Wordpress Plugin
Monthly
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.8 allows any authenticated user holding an Author-level role or above to assign themselves an arbitrary WordPress role, including Administrator, resulting in full site takeover. The plugin fails to enforce server-side authorization checks when creating membership plans and when users attach plans to their own accounts, permitting role manipulation that bypasses WordPress's native access-control hierarchy. A publicly available exploit exists via WPScan, and the CVSS 7.2 score understates real-world risk because the provided PR:H metric conflicts with the description's requirement of only Author-level access - a low-privilege role - suggesting a closer real-world base score of approximately 8.8.
Remote code execution is achievable in Tutor LMS WordPress plugin (≤4.0.7) via a PHP Object Injection flaw in the withdrawal account AJAX handler that exploits a subtle interaction between `esc_sql()` percent-escaping and PHP serialized string-length declarations. Authenticated attackers with subscriber-level access — or unauthenticated attackers on sites with user registration enabled, the typical eLearning configuration — can inject an arbitrary serialized object stream and trigger the well-documented `GuzzleHttp\Cookie\FileCookieJar` POP chain to write a webshell to an attacker-specified path. No public exploit or KEV listing is confirmed at time of analysis, but a fix changeset is available and the POP chain is reliably reachable due to the plugin's bundled PayPal Composer autoloader.
Remote code execution in The Events Calendar WordPress plugin (StellarWP) through version 6.17.3 lets unauthenticated attackers run arbitrary PHP on the server by abusing Element_Classes::parse_array(). A plain-array widget 'classes' payload evades the is_safe_widget_instance() object check and reaches a callable-invocation sink; the chain fires when do_blocks() renders a single-event page whose comment area contains a crafted wp:legacy-widget block. Reported by Wordfence with a 9.8 CVSS; no public exploit identified at time of analysis, and the flaw is only reachable on sites that enable comments on tribe_events posts.
Remote code execution in The Events Calendar plugin for WordPress (StellarWP) affects all versions up to and including 6.17.4, allowing unauthenticated attackers to run arbitrary PHP on the server via unsafe deserialization. The is_safe_widget_instance guard is bypassed because PHP fires magic methods during pre-parse and enable_rendering_widget_copied() forges a valid wp_hash integrity attribute before unserialize() executes; the malicious block markup reaches the sink through the V2 single-event template running do_blocks() over buffered comment HTML. Reported by Wordfence with a CVSS of 9.8; no public exploit identified at time of analysis, though the vulnerability is well-documented with pinpointed source-line references.
Local file inclusion and remote code execution in GEO my WP WordPress plugin (≤4.5.5.3) allow unauthenticated attackers to include arbitrary PHP files via the `gmw_posts_locator_ajax_info_window_loader` AJAX handler, which accepted attacker-controlled template paths and passed them to a PHP `require` statement without adequate allowlist enforcement. At minimum this exposes sensitive PHP files such as wp-config.php; when PEAR is installed with `register_argc_argv` enabled, attackers can leverage pearcmd.php to write and execute arbitrary PHP code, achieving full unauthenticated RCE. No public exploit has been identified at time of analysis, though the Wordfence advisory and vulnerable source code are publicly available, substantially reducing the development effort for a proof-of-concept.
Time-based blind SQL injection in rtMedia for WordPress, BuddyPress and bbPress (all versions through 4.7.11) enables unauthenticated remote attackers to exfiltrate arbitrary data from the WordPress database. The flaw stems from RTMediaQuery::query() merging raw $_REQUEST input into internal query parameters while only validating top-level array keys, allowing the nested 'compare' subvalue to bypass input validation and reach an unparameterized SQL sink. Exploitation requires only that a public-facing page exist with an rtMedia shortcode present - no authentication, interaction, or special server configuration is needed. No public exploit code or CISA KEV listing was identified at time of analysis.
Missing authorization in the Master Addons for Elementor WordPress plugin (≤3.2.2) by Pixar Labs enables privilege abuse by authenticated low-privileged users. The CVSS vector (PR:L/C:N/I:L/A:H) indicates that a subscriber-level or similarly low-privileged WordPress account is sufficient to trigger operations with high availability impact - likely destructive actions such as resetting plugin settings, deleting content blocks, or disrupting site functionality - while retaining limited integrity modification capability. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
SQL injection in the Amelia WordPress booking plugin (versions ≤ 2.4.9) allows authenticated Editor-role users to exfiltrate data from the underlying database via crafted queries. The vulnerability is scoped-changed, meaning successful exploitation reaches beyond the plugin component to the WordPress database. Reported by Patchstack; no public exploit code or CISA KEV listing identified at time of analysis.
SQL injection in Sky Addons for Elementor (WordPress plugin by wowdevs) versions 3.8.4 and earlier allows authenticated attackers with Editor-level WordPress privileges to query the underlying database beyond the plugin's normal scope, achieving high confidentiality impact. The scope-changed CVSS vector (S:C) indicates the injection can reach data outside the plugin's own tables - including sensitive WordPress core tables - making this an information-disclosure-focused SQLi. No public exploit code or active exploitation has been identified at time of analysis.
PHP Object Injection in the Masteriyo LMS WordPress plugin (versions <= 3.4.0) allows remote attackers to inject a crafted serialized PHP payload, potentially enabling arbitrary code execution via a PHP gadget chain present in the environment. The vulnerability is described as unauthenticated in the Patchstack disclosure title, though the supplied CVSS vector specifies PR:L - a discrepancy that materially affects real-world risk assessment and requires vendor clarification. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the SMS Alert Order Notifications WordPress plugin (versions ≤ 3.9.9) allows any authenticated subscriber - the lowest standard WordPress role - to elevate their account privileges, potentially gaining full administrative control over the affected site. The CVSS 8.8 score with PR:L confirms that only a low-privileged account is required, making exploitation accessible to any registered user on the platform. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Unauthenticated PHP Object Injection in the ThemeREX Addons (trx_addons) WordPress plugin before 2.45.0 lets remote attackers inject arbitrary serialized PHP objects into the application. Because no authentication is required (CVSS 9.8, PR:N/UI:N), an attacker can supply crafted serialized data to a vulnerable entry point; when combined with a suitable POP gadget chain present in the plugin, another plugin, a theme, or WordPress core, this can escalate to code execution, arbitrary file operations, or data compromise. Reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated PHP Object Injection affects the Everest Forms WordPress plugin (wpeverest) in all versions up to and including 3.6.0, allowing remote attackers to pass attacker-controlled serialized data into a PHP unserialize() call. If a suitable POP (property-oriented programming) gadget chain is present in the plugin, an installed theme, or WordPress core, this can escalate to arbitrary file operations, SQL injection, or remote code execution. Reported by Patchstack; no public exploit identified at time of analysis, and no EPSS or KEV signal was provided.
Privilege escalation in the Gato GraphQL WordPress plugin (versions ≤ 19.2.3) allows authenticated subscribers - the lowest registered-user role in WordPress - to elevate their access beyond their assigned privileges. The root cause is CWE-266 (Incorrect Privilege Assignment), where the plugin's GraphQL endpoint handling fails to properly gate privileged operations against low-privilege requestors. No confirmed active exploitation or public POC is identified at time of analysis, but the trivially low access bar of a subscriber account combined with full CIA impact makes this a high-priority finding for any WordPress installation running this plugin.
Stored Cross-Site Scripting in the Kirki - Freeform Page Builder, Website Builder & Customizer WordPress plugin (all versions through 6.2.0) allows unauthenticated attackers to permanently embed malicious JavaScript into pages via the unsanitized 'comment' parameter. Injected payloads persist in the database and execute in every subsequent visitor's browser session, enabling session hijacking, credential theft, or privilege escalation against logged-in administrators who view the affected pages. No public exploit or CISA KEV listing has been identified at time of analysis, but the unauthenticated write vector makes mass-exploitation trivially automatable across unpatched WordPress installations.
Arbitrary file deletion in UsersWP ≤ 1.2.70 for WordPress allows authenticated Subscriber-level users to delete any file on the server - including wp-config.php - via a path traversal bypass in the upload_file_remove() AJAX handler. The exploit exploits a two-phase validation failure: validate_file() only rejects literal '../' sequences, but the uwp_get_file_relative_url() helper later performs a global str_replace() that collapses crafted embedded tokens into directory traversal sequences after the final validation gate, with the result passed directly to wp_delete_file() without canonical containment. No public exploit code or CISA KEV listing is confirmed at time of analysis; however, the low privilege requirement and precise Wordfence source-level write-up substantially reduce the research barrier for threat actors.
Stored cross-site scripting in the Vigilant WordPress security plugin (all versions ≤2.10.2) lets an unauthenticated attacker permanently inject malicious scripts by supplying a crafted User-Agent header during any failed login attempt, after which the payload persists in the plugin's login-security log. The script executes automatically in the browser of any administrator who subsequently reviews the login events dashboard, enabling session hijacking or administrative account takeover without further attacker involvement. No public exploit code or CISA KEV listing has been identified at time of analysis, but the passive, zero-interaction delivery path lowers the bar for exploitation considerably.
Unauthenticated arbitrary file upload in the MIPL Grouped Checkout Fields for WooCommerce WordPress plugin (all versions through 1.2.1) lets remote attackers write arbitrary files to the server because the mipl_wc_upload_file function performs no file-type validation, which may escalate to remote code execution. Any WooCommerce store running this plugin is exposed to pre-authentication compromise. Reported by Wordfence; no public exploit identified at time of analysis and the plugin's real-world footprint appears small.
Unauthenticated SQL injection in the Unlimited Elements For Elementor WordPress plugin (versions ≤2.0.16) allows remote attackers to extract sensitive data from the WordPress database without any credentials. The flaw exists in getWhereString() where the 'addontype' parameter, when submitted as an array, has its first element injected verbatim as the SQL comparison operator into the WHERE clause; the companion normalizeAjaxInputData() method strips WordPress's built-in magic_quotes protection, eliminating the last layer of defense. No public exploit or KEV listing has been identified at time of analysis, but the unauthenticated network attack path and confirmed Wordfence disclosure make this a credible priority for sites running the affected plugin.
Stored XSS in the Simple Ajax Chat WordPress plugin (all versions ≤ 20260811) allows fully unauthenticated remote attackers to inject persistent JavaScript payloads that execute in every visitor's browser on every page load. The vulnerability is compounded by a nonce bypass: the WordPress nonce normally used to authenticate chat submissions is rendered in the public chat page DOM, enabling any anonymous attacker to extract and reuse it without logging in. No public exploit or CISA KEV listing has been identified at time of analysis.
SQL injection in the Sticky Chat Widget WordPress plugin (versions ≤1.4.2) allows unauthenticated remote attackers to extract sensitive data from the underlying WordPress database via the scw_save_form_data AJAX action. Three compounding weaknesses enable exploitation: $wpdb->insert() wraps column identifiers in unescaped backticks, PHP's filter_input() retrieves raw POST data bypassing WordPress's wp_magic_quotes() sanitization, and a widget_id validation loop that is never executed when no valid widget_id is supplied leaves the $isValid flag at its initialized true value. No public exploit has been confirmed at time of analysis, but the publicly accessible unauthenticated AJAX endpoint makes this mechanically straightforward to exploit against any site running the affected plugin.
Stored Cross-Site Scripting in the WP Photo Album Plus WordPress plugin (all versions through 9.2.08.003) allows unauthenticated remote attackers to permanently inject arbitrary JavaScript into pages served to other users. The vulnerability exists because the plugin's AJAX logging path - triggered via the unauthenticated wp_ajax_nopriv_wppa endpoint - records the attacker-supplied HTTP X-Forwarded-For header value directly to disk through wppa_log() without sanitization, then later renders that stored value without output escaping. No public exploit or KEV listing has been identified at time of analysis, but the technique (header spoofing against a nopriv AJAX endpoint) is trivially automatable.
Path traversal in AcyMailing WordPress plugin (all versions through 11.0.4) exposes arbitrary server files to unauthenticated remote attackers via the unsanitized `user[name]` parameter. Exploitation is gated on the 'Embed images' configuration option being enabled, but when active, an attacker can read sensitive server-side files including WordPress configuration, credentials, and other data without any authentication. Wordfence reported this flaw and a patch commit is available in the WordPress plugin repository. No public exploit or active exploitation has been identified at time of analysis.
Broken access control in the WP Fast Total Search WordPress plugin (versions ≤ 1.82.284) exposes restricted data to unauthenticated remote attackers via missing authorization checks (CWE-862). The Epsiloncool plugin fails to verify requester permissions on one or more endpoints, allowing network-accessible exploitation with no credentials or user interaction - reflected in a CVSS 7.5 High score with C:H/I:N/A:N impact. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make automated discovery straightforward.
Unauthenticated Cross-Site Scripting (XSS) in the WPAdverts WordPress plugin affects all versions through 2.3.3, allowing a remote attacker without any credentials to inject malicious JavaScript into pages served by the plugin. With user interaction (UI:R), a victim - likely a logged-in site administrator - must visit or trigger the vulnerable endpoint for the payload to execute in their browser context. Successful exploitation can lead to session hijacking, unauthorized administrative actions, or content manipulation via the changed-scope (S:C) browser execution context. No public exploit or KEV listing has been identified at time of analysis.
Unauthenticated cross-site scripting in the WPCS WordPress currency switcher plugin (versions ≤ 1.3.2) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in victims' browsers without any server-side privileges. The CVSS Scope:Changed metric confirms the injected payload escapes the plugin's own security context, enabling session theft, credential harvesting, or admin-level action execution on behalf of a tricked user. No public exploit or CISA KEV listing has been identified at time of analysis, though the unauthenticated nature lowers the bar for exploitation significantly.
Unauthenticated privilege escalation in the SiteSkite WordPress plugin (versions ≤ 2.1.5) allows a remote attacker to gain elevated privileges within a WordPress installation without any authentication. The vulnerability is classified under CWE-266 (Incorrect Privilege Assignment), meaning the plugin incorrectly grants elevated roles or capabilities during some reachable code path. With full C:H/I:H/A:H impact and PR:N, successful exploitation results in complete compromise of the affected WordPress site, though AC:H signals a non-trivial exploitation condition such as a race condition, specific request sequence, or timing-dependent logic.
Unauthenticated sensitive data exposure in the ZHBackup - Backup, Restore & Migration WordPress plugin (versions <= 2.4.2) permits remote attackers to access protected backup archives without any credentials or user interaction. Classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), the flaw likely exposes backup archives containing database dumps, WordPress configuration data, password hashes, and secret keys - artifacts that enable full site takeover if retrieved. No public exploit code has been identified at time of analysis, and the CVE has not been added to the CISA KEV catalog.
Remote code execution in the RepairBuddy WordPress plugin (versions <= 4.1224) is reachable by authenticated users holding only subscriber-level privileges - the lowest WordPress role - via a code injection flaw (CWE-94). A subscriber can send a crafted network request to trigger server-side code execution, achieving full confidentiality, integrity, and availability compromise of the WordPress host. No public exploit or KEV listing has been identified at time of analysis, but Patchstack has disclosed the vulnerability with a dedicated advisory.
Missing authorization in the WP-Stateless WordPress plugin (versions up to and including 4.4.1) allows authenticated subscriber-level users to modify plugin settings they should have no access to. WP-Stateless manages Google Cloud Storage offloading for WordPress media; unauthorized settings changes by a low-privileged user can corrupt the GCS integration, break media delivery, or reconfigure the storage bucket in ways that degrade site availability. No public exploit code has been identified at time of analysis, though the Patchstack advisory confirms the vulnerability.
SQL injection in the Verified Reviews (Avis Vérifiés) WordPress plugin (slug 'netreviews') affects all versions up to and including 2.4.6, allowing unauthenticated remote attackers to inject arbitrary SQL into backend queries. Per the CVSS vector (PR:N, S:C), no login is required and the impact crosses into the underlying WordPress database, enabling extraction of sensitive data such as user credentials and secrets. No public exploit has been identified at time of analysis, though Patchstack has published the vulnerability record.
Broken access control in the Return Refund and Exchange For WooCommerce WordPress plugin by WP Swings (versions ≤ 4.6.4) exposes privileged refund, return, or exchange management operations to unauthenticated remote attackers. The CVSS vector (PR:N/I:H) confirms that no authentication is required and that the integrity impact is high, consistent with CWE-862 (Missing Authorization) - meaning the plugin registers AJAX hooks or REST API routes without verifying WordPress user capabilities before executing write operations. No public exploit or active exploitation has been confirmed at time of analysis.
Broken authentication in the WP Travel WordPress plugin (versions ≤ 12.0.3) exposes protected plugin functionality to unauthenticated remote attackers via an alternate path or channel, satisfying CWE-288. Exploitation requires no credentials and no user interaction, making it accessible to any network-reachable attacker against a default plugin installation. The CVSS 7.3 vector indicates partial confidentiality, integrity, and availability impact, suggesting an attacker can read and modify travel booking data or disrupt plugin operations without logging in. No public exploit code or active exploitation has been confirmed at time of analysis.
Unauthenticated cross-site scripting in the Page Visits Counter - Lite WordPress plugin (versions ≤ 1.2.3) allows a remote, unauthenticated attacker to inject malicious JavaScript that executes in the browser context of a visiting user. Because CVSS marks scope as Changed (S:C), the injected script can escape the plugin's own context and affect the broader WordPress page environment, enabling session hijacking, credential theft, or malicious redirects. No public exploit or CISA KEV listing has been identified at time of analysis; the issue was disclosed by Patchstack.
Broken access control in Shirt Product Designer for WooCommerce plugin version 1.0.4 exposes WordPress/WooCommerce stores to unauthenticated data modification. The CVSS vector (PR:N, AC:L, AV:N, UI:N) confirms that a remote attacker with no credentials or user interaction can invoke privileged plugin functionality, achieving high integrity impact against store product or configuration data. No public exploit code has been identified at time of analysis, and Patchstack is the sole reporting source.
Unauthenticated arbitrary file deletion in the Advanced Product Fields Extended for WooCommerce WordPress plugin (versions <= 3.1.6) allows remote attackers to delete any file accessible to the web server process via a path traversal flaw. The scope-changed CVSS vector (S:C) reflects that an attacker can reach beyond the plugin's own file space - targeting WordPress core files such as wp-config.php, .htaccess, or even server-level configuration - resulting in complete site takedown or broader server disruption. Patchstack reported this vulnerability; no public exploit code or CISA KEV listing has been identified at time of analysis.
Broken access control in the VillaTheme Thank You Page Customizer for WooCommerce plugin (all versions through 1.2.2) exposes WooCommerce order data to unauthenticated remote attackers. The missing authorization check (CWE-862) on one or more plugin endpoints allows any network-reachable party to retrieve order-associated confidential data without credentials, consistent with the CVSS C:H/PR:N/UI:N vector reported by Patchstack. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated PHP Object Injection in Wise Chat WordPress plugin versions up to and including 3.4 allows a remote attacker to achieve high-impact compromise of confidentiality, integrity, and availability by passing crafted serialized data to an unprotected deserialization point. Exploitation requires a viable POP gadget chain within the target WordPress environment, keeping the practical bar elevated despite requiring no credentials. No KEV listing or public POC has been identified at time of analysis.
Subscriber-level broken authentication in the MailMunch - Grow your Email List WordPress plugin (versions ≤ 3.2.5) enables low-privileged authenticated users to bypass authentication controls, causing integrity and availability impacts on affected WordPress installations. The vulnerability is classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and reported by Patchstack, indicating a pathway or channel that circumvents the intended authentication mechanism. No public exploit code or active exploitation has been identified at time of analysis, though the network-accessible, low-complexity attack vector lowers the bar for abuse.
Unauthenticated arbitrary file read in the Direct Download for WooCommerce WordPress plugin (all versions ≤1.19) allows any remote attacker to retrieve the contents of any file accessible to the web server process — including wp-config.php, database credentials, and server-side secrets. The root flaw is a fatally incomplete authorization check in the plugin's top-level include handler (direct-download.php): it confirms only that some free, virtual, downloadable product exists anywhere on the site, without validating that the requested file path is one of that product's configured download assets. No public exploit has been identified at time of analysis, but the exploitation logic is straightforward and the prerequisite is met by the majority of WooCommerce stores offering free resources.
Stored XSS in the Sidebar Manager Light WordPress plugin (all versions through 1.18) allows unauthenticated attackers to permanently inject malicious JavaScript via the `sbm_description` parameter into pages served to any site visitor. The scope-changed impact means attacker-controlled scripts execute within victims' browsers rather than solely the plugin's own context, enabling session hijacking, credential phishing, or drive-by malware delivery. No public exploit code has been identified at time of analysis, and the plugin's limited deployment footprint constrains real-world exposure.
Privilege escalation in the Bulk Password Reset WordPress plugin (all versions ≤1.3.3) allows any authenticated subscriber-level user to perform a full administrative account takeover. The plugin fails to validate the requesting user's identity before permitting bulk password changes and email-address updates, meaning an attacker can redirect an administrator's email to an attacker-controlled address, then invoke the standard WordPress password-reset flow to obtain reset credentials for that admin account. No public exploit code has been identified at time of analysis, but source code references from WordPress Plugin Trac directly expose the vulnerable functions at lines 44, 594, 659, and 679 of bulk_password_reset.php.
Remote code execution in the Drag and Drop File Upload for Elementor Forms WordPress plugin (versions up to and including 1.6.0) allows unauthenticated attackers to upload executable PHP files through the elementor_file_upload handler. The is_file_type_valid() function trusts an attacker-controlled 'type' parameter as regex keys in its MIME allowlist, so a crafted extension bypasses the intended blacklist and is subsequently normalized to a .php extension by sanitize_file_name(). Reported by Wordfence with a CVSS of 9.8; no public exploit identified at time of analysis, but the unauthenticated network-facing RCE makes this a high-priority patch.
Stored cross-site scripting in the WPLP Cookie Consent WordPress plugin (all versions ≤ 4.4.1) enables any unauthenticated site visitor to inject persistent malicious scripts via the `wpl_user_preference` AJAX parameter. The consent-logging endpoint is registered without authentication requirements, and the protective nonce (`wpl_consent_logging_nonce`) is publicly broadcast to every page visitor via `wp_localize_script()`, rendering the nonce mechanism entirely ineffective as an access barrier. Injected payloads execute in the browsers of administrators or users who subsequently view pages rendering consent log data, enabling session hijacking, credential theft, or full administrative account takeover. No public exploit is identified at time of analysis and the CVE is not listed in CISA KEV, but the trivially low exploitation barrier warrants prompt patching.
Authentication bypass in the shared wp-module-data module (bundled across four Newfold WordPress plugins) allows unauthenticated remote attackers to gain full administrator-level access to any affected WordPress site that lacks a stored Hiive connection token. The defect degenerates the HMAC-style Bearer token verification into a trivially forgeable computation: when the stored connection token is absent, PHP coerces `strrev(false)` to `strrev('')`, reducing the secret salt to the publicly known SHA-256 empty-string hash `e3b0c44...`, while all remaining inputs (HTTP method, URL, body, and the attacker-supplied X-Timestamp header) are fully attacker-controlled, enabling offline token pre-computation. No public exploit code has been confirmed and the vulnerability is not listed in CISA KEV at time of analysis, but full technical details including source code references are publicly disclosed by Wordfence, substantially lowering the barrier to exploitation.
Privilege escalation in PublishPress Capabilities WordPress plugin (all versions ≤2.50.0) allows authenticated Editor-level users to elevate to site-wide capability managers without administrator consent. The root cause is a hard-coded role assignment in `addPluginCapabilities()` that unconditionally grants the Editor role all 15 `manage_capabilities_*` capabilities on the first `admin_init` hook after plugin activation, writing the grants persistently to the WordPress database. Once escalated, an Editor can create, rename, and delete non-system roles; modify capabilities of non-administrator roles; restore role backups; and write arbitrary plugin options under several namespaced prefixes - stopping short of full Administrator access only because WordPress's `map_meta_cap` layer blocks further escalation. No public exploit or CISA KEV listing identified at time of analysis.
Authentication bypass in the Next-Cart Store to WooCommerce Migration WordPress plugin (all versions ≤ 3.9.8) allows unauthenticated remote attackers to reach privileged migration endpoints and achieve full site takeover via arbitrary SQL execution and arbitrary file deletion. The root cause is a double design flaw: the `/wp-json/next_cart/v1/migration` REST route is registered with `permission_callback` set to `__return_true` (granting unrestricted access to all callers), and the token check falls back to the hardcoded literal `__token__` via `get_option('nextcart_token', '__token__')` whenever the database option has never been written. Once past the token check, attackers pass attacker-controlled SQL directly to `$wpdb->query()` and `$wpdb->get_results()` - enabling administrator account creation - and pass an attacker-controlled path to `unlink()`, enabling arbitrary file deletion. No public exploit or CISA KEV listing has been identified at time of analysis, though source code confirming the flaw is publicly visible in the WordPress plugin SVN repository.
Stored Cross-Site Scripting in the WPBot AI ChatBot WordPress plugin (QuantumCloud, all versions through 8.7.3) allows unauthenticated remote attackers to inject persistent JavaScript into pages viewed by site users and administrators. The critical design flaw is that the only access gate - a WordPress nonce - is rendered useless because it is embedded in every public-facing page via wp_localize_script, making it fully readable by any visitor. No public exploit code has been identified at time of analysis, but the low attack complexity and zero-authentication requirement make this a straightforward exploitation path for opportunistic attackers targeting WordPress sites.
Stored Cross-Site Scripting in the Repeater Fields for Gravity Forms WordPress plugin (all versions ≤3.0.4) allows unauthenticated attackers to inject arbitrary JavaScript into pages via multi-input sub-field types (Name, Address, Checkbox) within a repeater block, executing whenever any user views the affected page. The flaw is isolated to complex sub-field types because scalar single-input fields were patched with esc_html() output escaping in 3.0.4, leaving multi-input composite fields unprotected. Discovered and reported by Wordfence; no public exploit identified at time of analysis, though the vulnerability requires no authentication or special site configuration to abuse via a publicly accessible Gravity Form.
WP EasyCart (Shopping Cart & eCommerce Store) versions up to and including 5.9.3 exposes a privilege escalation path allowing authenticated Store Manager-level users to promote themselves to WordPress administrator. The `ec_ajax_save_page_default_options()` AJAX handler accepts arbitrary POST parameters and writes them directly to the WordPress options table via `update_option()` without any allowlist, while its nonce is embedded in frontend product and category templates accessible to any user holding the plugin's custom 'wpec_manager' capability. No public exploit code has been identified at time of analysis, but the attack technique is mechanically straightforward and requires only a Store Manager credential to execute.
Local File Inclusion in the Eventin WordPress event management plugin (versions ≤4.1.22) allows authenticated contributors to include and execute arbitrary PHP files on the server via the unsanitized 'event_layout' parameter, achieving full remote code execution. The etn_manage_event capability is assigned to WordPress Contributors by default, meaning any registered Contributor can set the malicious parameter value through the REST API without any site-specific configuration change. Exploitation requires a PHP file to already be present on the server, reflected in the AC:H CVSS rating; no public exploit or CISA KEV listing has been identified at time of analysis.
Local File Inclusion in the Eventin Event Calendar WordPress plugin (all versions through 4.1.22) allows authenticated attackers with custom-level WordPress access to include and execute arbitrary PHP files by supplying a crafted path via the unsanitized `event_layout` parameter in the plugin's event template and REST API endpoints. Successful code execution requires the attacker to first place a PHP file on the server - a two-stage exploit chain reflected in the CVSS AC:H rating. No public exploit code or CISA KEV listing has been identified at time of analysis; Wordfence reported this with direct source code line references, indicating the attack surface is well-documented.
Remote code execution in FireBox - WooCommerce Popup Builder (all versions ≤ 3.1.10) allows authenticated Author-level attackers to execute arbitrary PHP on the server by injecting unsanitized PHP expressions into campaign condition rules via the `firebox_meta` REST endpoint. The plugin's `Executer::allowedToRun()` blacklist (Executer.php L231) uses a trivially bypassable regex that permits WordPress core functions such as `wp_insert_user`, `update_option`, and `file_put_contents`, which the `value` function in the PHP Conditions class then evaluates directly. Critically, sites migrated from any version prior to 3.1.10 are automatically subjected to `Migrator::preserveCampaignRoleAccess()`, which grants Author-role users `edit_fireboxes` and `publish_fireboxes` capabilities, making exploitation reachable from any registered Author account with no further privilege requirements. No public exploit code or CISA KEV listing has been confirmed at time of analysis.
Stored Cross-Site Scripting in the Contact Form to DB by BestWebSoft WordPress plugin (versions ≤1.7.5) allows unauthenticated attackers to compromise administrator sessions via a malicious contact form submission. The `cntctfrm_contact_dropdown` parameter lacks input sanitization and output escaping, so injected JavaScript persists in the plugin's message store and executes automatically in the admin's browser context when they navigate to the message manager page at `/wp-admin/admin.php?page=cntctfrmtdb_manager`. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-prerequisite submission path make this trivially weaponizable against any site with the plugin installed.
Unauthenticated payment credential hijacking in the Event Tickets and Registration WordPress plugin (StellarWP, all versions ≤5.27.4) allows any remote attacker to silently replace the site's Stripe merchant account credentials - access tokens, publishable keys, and account ID - via a missing capability check on the plugin's Stripe OAuth return endpoint. Once the attacker's own Stripe credentials are stored, all subsequent ticket purchases by legitimate customers are processed into the attacker's account with no visible indication to the buyer or site administrator. No public exploit has been identified at time of analysis, but the fully unauthenticated AV:N/AC:L/PR:N attack surface makes opportunistic mass exploitation straightforward.
PHP Object Injection in the Live Composer - Free WordPress Website Builder plugin (all versions ≤ 2.1.18) enables authenticated attackers with contributor-level access to inject arbitrary PHP objects via deserialization in the plugin's downloads module. Real-world impact is entirely conditional on whether a Property-Oriented Programming (POP) chain is present in a co-installed plugin or theme; without one, exploitation produces no tangible effect. When a POP chain is available, consequences can include arbitrary file deletion, sensitive data extraction, or remote code execution. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Server-Side Request Forgery in the Hide My WP Ghost WordPress plugin (all versions through 7.0.09) allows unauthenticated remote attackers to induce the WordPress server to issue arbitrary HTTP requests to internal or external hosts. Reported by Patchstack under EUVD-2026-72652, the vulnerability carries a CVSS 7.2 with scope change (S:C), meaning successful exploitation can affect infrastructure beyond the WordPress host itself - including cloud metadata endpoints or internal network services. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated HTTP Denial of Service in WooCommerce (all versions before 11.1.0) allows remote attackers to exhaust server resources without any credentials, rendering affected storefronts and admin panels unavailable. The root cause is CWE-770 - missing throttling or resource allocation limits on one or more HTTP-accessible endpoints within the plugin. Patchstack reported the issue and a patched release (11.1.0) is available; no active exploitation or public proof-of-concept code has been identified at time of analysis.
Missing authorization in the Unbounce Landing Pages WordPress plugin (≤1.1.4) allows authenticated low-privilege users to exploit incorrectly configured access control, resulting in high availability impact and limited integrity modification. The CVSS vector (PR:L, A:H, I:L) indicates that a logged-in WordPress user with minimal permissions can invoke plugin actions without proper capability checks - most likely disrupting or deleting landing page content. No public exploit code or CISA KEV listing exists at time of analysis.
Missing authorization in the Hungarian WooCommerce pickup-points and shipping-labels plugin (versions before 4.2.8) allows unauthenticated remote attackers to perform actions that should be restricted to authorized users, resulting in high-integrity impact against affected WooCommerce stores. The flaw, classified as CWE-862 (Missing Authorization), means the plugin fails to verify whether the requesting party has the right to perform privileged operations - distinct from authentication failure. No public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based cross-site scripting in the Easy Appointments WordPress plugin (all versions through 4.0.2.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victim browsers by delivering a crafted URL. The CVSS scope-change metric (S:C) indicates injected scripts execute within the broader WordPress page context, enabling session hijacking, credential theft, or unauthorized actions on behalf of administrators or site visitors. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated Cross-Site Scripting in the Open User Map WordPress plugin (versions <= 1.4.50) allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in the browser context of visiting users. The scope-changed CVSS vector (S:C) indicates the injected script executes outside the plugin's own trust boundary, enabling session hijacking, credential theft, or malicious redirects against authenticated site visitors. No public exploit code or active exploitation has been identified at time of analysis, but the unauthenticated nature and WordPress plugin attack surface make this a realistic target for opportunistic actors.
Unauthenticated reflected cross-site scripting in the JetFormBuilder WordPress plugin (Crocoblock) affects all versions through 3.6.5.1, allowing a remote attacker to inject and execute arbitrary JavaScript in a victim's browser session. The CVSS vector (PR:N/UI:R/S:C) confirms no authentication is needed to craft a malicious payload, but exploitation requires social engineering to lure a logged-in user into clicking a crafted URL. No public exploit code or CISA KEV listing is identified at time of analysis, though the plugin's wide deployment in WordPress form-building workflows elevates the realistic exposure surface.
Cross-site scripting in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) versions up to and including 2.0.17 allows unauthenticated attackers to inject malicious scripts that execute in the browser context of site visitors or privileged WordPress users. The CVSS 7.1 rating reflects a scope change (S:C), meaning the injected payload escapes the plugin's own origin and can compromise administrator browser sessions. No public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in the User Profile Builder WordPress plugin (Cozmoslabs, versions ≤3.15.7) permits unauthenticated attackers to inject persistent JavaScript payloads via the 'Biographical Info' registration field, which execute in any visitor's browser upon viewing the affected profile page. The vulnerability is rooted in missing input sanitization and output escaping in class-formbuilder.php and class-email-confirmation.php, enabling session hijacking, credential theft, or malicious redirects targeting administrators and other authenticated users. A patch is confirmed via WordPress.org SVN changeset 3511465; no public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated account takeover in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.12) lets remote attackers overwrite any user's email address - including an administrator's - and then hijack the account via WordPress's built-in password-reset flow. The flaw stems from a missing capability check in pre_update_value combined with an authorization gate that is silently bypassed when a non-numeric post identifier (e.g. 'user_1') is supplied. Reported by Wordfence; no public exploit code or CISA KEV listing was identified at time of analysis, but the trivial, unauthenticated nature makes this a high-priority patch.
Authentication bypass in HivePress Authentication plugin for WordPress (≤1.1.4) allows an unauthenticated network attacker to log in as any WordPress user - including administrators - whose account email is linked to a Facebook account. The plugin's Facebook OAuth handler forwards the caller-supplied access_token directly to the Facebook Graph API and blindly trusts the returned email and user ID, performing no /debug_token audience validation and no comparison of the token's app_id against the configured hp_facebook_app_id. Exploitation requires the attacker to first acquire a valid Facebook access token associated with the victim's account, which is the primary complexity barrier - but once obtained, the attack yields full account takeover with no WordPress credentials required. No public exploit or CISA KEV listing has been identified at the time of analysis.
Remote code execution in the Mail Mint WordPress plugin (by getwpfunnels) affects all versions up to and including 1.31.0, where the 'handle_form_submission' function deserializes untrusted, attacker-supplied input (CWE-502). Because a usable POP (property-oriented programming) gadget chain is present in the plugin's bundled code, unauthenticated attackers can move from PHP Object Injection to arbitrary code execution on the server. The vendor only partially addressed the flaw in 1.23.1, meaning early-'fixed' installs may remain exploitable; no public exploit has been identified at time of analysis, though Wordfence has documented the vulnerability.
Stored cross-site scripting in the Contact Form by Supsystic WordPress plugin (all versions ≤1.10.2) allows unauthenticated attackers to inject persistent malicious scripts via a spoofed IP address header. The exploit chain is notable for its two-stage unauthenticated entry: the plugin's `updateNonce` action is excluded from the permission-check list, granting any unauthenticated caller a valid WordPress nonce; that nonce is then used to submit a contact form with a crafted `X-Forwarded-For` value, which the plugin stores unsanitized and later renders in the admin contacts list. No public exploit has been identified at time of analysis and no KEV listing exists, but the Wordfence advisory includes direct source-code references to the vulnerable code paths.
Stored Cross-Site Scripting in the SureForms plugin for WordPress (all versions up to and including 2.12.2) permits unauthenticated form submitters to embed persistent malicious scripts by bypassing sanitization with entity-encoded payloads in text fields. The injected payload executes in any visitor's or administrator's browser when they load an affected page, enabling session hijacking, cookie theft, or page defacement across any WordPress site running the vulnerable plugin version. Wordfence reported the issue and a fix was released in version 2.12.3.
PHP Object Injection in the Welcart e-Commerce WordPress plugin (all versions ≤ 2.12.1) enables unauthenticated attackers to inject a serialized POP-chain payload as order metadata during a public checkout, then trigger deserialization through the unprotected Telecom EDY payment callback. Exploitation via a bundled TCPDF POP chain can delete arbitrary server files - including wp-config.php - and culminates in full remote code execution when the attacker re-runs the WordPress installer against an attacker-controlled database. Successful file deletion requires an administrator to print an order invoice, captured by UI:R in the CVSS vector; no public exploit or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in W3 Total Cache (WordPress plugin) versions up to and including 2.10.5 allows unauthenticated attackers to inject arbitrary JavaScript via comment content processed by the LazyLoad Background Mutator. The flaw stems from insufficient sanitization and output escaping in UserExperience_LazyLoad_Mutator.php, specifically where comment text containing background-image CSS is mutated for lazy loading. Exploitation requires two non-default conditions: the Lazy Load Images feature with 'Process background images' enabled, and the malicious comment must be approved by a moderator before the payload executes against visiting users. A vendor-released patch is available in version 2.10.6.
Stored XSS with on-disk file write capability in the Ninja Forms WordPress plugin (versions ≤3.15.1) allows unauthenticated remote attackers to plant attacker-controlled HTML/JavaScript files anywhere in the web server's writable directory tree - including the site root - when the separately-installed Ninja Forms File Uploads add-on is active. The attack exploits a 'type' confusion flaw in Repeater child field processing: an unrecognized array key causes the submission pipeline to misroute input through the File Uploads handler, which writes raw attacker-supplied content to disk where it is subsequently served from the site's own origin. The fix is confirmed in version 3.15.2 via WordPress.org SVN changeset; no public exploit or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in the CleanTalk Spam Protection, Honeypot, Anti-Spam WordPress plugin (all versions through 6.86) allows injection of arbitrary JavaScript via unescaped aria-label attributes rendered from comment content by the plugin's ContactsEncoder component. The unauthenticated comment submission path makes the payload deliverable without credentials, though script execution is limited to non-logged-in visitors, and sites with comment moderation enabled require an administrator to approve the comment before it reaches other users. Version 6.87 contains the confirmed fix per WordPress SVN changeset 3677388; no public exploit code or CISA KEV entry is identified at time of analysis.
Stored Cross-Site Scripting in the iubenda All-in-one Compliance plugin for WordPress (all versions through 3.13.4) allows unauthenticated attackers to persist executable JavaScript in comment content that runs in the WordPress origin for any subsequent visitor, including logged-in administrators. The root cause is an interaction between the plugin's global strtr() substitution logic and WordPress's KSES allowlist: the substitution strips substrings from KSES-permitted tags (such as abbr title attributes and HTML comments), mutating what KSES treated as safe markup into executable elements like img onerror handlers. No public exploit has been identified at time of analysis, but a patched version (3.13.5) is available.
Stored Cross-Site Scripting in the iubenda All-in-one Compliance for GDPR/CCPA WordPress plugin (versions ≤3.13.4) allows unauthenticated attackers to inject persistent malicious scripts into pages via comment content processed through the AdSense regex rewrite path. The injected payload executes in any visiting user's browser, enabling session hijacking, credential theft, or malicious redirects. Exploitation is gated by a non-default parser engine configuration - sites running the newer DOM-based parser are not affected. Vendor-released patch 3.13.5 resolves the issue; no public exploit or KEV listing identified at time of analysis.
Remote code execution in the Hummingbird performance/caching plugin for WordPress (versions up to and including 3.21.0) lets unauthenticated attackers write arbitrary PHP into a web-accessible debug-log file and execute it with a single anonymous request. The plugin's protective '<?php die(); ?>' header is silently dropped due to a PHP namespace bug in a class_exists() check, and unsanitized cookie names are written straight into wp-content/wphb-logs/page-caching-log.php. Reported by Wordfence with no public exploit identified at time of analysis; exploitation depends on a non-default Debug Log configuration.
Authentication bypass in the InspireUI Mstore API plugin for WordPress (versions up to and including 4.20.0) lets unauthenticated attackers forge Firebase Phone Auth JWTs and impersonate any phone number. The FirebasePhoneAuthHelper::verify_id_token() function checks token claims (alg, kid, aud, iss) but never verifies the cryptographic signature against Google's public certificates, so an attacker can sign a token with their own RSA key and log into or create arbitrary WordPress accounts. Reported by Wordfence with a CVSS of 9.8; no public exploit identified at time of analysis and the plugin is not in CISA KEV.
Blind SQL injection in WooCommerce's Analytics Orders reporting allows high-privileged authenticated users to extract arbitrary database contents by injecting into the date column parameter used in order analytics queries. Affected are all WooCommerce installations running versions before 11.0. The vulnerability stems from the `woocommerce_date_type` option value and the `date_type` query argument being interpolated directly into SQL without allowlist validation, enabling exfiltration of customer PII, payment data, and credentials via time-based or boolean blind techniques. No public exploit identified at time of analysis, though Patchstack discovery typically precedes weaponization.
Cross-site scripting in the Quick Event Manager WordPress plugin (versions ≤ 9.17) allows unauthenticated remote attackers to inject malicious JavaScript into pages rendered for authenticated users. Exploitation requires a victim - typically a logged-in WordPress administrator or editor - to load a page or follow a crafted link carrying the payload, which then executes in their browser context with scope change beyond the plugin itself. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis.
Broken access control in Quick Event Manager WordPress plugin (≤9.17) allows unauthenticated remote attackers to perform unauthorized write operations against event management functions, achieving high integrity impact with no authentication required. CWE-862 (Missing Authorization) indicates the plugin omits capability checks on one or more endpoints or AJAX handlers before executing privileged actions. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Insecure Direct Object Reference (IDOR) in the WC Ukraine Shipping WordPress plugin versions 1.22.3 and earlier allows subscriber-level authenticated users to access and partially modify shipping and order objects belonging to other customers. Reported by Patchstack and classified CWE-639, the flaw arises from the plugin resolving shipping or order records via user-supplied identifiers without verifying the authenticated session owner is authorized to access that resource. With a CVSS 7.1 score carrying C:H/I:L impact, successful exploitation can expose customer PII, order histories, and shipping records; no public exploit or active exploitation has been identified at time of analysis.
PHP Object Injection in the eyecix JobSearch (wp-jobsearch) WordPress plugin allows remote attackers to inject crafted serialized PHP objects that are deserialized by the plugin, affecting all versions up to and including 3.2.0. Because the vector is unauthenticated (PR:N), any visitor can supply malicious input; if a suitable POP gadget chain is present in the plugin, WordPress core, or another installed plugin, this can escalate to arbitrary file operations, SQL injection, or remote code execution. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Privilege escalation in the Bricksforge WordPress plugin (versions <= 3.1.8.8) lets a low-privileged user elevate their account to higher-privileged roles, per a Patchstack advisory. The flaw (CWE-266, Incorrect Privilege Assignment) carries a CVSS of 9.8 with a network/no-auth vector, though the 'Subscriber Privilege Escalation' label implies a logged-in subscriber account is the realistic starting point. No public exploit code, KEV listing, or EPSS score was provided at time of analysis.
SQL injection in the GeoDirectory WordPress plugin (versions 2.8.174 and earlier) lets unauthenticated remote attackers inject SQL into backend database queries, per a Patchstack advisory. The flaw carries a CVSS of 9.3 driven largely by a scope-change assumption, and enables extraction of sensitive database contents (user credentials, secrets, PII). No public exploit code or active-exploitation evidence is identified at time of analysis.
Cross-site scripting in the BP Better Messages WordPress plugin (≤2.15.27) allows unauthenticated remote attackers to inject arbitrary JavaScript into pages viewed by authenticated users. The CVSS scope-change metric (S:C) indicates the injected payload can escape the plugin's execution context and affect the broader WordPress environment, enabling session hijacking, credential theft, or admin-level CSRF actions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Broken access control in the Agentimus AI SEO, llms.txt & MCP for AI Agents WordPress plugin (versions <= 1.51.0) allows any subscriber-level authenticated user to perform privileged administrative actions. The plugin fails to enforce capability checks on one or more endpoints, enabling low-privilege users to read or modify sensitive plugin data - including AI SEO configuration, llms.txt content, and MCP agent settings. No public exploit is identified at time of analysis, but the low authentication bar (subscriber registration is typically open on WordPress sites) makes this broadly exploitable wherever the plugin is installed.
Uncontrolled resource consumption in the Migrate Guru - Site Migration & Cloning WordPress plugin (versions 6.65 and earlier) exposes any WordPress installation running the plugin to remote denial of service by unauthenticated network attackers. The root cause (CWE-770) indicates that one or more plugin endpoints perform resource-intensive operations without adequate rate limiting or throttling, allowing an attacker to exhaust server capacity without supplying credentials. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated two-factor authentication bypass in the Really Simple SSL WordPress plugin (versions ≤9.8.0) allows a remote attacker to circumvent 2FA protections via an alternate authentication path (CWE-288), gaining unauthorized access to accounts with both confidentiality and integrity impact. The CVSS vector assigns AC:H, reflecting that exploitation requires specific conditions - most critically, the 2FA feature within the plugin must be actively enabled and configured on a target account. No public exploit code or CISA KEV listing has been identified at time of analysis, but Patchstack has published a database entry with technical details that may lower the barrier to exploitation.
Unauthenticated denial of service in MalCare Security WordPress plugin versions 6.69 and earlier allows any remote attacker with no credentials to exhaust server resources and take down affected WordPress sites. The vulnerability, rooted in CWE-770 (resource allocation without throttling), exposes a network-accessible plugin endpoint that can be abused to render the site unavailable. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this a straightforward target for automated abuse.
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.8 allows any authenticated user holding an Author-level role or above to assign themselves an arbitrary WordPress role, including Administrator, resulting in full site takeover. The plugin fails to enforce server-side authorization checks when creating membership plans and when users attach plans to their own accounts, permitting role manipulation that bypasses WordPress's native access-control hierarchy. A publicly available exploit exists via WPScan, and the CVSS 7.2 score understates real-world risk because the provided PR:H metric conflicts with the description's requirement of only Author-level access - a low-privilege role - suggesting a closer real-world base score of approximately 8.8.
Remote code execution is achievable in Tutor LMS WordPress plugin (≤4.0.7) via a PHP Object Injection flaw in the withdrawal account AJAX handler that exploits a subtle interaction between `esc_sql()` percent-escaping and PHP serialized string-length declarations. Authenticated attackers with subscriber-level access — or unauthenticated attackers on sites with user registration enabled, the typical eLearning configuration — can inject an arbitrary serialized object stream and trigger the well-documented `GuzzleHttp\Cookie\FileCookieJar` POP chain to write a webshell to an attacker-specified path. No public exploit or KEV listing is confirmed at time of analysis, but a fix changeset is available and the POP chain is reliably reachable due to the plugin's bundled PayPal Composer autoloader.
Remote code execution in The Events Calendar WordPress plugin (StellarWP) through version 6.17.3 lets unauthenticated attackers run arbitrary PHP on the server by abusing Element_Classes::parse_array(). A plain-array widget 'classes' payload evades the is_safe_widget_instance() object check and reaches a callable-invocation sink; the chain fires when do_blocks() renders a single-event page whose comment area contains a crafted wp:legacy-widget block. Reported by Wordfence with a 9.8 CVSS; no public exploit identified at time of analysis, and the flaw is only reachable on sites that enable comments on tribe_events posts.
Remote code execution in The Events Calendar plugin for WordPress (StellarWP) affects all versions up to and including 6.17.4, allowing unauthenticated attackers to run arbitrary PHP on the server via unsafe deserialization. The is_safe_widget_instance guard is bypassed because PHP fires magic methods during pre-parse and enable_rendering_widget_copied() forges a valid wp_hash integrity attribute before unserialize() executes; the malicious block markup reaches the sink through the V2 single-event template running do_blocks() over buffered comment HTML. Reported by Wordfence with a CVSS of 9.8; no public exploit identified at time of analysis, though the vulnerability is well-documented with pinpointed source-line references.
Local file inclusion and remote code execution in GEO my WP WordPress plugin (≤4.5.5.3) allow unauthenticated attackers to include arbitrary PHP files via the `gmw_posts_locator_ajax_info_window_loader` AJAX handler, which accepted attacker-controlled template paths and passed them to a PHP `require` statement without adequate allowlist enforcement. At minimum this exposes sensitive PHP files such as wp-config.php; when PEAR is installed with `register_argc_argv` enabled, attackers can leverage pearcmd.php to write and execute arbitrary PHP code, achieving full unauthenticated RCE. No public exploit has been identified at time of analysis, though the Wordfence advisory and vulnerable source code are publicly available, substantially reducing the development effort for a proof-of-concept.
Time-based blind SQL injection in rtMedia for WordPress, BuddyPress and bbPress (all versions through 4.7.11) enables unauthenticated remote attackers to exfiltrate arbitrary data from the WordPress database. The flaw stems from RTMediaQuery::query() merging raw $_REQUEST input into internal query parameters while only validating top-level array keys, allowing the nested 'compare' subvalue to bypass input validation and reach an unparameterized SQL sink. Exploitation requires only that a public-facing page exist with an rtMedia shortcode present - no authentication, interaction, or special server configuration is needed. No public exploit code or CISA KEV listing was identified at time of analysis.
Missing authorization in the Master Addons for Elementor WordPress plugin (≤3.2.2) by Pixar Labs enables privilege abuse by authenticated low-privileged users. The CVSS vector (PR:L/C:N/I:L/A:H) indicates that a subscriber-level or similarly low-privileged WordPress account is sufficient to trigger operations with high availability impact - likely destructive actions such as resetting plugin settings, deleting content blocks, or disrupting site functionality - while retaining limited integrity modification capability. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
SQL injection in the Amelia WordPress booking plugin (versions ≤ 2.4.9) allows authenticated Editor-role users to exfiltrate data from the underlying database via crafted queries. The vulnerability is scoped-changed, meaning successful exploitation reaches beyond the plugin component to the WordPress database. Reported by Patchstack; no public exploit code or CISA KEV listing identified at time of analysis.
SQL injection in Sky Addons for Elementor (WordPress plugin by wowdevs) versions 3.8.4 and earlier allows authenticated attackers with Editor-level WordPress privileges to query the underlying database beyond the plugin's normal scope, achieving high confidentiality impact. The scope-changed CVSS vector (S:C) indicates the injection can reach data outside the plugin's own tables - including sensitive WordPress core tables - making this an information-disclosure-focused SQLi. No public exploit code or active exploitation has been identified at time of analysis.
PHP Object Injection in the Masteriyo LMS WordPress plugin (versions <= 3.4.0) allows remote attackers to inject a crafted serialized PHP payload, potentially enabling arbitrary code execution via a PHP gadget chain present in the environment. The vulnerability is described as unauthenticated in the Patchstack disclosure title, though the supplied CVSS vector specifies PR:L - a discrepancy that materially affects real-world risk assessment and requires vendor clarification. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the SMS Alert Order Notifications WordPress plugin (versions ≤ 3.9.9) allows any authenticated subscriber - the lowest standard WordPress role - to elevate their account privileges, potentially gaining full administrative control over the affected site. The CVSS 8.8 score with PR:L confirms that only a low-privileged account is required, making exploitation accessible to any registered user on the platform. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Unauthenticated PHP Object Injection in the ThemeREX Addons (trx_addons) WordPress plugin before 2.45.0 lets remote attackers inject arbitrary serialized PHP objects into the application. Because no authentication is required (CVSS 9.8, PR:N/UI:N), an attacker can supply crafted serialized data to a vulnerable entry point; when combined with a suitable POP gadget chain present in the plugin, another plugin, a theme, or WordPress core, this can escalate to code execution, arbitrary file operations, or data compromise. Reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated PHP Object Injection affects the Everest Forms WordPress plugin (wpeverest) in all versions up to and including 3.6.0, allowing remote attackers to pass attacker-controlled serialized data into a PHP unserialize() call. If a suitable POP (property-oriented programming) gadget chain is present in the plugin, an installed theme, or WordPress core, this can escalate to arbitrary file operations, SQL injection, or remote code execution. Reported by Patchstack; no public exploit identified at time of analysis, and no EPSS or KEV signal was provided.
Privilege escalation in the Gato GraphQL WordPress plugin (versions ≤ 19.2.3) allows authenticated subscribers - the lowest registered-user role in WordPress - to elevate their access beyond their assigned privileges. The root cause is CWE-266 (Incorrect Privilege Assignment), where the plugin's GraphQL endpoint handling fails to properly gate privileged operations against low-privilege requestors. No confirmed active exploitation or public POC is identified at time of analysis, but the trivially low access bar of a subscriber account combined with full CIA impact makes this a high-priority finding for any WordPress installation running this plugin.
Stored Cross-Site Scripting in the Kirki - Freeform Page Builder, Website Builder & Customizer WordPress plugin (all versions through 6.2.0) allows unauthenticated attackers to permanently embed malicious JavaScript into pages via the unsanitized 'comment' parameter. Injected payloads persist in the database and execute in every subsequent visitor's browser session, enabling session hijacking, credential theft, or privilege escalation against logged-in administrators who view the affected pages. No public exploit or CISA KEV listing has been identified at time of analysis, but the unauthenticated write vector makes mass-exploitation trivially automatable across unpatched WordPress installations.
Arbitrary file deletion in UsersWP ≤ 1.2.70 for WordPress allows authenticated Subscriber-level users to delete any file on the server - including wp-config.php - via a path traversal bypass in the upload_file_remove() AJAX handler. The exploit exploits a two-phase validation failure: validate_file() only rejects literal '../' sequences, but the uwp_get_file_relative_url() helper later performs a global str_replace() that collapses crafted embedded tokens into directory traversal sequences after the final validation gate, with the result passed directly to wp_delete_file() without canonical containment. No public exploit code or CISA KEV listing is confirmed at time of analysis; however, the low privilege requirement and precise Wordfence source-level write-up substantially reduce the research barrier for threat actors.
Stored cross-site scripting in the Vigilant WordPress security plugin (all versions ≤2.10.2) lets an unauthenticated attacker permanently inject malicious scripts by supplying a crafted User-Agent header during any failed login attempt, after which the payload persists in the plugin's login-security log. The script executes automatically in the browser of any administrator who subsequently reviews the login events dashboard, enabling session hijacking or administrative account takeover without further attacker involvement. No public exploit code or CISA KEV listing has been identified at time of analysis, but the passive, zero-interaction delivery path lowers the bar for exploitation considerably.
Unauthenticated arbitrary file upload in the MIPL Grouped Checkout Fields for WooCommerce WordPress plugin (all versions through 1.2.1) lets remote attackers write arbitrary files to the server because the mipl_wc_upload_file function performs no file-type validation, which may escalate to remote code execution. Any WooCommerce store running this plugin is exposed to pre-authentication compromise. Reported by Wordfence; no public exploit identified at time of analysis and the plugin's real-world footprint appears small.
Unauthenticated SQL injection in the Unlimited Elements For Elementor WordPress plugin (versions ≤2.0.16) allows remote attackers to extract sensitive data from the WordPress database without any credentials. The flaw exists in getWhereString() where the 'addontype' parameter, when submitted as an array, has its first element injected verbatim as the SQL comparison operator into the WHERE clause; the companion normalizeAjaxInputData() method strips WordPress's built-in magic_quotes protection, eliminating the last layer of defense. No public exploit or KEV listing has been identified at time of analysis, but the unauthenticated network attack path and confirmed Wordfence disclosure make this a credible priority for sites running the affected plugin.
Stored XSS in the Simple Ajax Chat WordPress plugin (all versions ≤ 20260811) allows fully unauthenticated remote attackers to inject persistent JavaScript payloads that execute in every visitor's browser on every page load. The vulnerability is compounded by a nonce bypass: the WordPress nonce normally used to authenticate chat submissions is rendered in the public chat page DOM, enabling any anonymous attacker to extract and reuse it without logging in. No public exploit or CISA KEV listing has been identified at time of analysis.
SQL injection in the Sticky Chat Widget WordPress plugin (versions ≤1.4.2) allows unauthenticated remote attackers to extract sensitive data from the underlying WordPress database via the scw_save_form_data AJAX action. Three compounding weaknesses enable exploitation: $wpdb->insert() wraps column identifiers in unescaped backticks, PHP's filter_input() retrieves raw POST data bypassing WordPress's wp_magic_quotes() sanitization, and a widget_id validation loop that is never executed when no valid widget_id is supplied leaves the $isValid flag at its initialized true value. No public exploit has been confirmed at time of analysis, but the publicly accessible unauthenticated AJAX endpoint makes this mechanically straightforward to exploit against any site running the affected plugin.
Stored Cross-Site Scripting in the WP Photo Album Plus WordPress plugin (all versions through 9.2.08.003) allows unauthenticated remote attackers to permanently inject arbitrary JavaScript into pages served to other users. The vulnerability exists because the plugin's AJAX logging path - triggered via the unauthenticated wp_ajax_nopriv_wppa endpoint - records the attacker-supplied HTTP X-Forwarded-For header value directly to disk through wppa_log() without sanitization, then later renders that stored value without output escaping. No public exploit or KEV listing has been identified at time of analysis, but the technique (header spoofing against a nopriv AJAX endpoint) is trivially automatable.
Path traversal in AcyMailing WordPress plugin (all versions through 11.0.4) exposes arbitrary server files to unauthenticated remote attackers via the unsanitized `user[name]` parameter. Exploitation is gated on the 'Embed images' configuration option being enabled, but when active, an attacker can read sensitive server-side files including WordPress configuration, credentials, and other data without any authentication. Wordfence reported this flaw and a patch commit is available in the WordPress plugin repository. No public exploit or active exploitation has been identified at time of analysis.
Broken access control in the WP Fast Total Search WordPress plugin (versions ≤ 1.82.284) exposes restricted data to unauthenticated remote attackers via missing authorization checks (CWE-862). The Epsiloncool plugin fails to verify requester permissions on one or more endpoints, allowing network-accessible exploitation with no credentials or user interaction - reflected in a CVSS 7.5 High score with C:H/I:N/A:N impact. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make automated discovery straightforward.
Unauthenticated Cross-Site Scripting (XSS) in the WPAdverts WordPress plugin affects all versions through 2.3.3, allowing a remote attacker without any credentials to inject malicious JavaScript into pages served by the plugin. With user interaction (UI:R), a victim - likely a logged-in site administrator - must visit or trigger the vulnerable endpoint for the payload to execute in their browser context. Successful exploitation can lead to session hijacking, unauthorized administrative actions, or content manipulation via the changed-scope (S:C) browser execution context. No public exploit or KEV listing has been identified at time of analysis.
Unauthenticated cross-site scripting in the WPCS WordPress currency switcher plugin (versions ≤ 1.3.2) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in victims' browsers without any server-side privileges. The CVSS Scope:Changed metric confirms the injected payload escapes the plugin's own security context, enabling session theft, credential harvesting, or admin-level action execution on behalf of a tricked user. No public exploit or CISA KEV listing has been identified at time of analysis, though the unauthenticated nature lowers the bar for exploitation significantly.
Unauthenticated privilege escalation in the SiteSkite WordPress plugin (versions ≤ 2.1.5) allows a remote attacker to gain elevated privileges within a WordPress installation without any authentication. The vulnerability is classified under CWE-266 (Incorrect Privilege Assignment), meaning the plugin incorrectly grants elevated roles or capabilities during some reachable code path. With full C:H/I:H/A:H impact and PR:N, successful exploitation results in complete compromise of the affected WordPress site, though AC:H signals a non-trivial exploitation condition such as a race condition, specific request sequence, or timing-dependent logic.
Unauthenticated sensitive data exposure in the ZHBackup - Backup, Restore & Migration WordPress plugin (versions <= 2.4.2) permits remote attackers to access protected backup archives without any credentials or user interaction. Classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), the flaw likely exposes backup archives containing database dumps, WordPress configuration data, password hashes, and secret keys - artifacts that enable full site takeover if retrieved. No public exploit code has been identified at time of analysis, and the CVE has not been added to the CISA KEV catalog.
Remote code execution in the RepairBuddy WordPress plugin (versions <= 4.1224) is reachable by authenticated users holding only subscriber-level privileges - the lowest WordPress role - via a code injection flaw (CWE-94). A subscriber can send a crafted network request to trigger server-side code execution, achieving full confidentiality, integrity, and availability compromise of the WordPress host. No public exploit or KEV listing has been identified at time of analysis, but Patchstack has disclosed the vulnerability with a dedicated advisory.
Missing authorization in the WP-Stateless WordPress plugin (versions up to and including 4.4.1) allows authenticated subscriber-level users to modify plugin settings they should have no access to. WP-Stateless manages Google Cloud Storage offloading for WordPress media; unauthorized settings changes by a low-privileged user can corrupt the GCS integration, break media delivery, or reconfigure the storage bucket in ways that degrade site availability. No public exploit code has been identified at time of analysis, though the Patchstack advisory confirms the vulnerability.
SQL injection in the Verified Reviews (Avis Vérifiés) WordPress plugin (slug 'netreviews') affects all versions up to and including 2.4.6, allowing unauthenticated remote attackers to inject arbitrary SQL into backend queries. Per the CVSS vector (PR:N, S:C), no login is required and the impact crosses into the underlying WordPress database, enabling extraction of sensitive data such as user credentials and secrets. No public exploit has been identified at time of analysis, though Patchstack has published the vulnerability record.
Broken access control in the Return Refund and Exchange For WooCommerce WordPress plugin by WP Swings (versions ≤ 4.6.4) exposes privileged refund, return, or exchange management operations to unauthenticated remote attackers. The CVSS vector (PR:N/I:H) confirms that no authentication is required and that the integrity impact is high, consistent with CWE-862 (Missing Authorization) - meaning the plugin registers AJAX hooks or REST API routes without verifying WordPress user capabilities before executing write operations. No public exploit or active exploitation has been confirmed at time of analysis.
Broken authentication in the WP Travel WordPress plugin (versions ≤ 12.0.3) exposes protected plugin functionality to unauthenticated remote attackers via an alternate path or channel, satisfying CWE-288. Exploitation requires no credentials and no user interaction, making it accessible to any network-reachable attacker against a default plugin installation. The CVSS 7.3 vector indicates partial confidentiality, integrity, and availability impact, suggesting an attacker can read and modify travel booking data or disrupt plugin operations without logging in. No public exploit code or active exploitation has been confirmed at time of analysis.
Unauthenticated cross-site scripting in the Page Visits Counter - Lite WordPress plugin (versions ≤ 1.2.3) allows a remote, unauthenticated attacker to inject malicious JavaScript that executes in the browser context of a visiting user. Because CVSS marks scope as Changed (S:C), the injected script can escape the plugin's own context and affect the broader WordPress page environment, enabling session hijacking, credential theft, or malicious redirects. No public exploit or CISA KEV listing has been identified at time of analysis; the issue was disclosed by Patchstack.
Broken access control in Shirt Product Designer for WooCommerce plugin version 1.0.4 exposes WordPress/WooCommerce stores to unauthenticated data modification. The CVSS vector (PR:N, AC:L, AV:N, UI:N) confirms that a remote attacker with no credentials or user interaction can invoke privileged plugin functionality, achieving high integrity impact against store product or configuration data. No public exploit code has been identified at time of analysis, and Patchstack is the sole reporting source.
Unauthenticated arbitrary file deletion in the Advanced Product Fields Extended for WooCommerce WordPress plugin (versions <= 3.1.6) allows remote attackers to delete any file accessible to the web server process via a path traversal flaw. The scope-changed CVSS vector (S:C) reflects that an attacker can reach beyond the plugin's own file space - targeting WordPress core files such as wp-config.php, .htaccess, or even server-level configuration - resulting in complete site takedown or broader server disruption. Patchstack reported this vulnerability; no public exploit code or CISA KEV listing has been identified at time of analysis.
Broken access control in the VillaTheme Thank You Page Customizer for WooCommerce plugin (all versions through 1.2.2) exposes WooCommerce order data to unauthenticated remote attackers. The missing authorization check (CWE-862) on one or more plugin endpoints allows any network-reachable party to retrieve order-associated confidential data without credentials, consistent with the CVSS C:H/PR:N/UI:N vector reported by Patchstack. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated PHP Object Injection in Wise Chat WordPress plugin versions up to and including 3.4 allows a remote attacker to achieve high-impact compromise of confidentiality, integrity, and availability by passing crafted serialized data to an unprotected deserialization point. Exploitation requires a viable POP gadget chain within the target WordPress environment, keeping the practical bar elevated despite requiring no credentials. No KEV listing or public POC has been identified at time of analysis.
Subscriber-level broken authentication in the MailMunch - Grow your Email List WordPress plugin (versions ≤ 3.2.5) enables low-privileged authenticated users to bypass authentication controls, causing integrity and availability impacts on affected WordPress installations. The vulnerability is classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and reported by Patchstack, indicating a pathway or channel that circumvents the intended authentication mechanism. No public exploit code or active exploitation has been identified at time of analysis, though the network-accessible, low-complexity attack vector lowers the bar for abuse.
Unauthenticated arbitrary file read in the Direct Download for WooCommerce WordPress plugin (all versions ≤1.19) allows any remote attacker to retrieve the contents of any file accessible to the web server process — including wp-config.php, database credentials, and server-side secrets. The root flaw is a fatally incomplete authorization check in the plugin's top-level include handler (direct-download.php): it confirms only that some free, virtual, downloadable product exists anywhere on the site, without validating that the requested file path is one of that product's configured download assets. No public exploit has been identified at time of analysis, but the exploitation logic is straightforward and the prerequisite is met by the majority of WooCommerce stores offering free resources.
Stored XSS in the Sidebar Manager Light WordPress plugin (all versions through 1.18) allows unauthenticated attackers to permanently inject malicious JavaScript via the `sbm_description` parameter into pages served to any site visitor. The scope-changed impact means attacker-controlled scripts execute within victims' browsers rather than solely the plugin's own context, enabling session hijacking, credential phishing, or drive-by malware delivery. No public exploit code has been identified at time of analysis, and the plugin's limited deployment footprint constrains real-world exposure.
Privilege escalation in the Bulk Password Reset WordPress plugin (all versions ≤1.3.3) allows any authenticated subscriber-level user to perform a full administrative account takeover. The plugin fails to validate the requesting user's identity before permitting bulk password changes and email-address updates, meaning an attacker can redirect an administrator's email to an attacker-controlled address, then invoke the standard WordPress password-reset flow to obtain reset credentials for that admin account. No public exploit code has been identified at time of analysis, but source code references from WordPress Plugin Trac directly expose the vulnerable functions at lines 44, 594, 659, and 679 of bulk_password_reset.php.
Remote code execution in the Drag and Drop File Upload for Elementor Forms WordPress plugin (versions up to and including 1.6.0) allows unauthenticated attackers to upload executable PHP files through the elementor_file_upload handler. The is_file_type_valid() function trusts an attacker-controlled 'type' parameter as regex keys in its MIME allowlist, so a crafted extension bypasses the intended blacklist and is subsequently normalized to a .php extension by sanitize_file_name(). Reported by Wordfence with a CVSS of 9.8; no public exploit identified at time of analysis, but the unauthenticated network-facing RCE makes this a high-priority patch.
Stored cross-site scripting in the WPLP Cookie Consent WordPress plugin (all versions ≤ 4.4.1) enables any unauthenticated site visitor to inject persistent malicious scripts via the `wpl_user_preference` AJAX parameter. The consent-logging endpoint is registered without authentication requirements, and the protective nonce (`wpl_consent_logging_nonce`) is publicly broadcast to every page visitor via `wp_localize_script()`, rendering the nonce mechanism entirely ineffective as an access barrier. Injected payloads execute in the browsers of administrators or users who subsequently view pages rendering consent log data, enabling session hijacking, credential theft, or full administrative account takeover. No public exploit is identified at time of analysis and the CVE is not listed in CISA KEV, but the trivially low exploitation barrier warrants prompt patching.
Authentication bypass in the shared wp-module-data module (bundled across four Newfold WordPress plugins) allows unauthenticated remote attackers to gain full administrator-level access to any affected WordPress site that lacks a stored Hiive connection token. The defect degenerates the HMAC-style Bearer token verification into a trivially forgeable computation: when the stored connection token is absent, PHP coerces `strrev(false)` to `strrev('')`, reducing the secret salt to the publicly known SHA-256 empty-string hash `e3b0c44...`, while all remaining inputs (HTTP method, URL, body, and the attacker-supplied X-Timestamp header) are fully attacker-controlled, enabling offline token pre-computation. No public exploit code has been confirmed and the vulnerability is not listed in CISA KEV at time of analysis, but full technical details including source code references are publicly disclosed by Wordfence, substantially lowering the barrier to exploitation.
Privilege escalation in PublishPress Capabilities WordPress plugin (all versions ≤2.50.0) allows authenticated Editor-level users to elevate to site-wide capability managers without administrator consent. The root cause is a hard-coded role assignment in `addPluginCapabilities()` that unconditionally grants the Editor role all 15 `manage_capabilities_*` capabilities on the first `admin_init` hook after plugin activation, writing the grants persistently to the WordPress database. Once escalated, an Editor can create, rename, and delete non-system roles; modify capabilities of non-administrator roles; restore role backups; and write arbitrary plugin options under several namespaced prefixes - stopping short of full Administrator access only because WordPress's `map_meta_cap` layer blocks further escalation. No public exploit or CISA KEV listing identified at time of analysis.
Authentication bypass in the Next-Cart Store to WooCommerce Migration WordPress plugin (all versions ≤ 3.9.8) allows unauthenticated remote attackers to reach privileged migration endpoints and achieve full site takeover via arbitrary SQL execution and arbitrary file deletion. The root cause is a double design flaw: the `/wp-json/next_cart/v1/migration` REST route is registered with `permission_callback` set to `__return_true` (granting unrestricted access to all callers), and the token check falls back to the hardcoded literal `__token__` via `get_option('nextcart_token', '__token__')` whenever the database option has never been written. Once past the token check, attackers pass attacker-controlled SQL directly to `$wpdb->query()` and `$wpdb->get_results()` - enabling administrator account creation - and pass an attacker-controlled path to `unlink()`, enabling arbitrary file deletion. No public exploit or CISA KEV listing has been identified at time of analysis, though source code confirming the flaw is publicly visible in the WordPress plugin SVN repository.
Stored Cross-Site Scripting in the WPBot AI ChatBot WordPress plugin (QuantumCloud, all versions through 8.7.3) allows unauthenticated remote attackers to inject persistent JavaScript into pages viewed by site users and administrators. The critical design flaw is that the only access gate - a WordPress nonce - is rendered useless because it is embedded in every public-facing page via wp_localize_script, making it fully readable by any visitor. No public exploit code has been identified at time of analysis, but the low attack complexity and zero-authentication requirement make this a straightforward exploitation path for opportunistic attackers targeting WordPress sites.
Stored Cross-Site Scripting in the Repeater Fields for Gravity Forms WordPress plugin (all versions ≤3.0.4) allows unauthenticated attackers to inject arbitrary JavaScript into pages via multi-input sub-field types (Name, Address, Checkbox) within a repeater block, executing whenever any user views the affected page. The flaw is isolated to complex sub-field types because scalar single-input fields were patched with esc_html() output escaping in 3.0.4, leaving multi-input composite fields unprotected. Discovered and reported by Wordfence; no public exploit identified at time of analysis, though the vulnerability requires no authentication or special site configuration to abuse via a publicly accessible Gravity Form.
WP EasyCart (Shopping Cart & eCommerce Store) versions up to and including 5.9.3 exposes a privilege escalation path allowing authenticated Store Manager-level users to promote themselves to WordPress administrator. The `ec_ajax_save_page_default_options()` AJAX handler accepts arbitrary POST parameters and writes them directly to the WordPress options table via `update_option()` without any allowlist, while its nonce is embedded in frontend product and category templates accessible to any user holding the plugin's custom 'wpec_manager' capability. No public exploit code has been identified at time of analysis, but the attack technique is mechanically straightforward and requires only a Store Manager credential to execute.
Local File Inclusion in the Eventin WordPress event management plugin (versions ≤4.1.22) allows authenticated contributors to include and execute arbitrary PHP files on the server via the unsanitized 'event_layout' parameter, achieving full remote code execution. The etn_manage_event capability is assigned to WordPress Contributors by default, meaning any registered Contributor can set the malicious parameter value through the REST API without any site-specific configuration change. Exploitation requires a PHP file to already be present on the server, reflected in the AC:H CVSS rating; no public exploit or CISA KEV listing has been identified at time of analysis.
Local File Inclusion in the Eventin Event Calendar WordPress plugin (all versions through 4.1.22) allows authenticated attackers with custom-level WordPress access to include and execute arbitrary PHP files by supplying a crafted path via the unsanitized `event_layout` parameter in the plugin's event template and REST API endpoints. Successful code execution requires the attacker to first place a PHP file on the server - a two-stage exploit chain reflected in the CVSS AC:H rating. No public exploit code or CISA KEV listing has been identified at time of analysis; Wordfence reported this with direct source code line references, indicating the attack surface is well-documented.
Remote code execution in FireBox - WooCommerce Popup Builder (all versions ≤ 3.1.10) allows authenticated Author-level attackers to execute arbitrary PHP on the server by injecting unsanitized PHP expressions into campaign condition rules via the `firebox_meta` REST endpoint. The plugin's `Executer::allowedToRun()` blacklist (Executer.php L231) uses a trivially bypassable regex that permits WordPress core functions such as `wp_insert_user`, `update_option`, and `file_put_contents`, which the `value` function in the PHP Conditions class then evaluates directly. Critically, sites migrated from any version prior to 3.1.10 are automatically subjected to `Migrator::preserveCampaignRoleAccess()`, which grants Author-role users `edit_fireboxes` and `publish_fireboxes` capabilities, making exploitation reachable from any registered Author account with no further privilege requirements. No public exploit code or CISA KEV listing has been confirmed at time of analysis.
Stored Cross-Site Scripting in the Contact Form to DB by BestWebSoft WordPress plugin (versions ≤1.7.5) allows unauthenticated attackers to compromise administrator sessions via a malicious contact form submission. The `cntctfrm_contact_dropdown` parameter lacks input sanitization and output escaping, so injected JavaScript persists in the plugin's message store and executes automatically in the admin's browser context when they navigate to the message manager page at `/wp-admin/admin.php?page=cntctfrmtdb_manager`. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-prerequisite submission path make this trivially weaponizable against any site with the plugin installed.
Unauthenticated payment credential hijacking in the Event Tickets and Registration WordPress plugin (StellarWP, all versions ≤5.27.4) allows any remote attacker to silently replace the site's Stripe merchant account credentials - access tokens, publishable keys, and account ID - via a missing capability check on the plugin's Stripe OAuth return endpoint. Once the attacker's own Stripe credentials are stored, all subsequent ticket purchases by legitimate customers are processed into the attacker's account with no visible indication to the buyer or site administrator. No public exploit has been identified at time of analysis, but the fully unauthenticated AV:N/AC:L/PR:N attack surface makes opportunistic mass exploitation straightforward.
PHP Object Injection in the Live Composer - Free WordPress Website Builder plugin (all versions ≤ 2.1.18) enables authenticated attackers with contributor-level access to inject arbitrary PHP objects via deserialization in the plugin's downloads module. Real-world impact is entirely conditional on whether a Property-Oriented Programming (POP) chain is present in a co-installed plugin or theme; without one, exploitation produces no tangible effect. When a POP chain is available, consequences can include arbitrary file deletion, sensitive data extraction, or remote code execution. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Server-Side Request Forgery in the Hide My WP Ghost WordPress plugin (all versions through 7.0.09) allows unauthenticated remote attackers to induce the WordPress server to issue arbitrary HTTP requests to internal or external hosts. Reported by Patchstack under EUVD-2026-72652, the vulnerability carries a CVSS 7.2 with scope change (S:C), meaning successful exploitation can affect infrastructure beyond the WordPress host itself - including cloud metadata endpoints or internal network services. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated HTTP Denial of Service in WooCommerce (all versions before 11.1.0) allows remote attackers to exhaust server resources without any credentials, rendering affected storefronts and admin panels unavailable. The root cause is CWE-770 - missing throttling or resource allocation limits on one or more HTTP-accessible endpoints within the plugin. Patchstack reported the issue and a patched release (11.1.0) is available; no active exploitation or public proof-of-concept code has been identified at time of analysis.
Missing authorization in the Unbounce Landing Pages WordPress plugin (≤1.1.4) allows authenticated low-privilege users to exploit incorrectly configured access control, resulting in high availability impact and limited integrity modification. The CVSS vector (PR:L, A:H, I:L) indicates that a logged-in WordPress user with minimal permissions can invoke plugin actions without proper capability checks - most likely disrupting or deleting landing page content. No public exploit code or CISA KEV listing exists at time of analysis.
Missing authorization in the Hungarian WooCommerce pickup-points and shipping-labels plugin (versions before 4.2.8) allows unauthenticated remote attackers to perform actions that should be restricted to authorized users, resulting in high-integrity impact against affected WooCommerce stores. The flaw, classified as CWE-862 (Missing Authorization), means the plugin fails to verify whether the requesting party has the right to perform privileged operations - distinct from authentication failure. No public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based cross-site scripting in the Easy Appointments WordPress plugin (all versions through 4.0.2.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victim browsers by delivering a crafted URL. The CVSS scope-change metric (S:C) indicates injected scripts execute within the broader WordPress page context, enabling session hijacking, credential theft, or unauthorized actions on behalf of administrators or site visitors. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated Cross-Site Scripting in the Open User Map WordPress plugin (versions <= 1.4.50) allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in the browser context of visiting users. The scope-changed CVSS vector (S:C) indicates the injected script executes outside the plugin's own trust boundary, enabling session hijacking, credential theft, or malicious redirects against authenticated site visitors. No public exploit code or active exploitation has been identified at time of analysis, but the unauthenticated nature and WordPress plugin attack surface make this a realistic target for opportunistic actors.
Unauthenticated reflected cross-site scripting in the JetFormBuilder WordPress plugin (Crocoblock) affects all versions through 3.6.5.1, allowing a remote attacker to inject and execute arbitrary JavaScript in a victim's browser session. The CVSS vector (PR:N/UI:R/S:C) confirms no authentication is needed to craft a malicious payload, but exploitation requires social engineering to lure a logged-in user into clicking a crafted URL. No public exploit code or CISA KEV listing is identified at time of analysis, though the plugin's wide deployment in WordPress form-building workflows elevates the realistic exposure surface.
Cross-site scripting in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) versions up to and including 2.0.17 allows unauthenticated attackers to inject malicious scripts that execute in the browser context of site visitors or privileged WordPress users. The CVSS 7.1 rating reflects a scope change (S:C), meaning the injected payload escapes the plugin's own origin and can compromise administrator browser sessions. No public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in the User Profile Builder WordPress plugin (Cozmoslabs, versions ≤3.15.7) permits unauthenticated attackers to inject persistent JavaScript payloads via the 'Biographical Info' registration field, which execute in any visitor's browser upon viewing the affected profile page. The vulnerability is rooted in missing input sanitization and output escaping in class-formbuilder.php and class-email-confirmation.php, enabling session hijacking, credential theft, or malicious redirects targeting administrators and other authenticated users. A patch is confirmed via WordPress.org SVN changeset 3511465; no public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated account takeover in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.12) lets remote attackers overwrite any user's email address - including an administrator's - and then hijack the account via WordPress's built-in password-reset flow. The flaw stems from a missing capability check in pre_update_value combined with an authorization gate that is silently bypassed when a non-numeric post identifier (e.g. 'user_1') is supplied. Reported by Wordfence; no public exploit code or CISA KEV listing was identified at time of analysis, but the trivial, unauthenticated nature makes this a high-priority patch.
Authentication bypass in HivePress Authentication plugin for WordPress (≤1.1.4) allows an unauthenticated network attacker to log in as any WordPress user - including administrators - whose account email is linked to a Facebook account. The plugin's Facebook OAuth handler forwards the caller-supplied access_token directly to the Facebook Graph API and blindly trusts the returned email and user ID, performing no /debug_token audience validation and no comparison of the token's app_id against the configured hp_facebook_app_id. Exploitation requires the attacker to first acquire a valid Facebook access token associated with the victim's account, which is the primary complexity barrier - but once obtained, the attack yields full account takeover with no WordPress credentials required. No public exploit or CISA KEV listing has been identified at the time of analysis.
Remote code execution in the Mail Mint WordPress plugin (by getwpfunnels) affects all versions up to and including 1.31.0, where the 'handle_form_submission' function deserializes untrusted, attacker-supplied input (CWE-502). Because a usable POP (property-oriented programming) gadget chain is present in the plugin's bundled code, unauthenticated attackers can move from PHP Object Injection to arbitrary code execution on the server. The vendor only partially addressed the flaw in 1.23.1, meaning early-'fixed' installs may remain exploitable; no public exploit has been identified at time of analysis, though Wordfence has documented the vulnerability.
Stored cross-site scripting in the Contact Form by Supsystic WordPress plugin (all versions ≤1.10.2) allows unauthenticated attackers to inject persistent malicious scripts via a spoofed IP address header. The exploit chain is notable for its two-stage unauthenticated entry: the plugin's `updateNonce` action is excluded from the permission-check list, granting any unauthenticated caller a valid WordPress nonce; that nonce is then used to submit a contact form with a crafted `X-Forwarded-For` value, which the plugin stores unsanitized and later renders in the admin contacts list. No public exploit has been identified at time of analysis and no KEV listing exists, but the Wordfence advisory includes direct source-code references to the vulnerable code paths.
Stored Cross-Site Scripting in the SureForms plugin for WordPress (all versions up to and including 2.12.2) permits unauthenticated form submitters to embed persistent malicious scripts by bypassing sanitization with entity-encoded payloads in text fields. The injected payload executes in any visitor's or administrator's browser when they load an affected page, enabling session hijacking, cookie theft, or page defacement across any WordPress site running the vulnerable plugin version. Wordfence reported the issue and a fix was released in version 2.12.3.
PHP Object Injection in the Welcart e-Commerce WordPress plugin (all versions ≤ 2.12.1) enables unauthenticated attackers to inject a serialized POP-chain payload as order metadata during a public checkout, then trigger deserialization through the unprotected Telecom EDY payment callback. Exploitation via a bundled TCPDF POP chain can delete arbitrary server files - including wp-config.php - and culminates in full remote code execution when the attacker re-runs the WordPress installer against an attacker-controlled database. Successful file deletion requires an administrator to print an order invoice, captured by UI:R in the CVSS vector; no public exploit or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in W3 Total Cache (WordPress plugin) versions up to and including 2.10.5 allows unauthenticated attackers to inject arbitrary JavaScript via comment content processed by the LazyLoad Background Mutator. The flaw stems from insufficient sanitization and output escaping in UserExperience_LazyLoad_Mutator.php, specifically where comment text containing background-image CSS is mutated for lazy loading. Exploitation requires two non-default conditions: the Lazy Load Images feature with 'Process background images' enabled, and the malicious comment must be approved by a moderator before the payload executes against visiting users. A vendor-released patch is available in version 2.10.6.
Stored XSS with on-disk file write capability in the Ninja Forms WordPress plugin (versions ≤3.15.1) allows unauthenticated remote attackers to plant attacker-controlled HTML/JavaScript files anywhere in the web server's writable directory tree - including the site root - when the separately-installed Ninja Forms File Uploads add-on is active. The attack exploits a 'type' confusion flaw in Repeater child field processing: an unrecognized array key causes the submission pipeline to misroute input through the File Uploads handler, which writes raw attacker-supplied content to disk where it is subsequently served from the site's own origin. The fix is confirmed in version 3.15.2 via WordPress.org SVN changeset; no public exploit or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in the CleanTalk Spam Protection, Honeypot, Anti-Spam WordPress plugin (all versions through 6.86) allows injection of arbitrary JavaScript via unescaped aria-label attributes rendered from comment content by the plugin's ContactsEncoder component. The unauthenticated comment submission path makes the payload deliverable without credentials, though script execution is limited to non-logged-in visitors, and sites with comment moderation enabled require an administrator to approve the comment before it reaches other users. Version 6.87 contains the confirmed fix per WordPress SVN changeset 3677388; no public exploit code or CISA KEV entry is identified at time of analysis.
Stored Cross-Site Scripting in the iubenda All-in-one Compliance plugin for WordPress (all versions through 3.13.4) allows unauthenticated attackers to persist executable JavaScript in comment content that runs in the WordPress origin for any subsequent visitor, including logged-in administrators. The root cause is an interaction between the plugin's global strtr() substitution logic and WordPress's KSES allowlist: the substitution strips substrings from KSES-permitted tags (such as abbr title attributes and HTML comments), mutating what KSES treated as safe markup into executable elements like img onerror handlers. No public exploit has been identified at time of analysis, but a patched version (3.13.5) is available.
Stored Cross-Site Scripting in the iubenda All-in-one Compliance for GDPR/CCPA WordPress plugin (versions ≤3.13.4) allows unauthenticated attackers to inject persistent malicious scripts into pages via comment content processed through the AdSense regex rewrite path. The injected payload executes in any visiting user's browser, enabling session hijacking, credential theft, or malicious redirects. Exploitation is gated by a non-default parser engine configuration - sites running the newer DOM-based parser are not affected. Vendor-released patch 3.13.5 resolves the issue; no public exploit or KEV listing identified at time of analysis.
Remote code execution in the Hummingbird performance/caching plugin for WordPress (versions up to and including 3.21.0) lets unauthenticated attackers write arbitrary PHP into a web-accessible debug-log file and execute it with a single anonymous request. The plugin's protective '<?php die(); ?>' header is silently dropped due to a PHP namespace bug in a class_exists() check, and unsanitized cookie names are written straight into wp-content/wphb-logs/page-caching-log.php. Reported by Wordfence with no public exploit identified at time of analysis; exploitation depends on a non-default Debug Log configuration.
Authentication bypass in the InspireUI Mstore API plugin for WordPress (versions up to and including 4.20.0) lets unauthenticated attackers forge Firebase Phone Auth JWTs and impersonate any phone number. The FirebasePhoneAuthHelper::verify_id_token() function checks token claims (alg, kid, aud, iss) but never verifies the cryptographic signature against Google's public certificates, so an attacker can sign a token with their own RSA key and log into or create arbitrary WordPress accounts. Reported by Wordfence with a CVSS of 9.8; no public exploit identified at time of analysis and the plugin is not in CISA KEV.
Blind SQL injection in WooCommerce's Analytics Orders reporting allows high-privileged authenticated users to extract arbitrary database contents by injecting into the date column parameter used in order analytics queries. Affected are all WooCommerce installations running versions before 11.0. The vulnerability stems from the `woocommerce_date_type` option value and the `date_type` query argument being interpolated directly into SQL without allowlist validation, enabling exfiltration of customer PII, payment data, and credentials via time-based or boolean blind techniques. No public exploit identified at time of analysis, though Patchstack discovery typically precedes weaponization.
Cross-site scripting in the Quick Event Manager WordPress plugin (versions ≤ 9.17) allows unauthenticated remote attackers to inject malicious JavaScript into pages rendered for authenticated users. Exploitation requires a victim - typically a logged-in WordPress administrator or editor - to load a page or follow a crafted link carrying the payload, which then executes in their browser context with scope change beyond the plugin itself. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis.
Broken access control in Quick Event Manager WordPress plugin (≤9.17) allows unauthenticated remote attackers to perform unauthorized write operations against event management functions, achieving high integrity impact with no authentication required. CWE-862 (Missing Authorization) indicates the plugin omits capability checks on one or more endpoints or AJAX handlers before executing privileged actions. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Insecure Direct Object Reference (IDOR) in the WC Ukraine Shipping WordPress plugin versions 1.22.3 and earlier allows subscriber-level authenticated users to access and partially modify shipping and order objects belonging to other customers. Reported by Patchstack and classified CWE-639, the flaw arises from the plugin resolving shipping or order records via user-supplied identifiers without verifying the authenticated session owner is authorized to access that resource. With a CVSS 7.1 score carrying C:H/I:L impact, successful exploitation can expose customer PII, order histories, and shipping records; no public exploit or active exploitation has been identified at time of analysis.
PHP Object Injection in the eyecix JobSearch (wp-jobsearch) WordPress plugin allows remote attackers to inject crafted serialized PHP objects that are deserialized by the plugin, affecting all versions up to and including 3.2.0. Because the vector is unauthenticated (PR:N), any visitor can supply malicious input; if a suitable POP gadget chain is present in the plugin, WordPress core, or another installed plugin, this can escalate to arbitrary file operations, SQL injection, or remote code execution. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Privilege escalation in the Bricksforge WordPress plugin (versions <= 3.1.8.8) lets a low-privileged user elevate their account to higher-privileged roles, per a Patchstack advisory. The flaw (CWE-266, Incorrect Privilege Assignment) carries a CVSS of 9.8 with a network/no-auth vector, though the 'Subscriber Privilege Escalation' label implies a logged-in subscriber account is the realistic starting point. No public exploit code, KEV listing, or EPSS score was provided at time of analysis.
SQL injection in the GeoDirectory WordPress plugin (versions 2.8.174 and earlier) lets unauthenticated remote attackers inject SQL into backend database queries, per a Patchstack advisory. The flaw carries a CVSS of 9.3 driven largely by a scope-change assumption, and enables extraction of sensitive database contents (user credentials, secrets, PII). No public exploit code or active-exploitation evidence is identified at time of analysis.
Cross-site scripting in the BP Better Messages WordPress plugin (≤2.15.27) allows unauthenticated remote attackers to inject arbitrary JavaScript into pages viewed by authenticated users. The CVSS scope-change metric (S:C) indicates the injected payload can escape the plugin's execution context and affect the broader WordPress environment, enabling session hijacking, credential theft, or admin-level CSRF actions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Broken access control in the Agentimus AI SEO, llms.txt & MCP for AI Agents WordPress plugin (versions <= 1.51.0) allows any subscriber-level authenticated user to perform privileged administrative actions. The plugin fails to enforce capability checks on one or more endpoints, enabling low-privilege users to read or modify sensitive plugin data - including AI SEO configuration, llms.txt content, and MCP agent settings. No public exploit is identified at time of analysis, but the low authentication bar (subscriber registration is typically open on WordPress sites) makes this broadly exploitable wherever the plugin is installed.
Uncontrolled resource consumption in the Migrate Guru - Site Migration & Cloning WordPress plugin (versions 6.65 and earlier) exposes any WordPress installation running the plugin to remote denial of service by unauthenticated network attackers. The root cause (CWE-770) indicates that one or more plugin endpoints perform resource-intensive operations without adequate rate limiting or throttling, allowing an attacker to exhaust server capacity without supplying credentials. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated two-factor authentication bypass in the Really Simple SSL WordPress plugin (versions ≤9.8.0) allows a remote attacker to circumvent 2FA protections via an alternate authentication path (CWE-288), gaining unauthorized access to accounts with both confidentiality and integrity impact. The CVSS vector assigns AC:H, reflecting that exploitation requires specific conditions - most critically, the 2FA feature within the plugin must be actively enabled and configured on a target account. No public exploit code or CISA KEV listing has been identified at time of analysis, but Patchstack has published a database entry with technical details that may lower the barrier to exploitation.
Unauthenticated denial of service in MalCare Security WordPress plugin versions 6.69 and earlier allows any remote attacker with no credentials to exhaust server resources and take down affected WordPress sites. The vulnerability, rooted in CWE-770 (resource allocation without throttling), exposes a network-accessible plugin endpoint that can be abused to render the site unavailable. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this a straightforward target for automated abuse.