the realistic starting point is an authenticated low-privileged WordPress account, and that prerequisite is the one condition that most changes the real-world risk; the exact vulnerable endpoint and required account level are not detailed in the available data. No public exploit code has been identified at time of analysis, and Fluent CRM is not listed in CISA KEV; the sole public reference is the Patchstack advisory. Sites running Fluent CRM 3.2.5 or earlier should treat this as high priority because WordPress administrator takeover typically yields full site compromise, data theft, and persistent backdooring.
Stored cross-site scripting in the BSK PDF Manager WordPress plugin (all versions through 3.8.1) allows an attacker to persist malicious JavaScript that later executes in the browser of any user who loads the page or admin view that renders the unsanitized input. The published CVSS vector is 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) with a scope change, while the independent assessment retains a 7.1 score but rates privileges required as PR:L, noting that persisting a payload realistically depends on having at least a low-privilege authenticated role or access to a content-submission surface - sites where only trusted administrators can submit plugin content, or that have upgraded past 3.8.1, are not realistically exposed. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV.
Unauthenticated SQL injection in the TMS Amelia (ameliabooking) plugin for WordPress, affecting all versions through 2.4.10, allows remote attackers to inject arbitrary SQL into database queries executed by the plugin. Per the assessed vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), no authentication, no user interaction, and no non-default configuration are required - the only prerequisites are that the plugin be installed and active at a version at or below 2.4.10 on a network-reachable WordPress instance, making exposure broad across unpatched booking sites. The impact is confidentiality-focused: the classification indicates high confidentiality impact with no integrity or availability impact, so the practical risk is large-scale extraction of data from the site's WordPress database rather than data destruction or code execution. No public exploit code has been identified at time of analysis and the vulnerability is not listed as confirmed actively exploited (CISA KEV); no EPSS score was available in the source data, but given the unauthenticated, pre-auth access path and the database-level target, this should be treated as high priority on paper.
Stored cross-site scripting (XSS) in the Everest Forms WordPress plugin affects all releases through and including 3.6.1, allowing an attacker to persist a script payload inside form-submitted or plugin-stored data that later executes in the browser of a privileged user who views it. Our independent assessment rates this CVSS 3.1 at 7.1 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting that the payload is not self-firing - it requires a victim (most plausibly an administrator) to render the stored content, and that persisting it may in practice demand at least low-privilege authenticated access despite the upstream PR:N claim. Impact is bounded to the victim's browser session rather than the server, no public exploit code was identified at time of analysis, the issue does not appear in CISA KEV, and no EPSS score was supplied; sites running a release later than 3.6.1 are not exposed.
Remote code execution in ThemeHigh's Email Customizer for WooCommerce (Pro) through version 3.9.5 allows any authenticated user with subscriber-level access or higher to write attacker-controlled PHP into executable files inside the WordPress uploads directory through the plugin's send_test_mail() function, leading to full site compromise. The assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8) makes clear that the low-privilege account requirement is the main gate; exposure is greatest on WooCommerce stores that permit open customer/subscriber self-registration rather than manual account approval. Code execution also depends on the server permitting PHP to run from the uploads path, so sites that already harden that directory are materially less exposed, and no public exploit code has been identified at time of analysis.
Unauthenticated remote attackers can force-publish, rewrite, and create the managed pages of any WordPress site running Tutor LMS below 4.1.1, because the plugin's page-regeneration routine omits a capability check (CWE-862). Impact is confined to integrity - unpublished pages can be pushed live, existing page content overwritten, missing pages created, and the plugin options that reference those pages changed - with no confidentiality or availability effect and no code execution, so realistic damage is content tampering and manipulation of plugin page references rather than site takeover. Publicly available exploit code exists, and the CVSS 3.1 base score is 7.5 (HIGH) with vector AV:N/AC:L/PR:N/UI:N, making it trivially reachable on exposed sites; there is no CISA KEV entry indicating confirmed active exploitation at time of analysis.
Reflected cross-site scripting in the Document Gallery WordPress plugin (versions through 5.1.1) lets an unauthenticated attacker inject script into an HTML attribute returned by one of the plugin's AJAX actions, and the payload executes in the browser of any user who opens the crafted link - including a logged-in administrator. Publicly available exploit code exists and the issue is documented in the WPScan vulnerability database (EUVD-2026-101853), so exploitation only requires luring a victim into clicking or loading a malicious URL; no credentials are needed to deliver the payload (CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). At CVSS 7.1 the assessed impact is moderate rather than critical: script execution is confined to the victim's browser session instead of granting direct server control, there is no CISA KEV entry indicating confirmed actively exploited, and the decisive limiting factor is the mandatory victim interaction.
Unauthenticated attackers can register an administrator-equivalent account on any WordPress site running the User Rights Access Manager plugin through version 1.1.3, resulting in full site takeover. The plugin leaves one of its AJAX account-registration handlers accessible without any capability or nonce check, and assigns newly self-registered users a role that was created as a direct copy of the administrator role, so a single crafted request yields a fully privileged account. Publicly available exploit code exists, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms the attack is remote, unauthenticated, and requires no user interaction; no CISA KEV entry has been reported, so active exploitation is not confirmed, but the low complexity and public proof-of-concept make this a high-priority patch target wherever the plugin is deployed.
Unauthenticated time-based blind SQL injection in the WordPress Link Library plugin (all versions up to and including 7.9.2) lets remote attackers append arbitrary SQL to the plugin's existing query via the 'link_url' parameter and use timing side-channels to extract sensitive information from the site's database. The injection is reached through the plugin's front-end link user-submission functionality - the code path the vendor patch modifies in usersubmission.php - so a site only becomes directly attackable if that submission form is enabled and publicly reachable, and no authentication or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) with impact limited to confidentiality (C:H/I:N/A:N, base 7.5). Because the technique is blind and time-based, extraction is slow and requires many timed requests, and no public exploit code has been identified at time of analysis; this is a moderate-priority issue rather than a top-tier emergency.
Stored cross-site scripting in Mang Board WP 2.4.0 and earlier allows unauthenticated remote attackers to inject arbitrary web scripts through the 'data_type' parameter, with execution occurring when a victim later views the poisoned page. The issue affects WordPress sites that have the kitae-park Mang Board WP plugin active and reachable on the vulnerable API/code path; sites not running the plugin are unaffected. No public exploit code or CISA KEV entry is identified at time of analysis, and the CVSS 3.1 score of 7.2 reflects a moderate-priority issue that should be patched but does not rise to emergency status.
Stored cross-site scripting in the Groundhogg CRM, Newsletters, and Marketing Automation WordPress plugin (all versions up to and including 4.5.14) lets unauthenticated attackers inject arbitrary JavaScript through the 'ref' parameter, which is persisted as contact activity data and later rendered without escaping in the wp-admin contact editor. The script only executes in the browser of a logged-in staff member or administrator who opens the affected contact and views its activity timeline, so successful exploitation requires both the site to be actively using Groundhogg's link/visit activity tracking and an operator to view the poisoned record; the injection itself needs no authentication. This is a moderate-priority issue rather than a top-tier emergency, and at time of analysis there is no public exploit identified, no confirmed active exploitation (CISA KEV), and a vendor fix is available in version 4.5.15.
Unauthenticated stored cross-site scripting in the WordPress plugin Premium Packages - Sell Digital Products Securely (all versions up to and including 7.0.5) lets remote attackers inject arbitrary JavaScript into order records by supplying a crafted 'order_email' value during order submission. The payload is stored server-side and only executes later, when a privileged user - per the referenced admin view (list-orders.php), a store administrator - loads the order list page, which is why the assessed vector carries UI:R even though injection itself is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 7.2 High). Scope change (S:C) reflects the script executing in the WordPress admin security context rather than the attacker's unauthenticated context; no public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation.
An authorization bypass in the Checkout Field Manager (Checkout Manager) for WooCommerce plugin, affecting all versions up to and including 7.9.6, lets any logged-in user at subscriber level or above delete arbitrary attachments from the WordPress Media Library. The action handler fails to verify that the caller is permitted to remove the targeted attachment, so a low-privilege account - which many WooCommerce storefronts allow anyone to self-register for - is sufficient to destroy site media content. The vendor addressed the flaw in version 7.9.7; there is no public exploit code and no confirmed active exploitation (CISA KEV) at time of analysis, though the assessed EPSS-style risk is driven by how commonly subscriber registration is left open on commerce sites.
Unauthenticated arbitrary file upload in the 10Web Booster WordPress plugin (tenweb-speed-optimizer) in all versions up to and including 2.34.10 allows remote attackers to place executable files on a target site, leading to remote code execution. The compressCustom REST endpoint fails to validate file type or extension on the page_id parameter, and the authentication check is bypassed because the plugin's tenwebio_rest nonce is written to a world-readable file under wp-content/uploads/ whenever a bulk optimisation batch pauses - a nonce minted in a cron/loopback context with user ID 0, so it is accepted for unauthenticated visitors. Our independent assessment rates this CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (below the 9.8 base published elsewhere) because exploitation is conditional on the site having previously paused a bulk optimisation batch and on the uploaded file landing in a PHP-executable, web-accessible path; no public exploit code was identified at time of analysis and the CVE is not in CISA KEV.
Server-side request forgery in PhastPress affects WordPress sites running the optional PhastPress performance plugin through version 3.10, allowing unauthenticated remote attackers to make the server fetch arbitrary URLs by spoofing the HTTP Host header. Because the plugin builds its scripts-service URL whitelist from that attacker-controlled header, no login, user interaction, or non-default configuration is required; impact is limited to the response data and any reachable internal or external services the WordPress host can access. No public exploit identified at time of analysis, and EPSS is not supplied in the source data, so this is a genuine but not top-priority SSRF risk pending patch adoption.
Stored cross-site scripting in WPManageNinja's Best Payments Plugin for WP (WordPress plugin slug wp-payment-form) through version 4.6.27 lets attackers inject script that the plugin persists and later executes in a victim's browser, typically a logged-in administrator viewing the stored content in the WordPress dashboard, as required by the UI:R metric. The vulnerability is a CWE-79 improper-neutralization flaw rated 7.1 by the Patchstack reporter; our assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting low confidentiality and integrity impact within a changed browser scope and no availability impact, with PR:N implying the initial injection does not require credentials though the advisory should be confirmed as to whether the vulnerable sink is a public-facing submission form or an authenticated plugin area. There is no public exploit identified at time of analysis and no CISA KEV confirmation of active exploitation, so real-world risk depends on the plugin's payment or submission feature being in use and an administrator visiting the poisoned page.
Reflected cross-site scripting (moderate severity, reported CVSS 7.1) in the Hippoo Mobile App for WooCommerce plugin (versions through 1.12.0) allows remote attackers to inject malicious scripts that execute in the browser of a user who clicks a crafted link. Exploitation requires a victim with an active session on the affected WordPress/WooCommerce site - typically a logged-in administrator - to interact with the link (UI:R), but no attacker authentication is needed (PR:N). As of this analysis, no public exploit code has been identified and the vulnerability is not known to be actively exploited.
LatePoint WordPress plugin through 5.7.4 allows unauthenticated remote attackers who know a target customer's registered email address or phone number to bypass OTP authentication by racing the attempts counter and brute-forcing the 6-digit code, potentially taking over that customer's account, bookings, and personal data. Exploitation requires the site to use LatePoint's OTP/passwordless login flow and the attacker to win a concurrency race while guessing the code; no public exploit identified at time of analysis.
Stored cross-site scripting in the LearnPress WordPress LMS plugin (all versions up to and including 4.4.10) lets attackers plant arbitrary JavaScript that executes in a store administrator's browser when they open the affected order details or invoice export screens in wp-admin. Two injection points exist: the 'quantity' parameter handled by the frontend REST courses controller and the 'order_comments' field captured during checkout; the unauthenticated path depends on the site having guest checkout enabled, while sites with guest checkout disabled still expose both vectors to any Subscriber-level account. CISA KEV does not list this issue and no public exploit identified at time of analysis; exploitation requires the victimized operator to view a poisoned order or invoice page, which keeps it a credible but moderate-priority risk despite a 7.2 CVSS score reflecting scope change into the admin context.
PHP Object Injection in the Kirki WordPress plugin through 6.3.2 allows an authenticated Editor-level user to submit serialized data to the template import endpoint, but real impact is conditional on another installed plugin or theme providing a usable POP chain. Kirki itself contains no gadget chain, so the flaw alone does not enable file deletion, data theft, or code execution; the supplied 7.2 score overstates immediate risk, and no public exploit was identified at time of analysis. By default, KIRKI_USERS_DEFAULT_FULL_ACCESS lets Editors reach the endpoint despite the PR:H vector.
Unauthenticated information disclosure in the Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress through 6.3.2 allows remote attackers to read arbitrary users’ profile data by manipulating the 'context' parameter. The flaw is exploitable only when a published page uses a Kirki template containing at least one user-type dynamic content block, but under that condition no authentication or user interaction is needed and user IDs can be enumerated through standard WordPress REST endpoints. Impact is limited to disclosure of string-valued profile and user-meta fields, with no integrity or availability effect; no public exploit code was identified at time of analysis.
Cross-site request forgery in the aThemeArt Theme Helper WordPress plugin (all versions up to and including 1.0.8) allows a remote attacker with no credentials of their own (CVSS:3.1/AV:N/AC:L/PR:N) to induce a logged-in privileged WordPress user - typically an administrator - to submit a forged request to the site, causing state-changing plugin actions to execute with the victim's authority. The flaw is a missing CSRF token check (CWE-352); the forged action is limited to operations the plugin exposes without nonce validation, and exploitation hinges on the victim having an active authenticated session and being tricked into interacting with attacker-supplied content (UI:R). A Patchstack advisory is the only public reference, and no public exploit code or confirmed active exploitation has been identified at time of analysis. Note that the supplied CVSS 3.1 vector (8.8, C:H/I:H/A:H) is more severe than our independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L), which reflects that impact is bounded by the victim's privilege level and by which nonce-less plugin endpoints exist.
Missing authorization checks in the Advanced Post Manager WordPress plugin through version 4.5.6 let an authenticated user invoke functionality that should be reserved for higher-privileged roles, weakening the site's access-control boundary. Exploitation requires a valid low-privileged session (CVSS PR:L), so realistic exposure exists mainly on sites with open registration or attacker-controlled accounts, and no public exploit code has been identified at time of analysis. The demonstrated impact is limited to integrity and availability (C:N/I:L/A:L per our assessment), which is why this reads as a moderate-priority issue rather than a top-tier emergency.
SQL injection in the MapSVG WordPress plugin (mapsvg-lite-interactive-vector-maps) affects all versions through 8.16.1 and lets an authenticated low-privileged user, such as a subscriber, contributor or customer account, inject arbitrary SQL through the plugin's vulnerable request handling, exposing database contents. The issue is remotely reachable with low attack complexity and needs no victim interaction, but it does require a valid account on a site that both runs the affected plugin and permits untrusted low-privilege registration; sites that do not hand out such accounts face materially lower real-world exposure. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so the practical risk is driven by the population of sites exposing low-privileged authenticated access to the plugin.
Stored cross-site scripting in the WP Sessions Time Monitoring Full Automatic WordPress plugin affects all versions up to and including 1.1.5 and allows unauthenticated attackers to inject arbitrary JavaScript that persists in the site's stored data. Because the CVSS vector is PR:N, exploitation requires no prior authentication, but the injected payload only fires when a victim - typically an administrator reviewing the plugin's active-session and activity views - subsequently loads the affected page, so impact is deferred and depends on a privileged user visiting the poisoned view. The issue is assessed as moderate priority rather than a top-tier emergency, and no public exploit code or confirmed active exploitation was identified at time of analysis; the primary mitigations are updating or disabling the plugin and restricting exposure of its admin views.
Stored cross-site scripting in the GoSMTP Pro WordPress plugin (all versions up to and including 1.2.3) lets unauthenticated attackers plant arbitrary JavaScript inside the plugin's email-log records by submitting a comment crafted so that it survives WordPress comment kses moderation while entity-encoded, then is decoded into live HTML by core email notification handling and written verbatim to the plugin's log table. The script fires only when a privileged user, typically an administrator, opens the email-log page in wp-admin, which keeps real-world impact moderate despite the network-reachable, unauthenticated injection path; there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis. Exposure is limited to sites that accept comments from unauthenticated visitors and have GoSMTP Pro active with comment notification email logging enabled, while sites with comments disabled or logging unused are not affected.
SQL injection in the Vitepos - Point of Sale (POS) for WooCommerce WordPress plugin, affecting all versions up to and including 3.5.1, lets an attacker append arbitrary SQL through the 'src_by' parameter on the /vitepos/v1/vendor/list REST route and read sensitive data out of the site's database. Exploitation requires the affected plugin to be installed and active, and our assessment rates the route as reachable by any user holding a low-privileged POS role (for example vtpos-cashier) rather than by a fully anonymous visitor, although the vendor advisory also claims unauthenticated exploitation; no public exploit code has been identified at time of analysis. Impact is confidentiality-only - database disclosure, not modification - with no user interaction required.
Stored cross-site scripting in the SureCart plugin for WordPress (versions up to and including 4.9.4) allows unauthenticated attackers to inject arbitrary web scripts via the 'comment' parameter, which execute when a victim visits a page that loads the SureCart components runtime and lacks an sc-checkout element. While the entry point is unauthenticated, successful exploitation requires a specific combination of page layout (e.g., a post with a [sc_buy_button] shortcode and no sc-checkout element) and victim interaction, significantly limiting the real-world attack surface. No public exploit identified at time of analysis.
Arbitrary file upload in the DoubleScale All-in-One CRM WordPress plugin through version 1.5.1 allows authenticated attackers with subscriber-level access or higher to upload executable PHP files when the Helpdesk module is enabled, which can lead to remote code execution. The flaw is an unrestricted upload issue (CWE-434) with a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and no public exploit was identified at time of analysis. The assessed exploitation conditions require both a valid low-privilege WordPress account and an active Helpdesk module, making the risk highest on sites that allow open user registration.
Vulnity Security, a WordPress plugin maintained by Manuel Galan, can be bypassed to gain administrator access on Nginx-based installations running version 1.4.3 or earlier. The plugin's delegated-login feature writes a pairing credential file and auto-generates an Nginx configuration snippet intended to block web access to it, but the snippet guards the wrong directory path, leaving the credential file reachable by unauthenticated attackers who can then forge signed REST API requests and authenticate as an administrator. No public exploit code or confirmed active exploitation was identified at time of analysis, but the attack requires no authentication and no user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.1), with High complexity arising from the dependency on a qualifying Nginx deployment where the delegated-login pairing credential exists and the flawed snippet is active; Apache and other web servers appear unaffected.
Stored cross-site scripting in the premium build of the User Registration PRO WordPress plugin (all versions up to and including 6.2.9) lets unauthenticated attackers inject arbitrary JavaScript through the HTTP Referer header into a vulnerable AJAX endpoint, with the payload persisting so it executes whenever a victim loads the injected page. The nonce that normally protects that endpoint is localized into the page source of every front-end page for anonymous visitors, so no account or credentials are required, although the attacker must target a site running the paid premium build - the free WordPress.org distribution is not affected - and the payload only fires once a user actually visits the compromised page. No public exploit code and no confirmed active exploitation were identified at time of analysis; the assessed severity of 7.2 reflects the scope change and the limited, though real, confidentiality and integrity impact of script execution in a victim's browser.
PHP object injection in the Gravity Forms WordPress plugin (all versions before 3.1.1) allows unauthenticated, network-reachable attackers to feed crafted serialized data into a PHP unserialize() call, which can lead to object injection and, if a suitable gadget chain is present in the running PHP stack, to full compromise of confidentiality, integrity, and availability. The flaw is rated CVSS 8.1 with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning no credentials and no user interaction are needed, but the high attack-complexity component reflects that exploitation depends on a usable POP gadget chain existing in the plugin, WordPress core, or another installed plugin or theme. At time of analysis there is no public exploit identified (no CISA KEV listing and no published proof-of-concept in the supplied intelligence), and the vulnerability was reported through Patchstack to the vendor, with version 3.1.1 identified as the fixed release.
Reflected cross-site scripting (XSS) in the Houzez WordPress theme (versions up to and including 4.4.0) allows remote attackers to execute arbitrary script in a victim's browser by tricking them into clicking a crafted URL while the theme is active. The flaw requires user interaction (UI:R) and is unauthenticated from the attacker's side (PR:N), but since it is reflected and not stored, each victim must be individually targeted via phishing or a malicious link. No public exploit code or confirmed active exploitation was identified in the available intelligence at the time of analysis; the assessed CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Blind SQL injection in the halfdata Green Popups WordPress plugin before 7.6.3 lets a remote attacker inject crafted SQL through an HTTP request and extract data from the site's database one inferred bit at a time. The vendor (Patchstack) rates this 9.3 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, indicating network reachability, low complexity, a scope change, and high confidentiality impact, while our independent assessment scores it 9.3 as well but with PR:L instead of PR:N - meaning the true privilege prerequisite is not confirmed from the available data and pre-authentication exploitability cannot be assumed. There is no CISA KEV entry and no public exploit code identified at time of analysis, so this should be treated as a serious but not confirmed actively exploited issue; because it is blind, extraction is inference-based and slower than direct-output injection but still permits theft of user, configuration, and credential-adjacent data.
Remote code execution in the Theme-one The Grid WordPress plugin through version 2.8.1 allows network attackers to inject code or commands via the plugin's grid-generation code path, with the supplied CVSS:3.1 vector indicating AV:N/AC:L/PR:N/UI:N (unauthenticated and no user interaction per the vector, though the exact endpoint and authentication prerequisite should be verified in the Patchstack advisory). The provided vector rates this as 10.0 Critical with full confidentiality, integrity, and availability impact, while our independent assessment adjusts scope from Changed to Unchanged but still considers impact High. No public exploit identified at time of analysis, and no KEV or EPSS data was provided.
Authenticated OS command injection in the WP Photo Album Plus WordPress plugin (all versions up to and including 9.3.02.002) lets any WordPress user granted the plugin-defined wppa_upload capability execute arbitrary operating-system commands as the web-server user, achieving full server-side code execution where ImageMagick is the active image backend. Rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the flaw is reachable through the update-photo AJAX action's value parameter, and no public exploit code was identified at time of analysis; the bug is not in CISA KEV. Because wppa_upload is a plugin-level privilege that administrators can delegate to lower-privileged roles, the effective attacker pool can extend well beyond site administrators on misconfigured sites.
Stored cross-site scripting in WPConsent (Cookie Banner & Cookie Consent for Privacy Compliance) through 1.1.9 allows unauthenticated attackers to inject arbitrary web scripts into comment content that execute when a user views an injected page. Exploitation is constrained: it requires the optional Script Blocking feature to be enabled, the ability to submit comments that are rendered, and two coordinated comments that place event-handler syntax in an allowed code element and the deterministic ___noise___ restoration key in an allowed abbr title attribute, with the key offset confirmable via an unauthenticated wpconsent_debug=1 request. No public exploit identified at time of analysis, and the assessed vector is AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N, so the non-default configuration and precise coordination limit realistic exploitation below the raw 7.2 score.
Stored cross-site scripting in the HivePress Business Directory, Listings & Classified Ads plugin for WordPress (all versions up to and including 1.7.32) allows unauthenticated attackers to persist arbitrary JavaScript that executes whenever a user views a page rendering an affected custom user attribute. The published CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N); our assessment retains that score but raises attack complexity to High (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) because exploitation depends on a site administrator having configured a custom user attribute whose display_format template places the %value% token inside an href, src, or style attribute context - a documented but non-default use of the plugin's attribute display feature. No public exploit identified at time of analysis, and although an upstream fix has been merged (PR #375 / changeset 3747070), the realistic affected population is limited to sites with such an attribute template already in place.
Unauthenticated PHP object injection in the WordPress plugin Sunshine Photo Cart (all versions up to and including 3.7.4) allows an attacker to store a crafted serialized payload through the plugin's public favorites page, which is then deserialized when any image in a non-viewable or private gallery is viewed. The plugin ships no usable POP gadget chain of its own, so the flaw has no impact on a site running only this plugin; impact materialises only when a separate plugin or theme on the same installation provides a chain, in which case the attacker could delete arbitrary files, retrieve sensitive data, or execute code depending on that chain. No public exploit code or confirmed active exploitation was identified at time of analysis, and while the submitted CVSS is 9.8 the mandatory external gadget-chain precondition means our independent assessment rates it AV:N/AC:H/PR:N/UI:N with high confidentiality, integrity, and availability impact when the precondition is met.
Stored cross-site scripting in the TranslatePress - Translate Multilingual Sites with AI Translation WordPress plugin through version 3.3.7 allows unauthenticated attackers to inject arbitrary web scripts via the 'comment' parameter, which then execute in the browser of any visitor who loads the affected translated page. Successful exploitation depends on two conditions that coincide with the plugin's normal use case: the site must permit unmoderated comment submission on at least one post (WordPress holds first-time commenters for moderation by default, so this usually means a modified Discussion setting), and a secondary language must be configured so that comments are processed by the plugin's translation-render code path. Wordfence rates the issue at CVSS 3.1 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), confirming unauthenticated remote exploitation with no user interaction on the attacker's side and a scope change reflecting how stored script in a comment can act beyond the vulnerable component, and no public exploit code has been identified at time of analysis.
Remote code execution via arbitrary file upload affects the YaySMTP WordPress plugin in all versions up to and including 2.7.7, where an authenticated subscriber-level user can upload executable files through the putFile function. The plugin relies on sanitize_file_name() without an allow-list, MIME check, or safe-extension rename, and its only server-side guard is a .htaccess file with 'Require all denied' that nginx and Apache with AllowOverride None ignore, so full RCE is achievable on those configurations. No public exploit code was identified at time of analysis and there is no confirmed CISA KEV active exploitation; exploitation requires authentication at subscriber level or above, which is commonly available when open user registration is enabled.
Stored cross-site scripting in the WordPress plugin CP Multi View Events Calendar (CodePeople) in all versions up to and including 1.4.42 lets unauthenticated attackers inject arbitrary JavaScript through the CalendarTitle parameter, which is then rendered without escaping and executes in the browser of any user - including administrators - who later views the poisoned calendar page. Exploitation is conditional on a non-default configuration: a site administrator must have enabled the 'Allow edition in frontend?' option on at least one calendar view, which exposes the unauthenticated event-add endpoint together with a publicly accessible nonce that the attacker uses to submit the malicious title. No public exploit code was identified at the time of analysis and the issue is not listed in CISA KEV, but the 7.2 CVSS score with PR:N (unauthenticated) and scope change (S:C) makes the attack path low-complexity once that frontend-editing setting is active.
Unauthenticated account takeover in the WordPress plugin OTP Login & Register Woocommerce (versions before 2.7.3) is possible because the plugin counts one-time-password verification attempts against a value supplied by the client, which an attacker can freely change to reset the counter and brute-force the short numeric login code. Affected are WordPress sites running the plugin with its OTP-based login/registration flow enabled; publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been recorded, and the EPSS score is low at 0.15% (4th percentile). Successful brute-force yields full account takeover without knowing the victim's password, but the attack still requires enumerating a valid account identifier and issuing many requests, which is why the assessed severity is moderate (CVSS 7.4) rather than critical.
Cross-site request forgery in the Salon Booking System WordPress plugin (versions before 10.31.9) allows unauthenticated attackers to forge REST API requests in a logged-in administrator's browser by tricking the victim into clicking a crafted link, potentially leading to full site takeover via creation of a new administrator account. The flaw (CWE-352) stems from the plugin discarding WordPress core's nonce check for cookie-authenticated sessions across the entire REST API, so no plugin-specific feature toggle is needed beyond having the vulnerable version installed. Publicly available exploit code exists; EPSS is low at 0.11% (1st percentile), and there is no confirmed active exploitation (CISA KEV).
Stored cross-site scripting in the WordPress Profile Builder plugin (Cozmoslabs) affects all versions up to and including 4.0.3 and lets unauthenticated remote attackers plant arbitrary JavaScript through the First Name registration field, which executes in the browser of any user who later views the injected page - realistically an administrator processing pending registrations. The attack is explicitly gated on the plugin's Email Confirmation feature being enabled, so sites using default or other registration flows are not reachable through this path. Scoring is CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) with a scope change reflecting script execution in the victim's browser context, and no public exploit has been identified at time of analysis.
Authenticated attackers with Subscriber-level or higher PilotPress membership on WordPress sites can escalate to full Administrator privileges by exploiting a flawed ONTRAPORT synchronization routine in PilotPress versions up to and including 2.0.43. The defect allows an attacker to rename a remote ONTRAPORT contact to an existing Administrator's WordPress login, then leverage the plugin's authentication hook to cause WordPress core to issue an Administrator authentication cookie. This is a genuine high-priority vulnerability (CVSS 8.8), requiring a valid ONTRAPORT contact and the Customer Center nonce, but no victim interaction. No public exploit code was identified at time of analysis.
PHP object injection in the Search Regex WordPress plugin version 3.5 lets an authenticated attacker with subscriber-level access or above pass crafted serialized data into the plugin's replace_all function, which is then deserialized by PHP without validation. When a usable POP gadget chain exists in the installed plugin, WordPress core, or another active plugin, this object injection can be escalated to arbitrary code execution, giving the attacker full control of the site. No public exploit code or confirmed in-the-wild exploitation was identified at the time of analysis, and exploitation is conditional on both an authenticated account and a viable gadget chain.
Stored cross-site scripting in the NotificationX WordPress plugin (all versions up to and including 3.3.3) lets remote unauthenticated attackers inject arbitrary JavaScript through the 'name' parameter, which then executes in the browser of any visitor loading an affected page. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2), no authentication or victim interaction is required to deliver the payload, but exploitation is conditional: a site administrator must first enable the WordPress.org Reviews campaign and place the notificationx-pro/notificationx dynamic block on a publicly reachable page, neither of which is a default configuration. No confirmed active exploitation (not in CISA KEV) and no public exploit code has been identified at time of analysis, and the independent assessment rates this as a real-but-conditional, lower-tier priority rather than an urgent threat; a fix is available in version 3.3.4.
Stored DOM-based cross-site scripting in SiteOrigin CSS 1.6.7 and earlier allows unauthenticated attackers to inject scripts through the WordPress comment 'Website' (comment_author_url) field, executing when a victim loads a page where the plugin renders the stored comment URL into a DOM sink. Exploitation requires the site to accept comments from unauthenticated visitors and to use an affected plugin version; the CVSS 3.1 score of 7.2 reflects network reachability, low complexity, no authentication, and a scope change, with limited confidentiality and integrity impact. No public exploit code was identified at time of analysis.
Stored DOM-based cross-site scripting in the SiteOrigin CSS WordPress plugin (all versions up to and including 1.6.7) lets an unauthenticated attacker smuggle script into a page via the 'href' parameter, which the plugin's Visual Inspector later writes into the DOM without sanitization. Exploitation is not self-firing: the attacker's comment must survive moderation and be approved, and an administrator must subsequently open the Visual Inspector and manually click the injected anchor link - a mandatory user-interaction step that the CVSS base vector understates (our assessment re-scores it AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N versus the published 7.2). There is no confirmed active exploitation or public exploit code identified at time of analysis, and the practical impact is bounded to script execution in an authenticated administrator's browser context.
Stored cross-site scripting in the WP Ghost (Hide My WP Ghost) - Security & Firewall plugin for WordPress versions up to and including 7.0.12 lets unauthenticated attackers inject arbitrary web scripts through the plugin's replaceHeadersAndTags function, which performs insufficient input sanitization and output escaping; the injected payload persists and executes in a victim's browser when they click the crafted link, with impact limited to that victim's session (no availability impact). Exploitation requires the affected code path to be reachable on a site running 7.0.12 or earlier, but no authentication (CVSS PR:N) and no special non-default plugin configuration; although the published CVSS 3.1 vector scores UI:N, the practical trigger is a victim clicking the injected link, which is why our assessment adjusts user interaction to UI:R while keeping the same 7.2 base impact. The vendor has released a fix in version 7.0.13 (WordPress.org changeset from 7.0.12 to 7.0.13), no public exploit code has been identified and there is no CISA KEV entry indicating active exploitation at time of analysis. Reported by Wordfence, a credible source for WordPress plugin vulnerability intelligence.
Unauthenticated arbitrary file upload in the ELEX WordPress HelpDesk & Customer Ticketing System plugin (all versions up to and including 3.3.7) lets a remote attacker write attacker-controlled files, including potentially executable ones, into the WordPress installation via email attachments processed by the initMailPart function, enabling remote code execution with a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No WordPress authentication or victim interaction is required; the only prerequisite is that the plugin's email-piping/IMAP mailbox feature is configured and actively polling an inbox, since the attacker reaches the vulnerable code simply by sending a crafted email to that monitored support mailbox. Exploitation is therefore configuration-dependent rather than universal, and sites that do not use IMAP mail fetching are not exposed; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor fix is available in version 3.3.8.
Unauthenticated privilege escalation in the Cozmoslabs User Profile Builder WordPress plugin (all versions up to and including 4.0.3) allows an attacker to obtain a fully activated administrator account: they submit role=administrator through the public [wppb-register] registration form, then click the activation link emailed to them, and the activation handler applies that role via WP_User::set_role() without any allow-list check. The attack is conditional rather than trivial - the site must already carry a legacy registration form field with meta-name 'role' from before the 4.0.3 upgrade (the 4.0.3 reserved-name block deliberately exempts pre-existing fields), must have email confirmation enabled so the wp_signups path is used, and must allow open user registration. That combination of stable site-state prerequisites is why CVSS 3.1 scores it 8.1 with AC:H despite PR:N/UI:N, and no public exploit code has been identified at the time of analysis.
Unauthenticated path traversal in the 10Web Booster WordPress plugin (versions up to and including 2.34.5) lets remote attackers create arbitrary directories outside the plugin's cache root, with 0777 permissions applied recursively, and plant a cached page inside them by feeding unsanitized GET parameter names and values into the cache path. The write primitive is strictly limited - the filename is hard-coded to source.html and the body is the server-rendered page buffer rather than attacker-supplied content, so no executable file can be planted and code execution is not achievable, with the realistic outcomes being cache poisoning and stray directory creation (published CVSS 7.5 with I:H; the independent assessment revises integrity impact to Low), and no public exploit identified at time of analysis.
Stored cross-site scripting in the Salon Booking System WordPress plugin (Appointment Booking for Salons, Barbershops & Spas, all versions up to and including 10.31.9) lets unauthenticated attackers inject arbitrary JavaScript through the sln[<checkout-field-key>] checkout parameter, which is persisted and later executed when a user loads the affected page - in practice the admin customer view. Impact is conditional: the site must have at least one admin-configured custom checkout field of type Html or File, a documented but non-default plugin feature, so sites without such a field are not exploitable. No public exploit code has been identified at time of analysis, and the independent assessment rates the issue as a moderate, conditional risk rather than an emergency, downgrading the vendor's AC:L to AC:H because of the configuration dependency and the admin-context trigger.
Stored DOM-based cross-site scripting in the Opti-Behavior WordPress plugin (all versions up to and including 1.9.2.1) allows unauthenticated attackers to inject arbitrary JavaScript that executes when a victim later views recorded heatmap, session, or analytics data. The heatmap recording endpoint requires no authentication, and its only guard - a nonce - is freely obtainable by any anonymous visitor through the plugin's public opti_behavior_refresh_nonces AJAX action, so there is effectively no privilege barrier; the payload is stored rather than reflected, meaning it fires only when an administrator or other user loads the affected analytics page. The assessed CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (7.2), there is no CISA KEV entry and no public exploit code identified at time of analysis, and it should be treated as a genuine but moderate-priority issue rather than an emergency.
Privilege escalation in the Theme My Login plugin for WordPress (versions up to and including 7.2.1) allows unauthenticated attackers to change arbitrary user passwords on multisite installations in certain configurations, leading to account takeover and potential full network compromise. The flaw stems from improper validation of user identity before password updates (CWE-269). Exploitation requires a non-default multisite setup, and no public exploit code is identified at time of analysis; the effective attack complexity is higher than the base CVSS 9.8 score implies due to this configuration dependency.
Stored DOM-based cross-site scripting in the WordPress plugin Opti-Behavior (Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights) through version 1.9.2.1 lets unauthenticated attackers write arbitrary script content into heatmap/analytics records via the 'targetUrl' parameter, which is later rendered into a DOM sink when a user - most plausibly an administrator viewing the heatmap analytics metabox - accesses the injected page. The write endpoint is gated only by a nonce (optiBehaviorHeatmapConfig.nonce) that the plugin itself publicly emits to every anonymous visitor on tracked pages, so no account or login of any kind is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C, 7.2). Exploitation requires the plugin to be installed and active with heatmap/session tracking enabled on at least one page; no public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation, though the code references in the advisory make the vulnerable paths easy to locate.
Unauthenticated attackers can store arbitrary JavaScript in WordPress sites running the Simply Schedule Appointments plugin through version 1.6.12.35 by submitting an unsanitized 'status' parameter; the payload is written to the plugin's debug log unconditionally because debug logging is enabled by default. The script does not fire automatically for arbitrary visitors: execution is gated behind the plugin's debug-log viewer, which is reachable by anyone holding the site-wide Support PIN (an HMAC-MD5 of AUTH_SALT displayed in wp-admin), so the realistic victim is an administrator or support agent reviewing the log during routine troubleshooting, where the script executes in their session (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). There is no CISA KEV listing and no public exploit code identified at time of analysis, and the practical risk is lower on sites that rarely open the debug log or that rotate/restrict the Support PIN; signals are moderately concerning but do not indicate an urgent, widespread threat.
Stored cross-site scripting in the Ultra Addons for Contact Form 7 WordPress plugin (all versions up to and including 3.5.54) lets unauthenticated attackers upload a text-type file whose contents begin with HTML markup, which is then persisted and executed in the browser of any user who later views the injected page - a classic CWE-79 stored XSS. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (7.2), no authentication or user interaction is needed to deliver the payload, though execution depends on a victim subsequently loading the affected page. Exploitation is only reachable on sites that run the plugin and expose its file-upload/database add-on on a Contact Form 7 form; there is no public exploit identified at time of analysis and the issue is not in CISA KEV, so this is a credible moderate-priority web flaw rather than an emergency.
Stored cross-site scripting in the Schema & Structured Data for WP & AMP plugin (versions up to 1.67) allows unauthenticated attackers to inject arbitrary JavaScript via the 'saswp_review_text' parameter, because the nonce used as the sole authorization check is publicly exposed in the [saswp-reviews-form] shortcode. Exploitation requires the shortcode to be present, making it a genuine but deployment-specific issue that sits in the mid-tier of urgency. No public exploit code or active exploitation has been identified at time of analysis.
Arbitrary file deletion in the Groundhogg CRM, Newsletters and Marketing Automation plugin for WordPress (all versions up to and including 4.9.3) lets an authenticated user who holds the plugin's import_contacts capability - granted by default to Groundhogg's custom Sales Representative role - name an arbitrary server-side path and have the plugin delete it, with a realistic escalation to remote code execution (for example by removing wp-config.php). The flaw is reachable through the contact-import (CSV), REST API, and webhook paths that call copy_file, and it received a CVSS of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H); there is no CISA KEV listing and no public exploit code identified at time of analysis. The practical risk is bounded by the authentication requirement and by the attacker's need to know or guess the absolute path of a valuable target, but the capability is assigned by default and no user interaction or non-default configuration is needed, making this a credible, actionable priority rather than an inflated high-CVSS issue.
Sensitive information exposure in Modula Image Gallery 3.0.11 and earlier allows unauthenticated remote attackers to read the plaintext Password Protect password and username for published galleries by requesting the core WordPress REST route /wp-json/wp/v2/modula-gallery/{id}. The plugin redacts the same modulaSettings values on its dedicated /wp-json/modula/v2/gallery/{id}/settings endpoint, but the custom post type's show_in_rest=true registration leaves the core route without equivalent redaction. No public exploit identified at time of analysis; exploitation requires the target site to have enabled Password Protect for a gallery, so practical exposure is narrower than the 7.5 CVSS score suggests.
Unauthenticated privilege escalation in the My Calendar - Accessible Event Manager WordPress plugin (all versions up to and including 3.8.7) allows remote attackers to overwrite the credentials of the default Administrator account (user ID 1) and gain full wp-admin access. The flaw arises from unsanitized reflection of the `mcs` GET parameter into post content, enabling injection of a nested `[my_calendar above=...]` shortcode that is processed by `mc_generate_calendar_nav()`, which calls arbitrary PHP functions via `call_user_func()` without authorization or callable allowlisting. No public exploit code has been identified at time of analysis, but the plugin's auto-generated `/my-calendar/` page is publicly accessible by default, making exploitation trivially reachable by an unauthenticated attacker.
Unauthenticated order enumeration and PII disclosure in the Klarna for WooCommerce (Klarna Payments for WooCommerce) WordPress plugin affects all versions up to and including 4.13.3, allowing any remote attacker to retrieve the secret order_key plus full billing and shipping personal data for any order in the store. Because the plugin fails to verify authorization (CWE-862) before emitting order details inline as the klarna_payments_params JavaScript variable on the order-pay endpoint, and WooCommerce order IDs are sequential integers, a full store-wide order dump can be obtained with ordinary sequential GET requests and no session, order_key, or credentials. The CVSS vector confirms the exposure is remote, unauthenticated, and requires no user interaction (AV:N/AC:L/PR:N/UI:N), with high confidentiality impact only; exploitation is trivially automatable, though no public exploit code and no confirmed active exploitation were identified at time of analysis. This is a genuine high-priority information-disclosure flaw rather than an inflated high-CVSS score, since every signal aligns with easy mass abuse across any default storefront running an affected version.
An authorization bypass in the FunnelKit Funnel Builder for WooCommerce Checkout WordPress plugin (all versions up to and including 3.16.0.6) lets unauthenticated attackers pull billing PII - full name, street address, email address, and phone number - for any WooCommerce order on a site by simply iterating sequential order IDs. Exploitation requires no authentication, privileges, or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, 7.5), and the sequential ID space makes automated bulk extraction practical, so a single vulnerable store can leak its entire customer billing dataset. The hard precondition is that a FunnelKit thank-you page rendering the [wfty_order_meta] or [wfty_order_total] shortcode must exist and be reachable - stores that do not use these shortcodes are not exposed. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; Wordfence-coordinated disclosure tracks it as a genuine medium-to-high priority data-exposure flaw rather than a drop-everything emergency.
Privilege escalation in the Nexter Extension WordPress plugin (all versions up to and including 4.7.11) allows an authenticated Subscriber-level or higher user to restore a stale stored Administrator role onto their own account, effectively becoming an Administrator. Exploitation is tightly constrained: the attacker's account must previously have held the Administrator role, must have used the plugin's View Admin Role Switcher, and must have been demoted specifically through the wp-admin/users.php?action=promote bulk role-change control rather than the Edit User screen. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV, and the assessed conditions are why the effective risk is lower than the 7.5 (HIGH) base score implies.
Stored cross-site scripting in the Mang Board WordPress plugin (all versions up to and including 2.4.3) lets unauthenticated attackers inject arbitrary JavaScript that executes in the browser of any user who later loads the poisoned board content. The injection path is unusually easy because the wp_ajax_nopriv_mb_template endpoint is publicly reachable, nonce verification is not enforced in content_reply mode, and admin-ajax.php answers with Content-Type: text/html so script tags embedded in the JSON body are parsed and executed. Wordfence rates it CVSS 7.2 (scope changed, PR:N/UI:N) and an upstream fix commit is referenced in the plugin's Trac changeset, but no public exploit code has been identified at time of analysis and there is no confirmed active exploitation, so this is an elevated-priority, patch-now issue rather than a top-tier emergency - the residual constraint is that execution requires a victim, ideally a privileged one, to view the injected page.
Unauthenticated attackers can take over any WordPress user account, including administrators, on sites running the MailOptin plugin up to version 1.2.78.6 that have a 'WordPress User Registration' opt-in form published. The flaw allows manipulation of the optin_data[form_custom_field_mappings] parameter to override saved mappings, enabling injection of arbitrary wp_users column names (e.g., ID, user_pass) into wp_insert_user(), which then updates the target account's password. No authentication, nonce, or capability check is required, and the only prerequisite is the presence of the registration form; sites using MailOptin solely for mailing-list optins without this connection are not affected. No public exploit identified at time of analysis.
Privilege escalation in the InstaWP Connect - 1-click WP Staging & Migration WordPress plugin (all versions up to and including 0.1.4.1) lets any authenticated user at Subscriber level or above read the site's plaintext InstaWP master API key from a plugin settings page and redeem it for a full administrator session. The key is disclosed because the admin page is registered with a role name returned by InstaWP_Setting::get_allowed_role() in place of a real capability, and because generate_section_field() prints the master API key directly into a plain-text HTML input without a manage_options check; the attacker then derives the bearer secret from that key, satisfies the plugin's REST validate_api_request(), and calls POST /wp-json/instawp-connect/v2/auto-login to mint a 30-second single-use login URL that sets an administrator authentication cookie. Exploitation is not default-configured: it additionally requires the site to be actively connected to InstaWP (a valid master API key in instawp_api_options) and an administrator to have added the attacker's role to the plugin's Sync Tab Access list (instawp_sync_tab_roles) while still retaining administrator in that list, so realistic exposure is narrower than the 7.5 base score implies. There is no public exploit code identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); authentication requirements are authenticated (CVSS PR:L) with high attack complexity (AC:H).
Unauthenticated attackers can read other customers' stored billing and shipping address PII on WordPress sites running the FluentCart plugin through version 1.7.0, exploiting an insecure direct object reference in the plugin's public AJAX checkout endpoint. Because the attacker supplies both the order_id and the address ID being compared, the plugin's internal id-equality guard is trivially satisfied, and sequential AUTO_INCREMENT order/address IDs can be enumerated at the soft rate limit of five requests per sixty seconds to harvest street address, city, state, postcode, phone, company name, VAT number and legal registration ID. The issue is confidentiality-only (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), with no write, modification or availability impact; it is not listed in CISA KEV and no public exploit code was identified at time of analysis.
Unauthenticated account takeover of WordPress sites running miniOrange OTP Login, Verification and SMS Notifications through 5.5.8 is possible because the Delay OTP grace flag is stored per user rather than being bound to the originating session, cookie, IP address, or device. When OTP-only login and Delay OTP Verification are enabled and the target account is inside its grace interval, an attacker can submit a known username with `mo_wp_login_intent=otp` and any non-empty password to inherit that user's verified state and log in as any account, including administrators. No public exploit code or CISA KEV active exploitation was identified at time of analysis, and exploitation is constrained by non-default settings plus a race-window timing precondition (CVSS 8.1, AC:H).
Unauthenticated file upload in the WordPress plugin Mang Board (all versions up to and including 2.4.4) lets an anonymous visitor place executable content on the server and reach remote code execution, because the mbw_file_upload handler enforces its extension allowlist only on the file_name parameter while the filename actually saved is derived from the unvalidated image_path parameter. Exploitation fits the assessed CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N), requiring no WordPress account and no user interaction: guest posting is the plugin's default board mode, and the nonce the request must carry is printed on every public board page and therefore readable by any unauthenticated visitor. No public exploit code has been identified at time of analysis; the practical limiting factor is configuration, since an administrator who has disabled guest posting removes the unauthenticated attack surface.
Stored cross-site scripting (XSS) in the Colibri Page Builder WordPress plugin versions up to and including 1.0.390 allows unauthenticated attackers to inject arbitrary web scripts via the comment parameter; the payload is stored and executes when any user views the injected page. The vulnerability has a CVSS v3.1 score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and no public exploit has been identified at time of analysis. While the score is elevated due to scope change and low confidentiality/integrity impact, the practical risk is notable but the raw score overstates the absolute danger; sites with comments disabled are not exposed.
Stored cross-site scripting in the Feedzy RSS Feeds (RSS Aggregator by Feedzy) WordPress plugin, affecting all versions up to and including 5.2.11, allows a remote attacker to place arbitrary JavaScript into a page generated from an imported feed item by embedding a payload in the 'media:thumbnail@url' field, which then executes when a user views that page. The bug is not exploitable against an arbitrary site: the target must already have the plugin configured to import from an RSS feed whose content the attacker controls or can influence, and the script only fires when a visitor or administrator opens the resulting page. The published CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) reads as a low-complexity unauthenticated issue, but the assessed vector raises attack complexity to High (AC:H) because of the feed-control prerequisite; no public exploit code has been identified at time of analysis and there is no CISA KEV listing, and the vendor has released version 5.2.12 that fixes the flaw.
Privilege escalation in the Customer Email Verification for WooCommerce WordPress plugin through 3.3.0 allows unauthenticated attackers to gain authentication as any WordPress account that still has an unverified email address, including administrators, by brute-forcing a per-user activation secret that has only about 101 possible values. The weakness is genuine and high impact (full account takeover), but real-world risk is heavily gated by three preconditions: the plugin's 'Encoding method' must be set to the non-default 'hashids' option, the attacker must recover or brute-force the Hashids salt (which defaults to an md5(time()) value fixed at first initialization), and the targeted account's email must remain unverified. An upstream changeset addressing the issue is referenced in the WordPress plugin repository, and no public exploit code was identified at time of analysis; CVSS 3.1 scores it 8.1 (High, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), so despite the High score it should be triaged as lower priority than a default-configuration, unauthenticated account-takeover bug in most deployments.
Stored cross-site scripting in the Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress (all versions up to and including 7.5.5) allows unauthenticated commenters to plant script payloads in comment content that execute in visitors' browsers once the comment is approved and rendered. The flaw is a bypass of WordPress's wp_kses comment sanitization: the payload uses only allow-listed tags and hides executable tokens as plain text inside quoted attribute values, and the XSS is only realized when Complianz's own Cookie-Blocker output-buffer filter applies str_replace() rewrites that break out of the attribute context. Attack complexity is assessed as High rather than Low, because exploitation requires the Cookie-Blocker output buffering and the yotu-wp integration code path to be active, and critically requires a moderator to approve the malicious comment before it renders; no public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation. Overall this is a real but non-urgent, lower-tier issue gated by human comment moderation rather than a mass-exploitation priority.
Privilege escalation to full WordPress site takeover is possible in the Backuply backup/restore plugin (all versions up to and including 1.5.8) via a second-order SQL injection that an authenticated subscriber-level user plants in the profile Biographical Info field and that only fires when an administrator later creates a backup capturing that value and then restores it. During the restore the injected SQL executes blind inside an INSERT into wp_usermeta, allowing the attacker to alter database records - most notably to set the default_role option in wp_options to administrator and enable open registration, so a subsequently registered account is granted Administrator rights. Exploitation cannot be self-triggered by the attacker (UI:R) and requires a valid authenticated account (PR:L, no anonymous path); no public exploit identified at time of analysis.
Unauthenticated stored cross-site scripting in the WordPress plugin Flying Scripts (Delay JavaScript to Improve Site Speed & Performance) through 1.2.4 lets attackers inject script through comment input that the plugin's output-buffer rewriter later re-emits into an HTML attribute. The bypass relies on a crafted payload using only WordPress kses-allowed markup-an <abbr title> attribute plus a double-quote-bearing <code> body-and the plugin's predictable unsalted ___noise___ placeholder substitution, so the script executes when a victim views the affected page. No public exploit identified at time of analysis, and exploitation requires the vulnerable plugin to be installed with its rewriting active and a comment or equivalent input path enabled, making this a moderate-priority issue despite the CVSS 7.2 scope-changed rating.
Reflected cross-site scripting in the 8theme XStore WordPress theme affects all installations running a version before 9.7.9, allowing remote attackers to inject script that executes in the browser of a site visitor who loads a crafted URL. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) confirms the flaw is network-reachable at low complexity and requires no authentication, but it does require the victim to click or load an attacker-supplied link (UI:R), and the scope change (S:C) means the injected script runs in the victim's browser context rather than on the server. Impact is limited to the victim's browser session within the site origin; because the payload is reflected and not stored, each victim must be individually lured, and no public exploit code was identified at time of analysis. A vendor fix is available in version 9.7.9 per the Patchstack advisory.
Frontend Admin by DynamiApps (the acf-frontend-form-element WordPress plugin) through version 3.29.13 assigns privileges incorrectly, letting a submitted frontend form escalate the submitting user's role - most seriously to administrator - which on WordPress equates to full site compromise. The provided CVSS 3.1 vector scores this 9.8 as network-reachable with no privileges required (PR:N), while our independent assessment scores it 8.8 with PR:L, because the real-world precondition is that a Frontend Admin form capable of affecting roles (for example a user-registration or profile-edit form) is published and reachable by the attacker; sites that expose such a form to anonymous visitors are effectively unauthenticated targets, whereas sites gating it behind login require at least a low-privilege account first. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so there is no confirmation of active exploitation, though the low complexity and high payoff make opportunistic scanning plausible.
Stored cross-site scripting in maxfoundry Social Share Buttons for WordPress through 1.31 lets malicious input persist in content handled by the share-button plugin and execute in the browser of any user who later views the poisoned page. The supplied CVSS vector scores it 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L); our independent assessment applies PR:L because stored XSS in WordPress plugins usually requires at least a low-privilege authenticated account unless a specific unauthenticated sink exists, and the required victim interaction means impact occurs only when a logged-in user or administrator loads the affected page. No public exploit identified at time of analysis, and no CISA KEV or EPSS data was provided.
Blind SQL injection in the Link Whisper Free WordPress plugin (versions up to 0.9.7) enables remote attackers to extract sensitive information from the site's database by injecting crafted SQL commands into an unspecified request handler. The vulnerability is rated critical with a CVSS score of 9.3, and the supplied vector indicates network exploitability, low complexity, and no authentication or user interaction required (PR:N/UI:N); however, the independent assessment notes that the true authentication requirements are unconfirmed and may involve a low-privilege account, and the exact trigger parameter is not publicly documented. No public exploit code or confirmed active exploitation is identified at time of analysis.
PHP object injection in Link Whisper Free (a WordPress plugin) through version 0.9.7 allows unauthenticated remote attackers to pass untrusted data into PHP's unserialize() and instantiate arbitrary objects, per the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8) supplied with the advisory. Our independent assessment keeps the network-reachable, unauthenticated, no-interaction prerequisites but raises attack complexity to High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), because CWE-502 only translates into full confidentiality, integrity, and availability loss when a usable POP gadget chain exists somewhere in the plugin, its bundled libraries, or other code loaded on the target site; absent such a chain the injected object may be inert. No public exploit identified at time of analysis, there is no CISA KEV listing, and no EPSS score was provided, so exposure today is limited to sites running the vulnerable plugin version that also happen to carry a viable gadget chain.
Reflected cross-site scripting in the Link Whisper Free WordPress plugin (versions through 0.9.7) allows remote attackers to inject malicious scripts into a victim's browser by tricking them into following a crafted link. Exploitation requires user interaction and the payload is reflected, not stored, so the attacker must lure a victim to a specially crafted URL while the plugin is active. No authentication is required of the attacker, but impact is greatest if the victim has an authenticated WordPress session, such as an administrator. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis.
Authorization bypass in the Webba Booking Lite WordPress plugin (webba-booking-lite, all versions through 6.5.2) allows remote attackers to retrieve booking data they are not entitled to by supplying a user-controlled object identifier that the plugin fails to check against the requester's permissions. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5 High) characterizes this as an unauthenticated, network-reachable confidentiality breach with no integrity or availability impact, though our independent assessment notes that IDORs of this class in WordPress plugins frequently require at least a low-privileged session in practice, so the authentication prerequisite should be confirmed against the Patchstack advisory. There is no CISA KEV listing and no public exploit code identified at time of analysis, and the practical exposure is limited to sites with the vulnerable plugin installed and active, with impact confined to unauthorized disclosure of booking/attendee data rather than modification or denial of service.
SQL injection in the Mang Board WP WordPress plugin (Kitae Park) affects all versions through 2.4.4 and lets an attacker inject arbitrary SQL into the site's backend database queries, with the primary impact being high confidentiality loss (bulk read of user records, password hashes, and other stored data) plus a limited integrity effect. The vendor/Patchstack vector advertises a 9.3 score with scope change and no privileges required (PR:N/UI:N), but the independent assessment rates the issue as PR:L with unchanged scope (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), so the authentication requirement should be treated as unconfirmed - the PR:N rating in the published vector is unusually permissive for a WordPress plugin SQLi and is not corroborated by the description text, which names no vulnerable parameter, endpoint, or feature. Only a Patchstack database entry is available: no vendor patch version is stated and no public exploit code has been identified at time of analysis.
Authenticated low-privilege users can exploit missing authorization checks in the ThemeGrill User Registration plugin (versions up to 5.2.8) to perform unauthorized actions, potentially altering site data or user information. This broken access control flaw (CWE-862) has a CVSS score of 7.1 and requires network access with low complexity, but no user interaction. No public exploit code or active exploitation has been identified at this time.
Privilege escalation in the Fluent CRM WordPress plugin version 3.2.5 and earlier allows an authenticated low-privileged user - such as a subscriber or self-registered account - to elevate their privileges and gain control over site resources, with a CVSS 3.1 score of 8.8 and high impact to confidentiality, integrity, and availability. Exploitation is not anonymous: it requires a valid low-privilege WordPress account plus an active vulnerable plugin installation, but no user interaction is needed (PR:L, UI:N) and no non-default configuration is named in the advisory. No public exploit identified at time of analysis; this is a genuine priority, not a high-CVSS-but-low-real-risk issue.
FluentCart, the WPManageNinja e-commerce plugin for WordPress, embeds sensitive information inside data it sends to clients in versions through 1.7.1, letting remote attackers pull that embedded data without authenticating. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) shows the exposure is network-reachable, low-complexity and requires no credentials or user interaction, but yields only confidentiality impact - no integrity or availability effect. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; exposure is limited to WordPress sites running this specific plugin at 1.7.1 or earlier.
Privilege escalation in the Fluent CRM WordPress plugin (all versions through 3.2.5) allows a low-privileged account to elevate itself to higher privileges, including administrator-equivalent capabilities, by abusing an incorrectly assigned privilege (CWE-266). The vendor-supplied vector scores this 9.8 (AV:N/AC:L/PR:N/UI:N), but the independent vector analysis assigns PR:L, meaning the realistic starting point is an authenticated low-privileged WordPress account, and that prerequisite is the one condition that most changes the real-world risk; the exact vulnerable endpoint and required account level are not detailed in the available data. No public exploit code has been identified at time of analysis, and Fluent CRM is not listed in CISA KEV; the sole public reference is the Patchstack advisory. Sites running Fluent CRM 3.2.5 or earlier should treat this as high priority because WordPress administrator takeover typically yields full site compromise, data theft, and persistent backdooring.
Stored cross-site scripting in the BSK PDF Manager WordPress plugin (all versions through 3.8.1) allows an attacker to persist malicious JavaScript that later executes in the browser of any user who loads the page or admin view that renders the unsanitized input. The published CVSS vector is 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) with a scope change, while the independent assessment retains a 7.1 score but rates privileges required as PR:L, noting that persisting a payload realistically depends on having at least a low-privilege authenticated role or access to a content-submission surface - sites where only trusted administrators can submit plugin content, or that have upgraded past 3.8.1, are not realistically exposed. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV.
Unauthenticated SQL injection in the TMS Amelia (ameliabooking) plugin for WordPress, affecting all versions through 2.4.10, allows remote attackers to inject arbitrary SQL into database queries executed by the plugin. Per the assessed vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), no authentication, no user interaction, and no non-default configuration are required - the only prerequisites are that the plugin be installed and active at a version at or below 2.4.10 on a network-reachable WordPress instance, making exposure broad across unpatched booking sites. The impact is confidentiality-focused: the classification indicates high confidentiality impact with no integrity or availability impact, so the practical risk is large-scale extraction of data from the site's WordPress database rather than data destruction or code execution. No public exploit code has been identified at time of analysis and the vulnerability is not listed as confirmed actively exploited (CISA KEV); no EPSS score was available in the source data, but given the unauthenticated, pre-auth access path and the database-level target, this should be treated as high priority on paper.
Stored cross-site scripting (XSS) in the Everest Forms WordPress plugin affects all releases through and including 3.6.1, allowing an attacker to persist a script payload inside form-submitted or plugin-stored data that later executes in the browser of a privileged user who views it. Our independent assessment rates this CVSS 3.1 at 7.1 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting that the payload is not self-firing - it requires a victim (most plausibly an administrator) to render the stored content, and that persisting it may in practice demand at least low-privilege authenticated access despite the upstream PR:N claim. Impact is bounded to the victim's browser session rather than the server, no public exploit code was identified at time of analysis, the issue does not appear in CISA KEV, and no EPSS score was supplied; sites running a release later than 3.6.1 are not exposed.
Remote code execution in ThemeHigh's Email Customizer for WooCommerce (Pro) through version 3.9.5 allows any authenticated user with subscriber-level access or higher to write attacker-controlled PHP into executable files inside the WordPress uploads directory through the plugin's send_test_mail() function, leading to full site compromise. The assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8) makes clear that the low-privilege account requirement is the main gate; exposure is greatest on WooCommerce stores that permit open customer/subscriber self-registration rather than manual account approval. Code execution also depends on the server permitting PHP to run from the uploads path, so sites that already harden that directory are materially less exposed, and no public exploit code has been identified at time of analysis.
Unauthenticated remote attackers can force-publish, rewrite, and create the managed pages of any WordPress site running Tutor LMS below 4.1.1, because the plugin's page-regeneration routine omits a capability check (CWE-862). Impact is confined to integrity - unpublished pages can be pushed live, existing page content overwritten, missing pages created, and the plugin options that reference those pages changed - with no confidentiality or availability effect and no code execution, so realistic damage is content tampering and manipulation of plugin page references rather than site takeover. Publicly available exploit code exists, and the CVSS 3.1 base score is 7.5 (HIGH) with vector AV:N/AC:L/PR:N/UI:N, making it trivially reachable on exposed sites; there is no CISA KEV entry indicating confirmed active exploitation at time of analysis.
Reflected cross-site scripting in the Document Gallery WordPress plugin (versions through 5.1.1) lets an unauthenticated attacker inject script into an HTML attribute returned by one of the plugin's AJAX actions, and the payload executes in the browser of any user who opens the crafted link - including a logged-in administrator. Publicly available exploit code exists and the issue is documented in the WPScan vulnerability database (EUVD-2026-101853), so exploitation only requires luring a victim into clicking or loading a malicious URL; no credentials are needed to deliver the payload (CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). At CVSS 7.1 the assessed impact is moderate rather than critical: script execution is confined to the victim's browser session instead of granting direct server control, there is no CISA KEV entry indicating confirmed actively exploited, and the decisive limiting factor is the mandatory victim interaction.
Unauthenticated attackers can register an administrator-equivalent account on any WordPress site running the User Rights Access Manager plugin through version 1.1.3, resulting in full site takeover. The plugin leaves one of its AJAX account-registration handlers accessible without any capability or nonce check, and assigns newly self-registered users a role that was created as a direct copy of the administrator role, so a single crafted request yields a fully privileged account. Publicly available exploit code exists, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms the attack is remote, unauthenticated, and requires no user interaction; no CISA KEV entry has been reported, so active exploitation is not confirmed, but the low complexity and public proof-of-concept make this a high-priority patch target wherever the plugin is deployed.
Unauthenticated time-based blind SQL injection in the WordPress Link Library plugin (all versions up to and including 7.9.2) lets remote attackers append arbitrary SQL to the plugin's existing query via the 'link_url' parameter and use timing side-channels to extract sensitive information from the site's database. The injection is reached through the plugin's front-end link user-submission functionality - the code path the vendor patch modifies in usersubmission.php - so a site only becomes directly attackable if that submission form is enabled and publicly reachable, and no authentication or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) with impact limited to confidentiality (C:H/I:N/A:N, base 7.5). Because the technique is blind and time-based, extraction is slow and requires many timed requests, and no public exploit code has been identified at time of analysis; this is a moderate-priority issue rather than a top-tier emergency.
Stored cross-site scripting in Mang Board WP 2.4.0 and earlier allows unauthenticated remote attackers to inject arbitrary web scripts through the 'data_type' parameter, with execution occurring when a victim later views the poisoned page. The issue affects WordPress sites that have the kitae-park Mang Board WP plugin active and reachable on the vulnerable API/code path; sites not running the plugin are unaffected. No public exploit code or CISA KEV entry is identified at time of analysis, and the CVSS 3.1 score of 7.2 reflects a moderate-priority issue that should be patched but does not rise to emergency status.
Stored cross-site scripting in the Groundhogg CRM, Newsletters, and Marketing Automation WordPress plugin (all versions up to and including 4.5.14) lets unauthenticated attackers inject arbitrary JavaScript through the 'ref' parameter, which is persisted as contact activity data and later rendered without escaping in the wp-admin contact editor. The script only executes in the browser of a logged-in staff member or administrator who opens the affected contact and views its activity timeline, so successful exploitation requires both the site to be actively using Groundhogg's link/visit activity tracking and an operator to view the poisoned record; the injection itself needs no authentication. This is a moderate-priority issue rather than a top-tier emergency, and at time of analysis there is no public exploit identified, no confirmed active exploitation (CISA KEV), and a vendor fix is available in version 4.5.15.
Unauthenticated stored cross-site scripting in the WordPress plugin Premium Packages - Sell Digital Products Securely (all versions up to and including 7.0.5) lets remote attackers inject arbitrary JavaScript into order records by supplying a crafted 'order_email' value during order submission. The payload is stored server-side and only executes later, when a privileged user - per the referenced admin view (list-orders.php), a store administrator - loads the order list page, which is why the assessed vector carries UI:R even though injection itself is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 7.2 High). Scope change (S:C) reflects the script executing in the WordPress admin security context rather than the attacker's unauthenticated context; no public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation.
An authorization bypass in the Checkout Field Manager (Checkout Manager) for WooCommerce plugin, affecting all versions up to and including 7.9.6, lets any logged-in user at subscriber level or above delete arbitrary attachments from the WordPress Media Library. The action handler fails to verify that the caller is permitted to remove the targeted attachment, so a low-privilege account - which many WooCommerce storefronts allow anyone to self-register for - is sufficient to destroy site media content. The vendor addressed the flaw in version 7.9.7; there is no public exploit code and no confirmed active exploitation (CISA KEV) at time of analysis, though the assessed EPSS-style risk is driven by how commonly subscriber registration is left open on commerce sites.
Unauthenticated arbitrary file upload in the 10Web Booster WordPress plugin (tenweb-speed-optimizer) in all versions up to and including 2.34.10 allows remote attackers to place executable files on a target site, leading to remote code execution. The compressCustom REST endpoint fails to validate file type or extension on the page_id parameter, and the authentication check is bypassed because the plugin's tenwebio_rest nonce is written to a world-readable file under wp-content/uploads/ whenever a bulk optimisation batch pauses - a nonce minted in a cron/loopback context with user ID 0, so it is accepted for unauthenticated visitors. Our independent assessment rates this CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (below the 9.8 base published elsewhere) because exploitation is conditional on the site having previously paused a bulk optimisation batch and on the uploaded file landing in a PHP-executable, web-accessible path; no public exploit code was identified at time of analysis and the CVE is not in CISA KEV.
Server-side request forgery in PhastPress affects WordPress sites running the optional PhastPress performance plugin through version 3.10, allowing unauthenticated remote attackers to make the server fetch arbitrary URLs by spoofing the HTTP Host header. Because the plugin builds its scripts-service URL whitelist from that attacker-controlled header, no login, user interaction, or non-default configuration is required; impact is limited to the response data and any reachable internal or external services the WordPress host can access. No public exploit identified at time of analysis, and EPSS is not supplied in the source data, so this is a genuine but not top-priority SSRF risk pending patch adoption.
Stored cross-site scripting in WPManageNinja's Best Payments Plugin for WP (WordPress plugin slug wp-payment-form) through version 4.6.27 lets attackers inject script that the plugin persists and later executes in a victim's browser, typically a logged-in administrator viewing the stored content in the WordPress dashboard, as required by the UI:R metric. The vulnerability is a CWE-79 improper-neutralization flaw rated 7.1 by the Patchstack reporter; our assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting low confidentiality and integrity impact within a changed browser scope and no availability impact, with PR:N implying the initial injection does not require credentials though the advisory should be confirmed as to whether the vulnerable sink is a public-facing submission form or an authenticated plugin area. There is no public exploit identified at time of analysis and no CISA KEV confirmation of active exploitation, so real-world risk depends on the plugin's payment or submission feature being in use and an administrator visiting the poisoned page.
Reflected cross-site scripting (moderate severity, reported CVSS 7.1) in the Hippoo Mobile App for WooCommerce plugin (versions through 1.12.0) allows remote attackers to inject malicious scripts that execute in the browser of a user who clicks a crafted link. Exploitation requires a victim with an active session on the affected WordPress/WooCommerce site - typically a logged-in administrator - to interact with the link (UI:R), but no attacker authentication is needed (PR:N). As of this analysis, no public exploit code has been identified and the vulnerability is not known to be actively exploited.