Wordpress Plugin
Monthly
CartFlows through version 2.1.19 contains an unsafe deserialization vulnerability that enables object injection attacks against WordPress installations using the plugin. An authenticated attacker with high privileges can exploit this flaw to achieve arbitrary code execution with full system access. No patch is currently available for this vulnerability.
SQL injection in Yoren Chang Media Search Enhanced through version 0.9.1 enables unauthenticated remote attackers to execute arbitrary SQL queries and extract sensitive data from the underlying database. With high privileges required for exploitation, an authenticated attacker with administrative access can manipulate SQL commands to compromise data confidentiality while causing minor service disruption. No patch is currently available.
PHP Object Injection in WpEvently (mage-eventpress) WordPress plugin.
cmsmasters CMSMasters Content Composer cmsmasters-content-composer is affected by missing authorization (CVSS 7.1).
Sensitive information disclosure in the WPFunnels Mail Mint WordPress plugin (versions up to and including 1.19.4) allows remote unauthenticated attackers to reach functionality that is not properly constrained by access-control lists, exposing confidentiality-impacting data. The flaw is a broken access control / missing authorization weakness reported by Patchstack. EPSS is very low (0.02%, 6th percentile) and there is no public exploit identified at time of analysis, so real-world exploitation pressure is currently minimal despite the high CVSS of 7.5.
Blind SQL injection in KiviCare clinic management system versions 3.6.16 and earlier allows authenticated attackers to execute arbitrary SQL queries over the network with no user interaction required. An attacker with valid credentials can exploit this vulnerability to extract sensitive data from the underlying database, though code execution is not possible. No patch is currently available for this HIGH severity vulnerability affecting the Iqonic Design product.
magepeopleteam WpEvently mage-eventpress is affected by deserialization of untrusted data (CVSS 8.8).
DevsBlink EduBlink Core through version 2.0.7 contains a local file inclusion vulnerability in its PHP file handling that allows authenticated attackers to read arbitrary files on the server. An attacker with valid credentials can manipulate filename parameters to bypass proper input validation and access sensitive system files. No patch is currently available for this vulnerability.
Blind SQL injection in Neoforum version 1.0 and earlier allows high-privileged attackers to execute arbitrary SQL commands over the network without user interaction, potentially compromising data confidentiality and integrity. The vulnerability stems from inadequate sanitization of user inputs in SQL queries, and no patch is currently available.
Reflected cross-site scripting (XSS) in Neoforum version 1.0 and earlier allows authenticated attackers to inject malicious scripts that execute in users' browsers when they interact with crafted links, potentially leading to session hijacking or credential theft. The vulnerability requires user interaction and authenticated access, limiting its immediate impact but still posing a risk in multi-user forum environments. No patch is currently available.
Laurent Core plugin for PHP through version 2.4.1 contains a local file inclusion vulnerability in its filename handling for include/require statements, allowing authenticated attackers to read arbitrary files from the affected system. With a CVSS score of 7.5, this vulnerability enables confidentiality and integrity compromise, though exploitation requires valid credentials and no patch is currently available.
Nelio Content versions 4.1.0 and earlier contain a blind SQL injection vulnerability that allows authenticated attackers to execute arbitrary database queries over the network. This vulnerability requires valid user credentials but no user interaction, enabling attackers to read, modify, or delete sensitive database contents. No patch is currently available to address this high-severity flaw.
Omnipress through version 1.6.6 contains a local file inclusion vulnerability in its PHP program that allows authenticated attackers to read arbitrary files on the server. An attacker with valid credentials can manipulate filename parameters in include/require statements to access sensitive files outside the intended directory. This vulnerability requires user interaction but poses significant risk to confidentiality with no available patch at this time.
QantumThemes Kentha Elementor Widgets kentha-elementor is affected by php remote file inclusion (CVSS 7.5).
A WordPress plugin has a PHP Remote File Inclusion vulnerability (CWE-98) allowing unauthenticated attackers to include and execute arbitrary remote PHP files.
FireStorm Plugins FireStorm Professional Real Estate fs-real-estate-plugin is affected by sql injection (CVSS 7.6).
wphocus My auctions allegro my-auctions-allegro-free-edition is affected by php remote file inclusion (CVSS 7.5).
gregmolnar Simple XML Sitemap simple-xml-sitemap is affected by cross-site request forgery (csrf) (CVSS 7.1).
Modular DS modular-connector has a CVSS 10.0 privilege escalation vulnerability through incorrect privilege assignment, allowing unauthenticated attackers to gain full administrative access to WordPress sites.
Modular DS WordPress plugin (through 2.5.1) has incorrect privilege assignment allowing unauthenticated privilege escalation. Maximum CVSS 10.0 with scope change, EPSS 6.8%.
PHP Local File Inclusion in G5Theme Handmade Framework versions up to 3.9 enables authenticated attackers to read arbitrary files on the server through improper validation of include/require statements. An attacker with valid credentials can exploit this vulnerability to access sensitive configuration files, source code, or other protected data without requiring user interaction. No patch is currently available for this vulnerability.
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulnerability. Attackers can upload PHP files disguised with image extensions and then rename them back to .php using the plugin's built-in rename functionality, bypassing all upload restrictions.
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unauthenticated attackers to elevate their access to administrator level. This is a separate, broader vulnerability than the earlier CVE-2025-3102, affecting more installations since it works even on configured instances.
The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the the UploadHandler.php file and no direct file access. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote attackers to hijack logged-in sessions, including administrator accounts, by recovering weakly protected session credentials. With a 93.13% EPSS score (100th percentile) and publicly available exploit code, this is among the most likely-to-be-exploited vulnerabilities currently tracked. Successful exploitation yields full WordPress site takeover.
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'file_upload_action' function in all versions up to,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 93.2%.
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 93.3%.
The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/core/app/modules/onboarding/module.php. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/src/Image.php file which makes it possible for. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The Catch Themes Demo Import WordPress plugin is vulnerable to arbitrary file uploads via the import functionality found in the ~/inc/CatchThemesDemoImport.php file, in versions up to and including. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress allows Unrestricted File Upload and remote code execution by setting supported_type to php% and uploading a. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST request. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 80.6%.
The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.7%.
Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 for WordPress allows remote attackers to execute arbitrary PHP code by uploading. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 75.2%.
pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not validate hostnames, which allows remote authenticated users to write to arbitrary files via an upload URL with a host. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 70.5%.
Unrestricted file upload vulnerability in inc/amfphp/administration/banneruploaderscript.php in the WP EasyCart (aka WordPress Shopping Cart) plugin before 3.0.9 allows remote authenticated users to. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.9%.
The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers to upload arbitrary files and execute arbitrary PHP code via. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.2%.
Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remote authenticated users to execute arbitrary code by uploading a PHP file, then. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 64.7%.
The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 81.8%.
Broken access control in the Adenion Blog2Social plugin for WordPress before 9.1.0 lets any authenticated user holding the edit_posts capability (Contributor role or higher) reschedule, suppress, or otherwise alter the scheduled social-media post records belonging to other users. The issue is remotely reachable over HTTP with no user interaction, but exploitation is gated by low-privilege authentication and by the presence of other users' scheduled posts, so cross-user impact is negligible on single-author sites. It is rated CVSS 4.0 5.3 (Medium); there is no public exploit identified at time of analysis and no CISA KEV listing, and a vendor patch is available.
User email disclosure in Adenion's Blog2Social WordPress plugin before 9.1.0 allows any authenticated user holding the edit_posts capability to enumerate and retrieve the email addresses of every registered account on the site, including administrators. The b2s_search_user AJAX handler fails to restrict callers to those with the list_users capability, turning a routine user-search function into a bulk contact-harvesting primitive for low-privileged insider or subscriber-level accounts. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; the practical risk is data-harvesting and follow-on phishing rather than code execution, so this is a genuine but modest-severity information-disclosure issue rather than a high-impact priority.
User account enumeration in the Adenion Blog2Social plugin for WordPress before 9.1.0 lets any authenticated user holding the edit_posts capability - such as a Contributor, Author, Editor, or Administrator - resolve arbitrary numeric user IDs to their display names and confirm whether those accounts exist. The bug is an authorization bypass through a user-controlled key (CWE-639) in the b2s_get_select_mandant_user AJAX handler, which returns user data for the attacker-supplied owner parameter without checking that the caller is allowed to read account information; the CVSS 4.0 base score is 5.3 (Medium) and the assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, meaning confidentiality-only impact with no modification or availability effect. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation; practical risk is concentrated on sites that allow open or self-registration or that host many low-trust contributor accounts, since a valid low-privileged login is a strict prerequisite.
Reflected cross-site scripting in the Better Messages WordPress plugin (Chat Rooms, Group Chat, Private Messages & AI Chat Bots) affects all versions up to and including 2.15.22, where the 'icn' parameter is neither sanitized on input nor escaped on output. An attacker who can craft a link with a malicious 'icn' value and persuade a logged-in or anonymous visitor to click it can execute arbitrary JavaScript in that victim's browser context on the affected site. No public exploit code or active exploitation has been reported, but the flaw is trivially automatable and the fix is already published in the 2.15.23 tag.
Stored cross-site scripting in the Bold Page Builder plugin for WordPress, affecting all versions up to and including 5.9.6, lets authenticated users with Contributor-level access plant persistent JavaScript that executes in the browser of anyone who views the injected page. The plugin's bt_bb_save_pre filter is bypassable via null-byte injection, and the bt_bb_raw_content shortcode handler outputs base64-decoded content without adequate sanitization, so payloads survive the intended checks. No public exploit code or CISA KEV entry was identified at time of analysis; the supplied Trac changeset indicates an upstream fix has been committed, but no patched release version is confirmed in the available data.
Stored cross-site scripting in the Advanced Popups WordPress plugin (all versions up to and including 1.2.3) lets an authenticated attacker holding author-level rights or above inject arbitrary JavaScript through the popup 'Notification Button Link' field, which is then rendered unsanitized to every visitor of the affected page. Because the payload is persisted in the site's database, any visitor — including administrators — who opens the injected page will execute the script in their own browser session. No public exploit code and no CISA KEV entry were reported at the time of analysis, and the maintainers shipped a fix in version 1.2.4.
The Ad Inserter – Ad Manager & AdSense Ads WordPress plugin (all versions up to and including 2.8.16) exposes administrator-configured header and footer code blocks to unauthenticated visitors through the `ai-debug-code` URL parameter, because the debug handler performs no capability check. An attacker who can reach a site running the vulnerable plugin can simply append that parameter to a request and read code fragments — ad scripts, analytics snippets, custom CSS/JS — that the site owner deliberately disabled from public display. The impact is confidentiality-only (CVSS 5.3, PR:N/UI:N), and there is no public exploit code or CISA KEV listing identified at time of analysis.
Blind SQL injection in the WP Directory Kit WordPress plugin, affecting all versions up to and including 1.5.4, lets an authenticated attacker with 'custom-level access and above' append arbitrary SQL to an existing query through the unescaped 'order_by' parameter and extract sensitive data from the site's database. The flaw carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) because exploitation is network-reachable and low-complexity but gated behind a valid low-privilege account; confidentiality is the only impacted pillar, as the injection is blind and does not permit direct read-out or data modification. No public exploit code or confirmed active exploitation was identified at time of analysis, so the practical risk is concentrated on sites that expose low-privilege accounts and run a vulnerable plugin version.
Authentication downgrade in the miniOrange JWT Authentication for WP REST APIs WordPress plugin (versions before 4.8.0) lets unauthenticated remote attackers force the plugin to fall back to Basic HTTP authentication by supplying a crafted GET parameter, overriding whatever JWT or API token configuration the site administrator set. Because the vulnerable code path performs no capability check or nonce verification, and the plugin returns distinguishable error codes without rate limiting, attackers can chain the bypass into unthrottled username enumeration and credential guessing against WordPress REST endpoints. Exploitation yields only low confidentiality and integrity impact (CVSS 4.0 base 6.9), and no public exploit code or active exploitation was identified in the supplied intelligence at time of analysis.
Stored Cross-Site Scripting in the Job Postings WordPress plugin (versions ≤ 2.8.1) allows authenticated attackers with contributor-level access to inject persistent JavaScript payloads via the 'position_button' parameter, which subsequently execute in the browsers of any user who views the affected page. The vulnerability stems from insufficient sanitization of input and missing output escaping in class-job-add-edit.php, enabling session hijacking, credential theft, or malicious redirects against visiting users including administrators. No public exploit has been identified at time of analysis and no KEV listing is present, making this a medium-priority finding gated entirely on attacker access to a contributor account.
Stored Cross-Site Scripting in the Eventin WordPress plugin (all versions up to and including 4.1.23) allows contributor-level authenticated attackers to inject persistent arbitrary JavaScript via the `etn_shedule_objective` field within the schedule_slot REST API parameter. The injected payload executes in the browsers of any user who subsequently views an affected event schedule page, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Insecure Direct Object Reference in the AI Engine WordPress plugin (tigroumeow, versions ≤3.7.7) allows authenticated subscribers to retrieve transcribed text from private audio attachments owned by any WordPress user, including site administrators. The `mediaId` REST API parameter accepts user-supplied attachment IDs without verifying the requester's ownership or access rights, enabling systematic enumeration of sequential WordPress attachment IDs. Exploitation is configuration-gated - the Public API module must be enabled - and no KEV listing or confirmed public exploit code exists at time of analysis.
Unauthenticated information disclosure in the 3D FlipBook - PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery WordPress plugin (all versions ≤1.16.20) allows any remote attacker to retrieve the full metadata payload of password-protected flipbooks - including title, outline, props, and the serialized data blob containing the underlying PDF file's direct URL - bypassing WordPress post-password confidentiality entirely. The plugin's AJAX handler in inc/ajax-get.php processes the 'id' parameter without verifying that the requestor has authenticated against the post password, and a companion unauthenticated AJAX action (fb3d_send_posts) enables systematic enumeration of all flipbook post IDs with no prior knowledge of the target site's content structure. No public exploit code and no CISA KEV listing exist at time of analysis.
Stored XSS in the PublishPress Authors WordPress plugin (all versions through 4.15.0) allows authenticated users holding Author-level access or above to inject persistent malicious scripts via the `profile_fields_user_email_value_prefix` parameter in author box configuration. The injected payload executes in the browser of any site user who clicks the affected author box link, enabling session hijacking, credential theft, or admin account takeover through the browser context of higher-privileged victims. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Stored Cross-Site Scripting in the ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress (versions up to and including 4.9.5) allows authenticated attackers with Author-level access or higher to persistently inject arbitrary JavaScript via the `shopengine_product_title_header_size` parameter. The injected payload executes in any site visitor's browser upon loading an affected page, enabling session hijacking, credential theft, or malicious redirects. No public exploit code has been identified at time of analysis, and it is not listed in the CISA KEV catalog.
Really Simple Security (formerly Really Simple SSL) before 9.8.2 ships an unguarded profile-page update handler that lets an authenticated low-privileged WordPress user bypass mandatory two-factor authentication indefinitely. By POSTing to the profile update endpoint without the two-factor-authentication field, the attacker skips nonce verification and reaches delete_two_fa_meta(), which resets the grace-period anchor timestamp on every login cycle, so enforced 2FA is perpetually deferred rather than satisfied. The flaw is rated low severity (CVSS 4.0 base 2.3, PR:L, VI:L) and no public exploit code or CISA KEV entry was identified at time of analysis; a vendor patch is available in 9.8.2.
Stored Cross-Site Scripting in the Amelia Booking WordPress plugin (≤2.4.9) enables authenticated Contributor-level users with Elementor access to inject persistent JavaScript into booking-related pages via the unsanitized `load_manually` parameter across multiple Elementor widget render() methods. The injected payload executes in every subsequent visitor's browser session, producing cross-user, scope-changed impact. No public exploit has been identified at time of analysis, but the partial-then-full patch history across two separate changesets indicates the vendor required multiple iterations to close all affected widgets.
Unauthenticated option-overwrite in DT LMS <=1.1 allows any remote attacker to modify arbitrary plugin settings stored in the WordPress wp_options table by calling three unprotected AJAX handlers - dtlms_save_poc_settings, dtlms_save_skin_settings, and dtlms_save_options_settings - that are registered on wp_ajax_nopriv_* with no nonce validation, no capability check, and no input filtering before update_option() is invoked. Confirmed by Wordfence with direct source-code references; a patch commit (changeset 3585901) is present in the WordPress plugin repository but the exact released version number is not stated in available data. No public exploit code and no CISA KEV listing identified at time of analysis.
Authenticated SQL injection in the Smart Marketing SMS and Newsletters Forms WordPress plugin (versions ≤5.1.24) allows subscriber-level users to append arbitrary SQL to existing database queries, extracting sensitive data from the WordPress database. The vulnerability resides in insufficient input escaping on a user-supplied parameter before it reaches an existing SQL query, requiring only a low-privilege account and the plugin's sync/mapping feature to be in its typical operational state. No public exploit or active exploitation has been identified; the fix is available via WordPress SVN changeset 3663923.
SQL injection in the MPG - Multiple Page Generator WordPress plugin (all versions through 4.2.1) allows authenticated attackers holding only subscriber-level accounts to append arbitrary SQL into existing database queries via a crafted URL path, enabling full exfiltration of the WordPress database including password hashes, user PII, and stored credentials. The flaw originates in SpintaxController.php and Helper.php where URL-path parameters are interpolated into queries without adequate escaping or use of WordPress's prepare() API; the code path is only reachable when the [mpg_spintax] shortcode is rendered in site-wide components such as footers or template parts. No public exploit code has been identified at time of analysis, and an upstream fix has been committed to the WordPress plugin SVN repository (changeset 3687328) as reported by Wordfence.
Unauthenticated sensitive information exposure in the Royal Addons for Elementor WordPress plugin (all versions ≤1.7.1066) allows any remote attacker to enumerate arbitrary postmeta values from all published posts via a blind, character-by-character substring oracle. The critical enabler is that the AJAX nonce protecting the search endpoint is publicly emitted in page HTML via wp_localize_script whenever any Royal Elementor widget loads - no session, login, or prior action is required to obtain it. Postmeta data can include private field values, API keys, or other sensitive content stored by themes and other plugins, making the practical impact site-dependent but potentially significant beyond the CVSS 5.3 base score.
Sensitive data exposure in the ElasticPress WordPress plugin (versions through 5.3.4) allows unauthenticated network attackers to retrieve embedded sensitive information from plugin responses. The root cause is CWE-201: the plugin inserts confidential data into outbound payloads - likely search query results or API responses passed to Elasticsearch/OpenSearch - where it becomes accessible without authentication. Reported by Patchstack with a CVSS 5.3 Medium rating; no public exploit code or active exploitation confirmed at time of analysis.
Cross-site request forgery in Site Kit by Google WordPress plugin version 1.186.0 and earlier allows an unauthenticated remote attacker to perform unauthorized actions on behalf of authenticated site administrators or editors. The flaw (CWE-352) exists because the plugin fails to properly validate request origin tokens, enabling forged state-changing requests to succeed when an authenticated victim interacts with attacker-controlled content. No public exploit has been identified at time of analysis, and real-world impact is constrained by the UI:R requirement - a legitimate privileged user must be socially engineered into triggering the request.
Stored Cross-Site Scripting in Visual Composer Website Builder WordPress plugin (versions up to and including 45.16.1) allows an authenticated Contributor-role user to inject malicious scripts into page builder content. When a higher-privileged user such as an Editor or Administrator subsequently views or reviews that content, the injected script executes in their browser, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Sensitive data exposure in bbPress WordPress forum plugin 2.6.14 and earlier allows unauthenticated remote attackers to access restricted information due to missing authorization checks (CWE-862). The CVSS vector confirms network-accessible, no-authentication-required exploitation with a low confidentiality impact, consistent with unauthorized read access to content that should be gated. No public exploit code and no CISA KEV listing are identified at time of analysis, and the moderate CVSS 5.3 score reflects a real but bounded data-exposure risk rather than a full compromise.
Broken access control in the Flexible Quantity - Measurement Price Calculator for WooCommerce plugin (WPDesk) version 2.3.21 and earlier allows unauthenticated network attackers to perform restricted actions due to missing server-side authorization checks. The vulnerability (CWE-862) results in low-severity integrity impact - likely unauthorized manipulation of quantity or pricing-related plugin functionality - without requiring credentials or user interaction. No public exploit code or active exploitation has been identified at time of analysis, and Patchstack reported this as a standard missing-authorization class issue with a CVSS base score of 5.3.
Broken access control in the Booktics WordPress plugin (by Arraytics) through version 1.0.24 permits unauthenticated remote attackers to perform restricted write operations without any authentication. The CVSS vector (PR:N, I:L) confirms the flaw allows unauthorized integrity-impacting actions - such as modifying booking data or plugin state - accessible directly over the network. No public exploit code or active exploitation has been identified at time of analysis.
Contributor-level Insecure Direct Object Reference (IDOR) in the Starter Templates WordPress plugin (≤4.7.5) permits authenticated low-privilege users to manipulate object identifiers in plugin requests, modifying resources outside their authorized scope. Reported by Patchstack with a CVSS 4.3, the flaw is bounded to integrity-only impact - no data disclosure or availability disruption applies. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis.
Cross-Site Request Forgery (CSRF) in the RTMKit WordPress plugin (by RomeTheme, for Elementor) version 2.1.5 and earlier allows unauthenticated remote attackers to forge requests on behalf of authenticated site users, resulting in limited modification of plugin state and minor availability disruption. Exploitation requires social engineering to trick a logged-in WordPress user into visiting a crafted page. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in the Masteriyo LMS WordPress plugin through version 3.4.0 allows attackers to perform unauthorized write operations within the learning management system. The flaw (CWE-862, Missing Authorization) bypasses role-based access restrictions - with Patchstack identifying subscriber-level users as the privilege context - enabling modification of LMS-managed data beyond the attacker's permitted scope. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, though the integrity impact and network-accessible attack vector make prompt patching advisable.
Broken access control in the Passster WordPress content-protection plugin (versions up to and including 4.3.13) allows unauthenticated remote attackers to read content that site owners have restricted behind passwords. The root cause is CWE-862 (Missing Authorization) - the plugin fails to verify entitlement before serving protected material, directly undermining its core security purpose. No public exploit or CISA KEV listing exists at time of analysis, and impact is limited to partial confidentiality with no integrity or availability effect.
Slim SEO WordPress plugin versions up to and including 4.10.0 exposes an Insecure Direct Object Reference (IDOR) vulnerability exploitable by authenticated contributors. With only contributor-level access (PR:L), an attacker can access SEO-related data objects - such as post metadata or SEO settings - that belong to other users or posts they are not authorized to view. The vulnerability is limited to confidentiality impact (C:L) with no integrity or availability consequence, and no public exploit has been identified at time of analysis.
Stored Cross-Site Scripting in the Simple Payment WordPress plugin (≤2.5.4) allows authenticated contributors to inject malicious scripts into content that executes in the browsers of higher-privileged users - including administrators - who view the affected content. The vulnerability stems from insufficient output encoding (CWE-79) and carries a scope-changed CVSS vector (S:C), indicating the injected payload escapes the contributor context to affect admin sessions. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in Bold Page Builder (WordPress plugin by BoldThemes) versions up to and including 5.9.9 allows authenticated attackers holding the Contributor role to inject persistent malicious scripts into page content. When an administrator or higher-privileged user views the affected content, the injected script executes in their browser session, potentially enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or active exploitation has been identified at time of analysis, but the low barrier to exploitation (any registered Contributor account suffices) makes this a meaningful risk for multi-author WordPress sites.
Broken access control in the Deposits and Partial Payments for WooCommerce plugin (MagePeople Team) versions up to and including 3.1.0 allows unauthenticated network attackers to perform unauthorized integrity-impacting actions on deposit and partial payment functionality. The root cause is CWE-862 (Missing Authorization), meaning certain plugin endpoints or AJAX actions execute restricted operations without validating whether the caller has permission to do so. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated IDOR in Quiz And Survey Master WordPress plugin (versions ≤ 11.2.5) allows remote attackers to access quiz or survey objects they are not authorized to view by manipulating user-controlled resource identifiers. The flaw carries a CVSS 5.3 (C:L/I:N/A:N), meaning impact is limited to confidentiality - no data modification or denial of service is possible. No public exploit code or CISA KEV listing is identified at time of analysis, but the unauthenticated network vector lowers the bar for opportunistic discovery.
Authenticated SQL injection in GamiPress ≤7.9.7 allows a Subscriber-level WordPress user to exfiltrate the entire site database through a boolean-based blind injection channel in the wpForo integration AJAX handler. The flaw exploits a subtle interaction between WordPress core magic-quote processing and MySQL backslash semantics: `$wpdb->esc_like()` is called after magic quotes have already escaped a single quote to `\'`, producing `\\'` — which MySQL parses as one literal backslash plus a live closing quote, escaping the LIKE string context. No public exploit or CISA KEV listing has been identified at time of analysis, but Wordfence has confirmed the vulnerability with direct source-code references.
Stored Cross-Site Scripting in the Media Library Assistant WordPress plugin (versions ≤3.35) allows authenticated contributors to inject persistent malicious scripts via the unsanitized `mla_link_attributes` shortcode parameter. Any user who subsequently loads the injected page executes the attacker-controlled script in their browser context, enabling session hijacking, credential theft, or privilege escalation to administrator. A patch was committed in changeset 3512155 and no public exploit has been identified at time of analysis.
Stored Cross-Site Scripting in Media Library Assistant (WordPress plugin, ≤3.35) allows authenticated attackers with Author-level access to poison bulk edit preset configurations and execute arbitrary JavaScript in the context of an administrator's browser session. The flaw bypasses the `wp_kses()` tag-filtering safeguard because the payload operates at the HTML attribute level - injecting closing quotes and inline event handlers - exploiting the absence of `esc_attr()` escaping when preset field values are rendered into `<input value="...">` attributes via simple string replacement in `mla_generate_bulk_edit_form_fieldsets()` and the `mla-bulk-edit-fieldsets.tpl` template. No public exploit code and no CISA KEV listing are present in the available data; exploitation requires social engineering an administrator into importing a crafted preset file.
Stored Cross-Site Scripting in the Media Library Assistant WordPress plugin (versions ≤3.35) allows authenticated contributors to plant persistent JavaScript payloads that execute in any visitor's browser. The injection point is the mla_link_href parameter of the [mla_gallery] shortcode when mla_output is set to 'paginate_links': the _paginate_links() function processes the value through mla_process_shortcode_parameter() and _replace_query_parameter() but writes the result directly into href attributes without invoking WordPress's esc_url() sanitizer, leaving the output unsanitized. No public exploit has been identified at time of analysis, and a fix has been committed to the plugin's SVN trunk (changeset 3512155), though the exact released patch version is not independently confirmed from the available references.
Reflected Cross-Site Scripting in the Themify WooCommerce Product Filter WordPress plugin (versions ≤1.5.5) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers by tricking them into clicking a crafted URL containing a malicious query parameter name. The vulnerability stems from insufficient sanitization and escaping in class-wpf-utils.php and class-wpf-public.php, as confirmed by Wordfence source references. An upstream fix has been committed to the WordPress plugin SVN trunk, though an exact released patched version is not confirmed from available data. No public exploit code or CISA KEV listing has been identified.
Stored XSS in the Bold Timeline Lite WordPress plugin (versions ≤1.2.8) allows authenticated Contributor-level users to inject arbitrary JavaScript via the `supertitle` and `subtitle` attributes of the `bold_timeline_item` shortcode, executing in the browsers of any visitor loading the injected page. The root cause is unsanitized attribute input and unescaped HTML output in bold_timeline_item_view.php (lines 202 and 204), confirmed by WordPress plugin trac source references. A fix has been committed to the plugin trunk per the referenced changeset, though no public exploit or active exploitation has been identified at time of analysis.
Reflected cross-site scripting in HUSKY - Products Filter Professional for WooCommerce (WordPress plugin, versions ≤1.4.3) allows unauthenticated attackers to inject arbitrary JavaScript into page responses by embedding malicious payloads inside SEO-friendly permalink URL filter path segments. The root cause is in wp_load_js(), which calls parse_url_query() to extract filter values from the URL path and serializes them with PHP's json_encode() into an inline script block without escaping single quotes, enabling string-context escape and script injection. Exploitation requires social engineering - the victim must click a crafted link - but a successful attack against a store administrator can lead to session hijacking or full WooCommerce backend compromise. No public exploit identified at time of analysis.
Reflected XSS in Relevanssi - A Better Search (≤4.28.1) allows unauthenticated remote attackers to inject arbitrary JavaScript into WordPress search pages when a site administrator has enabled the plugin's 'Debugging mode' setting. The vulnerability exists in `relevanssi_debug_array()` (lib/debug.php), which passes raw user-supplied query parameters `s`, `post_types`, and `orderby` through PHP's `print_r()` into an unescaped `<pre>` HTML block. The debug code path is activated by appending `relevanssi_debug=on` to any search request and intentionally bypasses nonce, capability, and login checks - making it reachable by any unauthenticated visitor whenever debugging is active. Exploitation still requires user interaction (UI:R) to deliver the reflected payload, and no public exploit or KEV listing has been identified at time of analysis.
Unauthorized customer data modification in the Booktics WordPress plugin allows unauthenticated remote attackers to overwrite any existing customer's stored name, phone number, and linked WordPress user ID by supplying only the target's email address in a crafted REST API request. All plugin versions through 1.0.23 by Arraytics are affected, with the root cause split between a permission callback that unconditionally returns true and a guest-update function that applies caller-supplied contact data to any record whose email matches without ownership verification. No public exploit code has been identified at time of analysis, but the low-complexity, zero-authentication attack path makes systematic data poisoning of booking reminders, SMS notifications, and CRM integrations feasible for any attacker who can enumerate customer emails.
Reflected XSS in WP-Members Membership Plugin for WordPress (all versions through 3.5.6) allows unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser session. The vulnerability exists in the registration form's URL query string handling within class-wp-members-forms.php (lines 2202-2203), where unsanitized input is echoed into page output without proper escaping. Exploitation depends on a two-step social engineering chain - the victim must visit an attacker-crafted URL and then click the Terms of Service link on the rendered registration page - with no public exploit identified at time of analysis.
Reflected XSS in the Chaty (Floating Chat Widget) WordPress plugin by Premio affects all versions through 3.5.9, allowing unauthenticated attackers to inject arbitrary JavaScript into a victim's browser session by tricking them into clicking a crafted search URL. The root cause is a subtle DOM-level bypass: WordPress server-side HTML-encodes the 's' search parameter into the page title, but the plugin's frontend JavaScript reads that title via jQuery's `.text()` method, which invokes the browser DOM API and silently decodes the HTML entities back to raw characters before embedding the value unescaped into an HTML attribute. Wordfence has confirmed the vulnerability and a corrective code change is visible in the WordPress plugin repository changeset; no public exploit code has been identified at time of analysis.
Unauthenticated order enumeration via IDOR in Woo PDF Invoice Builder (also marketed as PDF Builder for WooCommerce) for WordPress exposes every WooCommerce order on affected stores to any logged-in user with Subscriber-level access or higher. The InspectOrder() AJAX handler registered on wp_ajax_rednao_wcpdfinv_inspect_order performs no capability check and no nonce verification before accepting an attacker-supplied OrderNumber POST parameter, loading the matching WC_Order object, and serializing its complete data-billing and shipping addresses, customer email and phone, payment method, gateway transaction ID, and order totals-to the response. All plugin versions through 2.0.8 are affected; no public exploit or CISA KEV listing has been confirmed at time of analysis.
CartFlows through version 2.1.19 contains an unsafe deserialization vulnerability that enables object injection attacks against WordPress installations using the plugin. An authenticated attacker with high privileges can exploit this flaw to achieve arbitrary code execution with full system access. No patch is currently available for this vulnerability.
SQL injection in Yoren Chang Media Search Enhanced through version 0.9.1 enables unauthenticated remote attackers to execute arbitrary SQL queries and extract sensitive data from the underlying database. With high privileges required for exploitation, an authenticated attacker with administrative access can manipulate SQL commands to compromise data confidentiality while causing minor service disruption. No patch is currently available.
PHP Object Injection in WpEvently (mage-eventpress) WordPress plugin.
cmsmasters CMSMasters Content Composer cmsmasters-content-composer is affected by missing authorization (CVSS 7.1).
Sensitive information disclosure in the WPFunnels Mail Mint WordPress plugin (versions up to and including 1.19.4) allows remote unauthenticated attackers to reach functionality that is not properly constrained by access-control lists, exposing confidentiality-impacting data. The flaw is a broken access control / missing authorization weakness reported by Patchstack. EPSS is very low (0.02%, 6th percentile) and there is no public exploit identified at time of analysis, so real-world exploitation pressure is currently minimal despite the high CVSS of 7.5.
Blind SQL injection in KiviCare clinic management system versions 3.6.16 and earlier allows authenticated attackers to execute arbitrary SQL queries over the network with no user interaction required. An attacker with valid credentials can exploit this vulnerability to extract sensitive data from the underlying database, though code execution is not possible. No patch is currently available for this HIGH severity vulnerability affecting the Iqonic Design product.
magepeopleteam WpEvently mage-eventpress is affected by deserialization of untrusted data (CVSS 8.8).
DevsBlink EduBlink Core through version 2.0.7 contains a local file inclusion vulnerability in its PHP file handling that allows authenticated attackers to read arbitrary files on the server. An attacker with valid credentials can manipulate filename parameters to bypass proper input validation and access sensitive system files. No patch is currently available for this vulnerability.
Blind SQL injection in Neoforum version 1.0 and earlier allows high-privileged attackers to execute arbitrary SQL commands over the network without user interaction, potentially compromising data confidentiality and integrity. The vulnerability stems from inadequate sanitization of user inputs in SQL queries, and no patch is currently available.
Reflected cross-site scripting (XSS) in Neoforum version 1.0 and earlier allows authenticated attackers to inject malicious scripts that execute in users' browsers when they interact with crafted links, potentially leading to session hijacking or credential theft. The vulnerability requires user interaction and authenticated access, limiting its immediate impact but still posing a risk in multi-user forum environments. No patch is currently available.
Laurent Core plugin for PHP through version 2.4.1 contains a local file inclusion vulnerability in its filename handling for include/require statements, allowing authenticated attackers to read arbitrary files from the affected system. With a CVSS score of 7.5, this vulnerability enables confidentiality and integrity compromise, though exploitation requires valid credentials and no patch is currently available.
Nelio Content versions 4.1.0 and earlier contain a blind SQL injection vulnerability that allows authenticated attackers to execute arbitrary database queries over the network. This vulnerability requires valid user credentials but no user interaction, enabling attackers to read, modify, or delete sensitive database contents. No patch is currently available to address this high-severity flaw.
Omnipress through version 1.6.6 contains a local file inclusion vulnerability in its PHP program that allows authenticated attackers to read arbitrary files on the server. An attacker with valid credentials can manipulate filename parameters in include/require statements to access sensitive files outside the intended directory. This vulnerability requires user interaction but poses significant risk to confidentiality with no available patch at this time.
QantumThemes Kentha Elementor Widgets kentha-elementor is affected by php remote file inclusion (CVSS 7.5).
A WordPress plugin has a PHP Remote File Inclusion vulnerability (CWE-98) allowing unauthenticated attackers to include and execute arbitrary remote PHP files.
FireStorm Plugins FireStorm Professional Real Estate fs-real-estate-plugin is affected by sql injection (CVSS 7.6).
wphocus My auctions allegro my-auctions-allegro-free-edition is affected by php remote file inclusion (CVSS 7.5).
gregmolnar Simple XML Sitemap simple-xml-sitemap is affected by cross-site request forgery (csrf) (CVSS 7.1).
Modular DS modular-connector has a CVSS 10.0 privilege escalation vulnerability through incorrect privilege assignment, allowing unauthenticated attackers to gain full administrative access to WordPress sites.
Modular DS WordPress plugin (through 2.5.1) has incorrect privilege assignment allowing unauthenticated privilege escalation. Maximum CVSS 10.0 with scope change, EPSS 6.8%.
PHP Local File Inclusion in G5Theme Handmade Framework versions up to 3.9 enables authenticated attackers to read arbitrary files on the server through improper validation of include/require statements. An attacker with valid credentials can exploit this vulnerability to access sensitive configuration files, source code, or other protected data without requiring user interaction. No patch is currently available for this vulnerability.
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulnerability. Attackers can upload PHP files disguised with image extensions and then rename them back to .php using the plugin's built-in rename functionality, bypassing all upload restrictions.
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unauthenticated attackers to elevate their access to administrator level. This is a separate, broader vulnerability than the earlier CVE-2025-3102, affecting more installations since it works even on configured instances.
The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the the UploadHandler.php file and no direct file access. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote attackers to hijack logged-in sessions, including administrator accounts, by recovering weakly protected session credentials. With a 93.13% EPSS score (100th percentile) and publicly available exploit code, this is among the most likely-to-be-exploited vulnerabilities currently tracked. Successful exploitation yields full WordPress site takeover.
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'file_upload_action' function in all versions up to,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 93.2%.
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 93.3%.
The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/core/app/modules/onboarding/module.php. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/src/Image.php file which makes it possible for. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The Catch Themes Demo Import WordPress plugin is vulnerable to arbitrary file uploads via the import functionality found in the ~/inc/CatchThemesDemoImport.php file, in versions up to and including. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress allows Unrestricted File Upload and remote code execution by setting supported_type to php% and uploading a. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST request. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 80.6%.
The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.7%.
Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 for WordPress allows remote attackers to execute arbitrary PHP code by uploading. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 75.2%.
pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not validate hostnames, which allows remote authenticated users to write to arbitrary files via an upload URL with a host. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 70.5%.
Unrestricted file upload vulnerability in inc/amfphp/administration/banneruploaderscript.php in the WP EasyCart (aka WordPress Shopping Cart) plugin before 3.0.9 allows remote authenticated users to. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.9%.
The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers to upload arbitrary files and execute arbitrary PHP code via. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.2%.
Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remote authenticated users to execute arbitrary code by uploading a PHP file, then. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 64.7%.
The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 81.8%.
Broken access control in the Adenion Blog2Social plugin for WordPress before 9.1.0 lets any authenticated user holding the edit_posts capability (Contributor role or higher) reschedule, suppress, or otherwise alter the scheduled social-media post records belonging to other users. The issue is remotely reachable over HTTP with no user interaction, but exploitation is gated by low-privilege authentication and by the presence of other users' scheduled posts, so cross-user impact is negligible on single-author sites. It is rated CVSS 4.0 5.3 (Medium); there is no public exploit identified at time of analysis and no CISA KEV listing, and a vendor patch is available.
User email disclosure in Adenion's Blog2Social WordPress plugin before 9.1.0 allows any authenticated user holding the edit_posts capability to enumerate and retrieve the email addresses of every registered account on the site, including administrators. The b2s_search_user AJAX handler fails to restrict callers to those with the list_users capability, turning a routine user-search function into a bulk contact-harvesting primitive for low-privileged insider or subscriber-level accounts. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; the practical risk is data-harvesting and follow-on phishing rather than code execution, so this is a genuine but modest-severity information-disclosure issue rather than a high-impact priority.
User account enumeration in the Adenion Blog2Social plugin for WordPress before 9.1.0 lets any authenticated user holding the edit_posts capability - such as a Contributor, Author, Editor, or Administrator - resolve arbitrary numeric user IDs to their display names and confirm whether those accounts exist. The bug is an authorization bypass through a user-controlled key (CWE-639) in the b2s_get_select_mandant_user AJAX handler, which returns user data for the attacker-supplied owner parameter without checking that the caller is allowed to read account information; the CVSS 4.0 base score is 5.3 (Medium) and the assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, meaning confidentiality-only impact with no modification or availability effect. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation; practical risk is concentrated on sites that allow open or self-registration or that host many low-trust contributor accounts, since a valid low-privileged login is a strict prerequisite.
Reflected cross-site scripting in the Better Messages WordPress plugin (Chat Rooms, Group Chat, Private Messages & AI Chat Bots) affects all versions up to and including 2.15.22, where the 'icn' parameter is neither sanitized on input nor escaped on output. An attacker who can craft a link with a malicious 'icn' value and persuade a logged-in or anonymous visitor to click it can execute arbitrary JavaScript in that victim's browser context on the affected site. No public exploit code or active exploitation has been reported, but the flaw is trivially automatable and the fix is already published in the 2.15.23 tag.
Stored cross-site scripting in the Bold Page Builder plugin for WordPress, affecting all versions up to and including 5.9.6, lets authenticated users with Contributor-level access plant persistent JavaScript that executes in the browser of anyone who views the injected page. The plugin's bt_bb_save_pre filter is bypassable via null-byte injection, and the bt_bb_raw_content shortcode handler outputs base64-decoded content without adequate sanitization, so payloads survive the intended checks. No public exploit code or CISA KEV entry was identified at time of analysis; the supplied Trac changeset indicates an upstream fix has been committed, but no patched release version is confirmed in the available data.
Stored cross-site scripting in the Advanced Popups WordPress plugin (all versions up to and including 1.2.3) lets an authenticated attacker holding author-level rights or above inject arbitrary JavaScript through the popup 'Notification Button Link' field, which is then rendered unsanitized to every visitor of the affected page. Because the payload is persisted in the site's database, any visitor — including administrators — who opens the injected page will execute the script in their own browser session. No public exploit code and no CISA KEV entry were reported at the time of analysis, and the maintainers shipped a fix in version 1.2.4.
The Ad Inserter – Ad Manager & AdSense Ads WordPress plugin (all versions up to and including 2.8.16) exposes administrator-configured header and footer code blocks to unauthenticated visitors through the `ai-debug-code` URL parameter, because the debug handler performs no capability check. An attacker who can reach a site running the vulnerable plugin can simply append that parameter to a request and read code fragments — ad scripts, analytics snippets, custom CSS/JS — that the site owner deliberately disabled from public display. The impact is confidentiality-only (CVSS 5.3, PR:N/UI:N), and there is no public exploit code or CISA KEV listing identified at time of analysis.
Blind SQL injection in the WP Directory Kit WordPress plugin, affecting all versions up to and including 1.5.4, lets an authenticated attacker with 'custom-level access and above' append arbitrary SQL to an existing query through the unescaped 'order_by' parameter and extract sensitive data from the site's database. The flaw carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) because exploitation is network-reachable and low-complexity but gated behind a valid low-privilege account; confidentiality is the only impacted pillar, as the injection is blind and does not permit direct read-out or data modification. No public exploit code or confirmed active exploitation was identified at time of analysis, so the practical risk is concentrated on sites that expose low-privilege accounts and run a vulnerable plugin version.
Authentication downgrade in the miniOrange JWT Authentication for WP REST APIs WordPress plugin (versions before 4.8.0) lets unauthenticated remote attackers force the plugin to fall back to Basic HTTP authentication by supplying a crafted GET parameter, overriding whatever JWT or API token configuration the site administrator set. Because the vulnerable code path performs no capability check or nonce verification, and the plugin returns distinguishable error codes without rate limiting, attackers can chain the bypass into unthrottled username enumeration and credential guessing against WordPress REST endpoints. Exploitation yields only low confidentiality and integrity impact (CVSS 4.0 base 6.9), and no public exploit code or active exploitation was identified in the supplied intelligence at time of analysis.
Stored Cross-Site Scripting in the Job Postings WordPress plugin (versions ≤ 2.8.1) allows authenticated attackers with contributor-level access to inject persistent JavaScript payloads via the 'position_button' parameter, which subsequently execute in the browsers of any user who views the affected page. The vulnerability stems from insufficient sanitization of input and missing output escaping in class-job-add-edit.php, enabling session hijacking, credential theft, or malicious redirects against visiting users including administrators. No public exploit has been identified at time of analysis and no KEV listing is present, making this a medium-priority finding gated entirely on attacker access to a contributor account.
Stored Cross-Site Scripting in the Eventin WordPress plugin (all versions up to and including 4.1.23) allows contributor-level authenticated attackers to inject persistent arbitrary JavaScript via the `etn_shedule_objective` field within the schedule_slot REST API parameter. The injected payload executes in the browsers of any user who subsequently views an affected event schedule page, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Insecure Direct Object Reference in the AI Engine WordPress plugin (tigroumeow, versions ≤3.7.7) allows authenticated subscribers to retrieve transcribed text from private audio attachments owned by any WordPress user, including site administrators. The `mediaId` REST API parameter accepts user-supplied attachment IDs without verifying the requester's ownership or access rights, enabling systematic enumeration of sequential WordPress attachment IDs. Exploitation is configuration-gated - the Public API module must be enabled - and no KEV listing or confirmed public exploit code exists at time of analysis.
Unauthenticated information disclosure in the 3D FlipBook - PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery WordPress plugin (all versions ≤1.16.20) allows any remote attacker to retrieve the full metadata payload of password-protected flipbooks - including title, outline, props, and the serialized data blob containing the underlying PDF file's direct URL - bypassing WordPress post-password confidentiality entirely. The plugin's AJAX handler in inc/ajax-get.php processes the 'id' parameter without verifying that the requestor has authenticated against the post password, and a companion unauthenticated AJAX action (fb3d_send_posts) enables systematic enumeration of all flipbook post IDs with no prior knowledge of the target site's content structure. No public exploit code and no CISA KEV listing exist at time of analysis.
Stored XSS in the PublishPress Authors WordPress plugin (all versions through 4.15.0) allows authenticated users holding Author-level access or above to inject persistent malicious scripts via the `profile_fields_user_email_value_prefix` parameter in author box configuration. The injected payload executes in the browser of any site user who clicks the affected author box link, enabling session hijacking, credential theft, or admin account takeover through the browser context of higher-privileged victims. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Stored Cross-Site Scripting in the ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress (versions up to and including 4.9.5) allows authenticated attackers with Author-level access or higher to persistently inject arbitrary JavaScript via the `shopengine_product_title_header_size` parameter. The injected payload executes in any site visitor's browser upon loading an affected page, enabling session hijacking, credential theft, or malicious redirects. No public exploit code has been identified at time of analysis, and it is not listed in the CISA KEV catalog.
Really Simple Security (formerly Really Simple SSL) before 9.8.2 ships an unguarded profile-page update handler that lets an authenticated low-privileged WordPress user bypass mandatory two-factor authentication indefinitely. By POSTing to the profile update endpoint without the two-factor-authentication field, the attacker skips nonce verification and reaches delete_two_fa_meta(), which resets the grace-period anchor timestamp on every login cycle, so enforced 2FA is perpetually deferred rather than satisfied. The flaw is rated low severity (CVSS 4.0 base 2.3, PR:L, VI:L) and no public exploit code or CISA KEV entry was identified at time of analysis; a vendor patch is available in 9.8.2.
Stored Cross-Site Scripting in the Amelia Booking WordPress plugin (≤2.4.9) enables authenticated Contributor-level users with Elementor access to inject persistent JavaScript into booking-related pages via the unsanitized `load_manually` parameter across multiple Elementor widget render() methods. The injected payload executes in every subsequent visitor's browser session, producing cross-user, scope-changed impact. No public exploit has been identified at time of analysis, but the partial-then-full patch history across two separate changesets indicates the vendor required multiple iterations to close all affected widgets.
Unauthenticated option-overwrite in DT LMS <=1.1 allows any remote attacker to modify arbitrary plugin settings stored in the WordPress wp_options table by calling three unprotected AJAX handlers - dtlms_save_poc_settings, dtlms_save_skin_settings, and dtlms_save_options_settings - that are registered on wp_ajax_nopriv_* with no nonce validation, no capability check, and no input filtering before update_option() is invoked. Confirmed by Wordfence with direct source-code references; a patch commit (changeset 3585901) is present in the WordPress plugin repository but the exact released version number is not stated in available data. No public exploit code and no CISA KEV listing identified at time of analysis.
Authenticated SQL injection in the Smart Marketing SMS and Newsletters Forms WordPress plugin (versions ≤5.1.24) allows subscriber-level users to append arbitrary SQL to existing database queries, extracting sensitive data from the WordPress database. The vulnerability resides in insufficient input escaping on a user-supplied parameter before it reaches an existing SQL query, requiring only a low-privilege account and the plugin's sync/mapping feature to be in its typical operational state. No public exploit or active exploitation has been identified; the fix is available via WordPress SVN changeset 3663923.
SQL injection in the MPG - Multiple Page Generator WordPress plugin (all versions through 4.2.1) allows authenticated attackers holding only subscriber-level accounts to append arbitrary SQL into existing database queries via a crafted URL path, enabling full exfiltration of the WordPress database including password hashes, user PII, and stored credentials. The flaw originates in SpintaxController.php and Helper.php where URL-path parameters are interpolated into queries without adequate escaping or use of WordPress's prepare() API; the code path is only reachable when the [mpg_spintax] shortcode is rendered in site-wide components such as footers or template parts. No public exploit code has been identified at time of analysis, and an upstream fix has been committed to the WordPress plugin SVN repository (changeset 3687328) as reported by Wordfence.
Unauthenticated sensitive information exposure in the Royal Addons for Elementor WordPress plugin (all versions ≤1.7.1066) allows any remote attacker to enumerate arbitrary postmeta values from all published posts via a blind, character-by-character substring oracle. The critical enabler is that the AJAX nonce protecting the search endpoint is publicly emitted in page HTML via wp_localize_script whenever any Royal Elementor widget loads - no session, login, or prior action is required to obtain it. Postmeta data can include private field values, API keys, or other sensitive content stored by themes and other plugins, making the practical impact site-dependent but potentially significant beyond the CVSS 5.3 base score.
Sensitive data exposure in the ElasticPress WordPress plugin (versions through 5.3.4) allows unauthenticated network attackers to retrieve embedded sensitive information from plugin responses. The root cause is CWE-201: the plugin inserts confidential data into outbound payloads - likely search query results or API responses passed to Elasticsearch/OpenSearch - where it becomes accessible without authentication. Reported by Patchstack with a CVSS 5.3 Medium rating; no public exploit code or active exploitation confirmed at time of analysis.
Cross-site request forgery in Site Kit by Google WordPress plugin version 1.186.0 and earlier allows an unauthenticated remote attacker to perform unauthorized actions on behalf of authenticated site administrators or editors. The flaw (CWE-352) exists because the plugin fails to properly validate request origin tokens, enabling forged state-changing requests to succeed when an authenticated victim interacts with attacker-controlled content. No public exploit has been identified at time of analysis, and real-world impact is constrained by the UI:R requirement - a legitimate privileged user must be socially engineered into triggering the request.
Stored Cross-Site Scripting in Visual Composer Website Builder WordPress plugin (versions up to and including 45.16.1) allows an authenticated Contributor-role user to inject malicious scripts into page builder content. When a higher-privileged user such as an Editor or Administrator subsequently views or reviews that content, the injected script executes in their browser, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Sensitive data exposure in bbPress WordPress forum plugin 2.6.14 and earlier allows unauthenticated remote attackers to access restricted information due to missing authorization checks (CWE-862). The CVSS vector confirms network-accessible, no-authentication-required exploitation with a low confidentiality impact, consistent with unauthorized read access to content that should be gated. No public exploit code and no CISA KEV listing are identified at time of analysis, and the moderate CVSS 5.3 score reflects a real but bounded data-exposure risk rather than a full compromise.
Broken access control in the Flexible Quantity - Measurement Price Calculator for WooCommerce plugin (WPDesk) version 2.3.21 and earlier allows unauthenticated network attackers to perform restricted actions due to missing server-side authorization checks. The vulnerability (CWE-862) results in low-severity integrity impact - likely unauthorized manipulation of quantity or pricing-related plugin functionality - without requiring credentials or user interaction. No public exploit code or active exploitation has been identified at time of analysis, and Patchstack reported this as a standard missing-authorization class issue with a CVSS base score of 5.3.
Broken access control in the Booktics WordPress plugin (by Arraytics) through version 1.0.24 permits unauthenticated remote attackers to perform restricted write operations without any authentication. The CVSS vector (PR:N, I:L) confirms the flaw allows unauthorized integrity-impacting actions - such as modifying booking data or plugin state - accessible directly over the network. No public exploit code or active exploitation has been identified at time of analysis.
Contributor-level Insecure Direct Object Reference (IDOR) in the Starter Templates WordPress plugin (≤4.7.5) permits authenticated low-privilege users to manipulate object identifiers in plugin requests, modifying resources outside their authorized scope. Reported by Patchstack with a CVSS 4.3, the flaw is bounded to integrity-only impact - no data disclosure or availability disruption applies. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis.
Cross-Site Request Forgery (CSRF) in the RTMKit WordPress plugin (by RomeTheme, for Elementor) version 2.1.5 and earlier allows unauthenticated remote attackers to forge requests on behalf of authenticated site users, resulting in limited modification of plugin state and minor availability disruption. Exploitation requires social engineering to trick a logged-in WordPress user into visiting a crafted page. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in the Masteriyo LMS WordPress plugin through version 3.4.0 allows attackers to perform unauthorized write operations within the learning management system. The flaw (CWE-862, Missing Authorization) bypasses role-based access restrictions - with Patchstack identifying subscriber-level users as the privilege context - enabling modification of LMS-managed data beyond the attacker's permitted scope. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, though the integrity impact and network-accessible attack vector make prompt patching advisable.
Broken access control in the Passster WordPress content-protection plugin (versions up to and including 4.3.13) allows unauthenticated remote attackers to read content that site owners have restricted behind passwords. The root cause is CWE-862 (Missing Authorization) - the plugin fails to verify entitlement before serving protected material, directly undermining its core security purpose. No public exploit or CISA KEV listing exists at time of analysis, and impact is limited to partial confidentiality with no integrity or availability effect.
Slim SEO WordPress plugin versions up to and including 4.10.0 exposes an Insecure Direct Object Reference (IDOR) vulnerability exploitable by authenticated contributors. With only contributor-level access (PR:L), an attacker can access SEO-related data objects - such as post metadata or SEO settings - that belong to other users or posts they are not authorized to view. The vulnerability is limited to confidentiality impact (C:L) with no integrity or availability consequence, and no public exploit has been identified at time of analysis.
Stored Cross-Site Scripting in the Simple Payment WordPress plugin (≤2.5.4) allows authenticated contributors to inject malicious scripts into content that executes in the browsers of higher-privileged users - including administrators - who view the affected content. The vulnerability stems from insufficient output encoding (CWE-79) and carries a scope-changed CVSS vector (S:C), indicating the injected payload escapes the contributor context to affect admin sessions. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in Bold Page Builder (WordPress plugin by BoldThemes) versions up to and including 5.9.9 allows authenticated attackers holding the Contributor role to inject persistent malicious scripts into page content. When an administrator or higher-privileged user views the affected content, the injected script executes in their browser session, potentially enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or active exploitation has been identified at time of analysis, but the low barrier to exploitation (any registered Contributor account suffices) makes this a meaningful risk for multi-author WordPress sites.
Broken access control in the Deposits and Partial Payments for WooCommerce plugin (MagePeople Team) versions up to and including 3.1.0 allows unauthenticated network attackers to perform unauthorized integrity-impacting actions on deposit and partial payment functionality. The root cause is CWE-862 (Missing Authorization), meaning certain plugin endpoints or AJAX actions execute restricted operations without validating whether the caller has permission to do so. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated IDOR in Quiz And Survey Master WordPress plugin (versions ≤ 11.2.5) allows remote attackers to access quiz or survey objects they are not authorized to view by manipulating user-controlled resource identifiers. The flaw carries a CVSS 5.3 (C:L/I:N/A:N), meaning impact is limited to confidentiality - no data modification or denial of service is possible. No public exploit code or CISA KEV listing is identified at time of analysis, but the unauthenticated network vector lowers the bar for opportunistic discovery.
Authenticated SQL injection in GamiPress ≤7.9.7 allows a Subscriber-level WordPress user to exfiltrate the entire site database through a boolean-based blind injection channel in the wpForo integration AJAX handler. The flaw exploits a subtle interaction between WordPress core magic-quote processing and MySQL backslash semantics: `$wpdb->esc_like()` is called after magic quotes have already escaped a single quote to `\'`, producing `\\'` — which MySQL parses as one literal backslash plus a live closing quote, escaping the LIKE string context. No public exploit or CISA KEV listing has been identified at time of analysis, but Wordfence has confirmed the vulnerability with direct source-code references.
Stored Cross-Site Scripting in the Media Library Assistant WordPress plugin (versions ≤3.35) allows authenticated contributors to inject persistent malicious scripts via the unsanitized `mla_link_attributes` shortcode parameter. Any user who subsequently loads the injected page executes the attacker-controlled script in their browser context, enabling session hijacking, credential theft, or privilege escalation to administrator. A patch was committed in changeset 3512155 and no public exploit has been identified at time of analysis.
Stored Cross-Site Scripting in Media Library Assistant (WordPress plugin, ≤3.35) allows authenticated attackers with Author-level access to poison bulk edit preset configurations and execute arbitrary JavaScript in the context of an administrator's browser session. The flaw bypasses the `wp_kses()` tag-filtering safeguard because the payload operates at the HTML attribute level - injecting closing quotes and inline event handlers - exploiting the absence of `esc_attr()` escaping when preset field values are rendered into `<input value="...">` attributes via simple string replacement in `mla_generate_bulk_edit_form_fieldsets()` and the `mla-bulk-edit-fieldsets.tpl` template. No public exploit code and no CISA KEV listing are present in the available data; exploitation requires social engineering an administrator into importing a crafted preset file.
Stored Cross-Site Scripting in the Media Library Assistant WordPress plugin (versions ≤3.35) allows authenticated contributors to plant persistent JavaScript payloads that execute in any visitor's browser. The injection point is the mla_link_href parameter of the [mla_gallery] shortcode when mla_output is set to 'paginate_links': the _paginate_links() function processes the value through mla_process_shortcode_parameter() and _replace_query_parameter() but writes the result directly into href attributes without invoking WordPress's esc_url() sanitizer, leaving the output unsanitized. No public exploit has been identified at time of analysis, and a fix has been committed to the plugin's SVN trunk (changeset 3512155), though the exact released patch version is not independently confirmed from the available references.
Reflected Cross-Site Scripting in the Themify WooCommerce Product Filter WordPress plugin (versions ≤1.5.5) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers by tricking them into clicking a crafted URL containing a malicious query parameter name. The vulnerability stems from insufficient sanitization and escaping in class-wpf-utils.php and class-wpf-public.php, as confirmed by Wordfence source references. An upstream fix has been committed to the WordPress plugin SVN trunk, though an exact released patched version is not confirmed from available data. No public exploit code or CISA KEV listing has been identified.
Stored XSS in the Bold Timeline Lite WordPress plugin (versions ≤1.2.8) allows authenticated Contributor-level users to inject arbitrary JavaScript via the `supertitle` and `subtitle` attributes of the `bold_timeline_item` shortcode, executing in the browsers of any visitor loading the injected page. The root cause is unsanitized attribute input and unescaped HTML output in bold_timeline_item_view.php (lines 202 and 204), confirmed by WordPress plugin trac source references. A fix has been committed to the plugin trunk per the referenced changeset, though no public exploit or active exploitation has been identified at time of analysis.
Reflected cross-site scripting in HUSKY - Products Filter Professional for WooCommerce (WordPress plugin, versions ≤1.4.3) allows unauthenticated attackers to inject arbitrary JavaScript into page responses by embedding malicious payloads inside SEO-friendly permalink URL filter path segments. The root cause is in wp_load_js(), which calls parse_url_query() to extract filter values from the URL path and serializes them with PHP's json_encode() into an inline script block without escaping single quotes, enabling string-context escape and script injection. Exploitation requires social engineering - the victim must click a crafted link - but a successful attack against a store administrator can lead to session hijacking or full WooCommerce backend compromise. No public exploit identified at time of analysis.
Reflected XSS in Relevanssi - A Better Search (≤4.28.1) allows unauthenticated remote attackers to inject arbitrary JavaScript into WordPress search pages when a site administrator has enabled the plugin's 'Debugging mode' setting. The vulnerability exists in `relevanssi_debug_array()` (lib/debug.php), which passes raw user-supplied query parameters `s`, `post_types`, and `orderby` through PHP's `print_r()` into an unescaped `<pre>` HTML block. The debug code path is activated by appending `relevanssi_debug=on` to any search request and intentionally bypasses nonce, capability, and login checks - making it reachable by any unauthenticated visitor whenever debugging is active. Exploitation still requires user interaction (UI:R) to deliver the reflected payload, and no public exploit or KEV listing has been identified at time of analysis.
Unauthorized customer data modification in the Booktics WordPress plugin allows unauthenticated remote attackers to overwrite any existing customer's stored name, phone number, and linked WordPress user ID by supplying only the target's email address in a crafted REST API request. All plugin versions through 1.0.23 by Arraytics are affected, with the root cause split between a permission callback that unconditionally returns true and a guest-update function that applies caller-supplied contact data to any record whose email matches without ownership verification. No public exploit code has been identified at time of analysis, but the low-complexity, zero-authentication attack path makes systematic data poisoning of booking reminders, SMS notifications, and CRM integrations feasible for any attacker who can enumerate customer emails.
Reflected XSS in WP-Members Membership Plugin for WordPress (all versions through 3.5.6) allows unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser session. The vulnerability exists in the registration form's URL query string handling within class-wp-members-forms.php (lines 2202-2203), where unsanitized input is echoed into page output without proper escaping. Exploitation depends on a two-step social engineering chain - the victim must visit an attacker-crafted URL and then click the Terms of Service link on the rendered registration page - with no public exploit identified at time of analysis.
Reflected XSS in the Chaty (Floating Chat Widget) WordPress plugin by Premio affects all versions through 3.5.9, allowing unauthenticated attackers to inject arbitrary JavaScript into a victim's browser session by tricking them into clicking a crafted search URL. The root cause is a subtle DOM-level bypass: WordPress server-side HTML-encodes the 's' search parameter into the page title, but the plugin's frontend JavaScript reads that title via jQuery's `.text()` method, which invokes the browser DOM API and silently decodes the HTML entities back to raw characters before embedding the value unescaped into an HTML attribute. Wordfence has confirmed the vulnerability and a corrective code change is visible in the WordPress plugin repository changeset; no public exploit code has been identified at time of analysis.
Unauthenticated order enumeration via IDOR in Woo PDF Invoice Builder (also marketed as PDF Builder for WooCommerce) for WordPress exposes every WooCommerce order on affected stores to any logged-in user with Subscriber-level access or higher. The InspectOrder() AJAX handler registered on wp_ajax_rednao_wcpdfinv_inspect_order performs no capability check and no nonce verification before accepting an attacker-supplied OrderNumber POST parameter, loading the matching WC_Order object, and serializing its complete data-billing and shipping addresses, customer email and phone, payment method, gateway transaction ID, and order totals-to the response. All plugin versions through 2.0.8 are affected; no public exploit or CISA KEV listing has been confirmed at time of analysis.